4172 matches found
Zero-Click iPhone Exploits
Citizen Lab is reporting on two zero-click iMessage exploits, in spyware sold by the cyberweapons arms manufacturer NSO Group to the Bahraini government. These are particularly scary exploits, since they dont require to victim to do anything, like click on a link or open a file. The victim receiv...
Microsoft, Google to Invest $30 Billion in Cybersecurity Over Next 5 Years
Google and Microsoft said they are pledging to invest a total of $30 billion in cybersecurity advancements over the next five years, as the U.S. government partners with private sector companies to address threats facing the country in the wake of a string of sophisticated malicious cyber activit...
US government and private sector agree to invest time, money in cybersecurity
In the wake of several high-profile ransomware attacks against critical infrastructure and major organizations in the last few months, President Biden met with private sector and education leaders to discuss a whole-of-nation effort needed to address cybersecurity threats and bolster the nation’s...
joondalup.wa.gov.au Cross Site Scripting vulnerability OBB-2127022
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2021-23031
creationtimestamp| type| source ---|---|--- 2021-08-26 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=636 2021-08-26 11:47:18+00:00| published-proof-of-concept| https://t.me/CyberSecurityIL/4999 2021-08-29 12:28:19+00:00| seen| https://t.me/CyberGovIL/1320 2021-09-14...
CVE-2021-32648
octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5. Recent...
Surveillance of the Internet Backbone
Vice has an article about how data brokers sell access to the Internet backbone. This is netflow data. Its useful for cybersecurity forensics, but can also be used for things like tracing VPN activity. At a high level, netflow data creates a picture of traffic flow and volume across a network. It...
All Vulnerabilities for fis.sandwell.gov.uk Patched via Open Bug Bounty
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| fis.sandwell.gov.uk ---|--- Open Bug...
Exploitation of Pulse Connect Secure Vulnerabilities
Summary The Cybersecurity and Infrastructure Security Agency CISA is aware of compromises affecting a number of U.S. government agencies, critical infrastructure entities, and other private sector organizations by a cyber threat actor—or actors—beginning in June 2020 or earlier related to...
cyprus.gov.cy Cross Site Scripting vulnerability OBB-2123064
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
InkySquid State Actor Exploiting Known IE Bugs
The InkySquid advanced persistent threat APT group, which researchers have linked to the North Korean government, was caught launching watering hole attacks against a South Korean newspaper using known Internet Explorer vulnerabilities. New analysis from Volexity reported its team of researchers...
HolesWarm Malware Exploits Unpatched Windows, Linux Servers
By leveraging more than 20 known vulnerabilities in Linux and Windows servers, the HolesWarm cryptominer malware has been able to break into more than 1,000 cloud hosts just since June. The basic cryptominer botnet has been so successful at juggling so many different known vulnerabilities between...
US Govt’s secret terrorist watchlist with 2M records exposed online
By Waqas The watchlist was exposed on a misconfigured server hosted on a Bahrain IP address instead of a US one. This is a post from HackRead.com Read the original post: US Govts secret terrorist watchlist with 2M records exposed online...
IT threat evolution Q2 2021
Targeted attacks The leap of a Cycldek-related threat actor It is quite common for Chinese-speaking threat actors to share tools and methodologies: one such example is the infamous "DLL side-loading triad": a legitimate executable, a malicious DLL to be side-loaded by it and an encoded payload,...
Auditors: Feds’ Cybersecurity Gets the Dunce Cap
Out of eight U.S. federal agencies identified two years ago with critical cybersecurity failures, seven still don’t meet basic standards, a new audit report found. The Federal government’s overall posture was given just a C-. Audited agencies included the Departments of State, Homeland Security,...
Lead generation firm exposed household data of 63 million Americans
By Waqas The data leak contains email addresses with .gov suffixes or indicated that the user worked for New York Police Department. This is a post from HackRead.com Read the original post: Lead generation firm exposed household data of 63 million Americans...
The Ransomware Task Force: A New Approach to Fighting Ransomware
In the past few months, we’ve seen ransomware attacks shut down healthcare across Ireland, fuel delivery across parts of the US, and meat processing across Australia, Canada and the US. We’ve seen demands of payments in the tens of millions of dollars. We’re also continuing to see trends around...
Smart car chargers. Plug-n-play for hackers?
Over the last 18 months, we’ve been investigating the security of smart electric vehicle chargers. These allow the owner to remotely monitor and manage the charge state, speed and timing of their car charger, among many functions. We bought 6 different brands of chargers and also reviewed securit...
Israeli Government Agencies Visit NSO Group Offices
UPDATE Authorities from multiple agencies of the Israeli government paid a visit the offices of the NSO Group as part of a new investigation into claims that the secretive firm is selling its spyware to threat actors for targeted attacks, according to the Israeli Ministry of Defense. A single twe...
Cutting the Red Tape: Lessons Learned from CyberThreats 2021
If I had a dollar for every time I heard the phrase "digital transformation," I would have a lot of dollars. I'm sure you would too. We'd have even more if we counted the term "Zero Trust." Maybe we should start counting them, now that I think about it! Speakers and authors often use these buzz...