Cybersecurity Update March 24th 2023: E-Commerce Plugin Flaws, Cyber Espionage, and Exploding USB Drives

Massive Security Flaw in WooCommerce Payments Plugin Resolved

A critical security flaw in the WooCommerce Payments plugin for WordPress, which affects over 500,000 websites, has been patched. The flaw could have allowed attackers to gain unauthorized admin access to impacted stores. Vulnerable versions of the plugin ranged from 4.8.0 to 5.6.1. Following the discovery, WooCommerce worked with WordPress to auto-update sites using affected versions, releasing patches for versions 4.8.2 up to 5.6.2. Although there’s no evidence of the vulnerability being actively exploited, users are advised to update to the latest version, check for newly added admin users, change administrator passwords, and rotate payment gateway and WooCommerce API keys.

SideCopy APT Targets India’s Premier Defense Research Agency

Cybersecurity startup Cyble has discovered that Pakistani cyberespionage group SideCopy APT is targeting the Indian government’s premier defense technology research agency, DRDO. The group uses spear phishing techniques to plant infostealing malware, often disguised as research material in email attachments. SideCopy APT has been known to target government and military officials in India and Afghanistan, continuously evolving its techniques and incorporating new tools into its arsenal. The group has previously targeted the Indian Army, the National Cadet Corps of India, and the National Council of Educational Research and Training.

US Officials Examine Chinese Risk to Electric Grid

US government officials are currently analyzing the prevalence of Chinese-made components in the electric grid. At a Senate Energy and Natural Resources Committee hearing, senators from both parties expressed frustration at the lack of clear answers regarding potential risks. The Energy Department has investigated critical components of the electric grid and their origins, testing electrical equipment down to the chip or software level to determine its country of origin. Congress has been urged to place more security requirements on firms serving critical infrastructure providers.

Explosive USB Drives Target Journalists in Ecuador

Journalists in Ecuador have been targeted by an extremist political group using explosive USB drives. Several journalists received rigged USB sticks containing military-grade RDX explosives, which were programmed to explode when plugged into a computer’s USB port. One journalist suffered minor injuries, but technical problems with the sticks prevented further harm. The Ecuadorian police are investigating the incident, and this attack serves as a reminder of the dangers of plugging unknown devices into computers. In addition to potential malicious software, such devices can cause physical harm, highlighting the importance of exercising caution when connecting unfamiliar devices to computers.

GitHub Takes Swift Action to Secure Git Operations

GitHub, the popular cloud-based repository hosting service, recently replaced its RSA SSH host key to maintain the security of Git operations. This decision was made in response to the brief exposure of the key in a public repository. The replacement occurred at 05:00 UTC on March 24, 2023, as a precautionary measure to prevent bad actors from impersonating the service or eavesdropping on users’ SSH operations. According to Mike Hanley, Chief Security Officer and SVP of Engineering at GitHub, the key does not grant access to the company’s infrastructure or customer data. The change only affects Git operations using RSA over SSH, leaving web traffic to GitHub.com and Git operations via HTTPS unaffected. ECDSA and Ed25519 users do not need to make any changes. GitHub, owned by Microsoft, stated that there is no evidence suggesting adversaries exploited the exposed SSH private key. The company emphasized that this issue was not the result of a compromise of any GitHub systems or customer information, but rather an accidental publishing of private data. Users of GitHub Actions may experience failed workflow runs if they use the actions/checkout with the ssh-key option. The company is currently updating the action across all tags. This disclosure follows a recent incident in which unknown threat actors exfiltrated encrypted code signing certificates related to some versions of GitHub Desktop for Mac and Atom apps. That wraps up todays cybersecurity update. As always, stay safe, stay vigilant and we’ll see you tomorrow with another update!