# MA-877.102022: MyCERT Alert - Best Practices for System Administrators and Internet Users

**Date:** 26 Oct 2022  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-877.102022  
**Advisory ID:** MA-877.102022

---

**1.0 Introduction**
Lately, MyCERT has been receiving high volumes of incidents affecting the Malaysian constituency. Therefore, as preventive measures, we would like to alert System Administrators to apply sufficient measures to secure their systems and networks, while Internet users must be always vigilant of potential cyber threats targeting Internet users by implementing best practices.
A total of 6,002 incidents were received through Cyber999, a service for incident reporting and response under MyCERT, between January and September 2022, with the majority of incidents reported 
*Figure 1: Statistics of incidents by category*
There had been several security incidents reported to Cyber999, since early this year such as Log4j vulnerability, Spring Framework vulnerability, VMware Carbon Black App Control vulnerabilities, banking trojan distributed through fake cleaning service websites, data breaches of Malaysian users' personally identifiable information, Shopee fake winning contest and large-scale phishing campaign that bypass MFA. MyCERT released Alerts and Advisories on these cyber threats to advise System Administrators and Internet users to apply necessary patches. Other than that, we also regularly produced advisories on software vulnerabilities and updates for a number of products. Below are the URLs for some of the mentioned advisories:
- [MA-873.102022: MyCERT Advisory - Microsoft Releases October 2022 Security Updates](https://www.mycert.org.my/portal/advisory?id=MA-873.102022)
- [MA-866.092022: MyCERT Advisory - Microsoft Guidance for Reported Zero-day Vulnerabilities in Microsoft Exchange Server](https://www.mycert.org.my/portal/advisory?id=MA-866.092022)
- [MA-864.092022: MyCERT Advisory - Microsoft Releases Out-of-Band Security Update for Microsoft Endpoint Configuration Manager](https://www.mycert.org.my/portal/advisory?id=MA-864.092022)
- [MA-861.092022: MyCERT Advisory - Microsoft Releases September 2022 Security Updates](https://www.mycert.org.my/portal/advisory?id=MA-861.092022)
- [MA-846.072022: MyCERT Alert - Alert on Fake Winning Contest Shopee](https://www.mycert.org.my/portal/advisory?id=MA-846.072022)
- [MA-845.072022: MyCERT Alert - Large-scale Phishing Campaign Bypasses MFA](https://www.mycert.org.my/portal/advisory?id=MA-845.072022)
- [MA-841.062022: MyCERT Alert - Security Best Practices on Data Breach](https://www.mycert.org.my/portal/advisory?id=MA-841.062022)
- [MA-839.062022: MyCERT Advisory - Microsoft Releases Workaround Guidance for MSDT Follina Vulnerability](https://www.mycert.org.my/portal/advisory?id=MA-839.062022)
- [MA-834.052022: MyCERT Alert - SMSSpy campaign to steal Malaysian banking user credential](https://www.mycert.org.my/portal/advisory?id=MA-834.052022)
- [MA-830.042022: MyCERT Advisory - Security Updates for "Spring4Shell" and Spring Cloud Function Vulnerabilities](https://www.mycert.org.my/portal/advisory?id=MA-830.042022)
- [MA-829.042022: MyCERT Advisory - VMware Carbon Black App Control Security Updates](https://www.mycert.org.my/portal/advisory?id=MA-829.042022)
- [MA-825.122021: MyCERT Advisory - Remediation and Mitigation for Apache Java Logging Library (Log4j) vulnerability](https://www.mycert.org.my/portal/advisory?id=MA-825.122021)
Thus, we highly recommend System Administrators and Malaysian Internet users regularly refer to our Alerts and Advisories for the latest information on software vulnerabilities and cyber threats. Necessary steps must be applied to prevent security incidents and minimize impacts or risks associated with the incidents.
**2.0 Importance of Preventive Measures**
System Administrators should practice additional precautions against potential intrusions, DDoS, phishing attacks, and malware activities such as ransomware, by implementing preventive measures against the threats. Data Centers and Web Hosting Companies should also take extra precautions against any software or third-party add-ons they have deployed by applying the latest patches or upgrades to prevent unwanted incidents that may exploit unpatched applications.
Financial Institutions must also be vigilant against any possibilities of phishing and fraudulent activities that target Internet banking customers. Customers must be advised adequately on avoiding becoming victims of phishing and fraudulent activities through safe browsing, safe email practice and safe Internet banking practice.
System Administrators and Internet users must be vigilant of cyber threats and software vulnerabilities by applying necessary patches and updates by referring to respective vendors' websites. System Administrators and Internet users may refer to MyCERT's website for the latest information on software vulnerabilities and cyber threats, which has pointers to patches and best practices.
**4.0 Recommendations**
Listed below are some recommendations for System Administrators:
- Make sure systems, applications and third-party add-ons are updated with the latest upgrades and security patches.
- If using older versions of operating systems or software, make sure they are upgraded to the latest versions as older versions may have some vulnerabilities that can be manipulated by intruders. Aside from that, please make sure web-based applications and network-based appliances are patched accordingly.
- Refer to respective vendors' websites for the latest patches, service packs and upgrades. Otherwise, may also refer to MyCERT’s website for the latest advisories on software vulnerabilities that have pointers to patches, service packs and upgrades.
- Make sure the Anti-virus software that is deployed on hosts and email gateways is updated with the latest signature files and is enabled to scan all files.
- Make sure that systems are configured appropriately in order to avoid incidents such as information disclosure, and directory listing that is caused by system misconfiguration.
- Make sure the logging for systems is always enabled, especially for critical systems.
- Perform regular backups of all critical information to limit the impact of data loss or destruction and to help expedite the recovery process. Ideally, the backup must be done daily, on a separate media and stored offline at an alternate site.
- Organizations are recommended to apply a defence-in-depth strategy in protecting networks. Firewalls, intrusion prevention systems (IPS), and network and host-based intrusion detection systems (IDS) can prevent malicious activities by blocking and dropping if it does occur and keeping track of most of the generic attacks.
The following are some recommendations for home users:
- Make sure PCs and browsers are up to date with the latest upgrades and security patches.
- Install Anti-Virus software on PCs to scan and block any potential malware infection to the PC. The Anti-virus should be regularly updated with the latest signature files in order to detect new malware.
- Do not simply click on links and attachments received via social networking sites or emails. Extra precautions must be taken when opening the links and attachments.
- Do not fall victim to online scams. Take precautions against online scams that target Internet users.
- Users are recommended the following tips and guidelines on safe Internet at the CyberSAFE website: <https://www.cybersafe.my/>
- Perform regular backups of all critical information to limit the impact of data loss or destruction and to help expedite the recovery process. Ideally, the backup must be done on daily basis and this data should be kept on a separate device, stored offline at an alternate site.
Please take note that incidents can be reported to Cyber999 through our reporting channels as below and our staff is on duty to respond to the incidents. If you need to report a critical incident, you can call Cyber999 via the 24x7 On Call Incident Reporting channel.
You can also report any fraud or scam-
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours)  
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>