Cyber Blurbs: Feds List Top Exploited Vulnerabilities

In this week’s Cyber Blurbs Roundup, we take a look at an important list from the Joint Cybersecurity Advisory, a bad couple of months for San Diego’s top hospital, and the latest zero-day vulnerability with the world’s most popular smartphone.


Federal Agencies Unveil Most Exploited Vulnerabilities

A group of federal agencies joined forces to publish a report highlighting the top 30 most exploited vulnerabilities, many of which are pretty old. The Joint Cybersecurity Advisory — composed of the US Cybersecurity and Infrastructure Security Agency (CISA), FBI, Australian Security Center Centre (ACSC), and UK’s National Cyber Security Center Centre (NCSC) — published the information last week.

The agencies list software from Citrix, Pulse, Microsoft, Atlassian, and Netlogon, among others, as those containing vulnerabilities most often exploited by bad actors. Many of these vulnerabilities have already been issued software patches to mitigate the issue, reminding us that cybersecurity is often really only as good as the end user who may or may not decide to keep systems up to date. 

"In cybersecurity, getting the basics right is often most important. Organizations that apply the best practices of cybersecurity, such as patching, can reduce their risk to cyber actors exploiting known vulnerabilities in their networks," CISA Executive Assistant Director Eric Goldstein told the FBI. "Collaboration is a crucial part of CISA’s work and today we partnered with ACSC, NCSC, and FBI to highlight cyber vulnerabilities that public and private organizations should prioritize for patching to minimize risk of being exploited by malicious actors." 

The full report can be found here


UC San Diego Health Suffers Data Breach

UC San Diego (UCSD) Health — just one day after being named the sixth-best hospital in California by U.S. News & World Report — announced it was the victim of a cyber attack. 

The hospital has not stated how many individuals may have been affected, but did note that protected information may have been compromised during a five-month stretch between Dec. 2 and April 8. Officials confirmed to The San Diego Union-Tribune that the breach resulted from an email phishing attack against one the hospital’s employees. A UCSD Health spokesperson also confirmed to the newspaper that — as a nice change of pace — ransomware was not involved. 

Of user data that “may have been accessed or acquired,” here’s what UC San Diego Health had to say (get your scrolling finger ready): 

  • Full names

  • Addresses

  • Dates of birth

  • Email addresses

  • Fax numbers

  • Claims information (including dates and costs of care received)

  • Lab results

  • Medical diagnoses and conditions

  • Medical record numbers

  • Prescription information

  • Treatment information

  • Social security numbers

  • Government identification numbers

  • Financial account numbers

  • Student identification numbers

  • Usernames 

  • Passwords

The hospital was first alerted of suspicious activity back in March, shutting down the compromised email accounts about a month later. An investigation is said to be ongoing, per the Union-Tribune.

News of UCSD’s breach comes just a few months after Scripps Health — another San Diego hospital — suffered a ransomware attack that left 147,000 people with leaked personal data. 


Apple Releases (Another) Zero-Day Patch for iPhones

Another week, another quiet (but critical) software update from Apple. Just days after releasing iOS 14.7 — a patch adding support for its totally reasonably priced magnetic battery pack — the company rolled out iOS 14.7.1., a software update addressing a recently discovered zero-day vulnerability. 

The company describes the flaw as follows:

“An application may be able to execute arbitrary code with kernel privileges.”

Apple says it is “aware of a report that this issue may have been actively exploited.” The update is available for the following devices:

  • iPhone 6s and later

  • iPad Pro (all models)

  • iPad Air 2 and later

  • iPad 5th generation and later

  • iPad mini 4 and later

  • iPod touch (7th generation)

The security update also applies to macOS 11.5.1 for its Mac computers. Apple released its latest updates on July 26. According to Security Week, this marks the 13th zero-day vulnerability Apple has patched in 2021. 


Recent Posts