Police investigate sexual assault on an avatar

British police are investigating a case involving a virtual sexual assault of a girls avatar. Even though there was no physical violence involved the incident will be investigated as it has caused psychological trauma. By definition, an avatar is a virtual representation of a user and is driven b...

CVE-2023-34323

CVE-2023-34323 affects the Xen stored component (C Xenstored). The issue arises when a transaction is committed: quota is checked, but some builds assume quota cannot be negative and use assert(), causing a crash if -DNDEBUG is not defined. Public details label the impact as local, with low privi...

Russian Hackers Had Covert Access to Ukraine's Telecom Giant for Months

Ukrainian cybersecurity authorities have disclosed that the Russian state-sponsored threat actor known as Sandworm was inside telecom operator Kyivstar's systems at least since May 2023. The development was first reported by Reuters. The incident, described as a "powerful hacker attack," first ca...

Rapid7 Recognized by Newsweek as one of ‘America’s Greatest Workplaces for Diversity for 2024’.

On December 13th, Newsweek Magazine published their list of ‘America’s Greatest Workplaces for Diversity for 2024’. Like many companies today, Rapid7 recognizes the positive impact diversity plays in driving organizational success, attracting and retaining exceptional talent, and creating positiv...

Attacks, Vulnerabilities and Actors 25 December to 31 December 2023

For a detailed threat digest, download the pdf file here Summary HiveForce Labs has recently made several significant discoveries related to cybersecurity threats. Over the past week, we identified a total of eight executed attacks, four instances of adversary activity, and five exploited...

X Account of Google Cybersecurity Firm Mandiant Hacked in Crypto Scam

By Waqas The hackers changed Mandiant's Twitter handle from "@Mandiant" to "@phantomsolw." This is a post from HackRead.com Read the original post: X Account of Google Cybersecurity Firm Mandiant Hacked in Crypto Scam...

DOJ Slams XCast with $10 Million Fine Over Massive Illegal Robocall Operation

The U.S. Department of Justice DoJ on Tuesday said it reached a settlement with VoIP service provider XCast over allegations that it facilitated illegal telemarketing campaigns since at least January 2018, in contravention of the Telemarketing Sales Rule TSR. In addition to prohibiting the compan...

CVE-2023-50350

CVE-2023-50350 affects HCL DRYiCE MyXalytics and is linked to the use of a broken cryptographic algorithm for encryption, potentially allowing an attacker to decrypt sensitive information. Affected component is the encryption implementation; the root cause is the cryptographic weakness described ...

TOTOLINK EX1800T setNtpCfg Interface Command Execution Vulnerability

The TOTOLINK EX1800T is a Wi-Fi range extender from China's Gion Electronics TOTOLINK. A command execution vulnerability exists in the TOTOLINK EX1800T setNtpCfg interface. The vulnerability stems from the failure of the tz parameter of the setNtpCfg interface of cstecgi .cgi to properly filter...

DNA data deserves better, with Suzanne Bernstein: Lock and Code S05E01

This week on the Lock and Code podcast… Hackers want to know everything about you: Your credit card number, your ID and passport info, and now, your DNA. On October 1 2023, on a hacking website called BreachForums, a group of cybercriminals claimed that they had stolen—and would soon...

Researchers Crack Tesla Autopilot with ‘Elon Mode,’ Access Critical Data

By Deeba Ahmed German cybersecurity researchers from Technische Universität Berlin employed a €600 £520 - $660 tool to gain root access to the ARM64-based circuit board of Tesla's autopilot. This is a post from HackRead.com Read the original post: Researchers Crack Tesla Autopilot with Elon Mode,...

CVE-2023-6113

CVE-2023-6113 affects WP STAGING WordPress Backup Plugin <3.1.3 and WP STAGING Pro

New Terrapin Flaw Could Let Attackers Downgrade SSH Protocol Security

Security researchers from Ruhr University Bochum have discovered a vulnerability in the Secure Shell SSH cryptographic network protocol that could allow an attacker to downgrade the connection's security by breaking the integrity of the secure channel. Called Terrapin CVE-2023-48795, CVSS score:...

Beware: Scam-as-a-Service Aiding Cybercriminals in Crypto Wallet-Draining Attacks

Cybersecurity researchers are warning about an increase in phishing attacks that are capable of draining cryptocurrency wallets. "These threats are unique in their approach, targeting a wide range of blockchain networks, from Ethereum and Binance Smart Chain to Polygon, Avalanche, and almost 20...

Happy 14th Birthday, KrebsOnSecurity!

KrebsOnSecurity celebrates its 14th year of existence today! I promised myself this post wouldnt devolve into yet another Cybersecurity Year in Review. Nor do I wish to hold forth about whatever cyber horrors may await us in 2024. But I do want to thank you all for your continued readership,...

Albanian Parliament and One Albania Telecom Hit by Cyber Attacks

The Assembly of the Republic of Albania and telecom company One Albania have been targeted by cyber attacks, the country's National Authority for Electronic Certification and Cyber Security AKCESK revealed this week. "These infrastructures, under the legislation in force, are not currently...

Barracuda Fixes ACE Zero-day Vulnerability Exploited by Attackers

Summary: The Barracuda Email Security Gateway vulnerability CVE-2023-7102 allows remote attackers to execute arbitrary commands, posing a substantial threat to the security and functionality of affected systems. Exploitation by threat actors has led to the deployment of new malware variants,...

Mastering Industrial Cybersecurity: The Significance of Combining Vulnerability Management with Detection and Response

Written by Elad Ben-Meir, CEO SCADAfence, a Honeywell company. In today's digital era, where industries are increasingly reliant on advanced technologies, safeguarding critical infrastructure against cyber threats has become paramount. The convergence of operational technology OT and information...

Mastering Industrial Cybersecurity: The Significance of Combining Vulnerability Management with Detection and Response

Written by Elad Ben-Meir, CEO SCADAfence, a Honeywell company. In today's digital era, where industries are increasingly reliant on advanced technologies, safeguarding critical infrastructure against cyber threats has become paramount. The convergence of operational technology OT and information...

Top 20 Most Popular Hacking Tools in 2023

As last year, this year we made a ranking with the most popular tools between January and December 2023. The tools of this year encompass a diverse range of cybersecurity disciplines, including AI-Enhanced Penetration Testing, Advanced Vulnerability Management, Stealth Communication Techniques,...