Malicious code in uber-rv-web-common-virtual-8d2dce4f55 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dbae8809f558786b2938d097fa3abc6d250af302ff70e680c5cbf865b32b6d75 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1017 Malicious code in uber-rv-web-common-virtual-8d2dce4f55 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dbae8809f558786b2938d097fa3abc6d250af302ff70e680c5cbf865b32b6d75 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

British LAPSUS$ Teen Members Sentenced for High-Profile Attacks

Two British teens part of the LAPSUS$ cyber crime and extortion gang have been sentenced for their roles in orchestrating a string of high-profile attacks against a number of companies. Arion Kurtaj, an 18-year-old from Oxford, has been sentenced to an indefinite hospital order due to his intent ...

Former Uber CISO Appealing His Conviction

Joe Sullivan, Ubers CEO during their 2016 data breach, is appealing his conviction. Prosecutors charged Sullivan, whom Uber hired as CISO after the 2014 breach, of withholding information about the 2016 incident from the FTC even as its investigators were scrutinizing the companys data security a...

Google Adopts Passkeys as Default Sign-in Method for All Users

Google on Tuesday announced the ability for all users to set up passkeys by default, five months after it rolled out support for the FIDO Alliance-backed passwordless standard for Google Accounts on all platforms. "This means the next time you sign in to your account, you'll start seeing prompts ...

Food delivery robots give captured video footage to police

In what sounds like a new step towards Skynet, footage from a food delivery robot has been used as part of a criminal investigation. As 404 Media reports, the food delivery robots that are deployed for Uber Eats in Los Angeles are operated by Serve Robotics, which ultimately wants to deploy up to...

The Alarming Rise of Infostealers: How to Detect this Silent Threat

A new study conducted by Uptycs has uncovered a stark increase in the distribution of information stealing a.k.a. infostealer or stealer malware. Incidents have more than doubled in Q1 2023, indicating an alarming trend that threatens global organizations. According to the new Uptycs' whitepaper,...

Malicious code in uber-eslint (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a520e43e8c3f5918ff525c55f9b99a1715b3b4d89e3596cc698e7954e2bc7e63 The OpenSSF Package Analysis project identified 'uber-eslint' @ 99.99.992 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1326 Malicious code in uber-eslint (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a520e43e8c3f5918ff525c55f9b99a1715b3b4d89e3596cc698e7954e2bc7e63 The OpenSSF Package Analysis project identified 'uber-eslint' @ 99.99.992 npm as malicious. It is considered malicious because: - The package...

Teenagers Face Trial for Hacking BT, Nvidia, Rockstar Games, Revolut, Uber

By Waqas Both teenagers, who are on trial in the United Kingdom, have been accused of being associated with the infamous Lapsus$ hacking group. This is a post from HackRead.com Read the original post: Teenagers Face Trial for Hacking BT, Nvidia, Rockstar Games, Revolut, Uber...

The Rising Threat of Secrets Sprawl and the Need for Action

The most precious asset in today's information age is the secret safeguarded under lock and key. Regrettably, maintaining secrets has become increasingly challenging, as highlighted by the 2023 State of Secrets Sprawl report, the largest analysis of public GitHub activity. The report shows a67%...

GO-2023-1505 Arbitrary file read vulnerability in github.com/uber/kraken

kraken contains an arbitrary file read vulnerability via component testfs...

A week in security (April 3 - 9)

Last week on Malwarebytes Labs: TikTok: Whats going on and should I be worried? Super FabriXss: an RCE vulnerability in Azure Service Fabric Explorer Big changes to Twitter verification: How to spot a verified account New macOS malware steals sensitive info, including a user's entire Keychain...

Uber data theft: Driver info stolen after law firm breached

Uber, yet again, has become a victim of data theft following a third-party breach. This time, threat actors have aimed at the company's law firm, Genova Burns. Data of Uber's drivers may have been swiped during the security incident. According to the letter sent to affected drivers, the firm beca...

Uber: Complete Admin account takeover due to PhpDebugBar turned on in Uber's production server

A security vulnerability was discovered in Uber's production server on February 22, 2023. The vulnerability allowed an attacker to gain complete admin account takeover due to PhpDebugBar being turned on...

Login Details of Tech Giants Leaked in Two Data Center Hacks

By Waqas Threat actors have hacked two data centers in Asia and accessed login credentials of top technology giants, including Apple, Uber, Microsoft, Samsung, Alibaba, etc., and leaked them on a hacker forum. This is a post from HackRead.com Read the original post: Login Details of Tech Giants...

Path Traversal

github.com/uber/kraken is vulnerable to Path Traversal. The vulnerability exists because the downloadHandler parameter in the server.go does not properly sanitize the relative file paths and user inputs, allowing an attacker to write arbitrary files outside the expected directory...

kraken 路径遍历漏洞

Uber Technologies kraken is a P2P-powered Docker registry from Uber Technologies. A path traversal vulnerability exists in kraken 0.1.4 and earlier versions, which stems from an arbitrary file read vulnerability via the component testfs...

Uber data stolen via third-party vendor

Uber is facing a new cybersecurity incident after threat actors stole some of its data from Teqtivity, a third-party vendor that provides asset management and tracking services. "We are aware of customer data that was compromised due to unauthorized access to our systems by a malicious third...

New Uber Data Breach – Hacker Leaks Employee and Other Sensitive Data

By Waqas Another day, another data breach at Uber - This time around, a hacker has leaked stolen data on a prominent cybercrime and hacking forum. This is a post from HackRead.com Read the original post: New Uber Data Breach - Hacker Leaks Employee and Other Sensitive Data...