BreachForums Founder Sentenced to 20 Years of Supervised Release, No Jail Time

Conor Brian Fitzpatrick has been sentenced to time served and 20 years of supervised release for his role as the creator and administrator of BreachForums. Fitzpatrick, who went by the online alias "pompompurin," was arrested in March 2023 in New York and was subsequently charged with conspiracy ...

Open Supervised Device Protocol Temporary Disconnection

The vulnerability of the Open Supervised Device Protocol OSDP implementation in the AXIS OS operating system and AXIS controllers is related to improper cleaning or release of resources. Exploiting this vulnerability can allow a malicious actor to cause temporary dysfunction of the functions...

NJ Man Hired Online to Firebomb, Shoot at Homes Gets 13 Years in Prison

A 22-year-old New Jersey man has been sentenced to more than 13 years in prison for participating in a firebombing and a shooting at homes in Pennsylvania last year. Patrick McGovern-Allen was the subject of a Sept. 4, 2022 story here about the emergence of "violence-as-a-service" offerings, wher...

Open Supervised Device Protocol Code Execution

The vulnerability of the Open Supervised Device Protocol OSDP implementation of the microprogramming-based controller AXIS A1001 is related to buffer overflow in dynamic memory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code using a specially crafted OSDP...

CVE-2023-21405

Knud from Fraktal.fi has found a flaw in some Axis Network Door Controllers and Axis Network Intercoms when communicating over OSDP, highlighting that the OSDP message parser crashes the pacsiod process, causing a temporary unavailability of the door-controlling functionalities meaning that doors...

PT-2023-3867 · Axis · Axis A1001

Name of the Vulnerable Software and Affected Versions: AXIS A1001 affected versions not specified Description: The issue is related to a heap-based buffer overflow in the pacsiod process, which handles Open Supervised Device Protocol OSDP communication. This allows an attacker to write outside th...

PT-2023-7483 · Axis · Axis Network Intercoms +1

Name of the Vulnerable Software and Affected Versions: Axis Network Door Controllers and Axis Network Intercoms affected versions not specified Description: The issue is related to a flaw in the implementation of the Open Supervised Device Protocol OSDP in Axis Network Door Controllers and Axis...

Twitter Hacker Sentenced to 5 Years in Prison for $120,000 Crypto Scam

A U.K. citizen who took part in the massive July 2020 hack of Twitter has been sentenced to five years in prison in the U.S. Joseph James O'Connor aka PlugwalkJoe, 24, was awarded the sentence on Friday in the Southern District of New York, a little over a month after he pleaded guilty to the...

Former Ubiquiti Employee Gets 6 Years in Jail for $2 Million Crypto Extortion Case

A former employee of Ubiquiti has been sentenced to six years in jail after he pleaded guilty to posing as an anonymous hacker and a whistleblower in an attempt to extort almost $2 million worth of cryptocurrency while working at the company. Nickolas Sharp, 37, was arrested in December 2021 for...

CVE-2023-20959

In AddSupervisedUserActivity, guest users are not prevented from starting the activity due to missing permissions checks. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

CVE-2020-36517

An information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised 2022.03 allows a DNS operator to gain knowledge about internal network resources via the hardcoded DNS resolver configuration...

Home Assistant security vulnerabilities

Home Assistant is an open source home automation management system. The system is primarily used to control home automation devices. A security vulnerability exists in the Home Assistant Operating System and Supervised that allows a DNS operator to gain knowledge about internal network resources...

CVE-2020-36517

An information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised 2022.03 allows a DNS operator to gain knowledge about internal network resources via the hardcoded DNS resolver configuration...

CVE-2020-36517

An information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised 2022.03 allows a DNS operator to gain knowledge about internal network resources via the hardcoded DNS resolver configuration...

PT-2022-8972

Name of the Vulnerable Software and Affected Versions Nabu Casa Home Assistant Operating System version 2022.03 Home Assistant Supervised version 2022.03 Description An information leak in the affected systems allows a DNS operator to gain knowledge about internal network resources via the...

CVE-2020-36517: Observable Discrepancy

An information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised 2022.03 allows a DNS operator to gain knowledge about internal network resources via the hardcoded DNS resolver configuration...

Gallagher Command Centre Server encryption vulnerability

Gallagher Command Center Server is a management system used by Gallagher New Zealand to monitor and manage infrastructure in buildings. Gallagher Command Centre Server is vulnerable to an encryption issue that originates from the discovery of an OSDP reader master key in a server memory dump of...

Avoid Alert Fatigue: How to Automatically Get Rid of WAF False Positive

Alert fatigue - introducing false positives in WAF All WAF experts know what it’s like handling massive amounts of alerts. They’re also very likely wasting a lot of time fishing false positives out of all these alerts. The WAF’s purpose is to block attacks and let legitimate traffic through. Fals...

Russian Hacker Behind NeverQuest Banking Malware Gets 4 Years in U.S. Prison

A Russian hacker who created and used Neverquest banking malware to steal money from victims' bank accounts has finally been sentenced to 4 years in prison by the United States District Court for the Southern District of New York. Stanislav Vitaliyevich Lisov, 34, was arrested by Spanish...

Security and Artificial Intelligence: Hype vs. Reality

While artificial intelligence and machine learning are far from new, many in security suddenly believe these technologies will transform their business and enable them to detect every cyber threat that comes their way. But instead, the hype may create more problems than it solves. Recently,...