# MA-729.052019: MyCERT Alert - MyCERT Special Alert - Festive Season and Holiday Alert

**Date:** 01 Jun 2019  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-729.052019  
**Advisory ID:** MA-729.052019

---

**1.0 Introduction**
As the festive season holiday approaches and many of us will be leaving for holiday break, we would like to alert System Administrators and Internet users to ensure sufficient measures had been implemented to secure their systems and networks before leaving for the holidays.
**2.0 Impact**
A total of 2977 incidents were received through the Cyber999 service between January and April 2019 with majority of incidents reported are 
|  |  |  | --- | --- | --- | --- | --- | --- |  | **JAN** | **FEB** | **MAR** | **APR** | **TOTAL** | Content 
Table 1: Statistics of incidents by category.
There had been several security incidents since early this year such as WhatsApp Messenger vulnerability, Fake Windows PC Cleaner, PHP Pear vulnerability and 10kBlaze exploit on SAP which we had released Alert & Advisory to address these issues. Other than that, we had also produced advisories on software vulnerabilities as well as product updates such as Microsoft, Adobe, Google Chrome, Android and others. Below are the URLs for some of the mentioned advisories:
- <https://www.mycert.org.my/portal/details?menu=431fab9c-d24c-4a27-ba93-e92edafdefa5&id=32444791-0bd9-45bb-bf29-260b8e15c363>
- <https://www.mycert.org.my/portal/details?menu=431fab9c-d24c-4a27-ba93-e92edafdefa5&id=4d10bed3-0079-4951-afcb-26353f17df64>
- <https://www.mycert.org.my/portal/details?menu=431fab9c-d24c-4a27-ba93-e92edafdefa5&id=8a2aeff1-c3c4-466c-bce5-67e26b221e11>
Thus, we highly recommend System Administrators and Internet users to refer to our Alerts & Advisories and follow the necessary steps to prevent security incidents and minimize the impacts or risks to a certain extent with preventive measures in place.
**3.0 Affected System and Devices**
System Administrators should take extra precautions against any possibilities of intrusions, phishing attacks, and malware activities such as ransomware during the festive season, by implementing proper preventive measures against the threats. Data Centres and Web Hosting Companies should also take extra precautions against any software or third party add-ons they're running by applying the latest patches or upgrades to prevent intrusions that may exploit unpatched applications.
Financial Institutions must also be vigilant against any possibilities of phishing and fraudulent activities that target Internet banking. Customers must be advised adequately on avoiding themselves becoming victims of phishing and fraudulent activities by applying safe browsing, safe email practice and safe Internet banking practice. Organizations must ensure contact information of System Administrators is made available in the event of a security incident that occurs at or originate from your site.
System Administrators and Internet users must be aware of these threats and vulnerabilities by applying necessary patches and updates by referring to MyCERT released on Alerts and Advisories on current threats and vulnerabilities.
MyCERT had released Alerts and Advisories which are available at:
https://www.mycert.org.my/portal/advisories?id=431fab9c-d24c-4a27-ba93-e92edafdefa5
MyCERT had also released Malaysia Threat Landscape Report for 2018, which is available at:
- <https://www.mycert.org.my/portal/publicationdoc?id=270d8ee0-cdd1-49fb-827d-f8fca7752155>
**4.0 Recommendations**
Listed below are some recommendations for System Administrators:
1. Make sure systems, applications and third party add-ons are updated with latest upgrades and security patches.
If you're running older versions of operating systems or software, make sure they are upgraded to the latest versions as older versions may have some vulnerability that can be manipulated by intruders. Aside from that, please make sure that your web-based applications and network-based appliances are patched accordingly.
You may refer to your respective vendors' websites for the latest patches, service packs and upgrades. You may also refer to MyCERT’s website for information on the latest patches, service packs and upgrades by referring to our latest advisories at:
<https://www.mycert.org.my/portal/advisories?id=431fab9c-d24c-4a27-ba93-e92edafdefa5>
2. Make sure Anti-virus software that are running on hosts and email gateways are updated with the latest signature files and are enabled to scan all files. 
3. Make sure that your systems are configured properly in order to avoid incidents such as information disclosure, directory listing that are caused by system misconfiguration.
4. Make sure loggings of systems and servers are always enabled.
5. Perform regular backups of all critical information to limit the impact of data or system loss and to help expedite the recovery process. Ideally, the backup must be done daily, on a separate media and stored offline at an alternate site.
6. Organizations are recommended to apply defense in depth strategy in protecting their networks. Firewalls, intrusion prevention systems (IPS), network and host-based intrusion detection systems (IDS) can prevent and log most of the generic attacks.
Below are some recommendations for home users:
1. Make sure your PCs and browsers are up-to-date with the latest upgrades and security patches.
2. Install Anti-Virus software on your PCs to scans and blocks any malware to the PC. The Anti-virus should be regularly updated with the latest signature files in order to detect new worms/viruses.
3. Do not simply click on links and attachments that they receive via social networking sites or emails. Extra precautions must be taken when opening the links and attachments.
4. Do not fall victim to online scams. Take precautions against online scams that target Internet users.
5. Users are recommended the following tips and guidelines on safe Internet at:
<http://www.cybersafe.my>
6. Perform regular backups of all critical information to limit the impact of data or system loss and to help expedite the recovery process. Ideally, the backup must be done on daily basis and this data should be kept on a separate device, stored offline at an alternate site. Below URL provide the list of best practices:
- <https://www.mycert.org.my/portal/advisories?id=431fab9c-d24c-4a27-ba93-e92edafdefa5>
Please take note that our physical office will be closed on 5th June until 7th June 2018 respectively as they are declared as public holidays. However, incidents can be reported to Cyber999 through our other reporting channels as below and our staff is on duty to respond to the incidents. If you need to report critical incident, you can call Cyber999 via the 24x7 On Call Incident Reporting channel. 
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#9cffe5fef9eea5a5a5dcffe5fef9eeeff9ffe9eef5e8e5b2f1e5) or [[email protected]](/cdn-cgi/l/email-protection#bfd2c6dcdacdcbffd2c6dcdacdcb91d0cdd891d2c6)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <http://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)