VideoBytes: Ryuk Ransomware Targeting US Hospitals

Hello Folks! In this Videobyte, we’re talking about why hospitals are being targeted by the Ryuk ransomware, what tricks they are using to pull this off and what their motivations might be. Ryuk ransomware is being spread to hospitals using targeted phishing emails that infect systems with the...

Norweigian researcher exposes how a US firm collected his location data

By Sudais Asif The researcher identified over 75000 data points of his phone being tracked. Here's how he found and exposed the firm behind the scenes. This is a post from HackRead.com Read the original post: Norweigian researcher exposes how a US firm collected his location data...

The US Used the Patriot Act to Justify Logging Website Users

Plus: Better Twitter two-factor, a Spotify hack, and more of the week’s top security news...

Cyber Monday - The Biggest Shopping Day of the Year?

Do you remember when Cyber Monday wasn't a thing? In late November 2005, The New York Times reported: "The name Cyber Monday grew out of the observation that millions of otherwise productive working Americans, fresh off a Thanksgiving weekend of window shopping, were returning to high-speed...

Hackers Are Targeting the Covid-19 Vaccine ‘Cold Chain’

As vaccines await US approval, a sophisticated global phishing campaign has tried to harvest credentials from companies involved in their distribution...

Arbitrary File Deletion Vulnerability in simcms us***.php File

simcms is a solution for used car website based on PHP+MYSQL. The simcms us.php file has an arbitrary file deletion vulnerability that can be exploited by an attacker to delete arbitrary files...

Indian National Gets 20-Year Jail in United States for Running Scam Call Centers

An Indian national on Monday was sentenced to 20 years in prison in the Southern District of Texas for operating and funding India-based call centers that defrauded US victims out of millions of dollars between 2013 and 2016. Hitesh Madhubhai Patel aka Hitesh Hinglaj, who hails from the city of...

Tendenci 12.3.1 - CSV/ Formula Injection

Exploit Title: Tendenci 12.3.1 - CSV/ Formula Injection Date: 2020-10-29 Exploit Author: Mufaddal Masalawala Vendor Homepage: https://www.tendenci.com/ Software Link: https://github.com/tendenci/tendenci Version: 12.3.1 Payload: =10+20+cmd|' /C calc'!A0 Tested on: Kali Linux 2020.3 Proof Of...

CVE-2020-5797: Improper Link Resolution Before File Access

UNIX Symbolic Link Symlink Following in TP-Link Archer C9USV1180125 firmware allows an unauthenticated actor, with physical access and network access, to read sensitive files and write to a limited set of files after plugging a crafted USB drive into the router...

PT-2020-18718

Name of the Vulnerable Software and Affected Versions TP-Link Archer C9US version V1 180125 Description The issue allows an unauthenticated actor, with physical access and network access, to read sensitive files and write to a limited set of files after plugging a crafted USB drive into the route...

IoT Cybersecurity Improvement Act Passed, Heads to President's Desk

Security experts are applauding the recent stamp of approval by the U.S. Senate on a groundbreaking internet-of-things IoT security regulatory effort. The IoT Cybersecurity Improvement Act, which was led in bipartisan sponsorship by Reps. Will Hurd R-Texas and Robin Kelly D-Ill., would require th...

The US Military Buys Commercial Location Data

Vice has a long article about how the US military buys commercial location data worldwide. The U.S. military is buying the granular movement data of people around the world, harvested from innocuous-seeming apps, Motherboard has learned. The most popular app among a group Motherboard analyzed...

Six Apart Movable Type Cross-Site Scripting Vulnerability (CNVD-2022-22655)

Six Apart Movable Type MT is a blogging system from Six Apart, a US-based company. Six Apart Movable Type Premium is vulnerable to a cross-site scripting vulnerability that could be exploited by a remote authenticated attacker to inject arbitrary scripts via unspecified vectors...

Congress unanimously passes federal IoT security law

The US Senate unanimously passed the IoT Cybersecurity Improvement Act H.R.1668 yesterday. The US House passed the bill in September, so it is highly likely to become law, barring a Presidential veto. This is arguably the most significant US IoT-specific cybersecurity law to date, as well as the...

Forget Impostors. Among Us Is a Playground for Hackers

The blockbuster game of deception has security holes that let cheaters run wild...

U.S. Dept Of Defense: Blind stored XSS due to insecure contact form at https://█████.mil leads to leakage of session token and

Summary: I have discovered a blind stored cross site scripting vulnerability due to an insecure Contact form available here https://███████.mil/ This form does not properly sanitize user input allowing for the insertion and submission of dangerous characters such as angle brackets. I was able to...

Donald Trump Could Still Launch Nuclear Weapons at Any Time

The president's responsibility for the US nuclear arsenal is a Cold War anachronism. The Trump era shows why it needs reform...

This Week in Security News: Ransomware Gang is Raking in Tens of Millions of Dollars and Microsoft Patch Tuesday Update Fixes 17 Critical Bugs

Welcome to our weekly roundup, where we share what you need to know about cybersecurity news and events that happened over the past few days. This week, learn about a ransomware group that walked away with 2,200 Bitcoin: More than $33 million based on the current Bitcoin exchange rate. Also, read...

Update iOS Right Now to Fix Some Bad Security Bugs

Plus: Ransomware hits Capcom, the US seizes Iranian domains, and more of the week’s top security news...

CVE-2020-5795: Improper Link Resolution Before File Access

UNIX Symbolic Link Symlink Following in TP-Link Archer A7USV5200721 allows an authenticated admin user, with physical access and network access, to execute arbitrary code after plugging a crafted USB drive into the router...