Vulnerability fixed in Red Hat Enterprise Linux

Red Hat has fixed a vulnerability in the Public Key Infrastructure PKI Core package. A component of this package writes out the administrator password during installation to a log file that is unjustifiably readable by any local user. A local malicious person with knowledge of the location of thi...

HPE Edgeline Infrastructure Manager Authentication Bypass (HPESBGN04124)

Binary data hpeeimcve-2021-29203.nbin...

Steamship Authority answers question: Who’s the next ransomware victim?

After the attacks on Colonial Pipeline and JBS, many may have been wondering, as we did, what the next ransomware headline was going to be. Well, here it is—another victim in the vital infrastructure of transport and logistics, although this time the impact may be less brutal. Steamship Authority...

Experts Uncover Yet Another Chinese Spying Campaign Aimed at Southeast Asia

An ongoing cyber-espionage operation with suspected ties to China has been found targeting a Southeast Asian government to deploy spyware on Windows systems while staying under the radar for more than three years. "In this campaign, the attackers utilized the set of Microsoft Office exploits and...

PKI-server 安全漏洞

PKI-server is a J2EE application running on the JBoss server . It is designed to automatically encrypt/decrypt data and apply/validate digital signatures with flags. A security vulnerability exists in PKI-server, which can be exploited by a local attacker to retrieve files in order to obtain the...

Effective Adoption of SASE in 2021

Think back to mid-2019: People had already been moving to the cloud, having talked about digital transformation for years. Then, March 2020 shoved transformation into hyperdrive: Suddenly, there was a mass exodus from the office, and everybody was working from home. That’s when the old ways of...

Privacy compliance for smart meter infrastructure with Microsoft Information Protection and Azure Purview

Smart meters and smart grid infrastructure have been deployed in many of the world’s electric distribution grids. They promise energy conservation, better grid management for utilities, electricity theft reduction, and a host of value-added services for consumers. To deliver on this promise, they...

JBS says it is recovering quickly from a ransomware attack

This week another major supplier reported it had been hit with ransomware. After the Colonial Pipeline attack last month, this time the victim is the worlds largest meatpacker, JBS. JBS halted cattle slaughter at all its US plants on Tuesday after the attack caused their Australian operations to...

Preventing Multi-layered Cybersecurity Threats

It’s 2021, and this rapidly evolving threat landscape requires partnership with a trusted cybersecurity expert, who can provide protection across distributed endpoints, networks, cloud infrastructure, and hybrid environments...

Creating coefficiency: DevOps, Security, and Compliance

Secure IaC Infrastructure-as-code IaC is a powerful partnership accelerator. As businesses and organizations scale into the cloud to realize its full production-enablement potential, security often struggles to keep up. The ultimate goal on the security horizon is, of course, to prevent risks and...

Kimsuky APT continues to target South Korean government using AppleSeed backdoor

This blog post was authored by Hossein Jazi. The Kimsuky APT—also known as Thallium, Black Banshee, and Velvet Chollima—is a North Korean threat actor that has been active since 2012. The group conducts cyber espionage operations to target government entities mainly in South Korea. On December...

A week in security (May 24 -30)

Last week on Malwarebytes Labs we discussed VPN Android apps, how even the FBI has to deal with insider threats, Chromes Incognito mode, new rules for critical infrastructure spurred by the Colonial Pipeline attack, how to delete your Twitter account, what encryption is, how healthcare service...

Virtuozzo ReadyKernel patch 128.0 for Virtuozzo Hybrid Server 7.0, 7.5 and Virtuozzo Hybrid Infrastructure 3.5, 4.0, 4.5

The cumulative Virtuozzo ReadyKernel patch was updated with stability fixes. The patch applies to the kernels 3.10.0-1062.4.2.vz7.116.7 Virtuozzo Hybrid Server 7.0.12 HF1 and Virtuozzo Hybrid Infrastructure 3.5, 3.10.0-1062.12.1.vz7.131.10 Virtuozzo Hybrid Server 7.0.13, 3.10.0-1127.8.2.vz7.151.1...

Breaking down NOBELIUM’s latest early-stage toolset

As we reported in earlier blog posts, the threat actor NOBELIUM recently intensified an email-based attack that it has been operating and evolving since early 2021. We continue to monitor this active attack and intend to post additional details as they become available. In this blog, we highlight...

Information Disclosure

@keystonejs/keystone is vulnerable to information disclosure. The query infrastructure discloses the values of private fields due to bypass of configured access control...

Siemens SIMATIC S7-1200 and S7-1500 CPU Families (Update A)

1. EXECUTIVE SUMMARY CVSS v3 8.1 ATTENTION: Exploitable remotely Vendor: Siemens Equipment: SIMATIC S7-1200 and S7-1500 CPU Families Vulnerability: Improper Restriction of Operations within the Bounds of a Memory Buffer 2. UPDATE INFORMATION This updated advisory is a follow-up to the original...

Private Field data leak

This security advisory relates to a newly discovered capability in our query infrastructure to directly or indirectly expose the values of private fields, bypassing the configured access control. This is an access control related oracle attack in that the attack method guides an attacker during...

GHSA-27G8-R9VW-765X Private Field data leak

This security advisory relates to a newly discovered capability in our query infrastructure to directly or indirectly expose the values of private fields, bypassing the configured access control. This is an access control related oracle attack in that the attack method guides an attacker during...

Fujitsu SaaS Hack Sends Govt. of Japan Scrambling

Threat actors have stolen files from several official government agencies of Japan by hacking into Fujitsu’s software-as-a-service SaaS platform and gaining access to its systems. The Japan-based tech giant temporarily disabled ProjectWEB enterprise after learning of the attack, which is known to...

Biden’s Cybersecurity EO: The Wrong Issues

It’s no secret that foreign adversaries are making a concerted effort to target U.S. government agencies and companies. As technology advances and foreign superpowers gain influence, the game is shifting beneath our feet here in the U.S. Motivated in part by the extent and consequences of the...