Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Global Transparency ...

 Business

Businesses are showing increased interest in having confidence in their technology providers, with more than 70% of IT decision makers declaring a strong importance of having ongoing assurance that the IT solutions they use are operating in a known and trusted state. This is why we decided to open two new   show more ...  

trust-building facilities for the companys partners and customers in Italy and in the Netherlands. The centers will operate as per a new format: providing customers and partners with just the most popular service — an overview of our engineering and data management practices. The new centers are part of the Kaspersky Global Transparency Initiative (GTI), and aim to open the black box of technology – increasing customer confidence in the companys solutions. With the 2017 launch of the GTI, we became the first cybersecurity company to open its source code for external review. The initiative aims to engage the broader community in validating and verifying the trustworthiness of our products, internal processes, and business operations. The opening of the new Transparency Centers reflects the companys ongoing commitment to enhance both transparency and accountability for its customers and partners. Having added new facilities in Utrecht and Rome, we now have the largest network of such centers in Europe, along with hubs in Madrid and Zurich. Operating in the companys offices, the centers in Rome and Utrecht – open to our partners, customers, and government cybersecurity authorities – serve exclusively for the blue piste option, the most sought-after option by Transparency Center visitors since the opening of the first facility in 2018. The blue piste represents a general overview of our engineering and data processing practices, products and services. During a visit, partners and customers will be met by a team of experts wholl answer any questions regarding the companys data processing practices and the functioning of our solutions, together with a live demonstration of a source code review. With the latest addition of two new facilities, we now operate nine Transparency Centers in Europe, APAC, North America and Latin America. Centers opened earlier offer additional review options — the red and black pistes — which vary in their depth and the level of technical skills required. The former provides a review of the most critical parts of the source code, enabling analysis of a particular functionality, while the latter represents the deepest and most comprehensive review of the most critical parts of the source code. The code review can be run solely for consultation purposes and in compliance with the strictest access policy to rule out the possibility of any modifications. To learn more or request access, please visit the Kaspersky transparency center website. The new edition of the Transparency report Another pillar forming our Global Transparency Initiative is the release of Kaspersky Transparency reports, revealing information on requests received from government and law enforcement agencies, and users for their personal data. The latest report covers the first six months of 2022. During the first half of 2022, we received a total of 89 requests from governments and law enforcement agencies from eight countries (Brazil, China, Italy, Japan, Jordan, Russia, Singapore, and South Korea), a 15% decrease in requests year-on-year (105 requests in H1 2021). As previously, the overwhelming majority — 89% — of requests received were for non-personal technical information, i.e., information facilitating the conduct of investigations into cybercrimes — indicators of compromise (IoCs), information about modus operandi of cyberattackers, results of malware reverse engineering, and other results of cyber forensic analysis. As many as 11% of requests asked for user data, with all of them having been rejected. The share of requests for non-personal technical data rose from 85% to 89%. The share of approved requests grew as well: out of all the requests received over H1 2022, 64% were granted. All other requests were rejected either for not meeting legal verification requirements or due to an absence of required data. In addition, as part of its Transparency reports, we are making public information about requests received from users for personal-data-related purposes — details on where a users data is stored, or provision or removal of personal information. We received 3,285 such requests in the first half of 2022. We are continuing our commitment to updating such data every six months, and publish Transparency reports on a regular basis to ensure stakeholders have the necessary information and can trust in our solutions. The reports also provide more information on the companys approach to handling such requests and our principles. Previous Transparency reports can be found on the Kaspersky Global Transparency Initiative page.

 Govt., Critical Infrastructure

The first meeting of the Joint Ransomware Task Force was held last week as the co-chairs from the Cybersecurity and Infrastructure Security Agency and the FBI mapped out how they would counter the ongoing ransomware threat.

 Breaches and Incidents

Uber confirmed that a cybercriminal group accessed multiple internet systems, stole vulnerability reports, and downloaded internal Slack messages. As per The New York Times report, the operator carried out a social engineering attack on an employee’s Slack account to gain initial access.

 Expert Blogs and Opinion

Integration enables applications and systems that were built separately to work together, resulting in new capabilities and efficiencies that cut costs, uncover insights, and much more.

 Trends, Reports, Analysis

According to Group-IB, around 63% of the fraudulent domains were registered with Russian registrars and included content to target English and Spanish-speaking crypto investors in the U.S. and other countries. 

 Identity Theft, Fraud, Scams

automobile company named JBM Group was allegedly duped by a fraudster who sent fake WhatsApp messages to the firm's chief financial officer Vivek Gupta in the name of its vice chairman and got the money transferred to seven bank accounts.

 Malware and Vulnerabilities

Vidar is designed to steal information from an infected device, including banking information, saved passwords, IP addresses, browser history, login credentials, and crypto wallets.

 Trends, Reports, Analysis

In a study by Deloitte, 50.2% of cyber pros said their organization is at risk of ‘harvest now, decrypt later’ attacks, whereby cybercriminals extract encrypted data in anticipation of the time quantum computers are able to break existing algorithms.

 Identity Theft, Fraud, Scams

Hackers have been launching phishing attacks, using the Browser-in-the-Browser technique, in an attempt to steal Steam credentials from professional gamers. The targets are sent direct invitation links on their Steam account, requesting them to join a team for LoL, CS, Dota 2, or PUBG competitions. Users or gamers are suggested to follow safety guidelines.

 Threat Intel & Info Sharing

The cyber security agency said that vulnerabilities can be exploited by a remote attacker to join meetings they are authorized to join without appearing to other participants.

 Malware and Vulnerabilities

Reported by security researcher Micha? Bentkowski, the bug highlights the challenges of preventing client-side prototype pollution attacks. Prototype pollution can happen both on the client side (browser) and server side (Node.js servers).

 Malware and Vulnerabilities

Upon tracking PrivateLoader’s network infrastructure and activities associated with ruzki PPI, SEKOIA researchers observed an overlap between the former’s C2 servers and the latter’s URLs offered to subscribers.

 Incident Response, Learnings

With the termination of the consent order, Capital One is no longer required to submit quarterly updates detailing its risk management and auditing practices to the OCC, which it was required to do following the discovery of the hack.

 Identity Theft, Fraud, Scams

The phishing email sent to targets supposedly originates from Slovenská pošta, the state-owned postal service provider in Slovakia, informing the recipient of the need to cover costs for a parcel that’s pending shipment.

 Feed

Ubuntu Security Notice 5625-1 - It was discovered that Mako incorrectly handled certain regular expressions. An attacker could possibly use this issue to cause a denial of service.

 Feed

Ubuntu Security Notice 5626-1 - Yehuda Afek, Anat Bremler-Barr, and Shani Stajnrod discovered that Bind incorrectly handled large delegations. A remote attacker could possibly use this issue to reduce performance, leading to a denial of service. It was discovered that Bind incorrectly handled statistics requests. A   show more ...  

remote attacker could possibly use this issue to obtain sensitive memory contents, or cause a denial of service. This issue only affected Ubuntu 22.04 LTS.

 Feed

Ubuntu Security Notice 5623-1 - Asaf Modelevsky discovered that the Intel 10GbE PCI Express Ethernet driver for the Linux kernel performed insufficient control flow management. A local attacker could possibly use this to cause a denial of service. It was discovered that the framebuffer driver on the Linux kernel did   show more ...  

not verify size limits when changing font or screen size, leading to an out-of- bounds write. A local attacker could use this to cause a denial of service or possibly execute arbitrary code.

 Feed

Ubuntu Security Notice 5624-1 - It was discovered that the framebuffer driver on the Linux kernel did not verify size limits when changing font or screen size, leading to an out-of- bounds write. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Duoming Zhou discovered   show more ...  

that race conditions existed in the timer handling implementation of the Linux kernel's Rose X.25 protocol layer, resulting in use-after-free vulnerabilities. A local attacker could use this to cause a denial of service.

 Feed

Ubuntu Security Notice 5622-1 - It was discovered that the framebuffer driver on the Linux kernel did not verify size limits when changing font or screen size, leading to an out-of- bounds write. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Moshe Kol, Amit Klein and   show more ...  

Yossi Gilad discovered that the IP implementation in the Linux kernel did not provide sufficient randomization when calculating port offsets. An attacker could possibly use this to expose sensitive information.

 Feed

Ubuntu Security Notice 5621-1 - It was discovered that the framebuffer driver on the Linux kernel did not verify size limits when changing font or screen size, leading to an out-of- bounds write. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Domingo Dirutigliano and   show more ...  

Nicola Guerrera discovered that the netfilter subsystem in the Linux kernel did not properly handle rules that truncated packets below the packet header size. When such rules are in place, a remote attacker could possibly use this to cause a denial of service.

 Feed

Red Hat Security Advisory 2022-6580-01 - The Booth cluster ticket manager is a component to bridge high availability clusters spanning multiple sites, in particular, to provide decision inputs to local Pacemaker cluster resource managers. It operates as a distributed consensus-based service, presumably on a separate   show more ...  

physical network. Tickets facilitated by a Booth formation are the units of authorization that can be bound to certain resources. This will ensure that the resources are run at only one site at a time.

 Feed

Red Hat Security Advisory 2022-6592-01 - This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel. Issues addressed include a heap overflow vulnerability.

 Feed

Red Hat Security Advisory 2022-6582-01 - The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Issues addressed include buffer overflow and heap overflow vulnerabilities.

 Feed

Red Hat Security Advisory 2022-6585-01 - Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Issues addressed include a double free vulnerability.

 Feed

This Metasploit module utilizes the Unified Remote remote control protocol to type out and deploy a payload. The remote control protocol can be configured to have no passwords, a group password, or individual user accounts. If the web page is accessible, the access control is set to no password for exploitation, then   show more ...  

reverted. If the web page is not accessible, exploitation will be tried blindly. This module has been successfully tested against version 3.11.0.2483 (50) on Windows 10.

 Feed

Google's American Fuzzy Lop is a brute-force fuzzer coupled with an exceedingly simple but rock-solid instrumentation-guided genetic algorithm. afl++ is a superior fork to Google's afl. It has more speed, more and better mutations, more and better instrumentation, custom module support, etc.

 Feed

Ubuntu Security Notice 5618-1 - It was discovered the Ghostscript incorrectly handled memory when processing certain inputs. By tricking a user into opening a specially crafted PDF file, an attacker could cause the program to crash.

 Feed

Red Hat Security Advisory 2022-6595-01 - Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Issues addressed include HTTP request smuggling and denial of service vulnerabilities.

 Feed

Red Hat Security Advisory 2022-6608-01 - dbus-broker is an implementation of a message bus as defined by the D-Bus specification. Its aim is to provide high performance and reliability, while keeping compatibility to the D-Bus reference implementation. It is exclusively written for Linux systems, and makes use of many   show more ...  

modern features provided by recent Linux kernel releases. Issues addressed include buffer over-read and null pointer vulnerabilities.

 Feed

Red Hat Security Advisory 2022-6610-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Issues addressed include buffer overflow and heap overflow vulnerabilities.

 Feed

Red Hat Security Advisory 2022-6536-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.11.5.

 Feed

Red Hat Security Advisory 2022-6602-01 - The GNU Privacy Guard is a tool for encrypting data and creating digital signatures, compliant with OpenPGP and S/MIME standards. Issues addressed include a spoofing vulnerability.

 Ne'er-Do-Well News

A Florida teenager who served as a lackey for a cybercriminal group that specializes in cryptocurrency thefts was beaten and kidnapped last week by a rival cybercrime gang. The teen’s captives held guns to his head while forcing him to record a video message pleading with his crew to fork over a $200,000 ransom   show more ...  

in exchange for his life. The youth is now reportedly cooperating with U.S. federal investigators, who are responding to an alarming number of reports of physical violence tied to certain online crime communities. The grisly kidnapping video has been circulating on a number of Telegram chat channels dedicated to SIM-swapping — the practice of tricking or bribing mobile phone store employees into diverting a target’s phone number, text messages and calls to a device the attackers control. The teen, known to the SIM-swapping community by the handle “Foreshadow,” appears to have served as a “holder” — a term used to describe a low-level member of any SIM-swapping group who agrees to carry out the riskiest and least rewarding role of the crime: Physically keeping and managing the various mobile devices and SIM cards that are used in SIM-swapping scams. “Yo, Dan, please bro send the 200k,” Foreshadow said in the video, which was shot on Sept. 15 in the backseat of a moving car. Bleeding from a swollen mouth with two handguns pointed at his head, Foreshadow pleaded for his life. A still shot from that video is available here [Warning: the image is quite graphic]. “They’re going to kill me if you don’t,” Foreshadow continued, offering to get a job as a complicit mobile store employee or “plug” to help with future SIM-swaps. “I’ll pay you back. Just let me know what you need. I got you, for real. Any work for free. Whatever. However long you need me, too. I’ll apply to any store you need me to apply to. I can be a plug. I don’t care if I get caught by the cops or anything. I’ll get that money back for you. I used to do that work.” It’s not clear where in the world the hostage video was recorded. But at one point in the video, the vehicle’s radio can be heard in the background mentioning WMIB, which is a hip-hop station in South Florida that serves both Ft. Lauderdale and Miami. As Foreshadow’s hostage video began making the rounds on SIM-swapping Telegram channels, a rumor surfaced that Foreshadow had died after being shot in the leg. It soon emerged that Foreshadow had not died, and that he was cooperating with the Federal Bureau of Investigation (FBI). Members of the SIM-swapping community were then warned to delete any messages to or from Foreshadow. One of those messages read: JUST IN: FORESHADOW IS NOT DEAD!!!! HES CURRENTLY CO-OPERATING WITH THE FBI DUE TO HIM BEING KIDNAPPED AND AN ATTEMPT TO EXTORT HIM FOR 200K IF YOU HAVE CHATS WITH HIM CLEAR THEM Foreshadow appears to be a teenager from Florida whose first name is Justin. Foreshadow’s main Telegram account was converted from a user profile into a channel on Sept. 15 — the same day he was assaulted and kidnapped — and it is not currently responding to messages. Foreshadow’s erstwhile boss Jarik told KrebsOnSecurity that the youth was indeed shot by his captors, and blamed the kidnapping on a rival SIM-swapper from Australia who was angry over getting shortchanged of the profits from a previous SIM-swapping escapade. The FBI did not immediately respond to requests for comment. Reached via Telegram, the alleged mastermind of the kidnapping — a SIM-swapper who uses the handle “Gus” — confirmed that he ordered the attack on Foreshadow because the holder had held back some of his stolen funds. In the same breath, Gus said Jarik was “gonna get done in next” for sharing Gus’ real name and address with KrebsOnSecurity. “No1 cared about that nigga anyway, he snaked targs [targets] and flaunted it everywhere,” Gus said of Foreshadow. “I’ve been fucked over so many times I’ve lost millions. I am just a guy trying to make more money.” Foreshadow’s experience is the latest example of a rapidly escalating cycle of physical violence that is taking hold of criminal SIM-swapping communities online. Earlier this month, KrebsOnSecurity detailed how multiple SIM-swapping Telegram channels are now replete with “violence-as-a-service” offerings, wherein denizens of the underground hire themselves out to perform various forms of physical violence — from slashing tires and throwing a brick through someone’s window, to conducting drive-by shootings, firebombings and home invasions. On Aug. 12, 2022, 21-year-old Patrick McGovern-Allen of Egg Harbor Township, N.J. was arrested by the FBI and charged with stalking in connection with several of these violence-as-a-service jobs. Prosecutors say the defendant fired a handgun into a Pennsylvania home, and helped to torch another residence in the state with a Molotov Cocktail — all allegedly in service of a beef over stolen cryptocurrency. Earlier this month, three men in the United Kingdom were arrested for attempting to assault a local man and steal his virtual currencies. The local man’s neighbor called the cops and said the three men were acting suspiciously and that one of them was wearing a police uniform. U.K. police stopped the three men allegedly fleeing the scene, and found a police uniform and weapons in the trunk of the car. All three defendants in that case were charged with “intent to cause loss to another to make an unwarranted demand of Crypto Currency from a person.” Dina Temple-Raston and Sean Powers over at The Record recently interviewed several members of the SIM-swapping community about this escalation in violence. That story is also available on the Click Here podcast — Throwing Bricks for $$$: Violence-as-a-Service Comes of Age.

 Feed

Cybersecurity company Imperva has disclosed that it mitigated a distributed denial-of-service (DDoS) attack with a total of over 25.3 billion requests on June 27, 2022. The "strong attack," which targeted an unnamed Chinese telecommunications company, is said to have lasted for four hours and peaked at 3.9 million requests per second (RPS). "Attackers used HTTP/2 multiplexing, or combining

 Feed

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday released an industrial control systems (ICS) advisory warning of seven security flaws in Dataprobe's iBoot-PDU power distribution unit product, mostly used in industrial environments and data centers. "Successful exploitation of these vulnerabilities could lead to unauthenticated remote code execution on the Dataprobe

 Feed

Almost every vendor, from email gateway companies to developers of threat intelligence platforms, is positioning themselves as an XDR player. But unfortunately, the noise around XDR makes it harder for buyers to find solutions that might be right for them or, more importantly, avoid ones that don't meet their needs.  Stellar Cyber delivers an Open XDR solution that allows organizations to use

 Feed

In what's the latest crypto heist to target the decentralized finance (DeFi) space, hackers have stolen digital assets worth around $160 million from crypto trading firm Wintermute. The hack involved a series of unauthorized transactions that transferred USD Coin, Binance USD, Tether USD, Wrapped ETH, and 66 other cryptocurrencies to the attacker's wallet. The company said that its centralized

 Feed

For cybersecurity professionals, it is a huge challenge to separate the “good guys” from the “villains”. In the past, most cyberattacks could simply be traced to external cybercriminals, cyberterrorists, or rogue nation-states. But not anymore. Threats from within organizations – also known as “insider threats” – are increasing and cybersecurity practitioners are feeling the pain.  Traditional

 Feed

The U.S. Federal Communications Commission (FCC) has added Pacific Network Corp, along with its subsidiary ComNet (USA) LLC, and China Unicom (Americas) Operations Limited, to the list of communications equipment and services that have been deemed a threat to national security. The agency said the companies are subject to the Chinese government's exploitation, influence, and control, and could

 Feed

An unknown attacker targeted tens of thousands of unauthenticated Redis servers exposed on the internet in an attempt to install a cryptocurrency miner. It's not immediately known if all of these hosts were successfully compromised. Nonetheless, it was made possible by means of a "lesser-known technique" designed to trick the servers into writing data to arbitrary files – a case of unauthorized

 Guest blog

Bespectacled video conferencing participants have more to worry about than if their hair is uncombed or they have some spinach stuck between their teeth. According to newly-publicised research, they may also be unwittingly leaking sensitive information displayed on their computer screens. Read more in my article on the Hot for Security blog.

2022-09
Aggregator history
Wednesday, September 21
THU
FRI
SAT
SUN
MON
TUE
WED
SeptemberOctoberNovember