Ethical Hacking News

The only thing worse than being fired is scammers fooling you into thinking you're fired

Scumbags play on victims' worst fears in phishing campaign referencing UK Employment Tribunal A current phishing campaign scares recipients into believing they've been sacked, when in reality they've been hacked and infected with infostealers and other malware that means a payday for the crooks behind the scam.

Published: 2024-11-28T07:31:07

The Register - Security

Salt Typhoon's surge extends far beyond US telcos

Plus, a brand-new backdoor, GhostSpider, is linked to the cyber spy crew's operations The reach of the China-linked Salt Typhoon gang extends beyond telecommunications giants in the United States, and its arsenal includes several backdoors including a brand-new malware dubbed GhostSpider according to Trend Micro researchers.

Published: 2024-11-27T23:44:14

The Register - Security

T-Mobile US takes a victory lap after stopping cyberattacks: 'Other providers may be seeing different outcomes'

Funny what putting more effort and resources into IT security can do Attackers - possibly China's Salt Typhoon cyber-espionage crew - compromised an unnamed wireline provider's network and used this access to try to break into T-Mobile US systems multiple times over the past few weeks, according to its Chief Security Officer Jeff Simon.

Published: 2024-11-27T20:59:13

The Register - Security

Bolster resilience against 2025 cyber threats

Watch this webinar to learn why cybersecurity leaders can trust the MITRE ATT&CK Evaluations Partner Content In today's dynamic threat landscape, security leaders are under constant pressure to make informed choices about which solutions and strategies they employ to protect their organizations.

Published: 2024-11-27T18:40:07

The Register - Security

Data broker leaves 600K+ sensitive files exposed online

Researcher spotted open database before criminals we hope Exclusive More than 600,000 sensitive files containing thousands of people's criminal histories, background checks, vehicle and property records were exposed to the internet in a non-password protected database belonging to data brokerage SL Data Services, according to a security researcher.

Published: 2024-11-27T18:00:08

The Register - Security

First-ever UEFI bootkit for Linux in the works, experts say

Bootkitty doesn't bite yet Security researchers say they've stumbled upon the first-ever UEFI bootkit targeting Linux, illustrating a key moment in the evolution of such tools.

Published: 2024-11-27T15:32:12

The Register - Security

Automating endpoint management

Addressing the challenges of patching and vulnerability remediation Webinar Managing endpoints efficiently has perhaps never been more important or more complex.

Published: 2024-11-27T14:53:11

The Register - Security

The workplace has become a surveillance state

Cracked Labs report explores the use of motion sensors and wireless networking kit to monitor offices Office buildings have become like web browsers they're full of tracking technology, a trend documented in a report out this week by Cracked Labs.

Published: 2024-11-27T08:31:08

The Register - Security

CrowdStrike still doesn't know how much its Falcon flame-out will cost

Thinks customers may have forgiven it after revenue hits a record CrowdStrike can't yet confidently predict the financial impact of the failed update to its Falcon software that crashed millions of computers around the world last July, but is confident its third quarter results show customers can't find a better security product.

Published: 2024-11-27T07:27:13

The Register - Security

Telco engineer who spied on US employer for Beijing gets four years in the clink

Provides insight to how China gets inside US systems, perhaps at Verizon and Infosys A 59 year-old Florida telco engineer was sentenced to 48 months in prison after he served as a spy for China and provided Beijing with details like his employer's cybersecurity, according to the US Department of Justice.

Published: 2024-11-27T05:30:13

The Register - Security

Man accused of hilariously bad opsec as alleged cybercrime spree detailed

Complaint claims he trespassed, gave himself discounts, and sorted CCTV access A Kansas City man who stands accused of having a disregard for basic opsec made his first court appearance on Friday over a series of alleged cybercrimes.

Published: 2024-11-26T20:33:06

The Register - Security

US senators propose law to require bare minimum security standards

In case anyone forgot about Change Healthcare American hospitals and healthcare organizations would be required to adopt multi-factor authentication (MFA) and other minimum cybersecurity standards under new legislation proposed by a bipartisan group of US senators.

Published: 2024-11-26T16:00:15

The Register - Security

Fortify your data

How cyber resilient storage hardware can defeat ransomware Sponsored Feature Ransomware is everywhere. The FBI and CISA just issued yet another advisory about it.

Published: 2024-11-26T14:52:06

The Register - Security

Bing Wallpaper app, now in Windows Store, accused of cookie shenanigans

Microsoft free tool snooping on users? Surely not! If you've been tempted to download the Bing Wallpaper app to spice up your Windows 11 desktop backgrounds, you may want to think twice.

Published: 2024-11-26T14:30:15

The Register - Security

Another 'major cyber incident' at a UK hospital, outpatients asked to stay away

Third time this year an NHS unit's IT systems have come under attack A UK hospital is declaring a "major incident," cancelling all outpatient appointments due to "cybersecurity reasons."

Published: 2024-11-26T11:36:39

The Register - Security

QNAP and Veritas dump 30-plus vulns over the weekend

Just what you want to find when you start a new week Updated Taiwanese NAS maker QNAP addressed 24 vulnerabilities across various products over the weekend.

Published: 2024-11-26T10:29:12

The Register - Security

Britain Putin up stronger AI defences to counter growing cyber threats

'Be in no doubt: the UK and others in this room are watching Russia' The government of the United Kingdom on Monday announced the formation of a Laboratory for AI Security Research (LASR) to make the nation more resilient to AI-powered cyber threats from Russia.

Published: 2024-11-26T06:29:13

The Register - Security

Supply chain management vendor Blue Yonder succumbs to ransomware

And it looks like major UK retailers that rely on it are feeling the pinch US-based supply chain SaaS vendor Blue Yonder has revealed a service disruption caused by ransomware, and its customers are reportedly struggling to get goods onto shelves as a result.

Published: 2024-11-26T01:27:10

The Register - Security

Security? We've heard of it: How Microsoft plans to better defend Windows

Did we say CrowdStrike? We meant, er, The July Incident... Ignite The sound of cyber security professionals spraying their screens with coffee could be heard this week as Microsoft claimed, "security is our top priority," as it talked up its Secure Future Initiative (SFI) once again and explained how Windows could be secured.

Published: 2024-11-25T19:15:11

The Register - Security

China has utterly pwned 'thousands and thousands' of devices at US telcos

Senate Intelligence Committee chair says his 'hair is on fire' as execs front the White House The Biden administration on Friday hosted telco execs to chat about China's recent attacks on the sector, amid revelations that US networks may need mass rebuilds to recover.

Published: 2024-11-25T13:15:05

The Register - Security

Google blocked 1,000-plus pro-China fake news websites from its search results

Beijing's propaganda buddies aren't just using social media Google's Threat Intelligence Group has blocked a network China-related firms from its search results for operating fake news services and websites.

Published: 2024-11-25T06:29:12

The Register - Security

Imagine a land in which Big Tech can't send you down online rabbit holes or use algorithms to overcharge you

China is trying to become that land, with a government crackdown on the things that make the internet no fun Internet echo chambers and nasty e-commerce tricks that analyze your behavior to milk you for more cash are set to be banned in China.

Published: 2024-11-25T05:29:08

The Register - Security

Russian spies may have moved in next door to target your network

Plus: Microsoft seizes phishing domains; Helldown finds new targets; Illegal streaming with Jupyter, and more Infosec in brief Not to make you paranoid, but that business across the street could, under certain conditions, serve as a launching point for Russian cyber spies to compromise your network.

Published: 2024-11-25T01:30:15

The Register - Security

Volunteer DEF CON hackers dive into America's leaky water infrastructure

Six sites targeted for security clean-up, just 49,994 to go A plan for hackers to help secure America's critical infrastructure has kicked off with six US water companies signing up to let coders kick the tires of their computer systems and fix any vulnerabilities.

Published: 2024-11-24T15:27:12

The Register - Security

Trump taps border hawk to head DHS. Will Noem's 'enthusiasm' extend to digital domain?

Meanwhile, CISA chief Jen Easterly will step down prior to inauguration Analysis President-elect Donald Trump has announced several unorthodox nominations for his cabinet over the last two weeks, including South Dakota Governor Kristi Noem, whom he tapped to serve as Homeland Security Secretary.

Published: 2024-11-23T17:39:15

The Register - Security

Andrew Tate's site ransacked, subscriber data stolen

He'll just have to take this one on the chin The website of self-proclaimed misogynist and alleged sex trafficker and rapist Andrew Tate has been compromised and data on its paying subscribers stolen.

Published: 2024-11-22T22:38:07

The Register - Security

1,000s of Palo Alto Networks firewalls hijacked as miscreants exploit critical hole

PAN-PAN! Intruders inject web shell backdoors, crypto-coin miners, more Updated Thousands of Palo Alto Networks firewalls were compromised by attackers exploiting two recently patched security bugs. The intruders were able to deploy web-accessible backdoors to remotely control the equipment as well as cryptocurrency miners and other malware.

Published: 2024-11-22T21:27:09

The Register - Security

How to master endpoint security

Get some advice from this discussion with a Kaseya expert Webinar Want to access the key takeaways from the recent "Secure Everything for Every Endpoint" webinar?

Published: 2024-11-22T11:14:34

The Register - Security

SafePay ransomware gang claims Microlise attack that disrupted prison van tracking

Fledgling band of crooks says it stole 1.2 TB of data The new SafePay ransomware gang has claimed responsibility for the attack on UK telematics biz Microlise, giving the company less than 24 hours to pay its extortion demands before leaking data.

Published: 2024-11-22T08:34:12

The Register - Security

Helpline for Yakuza victims fears it leaked their personal info

Organized crime types tend not to be kind to those who go against them, so this is nasty A local Japanese government agency dedicated to preventing organized crime has apologized after experiencing an incident it fears may have led to a leak of personal information describing 2,500 people who reached out to it for consultation.

Published: 2024-11-22T05:24:07

The Register - Security

Here's what happens if you don't layer network security or remove unused web shells

TL;DR: Attackers will break in and pwn you, as a US government red team demonstrated The US Cybersecurity and Infrastructure Agency often breaks into critical organizations' networks with their permission, of course to simulate real-world cyber attacks and thereby help improve their security. In one of those recent exercises conducted at a critical infrastructure provider, the Agency exploited a web shell left behind from an earlier bug bounty program, scooped up a bunch of credentials and security keys, moved through the network and ultimately pwned the org's domain and several sensitive business system targets.

Published: 2024-11-22T01:13:08

The Register - Security

DARPA-backed voting system for soldiers abroad savaged

VotingWorks, developer of the system, disputes critics' claims An electronic voting project backed by DARPA Uncle Sam's boffinry nerve center to improve the process of absentee voting for American military personnel stationed abroad has been slammed by security researchers.

Published: 2024-11-21T19:27:10

The Register - Security

Chinese ship casts shadow over Baltic subsea cable snipfest

Danish military confirms it is monitoring as Swedish police investigate. Cloudflare says impact was 'minimal' The Danish military has confirmed it is tracking a Chinese ship that is under investigation after two optical fiber internet cables under the Baltic Sea were damaged.

Published: 2024-11-21T17:20:09

The Register - Security

'Alarming' security bugs lay low in Linux's needrestart utility for 10 years

Update now: Qualys says flaws give root to local users, 'easily exploitable', default in Ubuntu Server Researchers at Qualys refuse to release exploit code for five bugs in the Linux world's needrestart utility that allow unprivileged local attackers to gain root access without any user interaction.

Published: 2024-11-21T15:03:05

The Register - Security

Now Online Safety Act is law, UK has 'priorities' but still won't explain 'spy clause'

Draft doc struggles to describe how theoretically encryption-busting powers might be used The UK government has set out plans detailing how it will use the new law it has created to control online platforms and social media with one telling exception.

Published: 2024-11-21T10:38:11

The Register - Security

Put your usernames and passwords in your will, advises Japan's government

Digital end of life planning saves your loved ones from a little extra anguish Japan's National Consumer Affairs Center on Wednesday suggested citizens start "digital end of life planning" and offered tips on how to do it.

Published: 2024-11-21T06:14:08

The Register - Security

Five Scattered Spider suspects indicted for phishing spree and crypto heists

DoJ also shutters allleged crimeware and credit card mart PopeyeTools The US Department of Justice has issued an indictment that names five people accused of stealing millions in cryptocurrency and we are told they are suspected members of cyber-gang Scattered Spider.

Published: 2024-11-21T01:29:13

The Register - Security

Chinese cyberspies, Musk's Beijing ties, labelled real risk to US security by senator

Meet Liminal Panda, which prowls telecom networks in South Asia and Africa A senior US senator has warned that American tech companies activities in China represent a national security risk, in a hearing that saw infosec biz CrowdStrike testify it has identified another cyber-espionage crew it believes is backed by Beijing.

Published: 2024-11-20T23:50:14

The Register - Security

Mega US healthcare payments network restores system 9 months after ransomware attack

Change Healthcare's $2 billion recovery is still a work in progress Still reeling from its February ransomware attack, Change Healthcare confirms its clearinghouse services are back up and running, almost exactly nine months since the digital disruption began.

Published: 2024-11-20T18:01:08

The Register - Security

Google's AI bug hunters sniff out two dozen-plus code gremlins that humans missed

OSS-Fuzz is making a strong argument for LLMs in security research Google's OSS-Fuzz project, which uses large language models (LLMs) to help find bugs in code repositories, has now helped identify 26 vulnerabilities, including a critical flaw in the widely used OpenSSL library.

Published: 2024-11-20T17:01:27

The Register - Security

D-Link tells users to trash old VPN routers over bug too dangerous to identify

Vendor offers 20% discount on new model, but not patches Owners of older models of D-Link VPN routers are being told to retire and replace their devices following the disclosure of a serious remote code execution (RCE) vulnerability.

Published: 2024-11-20T14:32:06

The Register - Security

Data is the new uranium incredibly powerful and amazingly dangerous

CISOs are quietly wishing they had less data, because the cost of management sometimes exceeds its value Column I recently got to play a 'fly on the wall' at a roundtable of chief information security officers. Beyond the expected griping and moaning about funding shortfalls and always-too-gullible users, I began to hear a new note: data has become a problem.

Published: 2024-11-20T07:15:09

The Register - Security

Healthcare org Equinox notifies 21K patients and staff of data theft

Ransomware scum LockBit claims it did the dirty deed Equinox, a New York State health and human services organization, has begun notifying over 21 thousand clients and staff that cyber criminals stole their health, financial, and personal information in a "data security incident" nearly seven months ago.

Published: 2024-11-20T00:30:07

The Register - Security

China-linked group abuses Fortinet 0-day with post-exploit VPN-credential stealer

No word on when or if the issue will be fixed Chinese government-linked snoops are exploiting a zero-day bug in Fortinet's Windows VPN client to steal credentials and other information, according to memory forensics outfit Volexity.

Published: 2024-11-19T23:02:13

The Register - Security

Russian suspected Phobos ransomware admin extradited to US over $16M extortion

This malware is FREE for EVERY crook ($300 decryption keys sold separately) A Russian citizen has been extradited from South Korea to the United States to face charges related to his alleged role in the Phobos ransomware operation.

Published: 2024-11-19T21:55:07

Security Latest

The US Army's Vision of Soldiers in Exoskeletons Lives On

Following decades of failed attempts and dashed dreams, the US Army is once again trying out powered exoskeletons to help soldiers haul munitions and equipment in the field.

Published: 2024-11-29T10:30:00

Security Latest

Emergency Vehicle Lights Can Screw Up a Car's Automated Driving System

Newly published research finds that the flashing lights on police cruisers and ambulances can cause “digital epileptic seizures” in image-based automated driving systems, potentially risking wrecks.

Published: 2024-11-26T12:00:00

Security Latest

Russia’s Ballistic Missile Attack on Ukraine Is an Alarming First

This is the first time Russia has used its so-called Oreshnik intermediate-range ballistic missile in combat. The launch also serves as a warning to the West.

Published: 2024-11-23T17:00:00

Security Latest

Andrew Tate’s ‘Educational Platform’ Was Hacked

Plus: The worst telecom hack in US history rolls on, iPhones are harder to break into, and more of the week’s top security news.

Published: 2024-11-23T11:30:00

Security Latest

The US Is Calling Out Foreign Influence Campaigns Faster Than Ever

The 2024 elections were a high-water mark for naming and shaming threat actors from foreign governments. There’s still work to be done, though, on how to attribute disinformation campaigns most effectively.

Published: 2024-11-22T20:36:33

Security Latest

Russian Spies Jumped From One Network to Another Via Wi-Fi in an Unprecedented Hack

In a first, Russia's APT28 hacking group appears to have remotely breached the Wi-Fi of an espionage target by hijacking a laptop in another building across the street.

Published: 2024-11-22T13:00:00

Security Latest

Meta Finally Breaks Its Silence on Pig Butchering

The company gave details for the first time on its approach to combating organized criminal networks behind the devastating scams.

Published: 2024-11-21T18:00:00

Security Latest

China’s Surveillance State Is Selling Citizen Data as a Side Hustle

Chinese black market operators are openly recruiting government agency insiders, paying them for access to surveillance data and then reselling it online no questions asked.

Published: 2024-11-21T11:30:00

Security Latest

Inside the Booming ‘AI Pimping’ Industry

AI-generated influencers based on stolen images of real-life adult content creators are flooding social media.

Published: 2024-11-20T11:00:00

Security Latest

Anyone Can Buy Data Tracking US Soldiers and Spies to Nuclear Vaults and Brothels in Germany

More than 3 billion phone coordinates collected by a US data broker expose the detailed movements of US military and intelligence workers in Germany and the Pentagon is powerless to stop it.

Published: 2024-11-20T04:00:00

Security Latest

Immigration Police Can Already Sidestep US Sanctuary City Laws Using Data-Sharing Fusion Centers

Built to combat terrorism, fusion centers give US Immigration and Customs Enforcement a way to gain access to data that’s meant to be protected under city laws limiting local police cooperation with ICE.

Published: 2024-11-19T10:00:00

Security Latest

Bitfinex Hacker Gets 5 Years for $10 Billion Bitcoin Heist

Plus: An “AI granny” is wasting scammers’ time, a lawsuit goes after spyware-maker NSO Group’s executives, and North Korea linked hackers take a crack at macOS malware.

Published: 2024-11-16T11:30:00

The Hacker News

Wanted Russian Hacker Linked to Hive and LockBit Ransomware Arrested

A Russian cybercriminal wanted in the U.S. in connection with LockBit and Hive ransomware operations has been arrested by law enforcement authorities in the country. According to a news report from Russian media outlet RIA Novosti, Mikhail Pavlovich Matveev has been accused of developing a malicious program designed to encrypt files and seek ransom in return for a decryption key. "At present,

Published: 2024-11-30T12:44:00

The Hacker News

AI-Powered Fake News Campaign Targets Western Support for Ukraine and U.S. Elections

A Moscow-based company sanctioned by the U.S. earlier this year has been linked to yet another influence operation designed to turn public opinion against Ukraine and erode Western support since at least December 2023. The covert campaign undertaken by Social Design Agency (SDA) leverages videos enhanced using artificial intelligence (AI) and bogus websites impersonating reputable news sources

Published: 2024-11-29T18:47:00

The Hacker News

Protecting Tomorrow's World: Shaping the Cyber-Physical Future

The lines between digital and physical realms increasingly blur. While this opens countless opportunities for businesses, it also brings numerous challenges. In our recent webinar, Shaping the Cyber-Physical Future: Trends, Challenges, and Opportunities for 2025, we explored the different factors shaping the cyber-physical future. In an insightful conversation with industry experts, we discussed

Published: 2024-11-29T16:30:00

The Hacker News

Phishing-as-a-Service "Rockstar 2FA" Targets Microsoft 365 Users with AiTM Attacks

Cybersecurity researchers are warning about malicious email campaigns leveraging a phishing-as-a-service (PhaaS) toolkit called Rockstar 2FA with an aim to steal Microsoft 365 account credentials. "This campaign employs an AitM [adversary-in-the-middle] attack, allowing attackers to intercept user credentials and session cookies, which means that even users with multi-factor authentication (MFA)

Published: 2024-11-29T15:36:00

The Hacker News

Microsoft Fixes AI, Cloud, and ERP Security Flaws; One Exploited in Active Attacks

Microsoft has addressed four security flaws impacting its artificial intelligence (AI), cloud, enterprise resource planning, and Partner Center offerings, including one that it said has been exploited in the wild. The vulnerability that has been tagged with an "Exploitation Detected" assessment is CVE-2024-49035 (CVSS score: 8.7), a privilege escalation flaw in partner.microsoft[.]com. "An

Published: 2024-11-29T15:04:00

The Hacker News

U.S. Citizen Sentenced for Spying on Behalf of China's Intelligence Agency

A 59-year-old U.S. citizen who immigrated from the People's Republic of China (PRC) has been sentenced to four years in prison for conspiring to act as a spy for the country and sharing sensitive information about his employer with China's principal civilian intelligence agency. Ping Li, 59, of Wesley Chapel, Florida, is said to have served as a cooperative contact for the Ministry of State

Published: 2024-11-29T11:01:00

The Hacker News

Over Two Dozen Flaws Identified in Advantech Industrial Wi-Fi Access Points Patch ASAP

Nearly two dozen security vulnerabilities have been disclosed in Advantech EKI industrial-grade wireless access point devices, some of which could be weaponized to bypass authentication and execute code with elevated privileges. "These vulnerabilities pose significant risks, allowing unauthenticated remote code execution with root privileges, thereby fully compromising the confidentiality,

Published: 2024-11-28T22:27:00

The Hacker News

The Future of Serverless Security in 2025: From Logs to Runtime Protection

Serverless environments, leveraging services such as AWS Lambda, offer incredible benefits in terms of scalability, efficiency, and reduced operational overhead. However, securing these environments is extremely challenging. The core of current serverless security practices often revolves around two key components: log monitoring and static analysis of code or system configuration. But here is

Published: 2024-11-28T17:00:00

The Hacker News

XML-RPC npm Library Turns Malicious, Steals Data, Deploys Crypto Miner

Cybersecurity researchers have discovered a software supply chain attack that has remained active for over a year on the npm package registry by starting off as an innocuous library and later adding malicious code to steal sensitive data and mine cryptocurrency on infected systems. The package, named @0xengine/xmlrpc, was originally published on October 2, 2023 as a JavaScript-based XML-RPC

Published: 2024-11-28T16:18:00

The Hacker News

Cybercriminals Exploit Popular Game Engine Godot to Distribute Cross-Platform Malware

A popular open-source game engine called Godot Engine is being misused as part of a new GodLoader malware campaign, infecting over 17,000 systems since at least June 2024. "Cybercriminals have been taking advantage of Godot Engine to execute crafted GDScript code which triggers malicious commands and delivers malware," Check Point said in a new analysis published Wednesday. "The technique

Published: 2024-11-28T14:59:00

The Hacker News

U.S. Telecom Giant T-Mobile Detects Network Intrusion Attempts from Wireline Provider

U.S. telecom service provider T-Mobile said it recently detected attempts made by bad actors to infiltrate its systems in recent weeks but noted that no sensitive data was accessed. These intrusion attempts "originated from a wireline provider's network that was connected to ours," Jeff Simon, chief security officer at T-Mobile, said in a statement. "We see no instances of prior attempts like

Published: 2024-11-28T10:07:00

The Hacker News

Researchers Discover "Bootkitty" First UEFI Bootkit Targeting Linux Kernels

Cybersecurity researchers have shed light on what has been described as the first Unified Extensible Firmware Interface (UEFI) bootkit designed for Linux systems. Dubbed Bootkitty by its creators who go by the name BlackCat, the bootkit is assessed to be a proof-of-concept (PoC) and there is no evidence that it has been put to use in real-world attacks. Also tracked as IranuKit, it was uploaded

Published: 2024-11-27T21:35:00

The Hacker News

Critical Flaw in ProjectSend Under Active Exploitation Against Public-Facing Servers

A critical security flaw impacting the ProjectSend open-source file-sharing application has likely come under active exploitation in the wild, according to findings from VulnCheck. The vulnerability, originally patched over a year-and-a-half ago as part of a commit pushed in May 2023 , was not officially made available until August 2024 with the release of version r1720. As of November 26, 2024,

Published: 2024-11-27T21:35:00

The Hacker News

Latest Multi-Stage Attack Scenarios with Real-World Examples

Multi-stage cyber attacks, characterized by their complex execution chains, are designed to avoid detection and trick victims into a false sense of security. Knowing how they operate is the first step to building a solid defense strategy against them. Let's examine real-world examples of some of the most common multi-stage attack scenarios that are active right now. URLs and Other Embedded

Published: 2024-11-27T17:00:00

The Hacker News

APT-C-60 Hackers Exploit StatCounter and Bitbucket in SpyGlace Malware Campaign

The threat actor known as APT-C-60 has been linked to a cyber attack targeting an unnamed organization in Japan that used a job application-themed lure to deliver the SpyGlace backdoor. That's according to findings from JPCERT/CC, which said the intrusion leveraged legitimate services like Google Drive, Bitbucket, and StatCounter. The attack was carried out around August 2024. "In this attack,

Published: 2024-11-27T16:44:00

The Hacker News

INTERPOL Busts African Cybercrime: 1,006 Arrests, 134,089 Malicious Networks Dismantled

An INTERPOL-led operation has led to the arrest of 1,006 suspects across 19 African countries and the takedown of 134,089 malicious infrastructures and networks as part of a coordinated effort to disrupt cybercrime in the continent. Dubbed Serengeti, the law enforcement exercise took place between September 2 and October 31, 2024, and targeted criminals behind ransomware, business email

Published: 2024-11-27T12:50:00

The Hacker News

Matrix Botnet Exploits IoT Devices in Widespread DDoS Botnet Campaign

A threat actor named Matrix has been linked to a widespread distributed denial-of-service (DoD) campaign that leverages vulnerabilities and misconfigurations in Internet of Things (IoT) devices to co-opt them into a disruptive botnet. "This operation serves as a comprehensive one-stop shop for scanning, exploiting vulnerabilities, deploying malware, and setting up shop kits, showcasing a

Published: 2024-11-27T10:51:00

The Hacker News

Critical WordPress Anti-Spam Plugin Flaws Expose 200,000+ Sites to Remote Attacks

Two critical security flaws impacting the Spam protection, Anti-Spam, and FireWall plugin WordPress could allow an unauthenticated attacker to install and enable malicious plugins on susceptible sites and potentially achieve remote code execution. The vulnerabilities, tracked as CVE-2024-10542 and CVE-2024-10781, carry a CVSS score of 9.8 out of a maximum of 10.0. They were addressed in versions

Published: 2024-11-26T18:53:00

The Hacker News

Intruder Launches Intel: A Free Vulnerability Intelligence Platform For Staying Ahead of the Latest Threats

When CVEs go viral, separating critical vulnerabilities from the noise is essential to protecting your organization. That’s why Intruder, a leader in attack surface management, built Intel - a free vulnerability intelligence platform designed to help you act fast and prioritize real threats. What is Intel? Intel was created to fill a gap in the resources available for tracking emerging

Published: 2024-11-26T17:00:00

The Hacker News

RomCom Exploits Zero-Day Firefox and Windows Flaws in Sophisticated Cyberattacks

The Russia-aligned threat actor known as RomCom has been linked to the zero-day exploitation of two security flaws, one in Mozilla Firefox and the other in Microsoft Windows, as part of attacks designed to deliver the eponymous backdoor on victim systems. "In a successful attack, if a victim browses a web page containing the exploit, an adversary can run arbitrary code without any user

Published: 2024-11-26T16:04:00

The Hacker News

Chinese Hackers Use GHOSTSPIDER Malware to Hack Telecoms Across 12+ Countries

The China-linked threat actor known as Earth Estries has been observed using a previously undocumented backdoor called GHOSTSPIDER as part of its attacks targeting Southeast Asian telecommunications companies. Trend Micro, which described the hacking group as an aggressive advanced persistent threat (APT), said the intrusions also involved the use of another cross-platform backdoor dubbed

Published: 2024-11-26T15:49:00

The Hacker News

CISA Urges Agencies to Patch Critical "Array Networks" Flaw Amid Active Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a now-patched critical security flaw impacting Array Networks AG and vxAG secure access gateways to its Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation in the wild. The vulnerability, tracked as CVE-2023-28461 (CVSS score: 9.8), concerns a case of missing authentication that

Published: 2024-11-26T10:33:00

The Hacker News

Google's New Restore Credentials Tool Simplifies App Login After Android Migration

Google has introduced a new feature called Restore Credentials to help users restore their account access to third-party apps securely after migrating to a new Android device. Part of Android's Credential Manager API, the feature aims to reduce the hassle of re-entering the login credentials for every app during the handset replacement. "With Restore Credentials, apps can seamlessly onboard

Published: 2024-11-25T19:52:00

The Hacker News

PyPI Python Library "aiocpa" Found Exfiltrating Crypto Keys via Telegram Bot

The administrators of the Python Package Index (PyPI) repository have quarantined the package "aiocpa" following a new update that included malicious code to exfiltrate private keys via Telegram. The package in question is described as a synchronous and asynchronous Crypto Pay API client. The package, originally released in September 2024, has been downloaded 12,100 times to date. By putting the

Published: 2024-11-25T19:24:00

The Hacker News

THN Recap: Top Cybersecurity Threats, Tools, and Practices (Nov 18 - Nov 24)

We hear terms like “state-sponsored attacks” and “critical vulnerabilities” all the time, but what’s really going on behind those words? This week’s cybersecurity news isn’t just about hackers and headlines it’s about how digital risks shape our lives in ways we might not even realize. For instance, telecom networks being breached isn’t just about stolen data it’s about power. Hackers are

Published: 2024-11-25T17:00:00

The Hacker News

Flying Under the Radar - Security Evasion Techniques

Dive into the evolution of phishing and malware evasion techniques and understand how attackers are using increasingly sophisticated methods to bypass security measures. The Evolution of Phishing Attacks “I really like the saying that ‘This is out of scope’ said no hacker ever. Whether it’s tricks, techniques or technologies, hackers will do anything to evade detection and make sure their

Published: 2024-11-25T17:00:00

The Hacker News

Cybersecurity Blind Spots in IaC and PaC Tools Expose Cloud Platforms to New Attacks

Cybersecurity researchers have disclosed two new attack techniques against infrastructure-as-code (IaC) and policy-as-code (PaC) tools like HashiCorp's Terraform and Styra's Open Policy Agent (OPA) that leverage dedicated, domain-specific languages (DSLs) to breach cloud platforms and exfiltrate data. "Since these are hardened languages with limited capabilities, they're supposed to be more

Published: 2024-11-25T16:54:00

The Hacker News

Researchers Uncover Malware Using BYOVD to Bypass Antivirus Protections

Cybersecurity researchers have uncovered a new malicious campaign that leverages a technique called Bring Your Own Vulnerable Driver (BYOVD) to disarm security protections and ultimately gain access to the infected system. "This malware takes a more sinister route: it drops a legitimate Avast Anti-Rootkit driver (aswArPot.sys) and manipulates it to carry out its destructive agenda," Trellix

Published: 2024-11-25T14:46:00

The Hacker News

Google Exposes GLASSBRIDGE: A Pro-China Influence Network of Fake News Sites

Government agencies and non-governmental organizations in the United States have become the target of a nascent China state threat actor known as Storm-2077. The adversary, believed to be active since at least January 2024, has also conducted cyber attacks against the Defense Industrial Base (DIB), aviation, telecommunications, and financial and legal services across the world, Microsoft said.

Published: 2024-11-23T17:40:00

The Hacker News

North Korean Hackers Steal $10M with AI-Driven Scams and Malware on LinkedIn

The North Korea-linked threat actor known as Sapphire Sleet is estimated to have stolen more than $10 million worth of cryptocurrency as part of social engineering campaigns orchestrated over a six-month period. These findings come from Microsoft, which said that multiple threat activity clusters with ties to the country have been observed creating fake profiles on LinkedIn, posing as both

Published: 2024-11-23T17:23:00

The Hacker News

APT-K-47 Uses Hajj-Themed Lures to Deliver Advanced Asyncshell Malware

The threat actor known as Mysterious Elephant has been observed using an advanced version of malware called Asyncshell. The attack campaign is said to have used Hajj-themed lures to trick victims into executing a malicious payload under the guise of a Microsoft Compiled HTML Help (CHM) file, the Knownsec 404 team said in an analysis published today. Mysterious Elephant, which is also known as

Published: 2024-11-22T22:29:00

The Hacker News

Russian Hackers Deploy HATVIBE and CHERRYSPY Malware Across Europe and Asia

Threat actors with ties to Russia have been linked to a cyber espionage campaign aimed at organizations in Central Asia, East Asia, and Europe. Recorded Future's Insikt Group, which has assigned the activity cluster the name TAG-110, said it overlaps with a threat group tracked by the Computer Emergency Response Team of Ukraine (CERT-UA) as UAC-0063, which, in turn, overlaps with APT28. The

Published: 2024-11-22T22:29:00

The Hacker News

China-Linked TAG-112 Targets Tibetan Media with Cobalt Strike Espionage Campaign

A China-linked nation-state group called TAG-112 compromised Tibetan media and university websites in a new cyber espionage campaign designed to facilitate the delivery of the Cobalt Strike post-exploitation toolkit for follow-on information collection. "The attackers embedded malicious JavaScript in these sites, which spoofed a TLS certificate error to trick visitors into downloading a

Published: 2024-11-22T22:17:00

The Hacker News

Unlocking Google Workspace Security: Are You Doing Enough to Protect Your Data?

Google Workspace has quickly become the productivity backbone for businesses worldwide, offering an all-in-one suite with email, cloud storage and collaboration tools. This single-platform approach makes it easy for teams to connect and work efficiently, no matter where they are, enabling seamless digital transformation that’s both scalable and adaptable. As companies shift from traditional,

Published: 2024-11-22T17:00:00

The Hacker News

Microsoft, Meta, and DOJ Disrupt Global Cybercrime and Fraudulent Networks

Meta Platforms, Microsoft, and the U.S. Department of Justice (DoJ) have announced independent actions to tackle cybercrime and disrupt services that enable scams, fraud, and phishing attacks. To that end, Microsoft's Digital Crimes Unit (DCU) said it seized 240 fraudulent websites associated with an Egypt-based cybercrime facilitator named Abanoub Nady (aka MRxC0DER and mrxc0derii), who

Published: 2024-11-22T15:07:00

The Hacker News

PyPI Attack: ChatGPT, Claude Impersonators Deliver JarkaStealer via Python Libraries

Cybersecurity researchers have discovered two malicious packages uploaded to the Python Package Index (PyPI) repository that impersonated popular artificial intelligence (AI) models like OpenAI ChatGPT and Anthropic Claude to deliver an information stealer called JarkaStealer. The packages, named gptplus and claudeai-eng, were uploaded by a user named "Xeroline" in November 2023, attracting

Published: 2024-11-22T11:45:00

The Hacker News

Warning: Over 2,000 Palo Alto Networks Devices Hacked in Ongoing Attack Campaign

As many as 2,000 Palo Alto Networks devices are estimated to have been compromised as part of a campaign abusing the newly disclosed security flaws that have come under active exploitation in the wild. According to statistics shared by the Shadowserver Foundation, a majority of the infections have been reported in the U.S. (554) and India (461), followed by Thailand (80), Mexico (48), Indonesia

Published: 2024-11-21T21:52:00

The Hacker News

Chinese APT Gelsemium Targets Linux Systems with New WolfsBane Backdoor

The China-aligned advanced persistent threat (APT) actor known as Gelsemium has been observed using a new Linux backdoor dubbed WolfsBane as part of cyber attacks likely targeting East and Southeast Asia. That's according to findings from cybersecurity firm ESET based on multiple Linux samples uploaded to the VirusTotal platform from Taiwan, the Philippines, and Singapore in March 2023.

Published: 2024-11-21T21:20:00

The Hacker News

10 Most Impactful PAM Use Cases for Enhancing Organizational Security

Privileged access management (PAM) plays a pivotal role in building a strong security strategy. PAM empowers you to significantly reduce cybersecurity risks, gain tighter control over privileged access, achieve regulatory compliance, and reduce the burden on your IT team. As an established provider of a PAM solution, we’ve witnessed firsthand how PAM transforms organizational security. In

Published: 2024-11-21T17:53:00

The Hacker News

North Korean Front Companies Impersonate U.S. IT Firms to Fund Missile Programs

Threat actors with ties to the Democratic People's Republic of Korea (DPRK) are impersonating U.S.-based software and technology consulting businesses in order to further their financial objectives as part of a broader information technology (IT) worker scheme. "Front companies, often based in China, Russia, Southeast Asia, and Africa, play a key role in masking the workers' true origins and

Published: 2024-11-21T17:34:00

The Hacker News

Cyber Story Time: The Boy Who Cried "Secure!"

As a relatively new security category, many security operators and executives I’ve met have asked us “What are these Automated Security Validation (ASV) tools?” We’ve covered that pretty extensively in the past, so today, instead of covering the “What is ASV?” I wanted to address the “Why ASV?” question. In this article, we’ll cover some common use cases and misconceptions of how people misuse

Published: 2024-11-21T17:00:00

The Hacker News

Over 145,000 Industrial Control Systems Across 175 Countries Found Exposed Online

New research has uncovered more than 145,000 internet-exposed Industrial Control Systems (ICS) across 175 countries, with the U.S. alone accounting for over one-third of the total exposures. The analysis, which comes from attack surface management company Censys, found that 38% of the devices are located in North America, 35.4% in Europe, 22.9% in Asia, 1.7% in Oceania, 1.2% in South America,

Published: 2024-11-21T16:30:00

The Hacker News

5 Scattered Spider Gang Members Indicted in Multi-Million Dollar Cybercrime Scheme

Five alleged members of the infamous Scattered Spider cybercrime crew have been indicted in the U.S. for targeting employees of companies across the country using social engineering techniques to harvest credentials and using them to gain unauthorized access to sensitive data and break into crypto accounts to steal digital assets worth millions of dollars. All of the accused parties have been

Published: 2024-11-21T14:46:00

The Hacker News

Google's AI-Powered OSS-Fuzz Tool Finds 26 Vulnerabilities in Open-Source Projects

Google has revealed that its AI-powered fuzzing tool, OSS-Fuzz, has been used to help identify 26 vulnerabilities in various open-source code repositories, including a medium-severity flaw in the OpenSSL cryptographic library. "These particular vulnerabilities represent a milestone for automated vulnerability finding: each was found with AI, using AI-generated and enhanced fuzz targets,"

Published: 2024-11-21T12:43:00

The Hacker News

NodeStealer Malware Targets Facebook Ad Accounts, Harvesting Credit Card Data

Threat hunters are warning about an updated version of the Python-based NodeStealer that's now equipped to extract more information from victims' Facebook Ads Manager accounts and harvest credit card data stored in web browsers. "They collect budget details of Facebook Ads Manager accounts of their victims, which might be a gateway for Facebook malvertisement," Netskope Threat Labs researcher

Published: 2024-11-21T12:04:00

The Hacker News

Ghost Tap: Hackers Exploiting NFCGate to Steal Funds via Mobile Payments

Threat actors are increasingly banking on a new technique that leverages near-field communication (NFC) to cash out victim's funds at scale. The technique, codenamed Ghost Tap by ThreatFabric, enables cybercriminals to cash-out money from stolen credit cards linked to mobile payment services such as Google Pay or Apple Pay and relaying NFC traffic. "Criminals can now misuse Google Pay and Apple

Published: 2024-11-20T18:39:00

The Hacker News

NHIs Are the Future of Cybersecurity: Meet NHIDR

The frequency and sophistication of modern cyberattacks are surging, making it increasingly challenging for organizations to protect sensitive data and critical infrastructure. When attackers compromise a non-human identity (NHI), they can swiftly exploit it to move laterally across systems, identifying vulnerabilities and compromising additional NHIs in minutes. While organizations often take

Published: 2024-11-20T17:00:00

The Hacker News

Decades-Old Security Vulnerabilities Found in Ubuntu's Needrestart Package

Multiple decade-old security vulnerabilities have been disclosed in the needrestart package installed by default in Ubuntu Server (since version 21.04) that could allow a local attacker to gain root privileges without requiring user interaction. The Qualys Threat Research Unit (TRU), which identified and reported the flaws early last month, said they are trivial to exploit, necessitating that

Published: 2024-11-20T14:46:00

The Hacker News

Microsoft Launches Windows Resiliency Initiative to Boost Security and System Integrity

Microsoft has announced a new Windows Resiliency Initiative as a way to improve security and reliability, as well as ensure that system integrity is not compromised. The idea, the tech giant said, is to avoid incidents like that of CrowdStrike's earlier this July, enable more apps and users to be run without admin privileges, add controls surrounding the use of unsafe apps and drivers, and offer

Published: 2024-11-20T12:30:00

The Hacker News

China-Backed Hackers Leverage SIGTRAN, GSM Protocols to Infiltrate Telecom Networks

A new China-linked cyber espionage group has been attributed as behind a series of targeted cyber attacks targeting telecommunications entities in South Asia and Africa since at least 2020 with the goal of enabling intelligence collection. Cybersecurity company CrowdStrike is tracking the adversary under the name Liminal Panda, describing it as possessing deep knowledge about telecommunications

Published: 2024-11-20T12:28:00

Security Affairs

Security Affairs newsletter Round 500 by Pierluigi Paganini INTERNATIONAL EDITION

A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. 15 SpyLoan Android apps found on Google Play had over 8 million installs Notorious ransomware programmer Mikhail Pavlovich […]

Published: 2024-12-01T12:37:14

Security Affairs

Hackers stole millions of dollars from Uganda Central Bank

Financially-motivated threat actors hacked Uganda ‘s central bank system, government officials confirmed this week. Ugandan officials confirmed on Thursday that the national central bank suffered a security breach by financially-motivated threat actors. The police’s Criminal Investigations Department and the Auditor General are investigating the incident. A senior government official at the finance ministry confirmed that […]

Published: 2024-12-01T00:49:07

Security Affairs

15 SpyLoan Android apps found on Google Play had over 8 million installs

McAfee researchers discovered 15 SpyLoan Android apps on Google Play with a combined total of over 8 million installs. 15 SpyLoan apps with a combined total of 8M+ installs were found on Google Play, targeting users in South America, Southeast Asia, and Africa. SpyLoan apps exploit social engineering to gain sensitive user data and excessive […]

Published: 2024-11-30T19:06:46

Security Affairs

Notorious ransomware programmer Mikhail Pavlovich Matveev arrested in Russia

Russian authorities arrested ransomware affiliate Mikhail Matveev, aka Wazawaka, for developing malware and ties to hacking groups. Russian authorities arrested a ransomware affiliate, Mikhail Pavlovich Matveev (also known as Wazawaka, Uhodiransomwar, m1x, and Boriselcin), and charged him for developing malware and his role in several hacking groups. The man was arrested in Kaliningrad, Russia, law […]

Published: 2024-11-30T07:29:57

Security Affairs

Phishing-as-a-Service Rockstar 2FA continues to be prevalent

Phishing tool Rockstar 2FA targets Microsoft 365 credentials, it uses adversary-in-the-middle (AitM) attacks to bypass multi-factor authentication. Trustwave researchers are monitoring malicious activity associated with Phishing-as-a-Service (PaaS) platforms, their latest report focuses on a toolkit called Rockstar 2FA. Rockstar 2FA targets Microsoft 365 accounts and bypasses multi-factor authentication with adversary-in-the-middle (AitM) attacks. In AiTM phishing, threat […]

Published: 2024-11-29T15:36:24

Security Affairs

Zello urges users to reset passwords following a cyber attack

Zello urges customers with accounts created before November 2 to reset passwords following a potential security breach. Zello is warning customers who have an account created before November 2 to reset their passwords, a circumstance that suggests that the incident took place on November 2. Zello is a tech software company in Austin, Texas, U.S., known for the […]

Published: 2024-11-29T00:23:57

Security Affairs

A cyberattack impacted operations at UK Wirral University Teaching Hospital

UK’s Wirral University Teaching Hospital suffered a cyberattack that caused delays in appointments and procedures. Wirral University Teaching Hospital NHS Foundation Trust (WUTH) is an NHS Foundation Trust. It provides healthcare for people of the Wirral Peninsula and the surrounding areas of North West England and North Wales. The trust is responsible for Arrowe Park […]

Published: 2024-11-28T15:53:50

Security Affairs

T-Mobile detected network intrusion attempts and blocked them

T-Mobile reported recent infiltration attempts but pointed out that threat actors had no access to its systems and no sensitive data was compromised. T-Mobile detected recent infiltration attempts but confirmed no unauthorized system access occurred, and no sensitive data was compromised. The carrier is investigating reports that are linking it to “Salt Typhoon” cyberattacks tied […]

Published: 2024-11-28T14:20:07

Security Affairs

ProjectSend critical flaw actively exploited in the wild, experts warn

Researchers warn that a critical security flaw in ProjectSend open-source file-sharing application may be under active exploitation. VulnCheck researchers warn that ProjectSend vulnerability CVE-2024-11680 (CVSS score: 9.8) appears to have been exploited by attackers in the wild. The vulnerability is an improper authentication issue that impacts ProjectSend versions before r1720. Remote, unauthenticated attackers can exploit this flaw […]

Published: 2024-11-28T07:28:00

Security Affairs

Bootkitty is the first UEFI Bootkit designed for Linux systems

ESET discovered the first Unified Extensible Firmware Interface (UEFI) bootkit specifically designed for Linux systems, named Bootkitty. Cybersecurity researchers from ESET discovered the first UEFI bootkit designed to target Linux systems, called by its authors Bootkitty. The bootkit allows attackers to disable the kernel’s signature verification feature and to preload two as yet unknown ELF […]

Published: 2024-11-27T21:01:19

News Packet Storm

US Senators Propose Law To Require Bare Minimum Security Standards

Telco Engineer Who Spied On Employer For Beijing Gets 4 Years

New York Fines GEICO And Travelers $11.3 Million In Data Breach Cases

Russian APT Chained Firefox and Windows Zero-Days Against US and European Targets

Feds Seek To Grill Kansas City Man With Hacking Charges

ProjectSend Vulnerability Exploited In The Wild

Source Code Of macOS Banshee Stealer Leaked

CyberVolk Analysis Explores Ransomware, Hacktivism Connections

The Workplace Has Become A Surveillance State

Russian Cyberspies Hacked Building Across Street From Target For W-Fi Attack

Cyberattacks Cost British Businesses $55 Billion In Past 5 Years

How The ZX Spectrum Became A 1980s Icon

China Has Pwned Thousands And Thousands Of Telco Devices

Here's What Happens If You Don't Layer Network Security Or Remove Unused Web Shells

Helpline For Yakuza Victims Fears It Leaked Their Personal Info

US Takes Down Stolen Credit Card Marketplace PopeyeTools

Microsoft Disrupts ONNX Phishing Service, Names Its Operator

Google's AI Powered Fuzzing Tool Discovers 26 New Vulns

Russian Women Stepping Up For Cybercrime Outfits

Five Scattered Spider Suspects Indicted For Phishing And Heists

Put Your Username And Passwords In Your Will, Advises Japan's Government

Ubuntu Affected By 10-Year-Old Flaws In needrestart Package

FBI And CISA Warn Of Continued Cyberattacks On US Telecoms

MITRE Updates List Of 25 Most Dangerous Software Vulnerabilities

North Korean Hackers Behind 2019 $42 Million Ethereum Heist

SecurityWeek

In Other News: OPPC Breach Impacts 1.7M, US Soldier Suspected in Snowflake Hack, Cloudflare Loses LogsIndustry Moves for the week of November 25, 2024 - SecurityWeek

T-Mobile Shares More Information on China-Linked Cyberattack

Microsoft Patches Exploited Vulnerability in Partner Network Website

ESET Flags Prototype UEFI Bootkit Targeting Linux

Source Code of $3,000-a-Month macOS Malware ‘Banshee Stealer’ Leaked

ProjectSend Vulnerability Exploited in the Wild

Bipartisan Legislation Seeks Stronger Healthcare Cybersecurity

New VPN Attack Demonstrated Against Palo Alto Networks, SonicWall Products

Russian APT Chained Firefox and Windows Zero-Days Against US and European Targets

Interpol Clamps Down on Cybercrime and Arrests Over 1,000 Suspects in Africa

CISA News

CISA Releases Venue Guide for Security Considerations

CISA Launches New Learning Platform to Enhance Training and Education U.S. Veterans and Other Stakeholders

Joint Statement from FBI and CISA on the People's Republic of China (PRC) Targeting of Commercial Telecommunications Infrastructure

CISA Kicks Off Critical Infrastructure Security and Resilience Month 2024

Statement from CISA Director Easterly on the Security of the 2024 Elections

Joint ODNI, FBI, and CISA Statement

Joint Statement from CISA and EAC in Support of State and Local Election Officials

Joint ODNI, FBI, and CISA Statement on Russian Election Influence Efforts

CISA Releases Its First Ever International Strategic Plan

CISA Launches #PROTECT2024 Election Threat Updates Webpage

CISA Blog

Shop Safely Online This Holiday Season with Tips from Secure Our World

AI Red Teaming: Applying Software TEVV for AI Evaluations

New Resilient Power Guidance Added to the CISA Resilient Toolkit Portal

USDA Stops Credential Phishing with FIDO Authentication

CISA’s Vulnerability Management goes “Big” on Interns and the Results are Staggering!

CISA’s ScubaGear Tool Improves Security for Organizations Using M365 and Surpasses 30,000 Downloads

Engaging with Security Researchers: Embracing a “See Something, Say Something” Culture

A Message to Election Officials from CISA Director Jen Easterly

Region 8 Invites You to Secure Our World

CISA Director Jen Easterly Remarks at the Election Center 39th Annual National Conference in Detroit

All CISA Advisories

Hitachi Energy MicroSCADA Pro/X SYS600

Schneider Electric EcoStruxure Control Expert, EcoStruxure Process Expert, and Modicon M340, M580 and M580 Safety PLCs

Schneider Electric PowerLogic PM55xx and PowerLogic PM8ECC

Schneider Electric PowerLogic P5

Hitachi Energy RTU500 Scripting Interface

CISA Releases Six Industrial Control Systems Advisories

CISA Adds One Known Exploited Vulnerability to Catalog

OSCAT Basic Library

Schneider Electric Modicon M340, MC80, and Momentum Unity M1E

CISA Releases Seven Industrial Control Systems Advisories

Schneider Electric PowerLogic PM5300 Series

Automated Logic WebCTRL Premium Server

CISA Adds Three Known Exploited Vulnerabilities to Catalog

mySCADA myPRO Manager

CISA Releases Insights from Red Team Assessment of a U.S. Critical Infrastructure Sector Organization

Schneider Electric EcoStruxure IT Gateway

Schneider Electric Modicon M340, MC80, and Momentum Unity M1E

Enhancing Cyber Resilience: Insights from CISA Red Team Assessment of a US Critical Infrastructure Sector Organization

2024 CWE Top 25 Most Dangerous Software Weaknesses

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA and Partners Release Update to BianLian Ransomware Cybersecurity Advisory

USDA Releases Success Story Detailing the Implementation of Phishing-Resistant Multi-Factor Authentication

Apple Releases Security Updates for Multiple Products

Mitsubishi Electric MELSEC iQ-F Series

CISA Releases One Industrial Control Systems Advisory

CISA Adds Three Known Exploited Vulnerabilities to Catalog

Siemens SIPORT

Siemens SINEC NMS

Siemens Solid Edge

CISA Adds Two Known Exploited Vulnerabilities to Catalog

Exploit-DB.com RSS Feed

[webapps] SOPlanning 1.52.01 (Simple Online Planning Tool) - Remote Code Execution (RCE) (Authenticated)

[webapps] reNgine 2.2.0 - Command Injection (Authenticated)

[webapps] openSIS 9.1 - SQLi (Authenticated)

[webapps] dizqueTV 1.5.3 - Remote Code Execution (RCE)

[webapps] NoteMark < 0.13.0 - Stored XSS

[webapps] Gitea 1.22.0 - Stored XSS

[webapps] Invesalius3 - Remote Code Execution

[dos] Windows TCP/IP - RCE Checker and Denial of Service

[webapps] Aurba 501 - Authenticated RCE

[webapps] HughesNet HT2000W Satellite Modem - Password Reset

[webapps] Elber Wayber Analog/Digital Audio STL 4.00 - Device Config Disclosure

[webapps] Elber Wayber Analog/Digital Audio STL 4.00 - Authentication Bypass

[webapps] Elber ESE DVB-S/S2 Satellite Receiver 1.5.x - Device Config

[webapps] Elber ESE DVB-S/S2 Satellite Receiver 1.5.x - Authentication Bypass

[webapps] Helpdeskz v2.0.2 - Stored XSS

[webapps] Calibre-web 0.6.21 - Stored XSS

[webapps] Devika v1 - Path Traversal via 'snapshot_path'

[local] Genexus Protection Server 9.7.2.10 - 'protsrvservice' Unquoted Service Path

[local] SolarWinds Kiwi Syslog Server 9.6.7.1 - Unquoted Service Path

[local] Oracle Database 12c Release 1 - Unquoted Service Path

[webapps] Ivanti vADC 9.9 - Authentication Bypass

[local] Bonjour Service 'mDNSResponder.exe' - Unquoted Service Path Privilege Escalation

[webapps] Xhibiter NFT Marketplace 1.10.2 - SQL Injection

[webapps] Azon Dominator Affiliate Marketing Script - SQL Injection

[webapps] Microweber 2.0.15 - Stored XSS

[webapps] Customer Support System 1.0 - Stored XSS

[webapps] Automad 2.0.0-alpha.4 - Stored Cross-Site Scripting (XSS)

[webapps] SolarWinds Platform 2024.1 SR1 - Race Condition

[webapps] Flatboard 3.2 - Stored Cross-Site Scripting (XSS) (Authenticated)

[webapps] Poultry Farm Management System v1.0 - Remote Code Execution (RCE)

[webapps] Boelter Blue System Management 1.3 - SQL Injection

[webapps] WP-UserOnline 2.88.0 - Stored Cross Site Scripting (XSS) (Authenticated)

[webapps] PHP < 8.3.8 - Remote Code Execution (Unauthenticated) (Windows)

[webapps] AEGON LIFE v1.0 Life Insurance Management System - SQL injection vulnerability.

[webapps] XMB 1.9.12.06 - Stored XSS

[webapps] Carbon Forum 5.9.0 - Stored XSS

[webapps] AEGON LIFE v1.0 Life Insurance Management System - Stored cross-site scripting (XSS)

[webapps] appRain CMF 4.0.5 - Remote Code Execution (RCE) (Authenticated)

[webapps] CMSimple 5.15 - Remote Code Execution (RCE) (Authenticated)

[webapps] WBCE CMS v1.6.2 - Remote Code Execution (RCE)

[webapps] Monstra CMS 3.0.4 - Remote Code Execution (RCE)

[webapps] Dotclear 2.29 - Remote Code Execution (RCE)

[webapps] Serendipity 2.5.0 - Remote Code Execution (RCE)

[webapps] Sitefinity 15.0 - Cross-Site Scripting (XSS)

[webapps] FreePBX 16 - Remote Code Execution (RCE) (Authenticated)

[webapps] Akaunting 3.1.8 - Server-Side Template Injection (SSTI)

[webapps] Check Point Security Gateway - Information Disclosure (Unauthenticated)

[webapps] Aquatronica Control System 5.1.6 - Information Disclosure

[webapps] changedetection < 0.45.20 - Remote Code Execution (RCE)

[webapps] ElkArte Forum 1.1.9 - Remote Code Execution (RCE) (Authenticated)

Full Disclosure

SEC Consult SA-20241127-0 :: Stored Cross-Site Scripting in Omada Identity (CVE-2024-52951)

SEC Consult SA-20241125-0 :: Unlocked JTAG interface and buffer overflow in Siemens SM-2558 Protocol Element, Siemens CP-2016 & CP-2019

Re: Local Privilege Escalations in needrestart

APPLE-SA-11-19-2024-5 macOS Sequoia 15.1.1

Local Privilege Escalations in needrestart

APPLE-SA-11-19-2024-4 iOS 17.7.2 and iPadOS 17.7.2

APPLE-SA-11-19-2024-3 iOS 18.1.1 and iPadOS 18.1.1

APPLE-SA-11-19-2024-2 visionOS 2.1.1

APPLE-SA-11-19-2024-1 Safari 18.1.1

Reflected XSS - fronsetiav1.1

XXE OOB - fronsetiav1.1

St. Poelten UAS | Path Traversal in Korenix JetPort 5601

St. Poelten UAS | Multiple Stored Cross-Site Scripting in SEH utnserver Pro

Apple web content filter bypass allows unrestricted access to blocked content (macOS/iOS/iPadOS/visionOS/watchOS)

SEC Consult SA-20241112-0 :: Multiple vulnerabilities in Siemens Energy Omnivise T3000 (CVE-2024-38876, CVE-2024-38877, CVE-2024-38878, CVE-2024-38879)

Open Source Security

Re: Linux: Race can lead to UAF in net/bluetooth/sco.c: sco_sock_connect()

Re: Local Privilege Escalations in needrestart

Re: Linux: Race can lead to UAF in net/bluetooth/sco.c: sco_sock_connect()

stalld: unpatched fixed temporary file use and other issues

Re: tuned: local root exploit in D-Bus method instance_create and other issues in tuned >= 2.23 (CVE-2024-52336, CVE-2024-52337)

Linux: Race can lead to UAF in net/bluetooth/sco.c: sco_sock_connect()

CVE-2024-52338: Apache Arrow R package: Arbitrary code execution when loading a malicious data file

Re: tuned: local root exploit in D-Bus method instance_create and other issues in tuned >= 2.23 (CVE-2024-52336, CVE-2024-52337)

tuned: local root exploit in D-Bus method instance_create and other issues in tuned >= 2.23 (CVE-2024-52336, CVE-2024-52337)

Multiple vulnerabilities in Jenkins and Jenkins plugins

WebKitGTK and WPE WebKit Security Advisory WSA-2024-0007

Today's cybersecurity headlines are brought to you by ThreatPerspective