Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Transatlantic Cable ...

 News

Episode 291 of the Transatlantic Cable Podcast kicks off with news around OpenAIs recent decision to reduce the amount of information its sharing about how ChatGPT is trained, causing some to worry that its no longer as open as originally designed. From there discussion moves to a recent story around the DEA (Drug   show more ...  

Enforcement Administration) in America and hackers looking to leverage DEAs internal toolset.  Following that, news around hacked crypto ATMs and a new story from Securelist around  a newly discovered APT group, CommonMagic. This episode also includes a discussion with Susi ONeil from Kasperskys Brand Activation Studio to talk about their upcoming audio mini-series called Insight Story. The series aims to help business leaders better understand digital tech such as AI, Metaverse and much more.  To listen to episode one, you can tune in here. If you liked what you heard, please consider subscribing. OpenAI co-founder on companys past approach to openly sharing research: We were wrong Inside the DEA Tool Hackers Allegedly Used to Extort Targets General Bytes Bitcoin ATMs hacked using zero-day, $1.5M stolen Bad magic: new APT found in the area of Russo-Ukrainian conflict

image for Phishing through Sha ...

 Business

A phishing link in the e-mail body is a thing of the past. Mail filters now detect this trick with near 100% efficiency. Thats why cybercriminals are constantly inventing new ways to get their hands on corporate login credentials. We recently came across a rather interesting method that makes use of perfectly   show more ...  

legitimate SharePoint servers. In this post, we explain how the scheme works, and what employees should look out for to avoid trouble. Anatomy of SharePoint phishing The employee receives a standard notification about someone sharing a file. This is unlikely to arouse suspicion (especially if the company where the employee works does actually use SharePoint). This is  because its a real notification from a real SharePoint server. Legitimate notification from a SharePoint server. The unsuspecting employee clicks the link and is taken to the genuine SharePoint server, where the supposed OneNote file appears as intended. Only, inside it looks like another file notification and contains an oversized icon (this time of a PDF file). Assuming this to be another step in the download process, the victim clicks the link — now a standard phishing one. Contents of the supposed OneNote file on the SharePoint server. This link in turn opens a standard phishing site that mimics the OneDrive login page, which readily steals credentials for Yahoo!, AOL, Outlook, Office 365, or another e-mail service. Fake Microsoft OneDrive login page. Why this type of phishing is especially dangerous This is by no means the first case of SharePoint-based phishing. However, this time the attackers dont only hide the phishing link on a SharePoint server, but distribute it through the platforms native notification mechanism. This is possible because, thanks to Microsoft developers, SharePoint has a feature that allows you to share a file thats on a corporate SharePoint site with external participants who dont have direct access to the server. Instructions on how to do this are given on the companys website. All the attackers have to do is gain access to someones SharePoint server (using a similar or any other phishing trick). That done, they upload the file with the link and add a list of e-mails to share it with. SharePoint itself helpfully notifies the e-mail owners. And these notifications will sail through all filters since they come from the legitimate service of some real company. How to stay safe To prevent your employees falling victim to scam e-mails, they need to be able to spot the telltale signs. In this case, the obvious red flags are as follows: When we dont know who shared the file (its good practice to never open files from strangers). When we dont know what kind of file it is (people normally dont share files off the cuff without an explanation of what they sent and why). The e-mail talks about a OneNote file — but on the server we see a PDF. The file download link takes us to a third-party site that has nothing to do with either the victims company or SharePoint. The file supposedly resides on a SharePoint server, yet the site mimics OneDrive — these are two different Microsoft services. To make sure, we recommend holding regular security-awareness trainings for employees. A specialized online platform can help with this. What the above-described ploy clearly demonstrates is that security solutions with anti-phishing technology must be installed not only at the corporate mail server level but on all employees work devices as well.

image for Google Suspends Chin ...

 A Little Sunshine

Google says it has suspended the app for the Chinese e-commerce giant Pinduoduo after malware was found in versions of the app. The move comes just weeks after Chinese security researchers published an analysis suggesting the popular e-commerce app sought to seize total control over affected devices by exploiting   show more ...  

multiple security vulnerabilities in a variety of Android-based smartphones. In November 2022, researchers at Google’s Project Zero warned about active attacks on Samsung mobile phones which chained together three security vulnerabilities that Samsung patched in March 2021, and which would have allowed an app to add or read any files on the device. Google said it believes the exploit chain for Samsung devices belonged to a “commercial surveillance vendor,” without elaborating further. The highly technical writeup also did not name the malicious app in question. On Feb. 28, 2023, researchers at the Chinese security firm DarkNavy published a blog post purporting to show evidence that a major Chinese ecommerce company’s app was using this same three-exploit chain to read user data stored by other apps on the affected device, and to make its app nearly impossible to remove. The three Samsung exploits that DarkNavy says were used by the malicious app. In November 2022, Google documented these three same vulnerabilities being used together to compromise Samsung devices. DarkNavy likewise did not name the app they said was responsible for the attacks. In fact, the researchers took care to redact the name of the app from multiple code screenshots published in their writeup. DarkNavy did not respond to requests for clarification. “At present, a large number of end users have complained on multiple social platforms,” reads a translated version of the DarkNavy blog post. “The app has problems such as inexplicable installation, privacy leakage, and inability to uninstall.” On March 3, 2023, a denizen of the now-defunct cybercrime community BreachForums posted a thread which noted that a unique component of the malicious app code highlighted by DarkNavy also was found in the ecommerce application whose name was apparently redacted from the DarkNavy analysis: Pinduoduo. A Mar. 3, 2023 post on BreachForums, comparing the redacted code from the DarkNavy analysis with the same function in the Pinduoduo app available for download at the time. On March 4, 2023, e-commerce expert Liu Huafang posted on the Chinese social media network Weibo that Pinduoduo’s app was using security vulnerabilities to gain market share by stealing user data from its competitors. That Weibo post has since been deleted. On March 7, the newly created Github account Davinci1010 published a technical analysis claiming that until recently Pinduoduo’s source code included a “backdoor,” a hacking term used to describe code that allows an adversary to remotely and secretly connect to a compromised system at will. That analysis includes links to archived versions of Pinduoduo’s app released before March 5 (version 6.50 and lower), which is when Davinci1010 says a new version of the app removed the malicious code. Pinduduo has not yet responded to requests for comment. Pinduoduo parent company PDD Holdings told Reuters Google has not shared details about why it suspended the app. The company told CNN that it strongly rejects “the speculation and accusation that Pinduoduo app is malicious just from a generic and non-conclusive response from Google,” and said there were “several apps that have been suspended from Google Play at the same time.” Pinduoduo is among China’s most popular e-commerce platforms, boasting approximately 900 million monthly active users. Most of the news coverage of Google’s move against Pinduoduo emphasizes that the malware was found in versions of the Pinduoduo app available outside of Google’s app store — Google Play. “Off-Play versions of this app that have been found to contain malware have been enforced on via Google Play Protect,” a Google spokesperson said in a statement to Reuters, adding that the Play version of the app has been suspended for security concerns. However, Google Play is not available to consumers in China. As a result, the app will still be available via other mobile app stores catering to the Chinese market — including those operated by Huawei, Oppo, Tencent and VIVO. Google said its ban did not affect the PDD Holdings app Temu, which is an online shopping platform in the United States. According to The Washington Post, four of the Apple App Store’s 10 most-downloaded free apps are owned by Chinese companies, including Temu and the social media network TikTok. The Pinduoduo suspension comes as lawmakers in Congress this week are gearing up to grill the CEO of TikTok over national security concerns. TikTok, which is owned by Beijing-based ByteDance, said last month that it now has roughly 150 million monthly active users in the United States. A new cybersecurity strategy released earlier this month by the Biden administration singled out China as the greatest cyber threat to the U.S. and Western interests. The strategy says China now presents the “broadest, most active, and most persistent threat to both government and private sector networks,” and says China is “the only country with both the intent to reshape the international order and, increasingly, the economic, diplomatic, military, and technological power to do so.”

image for Episode 249: Intel F ...

 Business

Paul speaks with Steve Orrin, the Federal CTO at Intel Corp about representing Intel and its technologies to Uncle Sam and the impact of the CHIPS Act a massive new federal investment in semiconductors. The post Episode 249: Intel Federal CTO Steve Orrin on the CHIPS Act and Supply Chain Security appeared first on The   show more ...  

Security Ledger with Paul F....Read the whole entry... » Click the icon below to listen. Related StoriesForget the IoT. Meet the IoZ: our Internet of Zombie thingsEpisode 248: GitHub’s Jill Moné-Corallo on Product Security And Supply Chain ThreatsCES Overlooks New Report That Finds Auto Cyber Is A Dumpster Fire

 Malware and Vulnerabilities

“The new variant of the FakeGPT Chrome extension, titled 'Chat GPT For Google,' is once again targeting your Facebook accounts under a cover of a ChatGPT integration for your Browser,” reads the post published by Guardio Labs.

 Malware and Vulnerabilities

All seven of the externally reported issues are high-severity memory safety bugs, with four of them described as use-after-free vulnerabilities, a type of bug that could lead to arbitrary code execution, data corruption, or denial of service.

 Malware and Vulnerabilities

In the past few months, there have been several Magecart skimmers abusing Google Tag Manager in one way or another. While the Kritec skimmer hangs around the Google Tag Manager script, researchers believe it is not related to other active campaigns.

 Breaches and Incidents

The Center's director said the attack could impact about 3,000 employees, though there have been no reports of problems. The Center purchased cybersecurity and insurance coverage for all employees who may be impacted, for three years.

 Malware and Vulnerabilities

Attackers have been found impersonating legitimate packages via typosquatting to infect .NET developers with cryptocurrency stealers. These malicious packages are delivered through the NuGet repository, with three of them being downloaded over 150,000 times within a month. The malicious packages are designed to   show more ...  

download and execute a PowerShell-based dropper script that configures the compromised system before dropping the second-stage payload.

 Breaches and Incidents

The Soft Cell threat actor, also tracked by Microsoft as Gallium, is known to target unpatched internet-facing services and use tools like Mimikatz to obtain credentials that allow for lateral movement across the targeted networks.

 Companies to Watch

The Israeli startup said the financing was provided by StageOne Ventures, First Rays Venture Partners, and D. E. Shaw & Co. A roster of prominent security practitioners and entrepreneurs also joined the round.

 Breaches and Incidents

M7 Group’s Czech and Slovak operator Skylink has reportedly fallen victim to a hacker attack. Skylink offers DTH and internet TV services in the Czech Republic and Slovakia.

 Trends, Reports, Analysis

The number of false claims is at times challenging to debunk. However, despite the inaccuracy of most claims, when hacktivist activity targeting OT becomes commonplace, the likelihood of actual and even substantial OT incidents increases.

 Malware and Vulnerabilities

Cisco published its semiannual IOS and IOS XE software security advisory bundle, which addresses ten vulnerabilities, including six 'high-severity’ ones. The most important three security bugs can be exploited remotely to cause a DoS condition.

 Threat Actors

German and South Korean government agencies warned about a new spear-phishing campaign by the North Korean APT, Kimsuky. The campaign targets experts on issues related to the Korean peninsula. Attackers send a spear-phishing email to the targeted victims, asking them to install a malicious Chrome extension. The other   show more ...  

tactic attempts to exploit Google Play's web-smartphone synchronization function to install malicious apps on the target’s device.

 Breaches and Incidents

Kaspersky researchers have identified cyberattacks targeting government, agriculture, and transportation organizations in Donetsk, Lugansk, and Crimea, conducted by the new Bad Magic APT. The campaign leverages old artifacts created as early as September 2021, along with a previously unseen malicious framework dubbed CommonMagic.

 Feed

This Metasploit module exploits an arbitrary file upload vulnerability and achieves remote code execution in the Monitorr application. Using a specially crafted request, custom PHP code can be uploaded and injected through endpoint upload.php because of missing input validation. Any user privileges can exploit this   show more ...  

vulnerability and it results in access to the underlying operating system with the same privileges under which the web services run (typically user www-data). Monitorr versions 1.7.6m, 1.7.7d, and below are affected.

 Feed

GRR Rapid Response is an incident response framework focused on remote live forensics. The goal of GRR is to support forensics and investigations in a fast, scalable manner to allow analysts to quickly triage attacks and perform analysis remotely. GRR consists of 2 parts: client and server. GRR client is deployed on   show more ...  

systems that one might want to investigate. On every such system, once deployed, GRR client periodically polls GRR frontend servers for work. "Work" means running a specific action: downloading file, listing a directory, etc. GRR server infrastructure consists of several components (frontends, workers, UI servers) and provides web-based graphical user interface and an API endpoint that allows analysts to schedule actions on clients and view and process collected data.

 Feed

Ubuntu Security Notice 5966-1 - Maher Azzouzi discovered an information disclosure vulnerability in the calcsize binary within amanda. calcsize is a suid binary owned by root that could possibly be used by a malicious local attacker to expose sensitive file system information. Maher Azzouzi discovered a privilege   show more ...  

escalation vulnerability in the rundump binary within amanda. rundump is a suid binary owned by root that did not perform adequate sanitization of environment variables or commandline options and could possibly be used by a malicious local attacker to escalate privileges.

 Feed

Ubuntu Security Notice 5942-2 - USN-5942-1 fixed vulnerabilities in Apache HTTP Server. This update provides the corresponding update for CVE-2023-25690 for Ubuntu 16.04 ESM. Lars Krapf discovered that the Apache HTTP Server mod_proxy module incorrectly handled certain configurations. A remote attacker could possibly use this issue to perform an HTTP Request Smuggling attack.

 Feed

Ubuntu Security Notice 5967-1 - It was discovered that the set method in object-path could be corrupted as a result of prototype pollution by sending a message to the parent process. An attacker could use this issue to cause object-path to crash.

 Feed

German and South Korean government agencies have warned about cyber attacks mounted by a threat actor tracked as Kimsuky using rogue browser extensions to steal users' Gmail inboxes. The joint advisory comes from Germany's domestic intelligence apparatus, the Federal Office for the Protection of the Constitution (BfV), and South Korea's National Intelligence Service of the Republic of Korea (NIS

 Feed

Telecommunication providers in the Middle East are the subject of new cyber attacks that commenced in the first quarter of 2023. The intrusion set has been attributed to a Chinese cyber espionage actor associated with a long-running campaign dubbed Operation Soft Cell based on tooling overlaps. "The initial attack phase involves infiltrating Internet-facing Microsoft Exchange servers to deploy

 Feed

An emerging Android banking trojan dubbed Nexus has already been adopted by several threat actors to target 450 financial applications and conduct fraud. "Nexus appears to be in its early stages of development," Italian cybersecurity firm Cleafy said in a report published this week. "Nexus provides all the main features to perform ATO attacks (Account Takeover) against banking portals and

 Feed

In 2022 alone, global cyberattacks increased by 38%, resulting in substantial business loss, including financial and reputational damage. Meanwhile, corporate security budgets have risen significantly because of the growing sophistication of attacks and the number of cybersecurity solutions introduced into the market. With this rise in threats, budgets, and solutions, how prepared are industries

 Feed

Google has stepped in to remove a bogus Chrome browser extension from the official Web Store that masqueraded as OpenAI's ChatGPT service to harvest Facebook session cookies and hijack the accounts. The "ChatGPT For Google" extension, a trojanized version of a legitimate open source browser add-on, attracted over 9,000 installations since March 14, 2023, prior to its removal. It was originally

 Android

It could be a case of aCropalypse now for Google Pixel users, there’s a warning for house buyers, and just why is TikTok being singled out for privacy concerns? All this and much much more is discussed in the latest edition of the “Smashing Security” podcast by computer security veterans Graham Cluley and Carole Theriault, joined this week by Thom Langford.

 Guest blog

If you were sent a USB stick anonymously through the post, would you plug it into your computer? Perhaps you'll think twice when you hear what happened to these Ecuadorian journalists. Read more in my article on the Hot for Security blog.

2023-03
Aggregator history
Thursday, March 23
WED
THU
FRI
SAT
SUN
MON
TUE
MarchAprilMay