Oktacron - Cyber Security RSS Feeds History

How to customize privacy and security in Mastodon | Kaspersky official blog

kaspersky Sep 06, 2023 Privacy

The once cozy world of social media has been getting feverish in recent years. In the battle for audience attention, fly-by-night social networks come and go (Clubhouse, anyone?), users run back and forth, and governments, as ever, ponder the introduction of regulations. Whod have thought, for example, that TikTok show more ...

would be able to displace such monsters as Facebook and Instagram, and also to be banned fully or partially in a host of countries? The public skirmishes between, and overall pantomime of the owners of the worlds largest social networks — Mark Zuckerberg (Facebook, Instagram, Threads) and Elon Musk (X, formerly Twitter) — similarly add nothing in terms of stability. And while Threads, despite analysts predictions, didnt bury Twitter, Musk himself is doing a good job of digging the latters grave: with every new innovation he comes up with, users jump ship in their droves. Catching up, slowly but surely, is YouTube, which has long since morphed from a mere video hosting service into a social media powerhouse boasting 2.5 billion users a month and used by 95% of teenagers; while taking a breather on the sidelines is LinkedIn, having carved out a business niche all for itself. Against this backdrop of upheavals, theres a relatively new… elephant in the room, which more than fills an X-shaped hole. And that is Mastodon (a mastodon, in case you dont know, was a furry elephant — long extinct). But it turns out Mastodon is no newcomer; its still a game-changer… How Mastodon works Created in 2016, Mastodon is a microblogging social network similar to X (ex-Twitter), but based on the principles of decentralization. Unlike X, Mastodon consists of multiple independent servers (called instances) brought together into a single network and interacting with each other, which offers far greater customization and control. Users can select instances according to their preferences and settings, yet still communicate with members from other instances. What are Mastodon instances? Instances are independent servers, each with their own address in the Mastodon network, its own administrator, and its own rules of use. They can be general-purpose, or highly specialized with a unique theme dedicated to specific interests, languages, regions or communities. Users can select the servers they want to register on, while being able to follow accounts registered on other servers and view posts from any account on any server in their timeline. Mastodon is a decentralized social network where each server has its own rules, values and guidelines. The first server to run Mastodon was mastodon.social. The instance was created and is maintained by its founder, Eugen Gargron Rochko, and is very popular. Picking a Mastodon server is like choosing a place to live. How to pick a Mastodon server There are several criteria when it comes to choosing an instance in Mastodon: Community size. Look at the number of registered users on the server. Larger instances are more buzzing with content, but the load on them is higher, and they may run slower. Sign-up process. This option is worth considering if you need to get registered quickly. Some instances offer instant registration; others require confirmation from an administrator. Server location. Instances may be hosted in different countries and regions. If accessibility and connection speed are important, choose a server closer to where you are. Rules and moderation. Each Mastodon instance has its own policies. Before registering on a server, read its rules and make sure they align with your values and expectations. As each server moderates its own content, some may, for example, allow pornography, and even viewing such content can have legal consequences in a number of countries or jurisdictions. Besides local rules, Mastodon has general ones that describe what can and cant be done on the platform. Violation of these common rules can result in the server being blocked and shut down. Example of local rules for the mastodon.social server. Given that this is the server of Mastodons creator, they can in part be considered as general policies. A privacy policy is published for each instance. On the whole, they all contain basic clauses about data collection, usage, storage and security, and about sharing information with third parties. On the odd occasion you might come across a particularly law-abiding server that mentions users rights to delete, amend, or do other things with collected personal data — usually these are EU servers that are subject to the GDPR. Topics and interests. If you like a particular topic, or want to join a community of interest, search for relevant thematic servers. Administration and support. Check whether the server has active administrators and community support. This may come in handy if you have any problems or questions. Server reputation. Find out about an instances reputation by reading reviews or asking other Mastodon users. Already registered? Lets set up privacy! Right after registration, head straight to the settings. First of all, turn on two-factor authentication and set the posting privacy level. You can choose one of three options for your account: Public — everyone can see your posts. Unlisted — everyone can see your posts, but theyre not listed on public timelines. Followers-only — only followers can see your posts. In addition, you can set the privacy level for each individual post: Public Followers-only Direct (visible only to users mentioned in the post) Privacy settings for accounts in general and for individual posts. Additional privacy settings allow you to show or hide your followers and follows in your profile, as well as show what app you use for posting. We recommend unchecking the latter — your readers really dont need to know what app or device you use. Additional privacy settings in Mastodon. On top of that, there are settings for choosing who can find and follow you, and how. For example, you can: enable your public posts to appear in Mastodon search results; make your profile findable in search engines; allow your posts and profile to show up in promos inside Mastodon; and even automatically accept follow requests. How to become a star (or not): customizing how Mastodon tells others about you. Finally, there are options to configure rules (and exceptions to them) for auto-deleting posts after a set period (from one week to two years) — and for archivists to export and download a complete archive of all their data. You can configure auto-deletion of posts, or download all your data. A few final tips Mastodon is a far less regulated social network than the notoriously censor-heavy monsters, but it too has its rules and regulations. That said, these are mostly determined by the server administrator, and you get to choose which server you want out of many. But there are platform-wide policies as well, so when publishing posts you need to take into account the rules of both the specific instance youre registered on and Mastodon in general. Furthermore, the privacy policy directly states: We may also release your information when we believe release is appropriate to comply with the law, enforce our site policies, or protect ours or others rights, property, or safety. So the golden rule — Think Before You Post — applies equally to this social network. Dont forget about security either. Although Mastodon may feel like a hobby club, there might be bad actors amid the like-minders. So, as with other social networks, it pays to protect your privacy and guard against phishing and leaks of personal data on all your devices with the help of Kaspersky Premium.

Experts Fear Crooks are Cracking Keys Stolen in LastPass Breach

krebsonsecurity Sep 06, 2023 A Little Sunshine

In November 2022, the password manager service LastPass disclosed a breach in which hackers stole password vaults containing both encrypted and plaintext data for more than 25 million users. Since then, a steady trickle of six-figure cryptocurrency heists targeting security-conscious people throughout the tech show more ...

industry has led some security experts to conclude that crooks likely have succeeded at cracking open some of the stolen LastPass vaults. Taylor Monahan is founder and CEO of MetaMask, a popular software cryptocurrency wallet used to interact with the Ethereum blockchain. Since late December 2022, Monahan and other researchers have identified a highly reliable set of clues that they say connect recent thefts targeting more than 150 people, Collectively, these individuals have been robbed of more than $35 million worth of crypto. Monahan said virtually all of the victims she has assisted were longtime cryptocurrency investors, and security-minded individuals. Importantly, none appeared to have suffered the sorts of attacks that typically preface a high-dollar crypto heist, such as the compromise of one’s email and/or mobile phone accounts. “The victim profile remains the most striking thing,” Monahan wrote. “They truly all are reasonably secure. They are also deeply integrated into this ecosystem, [including] employees of reputable crypto orgs, VCs [venture capitalists], people who built DeFi protocols, deploy contracts, run full nodes.” Monahan has been documenting the crypto thefts via Twitter/X since March 2023, frequently expressing frustration in the search for a common cause among the victims. Then on Aug. 28, Monahan said she’d concluded that the common thread among nearly every victim was that they’d previously used LastPass to store their “seed phrase,” the private key needed to unlock access to their cryptocurrency investments. MetaMask owner Taylor Monahan on Twitter. Image: twitter.com/tayvano Armed with your secret seed phrase, anyone can instantly access all of the cryptocurrency holdings tied to that cryptographic key, and move the funds to anywhere they like. Which is why the best practice for many cybersecurity enthusiasts has long been to store their seed phrases either in some type of encrypted container — such as a password manager — or else inside an offline, special-purpose hardware encryption device, such as a Trezor or Ledger wallet. “The seed phrase is literally the money,” said Nick Bax, director of analytics at Unciphered, a cryptocurrency wallet recovery company. “If you have my seed phrase, you can copy and paste that into your wallet, and then you can see all my accounts. And you can transfer my funds.” Bax said he closely reviewed the massive trove of cryptocurrency theft data that Taylor Monahan and others have collected and linked together. “It’s one of the broadest and most complex cryptocurrency investigations I’ve ever seen,” Bax said. “I ran my own analysis on top of their data and reached the same conclusion that Taylor reported. The threat actor moved stolen funds from multiple victims to the same blockchain addresses, making it possible to strongly link those victims.” Bax, Monahan and others interviewed for this story say they’ve identified a unique signature that links the theft of more than $35 million in crypto from more than 150 confirmed victims, with roughly two to five high-dollar heists happening each month since December 2022. KrebsOnSecurity has reviewed this signature but is not publishing it at the request of Monahan and other researchers, who say doing so could cause the attackers to alter their operations in ways that make their criminal activity more difficult to track. But the researchers have published findings about the dramatic similarities in the ways that victim funds were stolen and laundered through specific cryptocurrency exchanges. They also learned the attackers frequently grouped together victims by sending their cryptocurrencies to the same destination crypto wallet. A graphic published by @tayvano on Twitter depicting the movement of stolen cryptocurrencies from victims who used LastPass to store their crypto seed phrases. By identifying points of overlap in these destination addresses, the researchers were then able to track down and interview new victims. For example, the researchers said their methodology identified a recent multi-million dollar crypto heist victim as an employee at Chainalysis, a blockchain analysis firm that works closely with law enforcement agencies to help track down cybercriminals and money launderers. Chainalysis confirmed that the employee had suffered a high-dollar cryptocurrency heist late last month, but otherwise declined to comment for this story. Bax said the only obvious commonality between the victims who agreed to be interviewed was that they had stored the seed phrases for their cryptocurrency wallets in LastPass. “On top of the overlapping indicators of compromise, there are more circumstantial behavioral patterns and tradecraft which are also consistent between different thefts and support the conclusion,” Bax told KrebsOnSecuirty. “I’m confident enough that this is a real problem that I’ve been urging my friends and family who use LastPass to change all of their passwords and migrate any crypto that may have been exposed, despite knowing full well how tedious that is.” LastPass declined to answer questions about the research highlighted in this story, citing an ongoing law enforcement investigation and pending litigation against the company in response to its 2022 data breach. “Last year’s incident remains the subject of an ongoing investigation by law enforcement and is also the subject of pending litigation,” LastPass said in a written statement provided to KrebsOnSecurity. “Since last year’s attack on LastPass, we have remained in contact with law enforcement and continue to do so.” Their statement continues: “We have shared various technical information, Indicators of Compromise (IOCs), and threat actor tactics, techniques, and procedures (TTPs) with our law enforcement contacts as well as our internal and external threat intelligence and forensic partners in an effort to try and help identify the parties responsible. In the meantime, we encourage any security researchers to share any useful information they believe they may have with our Threat Intelligence team by contacting securitydisclosure@lastpass.com.” THE LASTPASS BREACH(ES) On August 25, 2022, LastPass CEO Karim Toubba wrote to users that the company had detected unusual activity in its software development environment, and that the intruders stole some source code and proprietary LastPass technical information. On Sept. 15, 2022, LastPass said an investigation into the August breach determined the attacker did not access any customer data or password vaults. But on Nov. 30, 2022, LastPass notified customers about another, far more serious security incident that the company said leveraged data stolen in the August breach. LastPass disclosed that criminal hackers had compromised encrypted copies of some password vaults, as well as other personal information. In February 2023, LastPass disclosed that the intrusion involved a highly complex, targeted attack against a DevOps engineer who was one of only four LastPass employees with access to the corporate vault. “This was accomplished by targeting the DevOps engineer’s home computer and exploiting a vulnerable third-party media software package, which enabled remote code execution capability and allowed the threat actor to implant keylogger malware,” LastPass officials wrote. “The threat actor was able to capture the employee’s master password as it was entered, after the employee authenticated with MFA, and gain access to the DevOps engineer’s LastPass corporate vault.” Dan Goodin at Ars Technica reported and then confirmed that the attackers exploited a known vulnerability in a Plex media server that the employee was running on his home network, and succeeded in installing malicious software that stole passwords and other authentication credentials. The vulnerability exploited by the intruders was patched back in 2020, but the employee never updated his Plex software. As it happens, Plex announced its own data breach one day before LastPass disclosed its initial August intrusion. On August 24, 2022, Plex’s security team urged users to reset their passwords, saying an intruder had accessed customer emails, usernames and encrypted passwords. OFFLINE ATTACKS A basic functionality of LastPass is that it will pick and remember lengthy, complex passwords for each of your websites or online services. To automatically populate the appropriate credentials at any website going forward, you simply authenticate to LastPass using your master password. LastPass has always emphasized that if you lose this master password, that’s too bad because they don’t store it and their encryption is so strong that even they can’t help you recover it. But experts say all bets are off when cybercrooks can get their hands on the encrypted vault data itself — as opposed to having to interact with LastPass via its website. These so-called “offline” attacks allow the bad guys to conduct unlimited and unfettered “brute force” password cracking attempts against the encrypted data using powerful computers that can each try millions of password guesses per second. “It does leave things vulnerable to brute force when the vaults are stolen en masse, especially if info about the vault HOLDER is available,” said Nicholas Weaver, a researcher at University of California, Berkeley’s International Computer Science Institute (ICSI) and lecturer at UC Davis. “So you just crunch and crunch and crunch with GPUs, with a priority list of vaults you target.” How hard would it be for well-resourced criminals to crack the master passwords securing LastPass user vaults? Perhaps the best answer to this question comes from Wladimir Palant, a security researcher and the original developer behind the Adblock Plus browser plugin. In a December 2022 blog post, Palant explained that the crackability of the LastPass master passwords depends largely on two things: The complexity of the master password, and the default settings for LastPass users, which appear to have varied quite a bit based on when those users began patronizing the service. LastPass says that since 2018 it has required a twelve-character minimum for master passwords, which the company said “greatly minimizes the ability for successful brute force password guessing.” But Palant said while LastPass indeed improved its master password defaults in 2018, it did not force all existing customers who had master passwords of lesser lengths to pick new credentials that would satisfy the 12-character minimum. “If you are a LastPass customer, chances are that you are completely unaware of this requirement,” Palant wrote. “That’s because LastPass didn’t ask existing customers to change their master password. I had my test account since 2018, and even today I can log in with my eight-character password without any warnings or prompts to change it.” Palant believes LastPass also failed to upgrade many older, original customers to more secure encryption protections that were offered to newer customers over the years. One important setting in LastPass is the number of “iterations,” or how many times your master password is run through the company’s encryption routines. The more iterations, the longer it takes an offline attacker to crack your master password. Palant noted last year that for many older LastPass users, the initial default setting for iterations was anywhere from “1” to “500.” By 2013, new LastPass customers were given 5,000 iterations by default. In February 2018, LastPass changed the default to 100,100 iterations. And very recently, it upped that again to 600,000. Palant said the 2018 change was in response to a security bug report he filed about some users having dangerously low iterations in their LastPass settings. “Worse yet, for reasons that are beyond me, LastPass didn’t complete this migration,” Palant wrote. “My test account is still at 5,000 iterations, as are the accounts of many other users who checked their LastPass settings. LastPass would know how many users are affected, but they aren’t telling that. In fact, it’s painfully obvious that LastPass never bothered updating users’ security settings. Not when they changed the default from 1 to 500 iterations. Not when they changed it from 500 to 5,000. Only my persistence made them consider it for their latest change. And they still failed implementing it consistently.” A chart on Palant’s blog post offers an idea of how increasing password iterations dramatically increases the costs and time needed by the attackers to crack someone’s master password. Palant said it would take a single GPU about a year to crack a password of average complexity with 500 iterations, and about 10 years to crack the same password run through 5,000 iterations. Image: palant.info However, these numbers radically come down when a determined adversary also has other large-scale computational assets at their disposal, such as a bitcoin mining operation that can coordinate the password-cracking activity across multiple powerful systems simultaneously. Weaver said a password or passphrase with average complexity — such as “Correct Horse Battery Staple” is only secure against online attacks, and that its roughly 40 bits of randomness or “entropy” means a graphics card can blow through it in no time. “An Nvidia 3090 can do roughly 4 million [password guesses] per second with 1000 iterations, but that would go down to 8 thousand per second with 500,000 iterations, which is why iteration count matters so much,” Weaver said. “So a combination of ‘not THAT strong of a password’ and ‘old vault’ and ‘low iteration count’ would make it theoretically crackable but real work, but the work is worth it given the targets.” Reached by KrebsOnSecurity, Palant said he never received a response from LastPass about why the company apparently failed to migrate some number of customers to more secure account settings. “I know exactly as much as everyone else,” Palant wrote in reply. “LastPass published some additional information in March. This finally answered the questions about the timeline of their breach – meaning which users are affected. It also made obvious that business customers are very much at risk here, Federated Login Services being highly compromised in this breach (LastPass downplaying as usual of course).” Palant said upon logging into his LastPass account a few days ago, he found his master password was still set at 5,000 iterations. INTERVIEW WITH A VICTIM KrebsOnSecurity interviewed one of the victims tracked down by Monahan, a software engineer and startup founder who recently was robbed of approximately $3.4 million worth of different cryptocurrencies. The victim agreed to tell his story in exchange for anonymity because he is still trying to claw back his losses. We’ll refer to him here as “Connor” (not his real name). Connor said he began using LastPass roughly a decade ago, and that he also stored the seed phrase for his primary cryptocurrency wallet inside of LastPass. Connor chose to protect his LastPass password vault with an eight character master password that included numbers and symbols (~50 bits of entropy). “I thought at the time that the bigger risk was losing a piece of paper with my seed phrase on it,” Connor said. “I had it in a bank security deposit box before that, but then I started thinking, ‘Hey, the bank might close or burn down and I could lose my seed phrase.'” Those seed phrases sat in his LastPass vault for years. Then, early on the morning of Sunday, Aug. 27, 2023, Connor was awoken by a service he’d set up to monitor his cryptocurrency addresses for any unusual activity: Someone was draining funds from his accounts, and fast. Like other victims interviewed for this story, Connor didn’t suffer the usual indignities that typically presage a cryptocurrency robbery, such as account takeovers of his email inbox or mobile phone number. Connor said he doesn’t know the number of iterations his master password was given originally, or what it was set at when the LastPass user vault data was stolen last year. But he said he recently logged into his LastPass account and the system forced him to upgrade to the new 600,000 iterations setting. “Because I set up my LastPass account so early, I’m pretty sure I had whatever weak settings or iterations it originally had,” he said. Connor said he’s kicking himself because he recently started the process of migrating his cryptocurrency to a new wallet protected by a new seed phrase. But he never finished that migration process. And then he got hacked. “I’d set up a brand new wallet with new keys,” he said. “I had that ready to go two months ago, but have been procrastinating moving things to the new wallet.” Connor has been exceedingly lucky in regaining access to some of his stolen millions in cryptocurrency. The Internet is swimming with con artists masquerading as legitimate cryptocurrency recovery experts. To make matters worse, because time is so critical in these crypto heists, many victims turn to the first quasi-believable expert who offers help. Instead, several friends steered Connor to Flashbots.net, a cryptocurrency recovery firm that employs several custom techniques to help clients claw back stolen funds — particularly those on the Ethereum blockchain. According to Connor, Flashbots helped rescue approximately $1.5 million worth of the $3.4 million in cryptocurrency value that was suddenly swept out of his account roughly a week ago. Lucky for him, Connor had some of his assets tied up in a type of digital loan that allowed him to borrow against his various cryptocurrency assets. Without giving away too many details about how they clawed back the funds, here’s a high level summary: When the crooks who stole Connor’s seed phrase sought to extract value from these loans, they were borrowing the maximum amount of credit that he hadn’t already used. But Connor said that left open an avenue for some of that value to be recaptured, basically by repaying the loan in many small, rapid chunks. WHAT SHOULD LASTPASS USERS DO? According to MetaMask’s Monahan, users who stored any important passwords with LastPass — particularly those related to cryptocurrency accounts — should change those credentials immediately, and migrate any crypto holdings to new offline hardware wallets. “Really the ONLY thing you need to read is this,” Monahan pleaded to her 70,000 followers on Twitter/X: “PLEASE DON’T KEEP ALL YOUR ASSETS IN A SINGLE KEY OR SECRET PHRASE FOR YEARS. THE END. Split up your assets. Get a hw [hardware] wallet. Migrate. Now.” If you also had passwords tied to banking or retirement accounts, or even just important email accounts — now would be a good time to change those credentials as well. I’ve never been comfortable recommending password managers, because I’ve never seriously used them myself. Something about putting all your eggs in one basket. Heck, I’m so old-fashioned that most of my important passwords are written down and tucked away in safe places. But I recognize this antiquated approach to password management is not for everyone. Connor says he now uses 1Password, a competing password manager that recently earned the best overall marks from Wired and The New York Times. 1Password says that three things are needed to decrypt your information: The encrypted data itself, your account password, and your Secret Key. Only you know your account password, and your Secret Key is generated locally during setup. “The two are combined on-device to encrypt your vault data and are never sent to 1Password,” explains a 1Password blog post ‘What If 1Password Gets Hacked?‘ “Only the encrypted vault data lives on our servers, so neither 1Password nor an attacker who somehow manages to guess or steal your account password would be able to access your vaults – or what’s inside them. Weaver said that Secret Key adds an extra level of randomness to all user master passwords that LastPass didn’t have. “With LastPass, the idea is the user’s password vault is encrypted with a cryptographic hash (H) of the user’s passphrase,” Weaver said. “The problem is a hash of the user’s passphrase is remarkably weak on older LastPass vaults with master passwords that do not have many iterations. 1Password uses H(random-key||password) to generate the password, and it is why you have the QR code business when adding a new device.” Weaver said LastPass deserves blame for not having upgraded iteration counts for all users a long time ago, and called the latest forced upgrades “a stunning indictment of the negligence on the part of LastPass.” “That they never even notified all those with iteration counts of less than 100,000 — who are really vulnerable to brute force even with 8-character random passwords or ‘correct horse battery staple’ type passphrases — is outright negligence,” Weaver said. “I would personally advocate that nobody ever uses LastPass again: Not because they were hacked. Not because they had an architecture (unlike 1Password) that makes such hacking a problem. But because of their consistent refusal to address how they screwed up and take proactive efforts to protect their customers.” Bax and Monahan both acknowledged that their research alone can probably never conclusively tie dozens of high-dollar crypto heists over the past year to the LastPass breach. But Bax says at this point he doesn’t see any other possible explanation. “Some might say it’s dangerous to assert a strong connection here, but I’d say it’s dangerous to assert there isn’t one,” he said. “I was arguing with my fiance about this last night. She’s waiting for LastPass to tell her to change everything. Meanwhile, I’m telling her to do it now.”

Securing Your Legacy: Identities, Data, and Processes

darkreading Sep 06, 2023 Feed

Legacy systems of all kinds pose significant cybersecurity risks. Here's how to mitigate them.

AtlasVPN Linux Zero-Day Disconnects Users, Reveals IP Addresses

darkreading Sep 06, 2023 Feed

All it takes is a simple copy-paste to undo a VPN service used by millions worldwide.

Russia's 'Fancy Bear' APT Targets Ukrainian Energy Facility

darkreading Sep 06, 2023 Feed

The group, best known for 2016 US election interference and other attacks on Ukraine, used phishing emails offering pictures of women to lure its victim into opening a malicious attachment.

Google's Souped-up Chrome Store Review Process Foiled by Data-Stealer

darkreading Sep 06, 2023 Feed

Researchers have discovered that despite Google's adoption of the Manifest V3 security standard to protect against malicious plug-ins, attackers can still get bad extensions past its review process.

MinIO Cyberattack Showcases Fresh Corporate Cloud Vector

darkreading Sep 06, 2023 Feed

The open source object storage service was the target of a never-before-seen attack on corporate cloud services, which researchers said should put DevOps in particular on notice.

Overcoming Open Source Vulnerabilities in the Software Supply Chain

darkreading Sep 06, 2023 Feed

By securing access to code and running scans against all code changes, developers can better prevent — and detect — potential risks and vulnerabilities.

New BLISTER Malware Update Fuelling Stealthy Network Infiltration

cyware Sep 06, 2023 Malware and Vulnerabilities

"New BLISTER update includes keying feature that allows for precise targeting of victim networks and lowers exposure within VM/sandbox environments," Elastic Security Labs researchers said in a technical report published late last month.

Ransomware Attacks Soar by 87% in U.K, Reveals JUMPSEC

cyware Sep 06, 2023 Trends, Reports, Analysis

A report from JUMPSEC noted an 87% increase in attacker-reported ransomware in the U.K and a 37% globally in H1 2023. The mass exploitation of vulnerabilities is the primary contributor to this growth. One key reason for the surge in attack figures is due to the growing number of ransomware variants.Organizations must continually enhance their strategies for responding to cyber extortion.

GhostSec Leaks Source Code of Alleged Iranian Surveillance Tool

cyware Sep 06, 2023 Threat Actors

The first messages were posted on August 27, with GhostSec saying it had discovered facial recognition "and various other privacy invading features and tools" within the FANAP group's software.

New Chae$ 4 Strain Targets Financial and Logistics Customers

cyware Sep 06, 2023 Malware and Vulnerabilities

A reworked variant of the Chaes malware, Chae$ 4, is causing havoc in the banking and logistics sectors with significant overhauls. It has been completely rewritten in Python to bypass traditional security defenses and improve communication protocols. It's essential to regularly update and patch software, and employ robust endpoint security solutions to safeguard against such threats.

Atlas VPN Zero-Day Vulnerability Leaks Users’ Real IP Address

cyware Sep 06, 2023 Malware and Vulnerabilities

In a proof of concept exploit shared on Reddit, a researcher describes how the Linux client of Atlas VPN, specifically the latest version, 1.0.3, has an API endpoint that listens on localhost (127.0.0.1) over port 8076.

Mend.io SAML Vulnerability Exposed

cyware Sep 06, 2023 Malware and Vulnerabilities

The vulnerability centers on Mend.io’s implementation of the Security Assertion Markup Language (SAML) login option, a standard method for enabling Single Sign-On (SSO) authentication across various online services.

Nine Vulnerabilities Patched in SEL Power System Management Products

cyware Sep 06, 2023 Malware and Vulnerabilities

Nine vulnerabilities, including potentially serious flaws, were patched recently in a couple of electric power management products made by Schweitzer Engineering Laboratories (SEL).

Nascent Malware Campaign Targets npm, PyPI, and RubyGems Developers

cyware Sep 06, 2023 Malware and Vulnerabilities

A malware campaign targeting software developers in multiple ecosystems (PyPI, npm, and RubyGems) has been discovered, with packages collecting and exfiltrating data from macOS machines.

Evil MinIO Exploits: A New Attack Vector to Breach Corporate Networks

cyware Sep 06, 2023 Breaches and Incidents

An unidentified threat actor weaponized critical security holes in the MinIO high-performance object storage system, gaining unauthorized code execution on targeted servers. Upon launching the application, attackers exploit the flaws to add a backdoor that allows them to conduct remote code execution attacks on show more ...

victims’ systems. It is recommended to apply the available security update to protect their assets from Evil MinIO exploit attacks.

Yes, There's an npm Package Called @(-.-)/env and Some Others Like it

cyware Sep 06, 2023 Trends, Reports, Analysis

These packages have unconventional names and some of them do not follow naming guidelines. While not all of them pose a security risk, they could potentially cause confusion or break software development tooling.

Crypto Gambling Platform Stake.com Back Online After $40 Million Heist

cyware Sep 06, 2023 Breaches and Incidents

Curaçao-headquartered Stake.com offers casino and sports betting for players using cryptocurrency. However, the firm flagged on Monday that it had spotted unauthorized transactions being made from its ETH and BSC hot wallets.

Threat Actors Target NPM, PyPI, and RubyGems Developers

cyware Sep 06, 2023 Malware and Vulnerabilities

A new cyber campaign has emerged, with threat actors uploading malicious packages to PyPI, NPM, and RubyGems repositories, posing a significant threat to macOS user data. The malicious packages would collect system information and exfiltrate it to attacker-controlled servers. Security firm Phylum identified a connection between these packages, suggesting a coordinated campaign against software developers.

Bogus URL Shorteners Go Mobile-Only in AdSense Fraud Campaign

cyware Sep 06, 2023 Malware and Vulnerabilities

The attackers have implemented multiple layers of defense to protect their Google AdSense accounts, including JavaScript execution, mobile user agent checks, user interaction requirements, and server-side user agent checks.

Researchers Discover Critical Vulnerability in PHPFusion CMS

cyware Sep 06, 2023 Malware and Vulnerabilities

The authenticated local file inclusion flaw, identified as CVE-2023-2453, allows for remote code execution if an attacker can upload a maliciously crafted ".php" file to a known path on a target system.

New Agent Tesla Variant Being Spread by Specially Crafted Excel Document

cyware Sep 06, 2023 Malware and Vulnerabilities

A new variant of the Agent Tesla malware is spreading through a phishing campaign, exploiting the CVE-2017-11882/CVE-2018-0802 vulnerability to gain access to victims' devices and steal sensitive information.

ASUS Routers are Affected by Three Critical Remote Code Execution Flaws

cyware Sep 06, 2023 Malware and Vulnerabilities

ASUS routers RT-AX55, RT-AX56U_V2, and RT-AC86U are affected by three critical remote code execution vulnerabilities (CVE-2023-39238, CVE-2023-39239, and CVE-2023-39240) that can potentially allow threat actors to take over the devices.

What Businesses Need To Know To Comply With SEC's New Cyber Disclosure Rules

packetstormsecurity Sep 06, 2023 headline,hacker,government,privacy,usa,d

Big Tech Has Failed To Police Russian Disinformation

packetstormsecurity Sep 06, 2023 headline,government,russia,fraud,cyberwa

Android Zero Day Patched With September 2023 Security Updates

packetstormsecurity Sep 06, 2023 headline,phone,flaw,google,patch,zero da