WyzGuys Tech Talk

Weekend Update

A quick Saturday digest of cybersecurity news articles from other sources.

GoDaddy Breach

From Wordfence Security

GoDaddy announced this morning that they have been breached. Our team took a deep dive into the breach and found that GoDaddy appears to have stored passwords in plaintext, or in a format that could be reversed back into plaintext, which is not an industry best practice

 We confirmed this by signing into a GoDaddy Managed WordPress Hosting Account and verifying that we were able to view our own sFTP password. That means the attacker didn’t need to crack the passwords and could likely retrieve them directly. 

According to GoDaddy’s own SEC filing: “For active customers, sFTP and database usernames and passwords were exposed.

The attacker had access to GoDaddy’s systems for over two months before they were discovered. 

We have published a detailed post explaining how customers are affected, and what to do. Please pay special attention to our comments regarding your own customer notification obligations, if your site(s) are affected by this. 

Click here to read our post about this breach on the official Wordfence blog…..

We have received confirmation from GoDaddy that the breach has widened to GoDaddy Managed WordPress resellers that include tsoHost, Media Temple, 123Reg, Domain Factory, Heart Internet, and Host Europe.

 We have verified that these hosts are using the same provisioning system that allows sFTP passwords to be retrieved in plain text.

 Click here to read the full story on the official Wordfence Blog….

Cyber fraud in banking: Key threats and how to overcome them

In recent times, hackers have developed ingenious methods using unique and complex arrays of cyberattacks to outwit security systems. They can be seen gaining sensitive financial information of individuals from banking servers or personal devices of an individual.  Here are some common types of cyber threats that are taking place these days.  More…

Your weak passwords can be cracked in less than a second

Easy-to-crack phrases “123456,” “123456789,” “12345,” “qwerty” and “password” are the five most common passwords, says NordPass.

A bug is about to confuse a lot of computers by turning back time 20 years

For those of you that remember the fuss about the Y2K bug, this story may sound familiar.

The Cybersecurity & Infrastructure Security Agency (CISA) has issued a warning to Critical Infrastructure (CI) owners and operators, and other users who get the time from GPS, about a GPS Daemon (GPSD) bug in GPSD versions 3.20 through 3.22.

8 advanced threats Kaspersky predicts for 2022

Advanced threats constantly evolve. This year saw multiple examples of advanced persistent threats under the spotlight, allowing Kaspersky to predict what threats might lead in the future.  This article is a must read.

Sick of Windows? Here’s how easy it is to install Linux

If you thought installing an operating system was challenging, think again. Jack Wallen shows you how getting elementary OS up and running in about five minutes is easy enough for any skill level.

Ransomware is a threat, even for the smallest of businesses

The holiday season is upon us—and so are the ransomware thieves.

If I’ve heard it once, I’ve heard it a million times: “My business is too small for a cyber crook to bother with me.” Oh, my friend you are so, so wrong. No company is too big or too small for a ransomware dealer to come knocking at your virtual door.

A recent report from Webroot, The Hidden Costs of Ransomware, found the vast majority—85%—of managed service providers (MSPs) have reported attacks against small and midsized businesses (SMBs). Despite that appallingly high number, just 28% of SMBs consider ransomware a worry.  More..,.

Check your patches – public exploit now out for critical Exchange bug

It was a zero-day bug until Patch Tuesday, now there’s an anyone-can-use-it exploit. Don’t be the one who hasn’t patched.




About the Author:

I am a cybersecurity and IT instructor, cybersecurity analyst, pen-tester, trainer, and speaker. I am an owner of the WyzCo Group Inc. In addition to consulting on security products and services, I also conduct security audits, compliance audits, vulnerability assessments and penetration tests. I also teach Cybersecurity Awareness Training classes. I work as an information technology and cybersecurity instructor for several training and certification organizations. I have worked in corporate, military, government, and workforce development training environments I am a frequent speaker at professional conferences such as the Minnesota Bloggers Conference, Secure360 Security Conference in 2016, 2017, 2018, 2019, the (ISC)2 World Congress 2016, and the ISSA International Conference 2017, and many local community organizations, including Chambers of Commerce, SCORE, and several school districts. I have been blogging on cybersecurity since 2006 at http://wyzguyscybersecurity.com
  Related Posts

Add a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.