January 24, 2018 – Morning Cyber Coffee Headlines – “Taco” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! January 24, 2018 - Headlines Carbon Black in the News: Amazon Web Services Buys...

Nearly Half of the Norway Population Exposed in HealthCare Data Breach

Cybercriminals have stolen a massive trove of Norway's healthcare data in a recent data breach, which likely impacts more than half of the nation's population. An unknown hacker or group of hackers managed to breach the systems of Health South-East Regional Health Authority RHF and reportedly...

Infographic: Cyberattacks by the Numbers

As the calendar shifted from December 2016 to January 2017, the prospect of a large-scale cyberattack loomed. Questions over the possible hacking of the 2016 U.S. presidential election swirled and businesses faced a growing attack vector in ransomware. In 2016, ransomware was estimated to be an...

This Week in Security News: Hackers and Ransoms

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, we saw discussion on the ransomware attacks plaguing institutions in the New Year, and emerging malware targeting Meltdown/Spectre patches...

OnePlus confirms up to 40,000 customers affected by Credit Card Breach

OnePlus has finally confirmed that its online payment system was breached, following several complaints of fraudulent credit card transactions from its customers who made purchases on the company's official website. In a statement released today, Chinese smartphone manufacturer admitted that cred...

CVE-2018-2660

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure component of Oracle Financial Services Applications subcomponent: Core. Supported versions that are affected are 7.3.5.x and 8.0.x. Easily exploitable vulnerability allows low privileged attacker with network...

CVE-2018-2577

CVE-2018-2577 affects Oracle Solaris (Kernel subcomponent) in the Solaris component of the Sun Systems Products Suite, for the 11.3 release. The vulnerability is local: a low-privilege attacker with logon can compromise Solaris, potentially gaining unauthorized access to all Solaris-accessible da...

CVE-2018-2637

CVE-2018-2637 affects the OpenJDK/OpenJDK JMX component (SingleEntryRegistry deserialization filter). A remote, unauthenticated attacker could exploit improper deserialization filter setup to bypass deserialization restrictions. Multiple advisories (ALAS-2018-949; CentOS/DSA entries; Debian secur...

CVE-2018-2709

CVE-2018-2709 affects the Oracle Banking Corporate Lending Core module of Oracle Financial Services Applications , with impacted versions 12.3.0 and 12.4.0 . The vulnerability allows a low-privileged attacker with network access via HTTP to compromise data confidentiality, per CVSSv3.0 base score...

CVE-2018-2673

CVE-2018-2673 affects the Oracle Hospitality Simphony component (POS) and is listed against Oracle Hospitality Applications. Affected versions are 2.7, 2.8, and 2.9. The vulnerability is described as difficult to exploit but allows an unauthenticated attacker with network access via HTTP to compr...

OnePlus Site’s Payment System Reportedly Hacked to Steal Credit Card Details

This year's first bad news for OnePlus users—a large number of OnePlus customers are reporting of fraudulent credit card transactions after buying products from the Chinese smartphone manufacturer's official online store. The claim initially surfaced on the OnePlus support forum over the weekend...

Alleged creator of Fruitfly indicted for 13 years of spying

Way back at the start of last year, we took a look at something called Fruitfly, a Mac backdoor using old code that had been around for a long time and could deep breath upload files to computers, record images and video, snoop around in victims' information, take screenshots, and also log...

How to disrupt attacks caused by social engineering

This post is authored by Milad Aslaner, Senior Program Manager, Windows & Devices Group. A decade ago, most cyber-attacks started with a piece of malware or a complex method to directly attack the infrastructure of a company. But this picture has changed and today all it takes is a sophisticated...

Private Details of 240,000 DHS Employees Accessed after Data Breach

By Uzair Amir A data breach targeted towards the Department of Homeland Security This is a post from HackRead.com Read the original post: Private Details of 240,000 DHS Employees Accessed after Data Breach...

January 4, 2017 – Morning Cyber Coffee Headlines – “Scrabble” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! January 4, 2018 - Headlines Carbon Black in the News: Ransomware: The Problem...

Three Reasons Why GDPR Encourages Pseudonymization

The General Data Protection Regulation GDPR is the European Union’s new data regulation designed to provide individuals with rights and protections over their personal data that is collected or created by businesses or government entities. It unifies data protection regulation across all member...

Intel In Security Hot Seat Over Reported CPU Design Flaw

UPDATE Intel is grappling with what many experts are describing as a processor design flaw impacting CPUs used in Linux, Windows and some macOS systems. The reported flaw is tied to Intel’s kernel virtual memory system that could allow an attacker to access kernel-protected data such as passwords...

Forever 21 Confirms Security Breach Exposed Customer Credit Card Details

First notified in November of a data breach incident, popular clothing retailer Forever 21 has now confirmed that hackers stole credit card information from its stores throughout the country for several months during 2017. Although the company did not yet specify the total number of its customers...

Chatting System PHP Ajax MySQL JavaScript 1.0 Shell Upload

Exploit Title: Chatting System PHP Ajax MySQL JavaScript - Remote Shell Upload Google Dork: N/A Date: 2017/31/12 Exploit Author: ShanoWeb Author Mail : MrdotNet2NetatGmaildotcom Vendor Homepage: https://www.codester.com/IngeniousDeveloper Software Buy:...

Leaky RootsWeb Server Exposes Some Ancestry.com User Data

Ancestry.com said it closed portions of its community-driven genealogy site RootsWeb as it investigated a leaky server that exposed 300,000 passwords, email addresses and usernames to the public internet. In a statement issued over the weekend, Chief Information Security Officer of Ancestry.com...