TomCyberDaily #20

Routers behaving badly, VPNs under siege, a massive data breach, a tech support scam that rivals the plot of a bad thriller, and WordPress plugins gone rogue. Buckle up, update your firmware,and enjoy

May 28, 2024

1. TP-Link’s Gaming Router Drama

Imagine you’re in the middle of an epic gaming session, dominating the leaderboard, when suddenly your router decides to play for the other team. This nightmare became a reality for TP-Link Archer C5400X users due to a vulnerability tracked as CVE-2024-5035. This flaw allowed cyber attackers to remotely execute commands on the router by exploiting open TCP ports (8888, 8889, and 8890). Think of these ports as secret back doors left wide open, letting hackers waltz in and hijack your network.

The culprit? A service called ‘rftest’ that performs wireless interface checks but, unfortunately, wasn’t good at locking its doors. Hackers could send specially crafted messages with shell metacharacters (like the symbols ;, &, |) to gain elevated privileges, essentially letting them run commands on your router as if they had admin access.

But fear not, fellow gamers! TP-Link has released a firmware update (version 1.1.7) to close these doors and filter out any sneaky commands. So, update your firmware ASAP to keep your gaming sessions uninterrupted and your network secure.

Tech Translation:

RCE (Remote Code Execution): Hackers can run any command on your device from anywhere.

TCP Ports: Channels your router uses to communicate; open ones can be security holes.

Shell Metacharacters: Special characters in command lines that can control program functions; bad input handling can let hackers exploit them.

Link: TP-Link fixes critical RCE bug in popular C5400X gaming router

A dramatic scene featuring a 3D TP-Link gaming router with LED lights glowing brightly, surrounded by an intense, electrifying atmosphere. The router is positioned as the centerpiece on a desk, with cables and gaming accessories scattered around. In the background, there are abstract digital elements and waves of data flowing, representing high-speed internet. The scene has a dark, moody ambiance with a spotlight on the router, emphasizing its importance and creating a sense of drama.

2. Hackers Tackle Check Point VPNs

Hackers are now targeting Check Point VPNs (Virtual Private Networks) like determined gamers going after a high score. By exploiting weaknesses, they’re sneaking into enterprise networks, accessing sensitive data, and wreaking havoc. This is a grim reminder that even our best digital defenses need regular updates and checkups to keep cybervillains at bay.

Tech Translation:

VPN (Virtual Private Network): A service that creates a secure, encrypted connection over a less secure network, like the internet.
Enterprise Networks: Large-scale networks used by businesses, often containing valuable and sensitive information.

Link: Hackers target Check Point VPNs to breach enterprise networks

A dramatic 3D scene showing hackers targeting Check Point VPNs. The central focus is on a Check Point VPN device surrounded by digital flames and sparks. Hackers are represented as shadowy figures with hoodies and glowing eyes, working on computers with cascading lines of code on the screens. The background is filled with cyber elements like binary code, locks, and shields being breached. The overall atmosphere is dark and intense, with a sense of urgency and tension, highlighted by neon blue and red tones.

3. Sav-Rx Data Breach

Sav-Rx, a prescription benefit management company, found itself in the middle of a data breach horror story, impacting 28 million Americans. Think of it as accidentally leaving the vault door open, and thieves walking out with stacks of your personal data. Hackers managed to access sensitive information, potentially leading to identity theft and other cyber nastiness.

For those affected, it’s a bit like being in a high-stakes game of “Where’s Waldo?” but instead of finding a character in a striped shirt, you’re looking for suspicious activity in your credit reports and email accounts. Keep your defenses up, and monitor your financial statements closely to avoid any unpleasant surprises.

Tech Translation:

Data Breach: Unauthorized access to confidential information.
Identity Theft: When someone uses your personal data to impersonate you, often for financial gain.

Link: Sav-Rx discloses data breach impacting 28 million Americans

4. Guilty Plea in Tech Support Scam

In a plot twist worthy of a heist movie, an Indian national pleaded guilty to a tech support scam that duped victims out of $3.7 million. The scam worked like this: fake tech support agents called unsuspecting victims, claiming their computers were infected. In reality, the only thing spreading was the scammers’ greed. Victims were tricked into paying for bogus services, highlighting a crucial lesson: real tech support won’t call you first. It’s always safer to initiate contact with your service provider.

Tech Translation:

Tech Support Scam: Fraudsters pretending to be tech support to trick you into giving them money or access to your computer.
Cold Call: An unsolicited call to someone, typically used by scammers to initiate their fraud.

Link: Indian National Pleads Guilty to $3.7 Million Tech Support Scam

A 3D scene showing an Indian national pleading guilty to a tech support scam. The central focus is on a courtroom with a judge, the defendant, and lawyers. The defendant is standing in front of the judge, with a solemn expression. Surrounding the scene are visual elements representing the scam: distressed victims, computers with warning messages, and piles of money amounting to $3.7 million. The background has elements of technology and digital deception, with a dark and somber atmosphere, highlighted by courtroom lighting.

5. WordPress Plugin Exploit

Imagine your favorite WordPress plugin turning into a double agent. That’s what happened with a recent exploit affecting a widely-used plugin. This exploit allowed hackers to steal sensitive data from websites, making webmasters feel like they’re in a high-stakes spy drama. Even the most trusted plugins can have vulnerabilities, so it’s crucial to keep them updated and stick to reputable sources. It’s like maintaining a high-security facility: constant vigilance and regular updates are key to keeping the bad guys out.

Tech Translation:

WordPress Plugin: Add-ons that enhance the functionality of WordPress websites.
Exploit: A method to take advantage of a flaw in software to gain unauthorized access.

Link: WordPress Plugin Exploited to Steal Data

Thank you for reading Tom Cyber Daily. This post is public so feel free to share it.