15946 matches found
Log4Shell Is Spawning Even Nastier Mutations
The internet has a fast-spreading, malignant cancer – otherwise known as the Apache Log4j logging library exploit – that’s been rapidly mutating and attracting swarms of attackers since it was publicly disclosed last week. Most of the attacks focus on cryptocurrency mining done on victims’ dimes,...
Bug in Millions of Flawed IoT Devices Lets Attackers Eavesdrop
Security researchers have discovered a critical flaw that affects tens of millions of internet-of-things IoT devices – one that exposes live video and audio streams to eavesdropping threat actors and which could enable attackers to take over control of devices, including security webcams and...
DarkSide Hits Toshiba; XSS Forum Bans Ransomware
For a ransomware gang whose servers were purportedly commandeered last week, DarkSide has had a server-fueled weekend, with a reported hit on Toshiba Business. Late on Thursday night came a post to the “Exploit” underground forum that looked, at least, to be from DarkSide. It described how the...
Scheme Flooding Allows User Tracking Across Browsers
A security researcher has discovered a vulnerability that allows websites to track users across a number of different desktop browsers — including Apple Safari, Google Chrome, Microsoft Edge, Mozilla Firefox and Tor — posing a threat to cross-browser anonymity. Called “scheme flooding,” the flaw...
Anti-Spam WordPress Plugin Could Expose Website User Data
An SQL-injection vulnerability discovered in a WordPress plugin called “Spam protection, AntiSpam, FireWall by CleanTalk” could expose user emails, passwords, credit-card data and other sensitive information to an unauthenticated attacker. Spam protection, AntiSpam, FireWall by CleanTalk is...
Crossing the Line: When Cyberattacks Become Acts of War
The Cold War concept isn’t outdated. In the decades since the fall of the Soviet Union, the battleground has simply shifted from conflicts between ideological proxy governments to cyberspace. And the opponents have grown from a few primary nations into a broad range of sovereign threat actors. Th...
2020 Work-for-Home Shift: What We Learned
Goodbye, 2020 — and good riddance, right? Most of us don’t want to take too much from this year into the next — but let’s make an exception for what we learned about security in the wake of the COVID-19 pandemic. In 2021 after all, more enterprises will permanently downsize their physical spaces...
Spotify Changes Passwords After Another Data Breach
Spotify has alerted users that some of their registration data was inadvertently exposed to a third-party business partner, including emails addresses, preferred display names, passwords, gender and dates of birth. This is at least the third breach in less than a month for the world’s largest...
Amazon Sues Instagram, TikTok Influencers Over Knockoff Scam
Instagram and TikTok social-media influencers Kelly Fitzpatrick and Sabrina Kelly-Krejci are among 13 defendants in a lawsuit filed by Amazon, which alleges that they participated in an an online scam to sell counterfeit luxury goods. Counterfeit goods are strictly forbidden in the Amazon...
Have I Been Pwned Set to Go Open-Source
Have I Been Pwned, the service that logs data breaches and lets individuals search to see if they’ve been affected by one, is about to go open-source. The result of that, according to its founder, will be additional transparency and security-enhancing features. HIBP, which was kicked off in 2013,...
TikTok Violated Children’s Privacy Law, FTC Complaint Says
The popular video sharing app TikTok has landed in hot water again over privacy issues. On Thursday, a group of privacy advocates filed a complaint with the Federal Trade Commission FTC alleging the platform failed to adequately protect children’s privacy. The complaint alleged that TikTok violat...
Attackers Claim Identity of Financial NGO to Steal Sharepoint, Office Credentials
A new phishing campaign is targeting investment brokers with fraudulent emails aimed at stealing their Microsoft SharePoint and Office credentials, by invoking the identity of a credible financial regulatory organization. The “widespread, ongoing phishing campaign” is using emails that claim to b...
GDPR Compliance Site Leaks Git Data, Passwords
A website that gives advice on privacy regulation compliance has fixed a security issue that was exposing MySQL database settings — including passwords — to anyone on the internet. The website, GDPR.EU, is an advice site for organizations that are struggling to comply with the General Data...
Public Sector Ransomware Attacks Rage On: Can Your Organization Repel Them?
To pay or not to pay? That is the question many public-sector organizations must grapple with when faced with a complex ransomware attack – even while the COVID-19 pandemic rages on around them. Ransomware attacks to municipal, local, and state government agencies are on the rise. Places as...
Travelex Pays $2.3M in Bitcoin to Hackers Who Hijacked Network in January
Travelex has paid out $2.3 million in Bitcoin to hackers to regain access to its global network after a malware attack at the new year knocked the global currency exchange offline and crippled its business during the month of January. The move—reported by the Wall Street Journal—may seem...
WHO Targeted in Espionage Attempt, COVID-19 Cyberattacks Spike
The World Health Organization WHO has attracted the notice of cybercriminals as the worldwide COVID-19 pandemic continues to play out, with a doubling of attacks recently, according to officials there. Problematically, evidence has also now apparently surfaced that the DarkHotel APT group has tri...
What is the Best Defense Against Phishing Attacks?
Whether the subject line was “You’re account will be closed!” or the email address was [email protected], we have all received and rolled our eyes at a poorly disguised phishing attempt. While many view phishing as a small annoyance, this attack method has maintained longevity for a reason and...
RSAC 2020: Lack of Machine Learning Laws Open Doors To Attacks
SAN FRANCISCO – As companies quickly adopt machine learning systems, cybercriminals are close behind scheming to compromise them. That worries legal experts who say a lack of laws swing open the door for bad guys to attack systems. During a panel session at RSA Conference 2020 this week, Cristin...
N.Y. Could Ban Cities from Paying Ransomware Attackers
New York State may soon ban municipalities from paying ransomware demands in the event of a cyberattack. State Senators Phil Boyle, George M. Borrello and Sue Serino introduced Senate Bill S7246 earlier this month, in response to the rising tide of cyberattacks targeting government agencies and...
Top 10 IoT Disasters of 2019
IoT Disasters 2019 Though more light was shed around insecure Internet of Things IoT devices in 2019 – consequently leading to more calls for regulation– connected devices themselves seemingly stayed just as insecure. From privacy concerns in smart home devices, to botnets evolving to launch...
Supply Chain Account Takeover: How Criminals Exploit Third-Party Access
Empower Your Suppliers Against Attack The average business shares data with a complex network of third parties, depending on their operational needs. In a survey of security and risk professionals, Forrester learned that the average business has 4,700 third-party partners with some access to...
Lizard Squad Threatens UK's Labour Leader with Cyberattacks Against His Family
Lizard Squad, the well-known hacktivist cybergang, is pledging to mount personal cyberattacks on Britain’s Labour Party leader, Jeremy Corbyn. As the UK continues to be roiled by Brexit debate ahead of a Dec. 12 general election, the Labour Party said on Tuesday that it had been targeted by a...
Murky Details Surround Bed, Bath and Beyond Breach
Housewares and home furnishings purveyor Bed, Bath and Beyond has disclosed a data-thieving cyber attack that allowed the adversaries to access customers’ online accounts. According to a Tuesday SEC filing, the company “discovered that a third party acquired email and password information from a...
U.S. Government, Military Personnel Data Leaked By Autoclerk
A leaky database owned by reservations management system Autoclerk has exposed the personal data and travel information for thousands of users – including U.S. government and military personnel. Autoclerk, which was acquired by the Best Western Hotel and Resorts Group in August, provides...
198 Million Car-Buyer Records Exposed Online for All to See
Over 198 million records containing information on prospective car buyers, including loan and finance data, vehicle information and IP addresses for website visitors, has been found exposed on the internet for anyone to see. The non-password protected Elasticsearch database belonged to Dealer...
MSP or System Integrator? Add Incident Response to Your Portfolio at No Cost
As breaches and cyberattacks grow in a steady upward trajectory, organizations are increasingly looking for ways to protect their assets, outsourcing critical Incident Response IR services to third-party providers. Cynet is now providing its IR services at no cost in a market-first offering which...
Energy Sector Phish Swims Past Microsoft Email Security via Google Drive
A targeted spearphishing campaign has hit an organization in the energy sector – after using a savvy trick to get around the company’s Microsoft email security stack. According to Aaron Riley, a researcher from Cofense, the campaign impersonated the CEO of the targeted company, sending email via...
DEF CON and Feds Partner on Anonymous Bug Submission Program
Hacking conference organizer DEF CON Communications said it plans to roll out a global anonymous bug submission platform based on the SecureDrop communications tool. During a session at DEF CON in Las Vegas last week, conference founder Jeff Moss said the goal was to launch the yet-to-be-named...
Election Security Threats: From Misinformation to Voting Machine
Election security continues to be a top concern – from social media misinformation campaigns, to vulnerabilities in the actual voting machines themselves. At Black Hat USA 2019, Threatpost caught up with Matt Olney, director of threat intelligence at Cisco Talos, to discuss the challenges that...
Researchers Bypass Apple FaceID Using Biometrics 'Achilles Heel'
LAS VEGAS – Vulnerabilities have been uncovered in the authentication process of biometrics technology that could allow bad actors to bypass various facial recognition applications – including Apple’s FaceID. But there is a catch. Doing so requires the victim to be out cold. Researchers on...
Black Hat 2019: Ethical Hackers Must Protect Digital Human Rights
LAS VEGAS – At a time when technology is being utilized for human-rights abuses, the security space needs to turn its focus to public interest defense technology, security stalwarts urged during Black Hat USA 2019. Security has long focused on protecting company data and providing cyber-defense f...
Podcast: Chris Vickery on UpGuard's Discovery of Millions of Facebook Records
Data collection and security was thrust to the forefront this week after researchers with UpGuard disclosed that hundreds of millions of Facebook records were found in two separate publicly-exposed app datasets. The two publicly-exposed datasets included one controlled by Mexican media company...
RSA Conference 2019: Firms Continue to Fail at IoT Security
SAN FRANCISCO – Low prices and firms racing products to market are two of the biggest factors when it comes to why Internet of Things devices are not getting the type of security do diligence they deserve. According to Checkmarx researcher Erez Yalon, despite years of the infosec community soundi...
Project Zero Discloses High-Severity Apple macOS Flaw
Researchers have disclosed what they say is a high-severity security flaw in Apple’s MacOS operating system – which has not yet been patched. The flaw gives an attacker privileges to perform malicious actions on a mounted filesystem – without the victim knowing. The Google Project Zero team...
Major Container Security Flaw Threatens Cascading Attacks
runc, a building-block project for the container technologies used by many enterprises as well as public cloud providers, has patched a vulnerability that would allow root-level code-execution, container escape and access to the host filesystem. Discovered by researchers Adam Iwaniuk and Borys...
2019 Already Marred By Slew of Data Breach Incidents
It has been a busy year for data breaches already, and January isn’t even officially over. This past week has been no exception. In past seven days, in addition to the Airbus news that we previously reported, Discover Financial, IT management giant Rubrik, the City of St. John in New Brunswick,...
Adobe Patches Zero-Day Vulnerability in Flash Player
Adobe on Wednesday released several unscheduled fixes for Flash Player, including a critical vulnerability that it said is being exploited in the wild. The critical vulnerability, CVE-2018-15982, is a use-after-free flaw enabling arbitrary code-execution in Flash. “Adobe has released security...
Google+ Privacy Snafu Leaves a Cloud Over the Tech Landscape
In the wake of Google shutting down its Google+ social networking platform after a privacy snafu, questions remain about the responsibility of tech giants when it comes to consumer data and its handling. A software bug in an API for the social site was discovered by Google’s own internal security...
Another Linux Kernel Bug Surfaces, Allowing Root Access
A high-severity cache invalidation bug in the Linux kernel has been uncovered, which could allow an attacker to gain root privileges on the targeted system. This is the second kernel flaw in Linux to debut in the last week; a local-privilege escalation issue was also recently discovered. The flaw...
Critical Moodle Vulnerability Could Lead to Server Compromise
A critical vulnerability in Moodle, an open source PHP-based learning management system deployed across scores of schools and universities, could expose the server its running on to compromise. Tens of thousands of universities worldwide, including the California State University system, the...
APT Groups Exploiting Patch Microsoft Office Flaw CVE-2015-2545
A Microsoft Office vulnerability patched six months ago continues to be a valuable tool for APT gangs operating primarily in Southeast Asia and the Far East. Researchers at Kaspersky Lab today published a report describing how attackers continue to flourish exploiting CVE-2015-2545, a remote code...
Mixed Reviews on Microsoft myBulletins Patch Service
Microsoft today released its new myBulletins service, an interface where IT administrators can customize security patch update information. While providing users with a slick GUI that allows for extensive filtering of patch information by the products in use inside an enterprise or small company,...
Microsoft Giving .NET Users The Option to Shed RC4
Microsoft didn’t beat around the bush when it warned customers to stay away from the deprecated RC4 algorithm last fall. Now it’s giving those who use its .NET software framework an option to disable the cipher in Transport Layer Security TLS as well. In a security advisory issued on its Security...
Issue with SWFUploader Could Lead to XSS Vulnerabilities, Content Spoofing
UPDATED Many versions of SWFUpload – an applet that combines Flash and JavaScript that’s used in millions of websites, including WordPress sites– are vulnerable to content spoofing and a cross-site scripting vulnerability that could lead to the takeover of accounts, according to reports this week...
Volume of Malware Targeting Java CVE-2012-1723 Flaw Spikes
It’s been nearly two months since Oracle patched the CVE-2012-1723 Java vulnerability, a serious remote pre-authentication flaw that’s present in the Java Runtime Environment. It’s taken a little time, but the attacker community has decided that this bug deserves some serious attention, and as a...
Fake Automated Craigslist Email Notifications Link to Blackhole Exploit Kit
UPDATE: A big wave of emails purporting to be Craigslist notifications but containing links to websites hosting the Black Hole exploit kit hit the Internet yesterday, a day that already was filled with drama surrounding the LinkedIn password dump. The malicious emails, 150,000 of which were caugh...
PHP Group Releases New Versions, But Patch Doesn't Fix CVE-2012-1823 Bug
UPDATE–The developers of PHP have released new versions of the scripting language to fix a remotely exploitable vulnerability announced earlier this week that enables an attacker to pass command-line arguments to the PHP binary. The flaw has been in the code for more than eight years and The PHP...
Arms Race In Zero Days Spells Trouble For Privacy, Public Safety
Editor’s Note: This is the second of a two-part podcast with independent security researcher Chris Soghoian. In the first part of our podcast with independent security researcher Chris Soghoian, we talked about the way that the proliferation of “free” applications have forced consumers into the...
Katie Moussouris on Microsoft, Trustworthy Computing and the Evolution of the Security Community
Dennis Fisher talks with Microsoft’s Katie Moussouris about the way that the Trustworthy Computing effort at Microsoft has changed, how the security community has evolved since she got involved in the 1990s and the challenges–and fun–of being a woman in security. Podcast audio courtesy of sykboy6...