Air-Gapped Devices Can Send Covert Morse Signals via Network Card LEDs

A security researcher who has a long line of work demonstrating novel data exfiltration methods from air-gapped systems has come up with yet another technique that involves sending Morse code signals via LEDs on network interface cards NICs. The approach, codenamed ETHERLED, comes from Dr...

CVE-2022-29964

The Emerson DeltaV Distributed Control System DCS controllers and IO cards through 2022-04-29 misuse passwords. WIOC SSH provides access to a shell as root, DeltaV, or backup via hardcoded credentials. NOTE: this is different from CVE-2014-2350...

CVE-2022-29964

The Emerson DeltaV Distributed Control System DCS controllers and IO cards through 2022-04-29 misuse passwords. WIOC SSH provides access to a shell as root, DeltaV, or backup via hardcoded credentials. NOTE: this is different from CVE-2014-2350...

CVE-2022-29965

The Emerson DeltaV Distributed Control System DCS controllers and IO cards through 2022-04-29 misuse passwords. Access to privileged operations on the maintenance port TELNET interface 23/TCP on M-series and SIS CSLS/LSNB/LSNG nodes is controlled by means of utility passwords. These passwords are...

Hardcoded credentials

The Emerson DeltaV Distributed Control System DCS controllers and IO cards through 2022-04-29 misuse passwords. WIOC SSH provides access to a shell as root, DeltaV, or backup via hardcoded credentials. NOTE: this is different from CVE-2014-2350...

CVE-2022-29962

CVE-2022-29962 affects Emerson DeltaV DCS controllers and IO cards (S-series, P-series, CIOC/EIOC) with hardcoded FTP credentials used up to 2022-04-29. The issue stems from misuse of passwords and an FTP service that may be disabled in production; the CVSSv3.1 vector indicates local access, low ...

CVE-2022-29964

The Emerson DeltaV Distributed Control System DCS controllers and IO cards through 2022-04-29 misuse passwords. WIOC SSH provides access to a shell as root, DeltaV, or backup via hardcoded credentials. NOTE: this is different from CVE-2014-2350...

CVE-2022-29963

Emerson DeltaV DCS and IO cards (S-series, P-series, CIOC/EIOC) up to 2022-04-29 are affected by CVE-2022-29963 due to hardcoded passwords enabling TELNET access on port 18550, yielding a root shell on vulnerable nodes. Root cause: misuse of passwords with static credentials. Impact is local (L) ...

CVE-2022-29964

Summary of the CVE-2022-29964 family (Emerson DeltaV DCS): The vulnerabilities involve misuse of passwords in DeltaV controllers and IO cards up to 2022-04-29. Specifically, WIOC SSH provides a root/DeltaV/backup shell via hardcoded credentials, enabling local access. The issue affects S-series, ...

The vulnerability of the implementation of the VPLS operating system Cisco IOS on Cisco Catalyst 6800 series switches allows a intruder to cause service interruptions.

The vulnerability of the VPLS operating system Cisco IOS implemented on Cisco Catalyst 6800 series switches is related to resource management errors. Exploiting this vulnerability allows a malicious actor to cause failures in the C6800-16P10G or C6800-16P10G-XL line cards, leading to service...

Teradici Management Console 安全漏洞

Teradici Management Console is a management console from Teradici Canada Inc. It enables IT administrators to easily manage, monitor and scale PCoIP Zero Clients and Remote Workstation Cards in their deployments. A security vulnerability exists in Teradici Management Console version 2.2.0 that...

Malicious code in uitk-react-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9965bbd837fd0acf75ec3df445f665c925c79dfccaa53f0ac34b59b933ab2011 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6762 Malicious code in uitk-react-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9965bbd837fd0acf75ec3df445f665c925c79dfccaa53f0ac34b59b933ab2011 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in adaptivecards-designer-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 856c233e2f24035efd8d882b600a5c0242af1ed5eea2fda4eca7f5cad6d01e6c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Hacking Tesla’s Remote Key Cards

Interesting vulnerability in Teslas NFC key cards: Martin Herfurt, a security researcher in Austria, quickly noticed something odd about the new feature: Not only did it allow the car to automatically start within 130 seconds of being unlocked with the NFC card, but it also put the car in a state...

CVE-2022-30740

Improper auto-fill algorithm in Samsung Internet prior to version 17.0.1.69 allows physical attackers to guess stored credit card numbers...

New York Man Sentenced to 4 Years in Transnational Cybercrime Scheme

A 37-year-old man from New York has been sentenced to four years in prison for buying stolen credit card information and working in cahoots with a cybercrime cartel known as the Infraud Organization. John Telusma, who went by the alias "Peterelliot," had previously pleaded guilty to one count of...

Update now! Nvidia released fixes for 10 flaws in Windows GPU drivers

Multiple NVIDIA graphic card models have been found to have flaws in their GPU drivers, with six medium-and four high-severity ratings. Last Monday, the company released a software security update for NVIDIA GPU Display Driver to address the vulnerabilities. If exploited, they could lead to denia...

How iPhones can run malware even when they’re off

Most people think that turning off their iPhone - or letting the battery die - means that the phone is, well, off. The thing is, this isnt quite true. In reality, most of the phones functionality has ended, but there are components that mindlessly continue a zombie-like existence, for the most pa...

A week in security (May 9 – 15)

Last week on Malwarebytes Labs: How to spot the signs of a virtual kidnap scam Virtual credit cards coming to Chrome: What you need to know Clearview AI banned from selling facial recognition data in the US Cyberattacks on SATCOM networks attributed to Russian threat actors F5 BIG-IP vulnerabilit...