Security Vulnerabilities: Bluetooth, Macy's, Emotet & More

Dozens of new security vulnerabilities have been discovered in the last few weeks. Some target hospitals, others banking software and still others regular everyday website users. These attacks have come in many different forms including:

• Bluetooth vulnerability
• Banking malware
• Ransomware via brute force RDP (remote desktop protocol)
• Accessing user accounts via breached websites and unprotected files

This post provides information about the most recent security vulnerabilities including how they might affect you and what you should do to protect yourself. The title of each breach type listed below is a link to an external news source with additional information about that particular security vulnerability.

Security Vulnerabilities: Bluetooth, Macy's, Emotet & More

Bluetooth Vulnerability  

Bluetooth is used by desktops, laptops, tablets, mobile devices, headphones, speakers, cars and much more. This recent Bluetooth vulnerability affects part of the process Bluetooth devices use to pair and authenticate with one another. The threat involves one aspect of the validation process being skipped which introduces the risk of a man-in-the-middle attack. When taking advantage of this vulnerability, attackers can intercept and decrypt, or forge and inject messages between devices. 

Software and firmware updates for devices are currently being created and are expected to be released in the coming weeks. If you notice updates on your devices, be sure to implement them as soon as possible to reduce the security risk presented by this vulnerability.

Macy's Breach

On July 2, 2018 Macy's notified affected eCommerce customers of a data breach that included unauthorized access to personal information stored on their website. After investigating the breach, Macy's found that hackers had unauthorized access to user profiles via their website from April 26 until June 12. After obtaining user login information, these credentials were used to access customer credit card numbers, addresses, and other personal information.

All accounts affected will require users to update their password before regaining access. If you have been a victim of this particular breach, be sure to immediately update any other accounts using the same user credentials. 

Emotet Malware

Emotet is a banking malware Trojan whose primary function is to gain access to a system for other malware. It is delivered via attachments or links in emails often imitating brands known to the intended targets.Their most recent campaigns include language spoofing PayPal receipts, shipping notifications or past due invoices. Once a device is infected, Emotet attempts to propagate the local network making it harder to contain. 

Example of a malicious email provided by US-Cert.

The best protection against Emotet is to use caution opening emails, even when they seem like they are from a familiar company or sender. Also, always use caution opening attachments and go directly to websites whenever possible rather than clicking on links in emails. Lastly, do not let threats or fear cause you to act rashly or do something you might not otherwise do, as this is a tactic often used by hackers.

This post covers three recently exposed security vulnerabilities including Bluetooth, Macy's, and Emotet. The Bluetooth vulnerability affects large numbers of devices but updates should be pushed out in the next few weeks. The Macy's breach allowed user logins to be compromised along with other personal information. Any accounts using the same credentials as one should be changed immediately. Lastly, the Emotet threat uses malware attached or linked in emails to compromise a device. The best protection against it is to use caution opening emails and attachments. If questioning the authenticity of an email, go to a website directly rather than clicking on links in the email. 

Part 2 of this topic will cover security vulnerabilities involving voter user data, health care Ransomware and user data related to cloud-based HR company ComplyRight.

As always, our data is valuable and knowing what vulnerabilities exist is critical to  protecting it!

Enjoy this post? Subscribe to our Blog