Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Toy robot security i ...

 Threats

Kaspersky experts recently studied the security of a popular toy robot model, finding major issues that allowed malicious actors to make a video call to any such robot, hijack the parental account, or, potentially, even upload modified firmware. Read on for the details. What a toy robot can do The toy robot model that   show more ...  

we studied is a kind of hybrid between a smartphone/tablet and a smart-speaker on wheels that enables it to move about. The robot has no limbs, so rolling around the house is its only option to physically interact with its environment. The robots centerpiece is a large touchscreen that can display a control UI, interactive learning apps for kids, and a lively, detailed animated cartoon-like face. Its facial expressions change with context: to their credit the developers did a great job on the robots personality. You can control the robot with voice commands, but some of its features dont support these, so sometimes you have to catch the robot and poke its face the built-in screen. In addition to a built-in microphone and a rather loud speaker, the robot has a wide-angle camera placed just above the screen. A key feature touted by the vendor is parents ability to video-call their kids right through the robot. On the front face, about halfway between the screen and the wheels, is an extra optical-object-recognition sensor that helps the robot avoid collisions. Obstacle recognition being totally independent of the main camera, the developers very usefully added a physical shutter that completely covers the latter. So, if youre concerned that someone might be peeping at you and/or your child through that camera — sadly not without reason as well learn later — you can simply close the shutter. And in case youre worried that someone might be eavesdropping on you through the built-in microphone, you can just turn off the robot (and judging by the time it takes to boot back up, this is an honest-to-goodness shutdown — not a sleep mode). As youd expect, an app for controlling and monitoring the toy is available for parents to use. And, as you must have guessed by now, its all connected to the internet and employs a bunch of cloud services under the hood. If youre interested in the technical details, you can find these in the full version of the security research, which weve published on Securelist. As usual, the more complex the system — the more likely it is to have security holes, which someone might try to exploit to do something unsavory. And here weve reached the key point of this post: after studying the robot closely, we found several serious vulnerabilities. Unauthorized video calling The first thing we found during our research was that malicious actors could make video calls to any robot of this kind. The vendors server issued video session tokens to anyone who had both the robot ID and the parent ID. The robots ID wasnt hard to brute-force: every toy had a nine-character ID similar to the serial number printed on its body, with the first two characters being the same for every unit. And the parents ID could be obtained by sending a request with the robot ID to the manufacturers server without any authentication. Thus, a malicious actor who wanted to call a random child could either try to guess a specific robots ID, or play a chat-roulette game by calling random IDs. Complete parental account hijack It doesnt end there. The gullible system let anyone with a robot ID retrieve lots of personal information from the server: IP address, country of residence, kids name, gender, age — along with details of the parental account: parents email address, phone number, and the code that links the parental app to the robot. This, in turn, opened the door for a far more hazardous attack: complete parental-account hijack. A malicious actor would only have needed to have taken a few simple steps: The first one would have been to log in to the parental account from their own device by using the email address or phone number obtained previously. Authorization required submitting a six-digit one-time code, but login attempts were unlimited so trivial brute-forcing would have done the trick. It would only have taken one click to unlink the robot from the true parental account. Next would have been linking it to the attackers account. Account verification relied on the linking-code mentioned above, and the server would send it to all comers. A successful attack would have resulted in the parents losing all access to the robot, and recovering it would have required contacting tech support. Even then, the attacker could still have repeated the whole process again, because all they needed was the robot ID, which remained unchanged. Uploading modified firmware Finally, as we studied the way that the robots various systems functioned, we discovered security issues with the software update process. Update packages came without a digital signature, and the robot installed a specially formatted update archive received from the vendors server without running any verifications first. This opened possibilities for attacking the update server, replacing the archive with a modified one, and uploading malicious firmware that let the attacker execute arbitrary commands with superuser permissions on all robots. In theory, the attackers would then have been able to assume control over the robots movements, use the built-in cameras and microphones for spying, make calls to robots, and so on. How to stay safe This tale has a happy ending, though. We informed the toys developers about the issues wed discovered, and they took steps to fix them. The vulnerabilities described above have all been fixed. In closing, here are a few tips on staying safe while using various smart gadgets: Remember that all kinds of smart devices — even toys — are typically highly complex digital systems whose developers often fail to ensure secure and reliable storage of user data. As you shop for a device, be sure to closely read user feedback and reviews and, ideally, any security reports if you can find them. Keep in mind that the mere discovery of vulnerabilities in a device doesnt make it inferior: issues can be found anywhere. What you need to look for is the vendors response: its a good sign if any issues have been fixed. Its not a good thing if the vendor appears not to care. To avoid being spied or eavesdropped on by your smart devices, turn them off when youre not using them, and shutter or tape over the camera. Finally, it goes without saying that you should protect all your family members devices with a reliable security solution. A toy-robot hack is admittedly an exotic threat — but the likelihood of encountering other types of online threats is still very high these days.

image for ConnectWise Phishing ...

 Dark Web News

A new ConnectWise phishing campaign has been discovered directed at both the healthcare and cryptocurrency communities in the United States. These campaigns, orchestrated by threat actors on the dark web, have utilized deceptive tactics to distribute malicious software, particularly leveraging the ScreenConnect   show more ...  

vulnerability. ConnectWise ScreenConnect, a legitimate remote support tool widely used by IT professionals and Managed Service Providers (MSPs), has become the focal point of these cyberattacks. By exploiting ScreenConnect vulnerabilities, threat actors have gained unauthorized access to victim systems, enabling them to execute various nefarious activities. ScreenConnect Vulnerability Exploited by Threat Actors According to Cyble Research and Intelligence Labs (CRIL), the modus operandi of these phishing campaigns involves the creation of fraudulent websites, often mimicking legitimate cryptocurrency platforms or healthcare organizations.  Source: Cyble For instance, one such phishing site, “hxxps://rollecoin[.]online,” closely resembled the authentic website of RollerCoin, a platform offering Bitcoin mining simulation games. Unfamiliar to visitors, interacting with these fraudulent sites led to the unwitting download of ScreenConnect client files, placing them at risk of exploitation by hackers, which is the initial point of contact between the threat actors and victims. Source: Cyble Similarly, healthcare entities have been targeted through deceptive websites hosted using subdomain takeovers, such as “sgacor.kenparkmdpllc[.]com,” masquerading as legitimate healthcare platforms. These phishing sites capitalize on the trust associated with renowned healthcare services to lure victims into downloading malicious software. Given the rise of cyberattacks on healthcare facilities, the ConnectWise phishing campaign adds fuel to the fire as threat actors aggressively targets organization related to healthcare and medicine. Similar Incidents Exploiting ScreenConnect Vulnerability Upon analysis, CRIL discovered that the downloaded ScreenConnect client files initiated the deployment of Microsoft Installer files, facilitating the installation of the ScreenConnect service on compromised machines. While active communication between the server and the client was not detected in these instances, the potential for data extraction or malware deployment remained a looming concern. This exploitation of ScreenConnect vulnerabilities is not unprecedented. Previous incidents, documented by various cybersecurity firms, have highlighted similar patterns of abuse.  For example, suspicions arose in February 2021 regarding the potential exploitation of ScreenConnect by threat groups like Static Kitten. Subsequent incidents in May 2022 and November 2023 further highlighted the susceptibility of organizations, particularly in the healthcare sector, to cyberattacks facilitated through ScreenConnect. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Akira Ransomware Gro ...

 Firewall Daily

The Akira ransomware group has set its sights on yet another target: the municipality of Bjuv in Skåne County, South Sweden. The notorious hacker group, known for its brazen cyberattacks against Swedish entities, has issued a warning on the dark web, threatening to leak nearly 200GB of stolen data from Bjuv   show more ...  

Municipality’s systems. The ransomware group’s message, posted on the dark web, outlines the nature of the stolen data, including confidential documents, contracts, agreements, and personal HR files. “We will upload almost 200GB of Bjuvs kommun organization. Confidential documents, contracts, agreements, personal HR files, and so on,” reads the ransomware group message. Despite the Bjuv Data Breach claim made by the cybercriminals, Bjuv Municipality’s official website remains fully functional, raising questions about the authenticity of the cyberattack. Source: Twitter Potential Implication of Bjuvs Data Breach Bjuv Municipality, situated in southern Sweden, plays a pivotal role as a vital administrative center serving the needs of its residents and businesses alike. With its seat nestled in the charming town of Bjuv, the municipality oversees a wide range of essential services and functions, from local governance and infrastructure management to public health and safety initiatives. Given its central role in the region’s administrative landscape, the potential ramifications of a successful Bjuv data breach could reverberate far beyond its borders. The compromised confidentiality of sensitive information, including personal data, financial records, and confidential agreements, could have far-reaching implications for the municipality’s operations and its constituents. Moreover, such a breach has the potential to erode public trust in governmental institutions, casting doubt on the municipality’s ability to safeguard sensitive information and uphold the privacy rights of its residents. In an era marked by increasing concerns over data privacy and cybersecurity, maintaining the integrity of government systems is paramount to preserving public confidence and ensuring the smooth functioning of democratic governance. Akira Ransomware Group’s Previous Targets This latest Bjuvs data breach comes on the heels of previous incidents involving the Akira ransomware group targeting Canadian-based TeraGo, a provider of secure cloud services. In February 2024, the group allegedly infiltrated TeraGo and boasted of accessing 45GB of data, including client agreements and financial records, threatening to expose the information to the public. The denim industry also fell victim to the nefarious activities of the Akira ransomware group, with Amsterdam-based DENHAM the Jeanmaker disclosing a cyberattack in January 2024. While the denim giant confirmed the breach, it refrained from attributing the incident to the ransomware group, leaving the veracity of the claims unconfirmed. Furthermore, the Akira ransomware group’s audacious cyber activities have extended beyond corporate entities to include educational institutions such as Van Buren Public School in Belleville, Michigan. The threat actor boasted of accessing sensitive information about the public school and flaunted their ill-gotten gains on the dark web, although the veracity of this claim awaits official confirmation from authorities. The Cyber Express has reached out to Bjuv Municipality for further information on the cyberattacks on Bjuv and any associated threat actors. As of now, no official statements or responses have been received, leaving the claims for the Bjuv data breach unconfirmed. As this story continues to unfold, The Cyber Express remains committed to providing updates on these rapidly evolving cybersecurity incidents. Stay tuned for the latest developments as authorities investigate these alarming threats and organizations work to enhance their defenses against cybercriminals. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Dark Web Actor Selli ...

 Dark Web News

A newcomer to the underground forum “Crackingx” under the username “10cker” caused a stir by offering the source code of a sophisticated information stealer written in Rust programming language. The post, which garnered immediate attention, outlined the features of the information stealer and   show more ...  

its asking price of $700, available to only one buyer. The stealer features an array of capabilities as detailed by “10cker”. It was designed to extract saved passwords from popular browsers like Google Chrome, Edge, and Brave. Additionally, it could target files from messaging platforms such as Telegram and Discord, along with other document files. To maintain stealth, the stealer came with a hidden console and an auto-startup feature. Notably, it could also mimic user behavior by opening various programs, including images and documents, to avoid arousing suspicion. New Rust-Based Information Stealer on Dark Web To substantiate the claims, “10cker” provided supporting evidence in the form of a Telegram ID and a Vimeo link showcasing the stealer’s ability to evade detection even by updated Windows Security protocols. Source: Reza abasi on LinkedIn Cyber threat intelligence analyst, Reza Abasi, weighed in on the matter, highlighting that “10cker” went as far as sharing the stealer’s file on “Jotti’s malware scan” site to demonstrate its undetectable nature to several antivirus programs, including “F-Secure,” “Bitdefender,” and “Kaspersky.” Source: Reza abasi on LinkedIn Interestingly, a similar post surfaced on another underground forum, “breachforums,”, hinting at a possible connection between “Shnz” and “10cker,” either as the same individual or collaborating actors behind the development of this potent information stealer. The post by “10cker” on the Crackingx forum read, “Stealer source code written in Rust FUD. Selling stealer source code. If you want to use CnC server I can configure it for free. Or you can receive it with email; it’s your choice. Browser: Google Chrome, Edge, Brave saved passwords. Files: Telegram, Discord, and other document files. Hidden console + auto startup.” More Information Stealers on the Market Recently, in a similar instance, Cyble Research & Intelligence Labs (CRIL) reported a new information stealer on the market, possibly a revamped version of the now-closed ObserverStealer. The Malware-as-a-Service (MaaS) ‘AsukaStealer’ was found on a Russian cybercrime forum, with version 0.9.7 offered for $80/month.  Source: Cyble Originally advertised on another forum on January 24, 2024, the malware targets browser data, Discord and Telegram sessions, crypto wallets, screenshots, and files from Steam Desktop Authenticator. Notable features include customizable settings for browsers, file grabbing, and process capturing. The malware shares similarities with ObserverStealer, suggesting it is a revamped version.  Source: Cyble Similarly, last month, a similar info-stealer was recorded on the dark web. Known as the Atomic Stealer (AMOS), the threat actors behind it were using phishing websites masquerading as popular Mac applications to distribute the information stealer. As of the analysis’s publication, these deceptive sites remain operational. AMOS undergoes constant updates, showcasing the developer’s dedication to enhancing its malicious functionalities. .  What are Info-stealers? Information stealers or infostealers are a form of malware designed to pilfer sensitive data such as login credentials, financial information, and personal details from victims’ systems. This stolen data is often sold on the darknet for illicit purposes.  Info-stealers operate across platforms like Windows and Linux, aiming to bypass multi-factor authentication and gain access to user accounts. They commonly spread through phishing emails, keylogging, data exfiltration, and infected software or hardware. Notable examples include Redline, Vidar, and Raccoon info-stealers.  To mitigate the risk, users should scan email attachments, use endpoint detection solutions, and avoid downloading from untrusted sources. Countermeasures also include updating software, using password managers, and implementing email validation systems.  Regular backups, network segmentation, and application whitelisting are recommended to minimize the impact of potential attacks. Removal tools like CSK Free Bot Removal Tool can help detect and eliminate information stealers. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for RansomHouse Adds Web ...

 Dark Web News

The notorious RansomHouse ransomware group has struck again, targeting two new victims and adding them to their dark web portal. Among the entities allegedly compromised in this RansomHouse ransomware cyberattack are Webber International University and GCA Nederland. The claims were added last week where the threat   show more ...  

actors have shared the dates of the intrusion. According to its post, the GCA Nederland cyberattack was initiated on February 12, 2024. The Webber International University cyberattack on the other hand was added on January 20, 2024.  RansomHouse Ransomware Cyberattack: Two New Victims Added Source: X The first alleged victim on this list, Webber International University, is renowned for its distinction as one of “America’s Best Value Colleges’ and its diverse student body representing over 48 nations. Despite its esteemed reputation, Webber International University faced a grave threat as the threat actor encrypted its data last month. The cybercriminals brazenly demanded action from the university, cautioning against the leakage or sale of confidential data to third parties. Source: X Similarly, GCA Nederland, an important component of the pan-European logistics provider Groupe Charles Andre, found itself targeted by the RansomHouse ransomware group. Specializing in the transportation of goods and offering comprehensive services to streamline logistics, GCA Nederland encountered the RansomHouse ransomware attack last month.  Similar RansomHouse Ransomware Attacks The Cyber Express has reached out to both Webber International University and GCA Nederland regarding the purported cyberattack orchestrated by the RansomHouse ransomware group. However, at the time of writing this, no official statements or responses have been received, leaving the claims of the RansomHouse ransomware cyberattack on these entities unverified. Despite the threats posed by the RansomHouse ransomware group, the websites of Webber International University and GCA Nederland remained operational, showing no immediate signs of the cyberattack. This suggests a stealthy infiltration targeting the databases rather than overt disruptions to the front-end interfaces through DDoS attacks or defacements. The incident involving Webber International University and GCA Nederland cyberattack echoes similar cybersecurity incidents faced by Banco Promerica in the past. The financial institution grappled with the fallout of a data breach, initially brought to light by RansomHouse in December and further highlighted by the Snatch ransomware group’s listing of the institution on January 11th. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Dark Web User Sellin ...

 Dark Web News

A Brazilian currency exchange cyberattack has surfaced on the dark web, offering unauthorized access for a price tag of $15,000. The illicit offer was posted on a dark web forum where a user named ‘Dementorfraud’ is selling access to an undisclosed Brazilian currency exchange. Although the specific identity of   show more ...  

the targeted Brazilian currency exchange remains undisclosed, the threat actor’s post provided insight into the compromised entity. The cyberattack on this exchange is just one example of the numerous assaults witnessed by financial institutions in recent years. The Brazilian Currency Exchange Cyberattack and Similar Incidents Source: Daily Dark Web The Brazilian Currency Exchange cyberattack was posted by a user who joined the platform in 2024. The threat actor post reads, “Selling access to a Brazilian currency exchange. The company sends a cache by mail. Inside the log: huge databases, selfies, selfies with documents, and most importantly- the ability to send the cache to your drops (up to $10k per sending) The implementation of the log depends only on your imagination”. Moreover, this cyberattack on currency exchange follows a similar intrusion that happened in 2020, impacting Travelex, a popular foreign currency exchange. According to official reports, Travelex faced a severe operational and reputational crisis due to a major cyber assault.  Hackers disrupted the firm’s website and forced its offices worldwide to resort to manual processes. The attackers, purportedly a ransomware gang, demanded £4.6 million from Travelex to restore normal operations. Despite efforts to mitigate the damage, the incident tarnished Travelex’s reputation irreparably. Cyberattack on Cryptocurrency Firms: A Growing Trend Similarly, the cryptocurrency industry has witnessed its share of high-profile hacks. In March 2022, the Ronin Network, which supports the Axie Infinity blockchain gaming platform, fell victim to a massive breach, resulting in the theft of approximately $625 million worth of Ethereum and USDC stablecoin. U.S. officials linked a North Korean state-backed hacking collective, Lazarus Group, to the theft, making it one of the largest cryptocurrency hacks in history. Another notable incident occurred in August 2021 when a lone hacker exploited vulnerabilities in the Poly Network decentralized finance platform, absconding with over $600 million. However, the hacker surprisingly cooperated with efforts to return the stolen funds, signaling a peculiar motive behind the attack. In November 2022, FTX, a prominent player in the crypto industry, declared bankruptcy after losing over $600 million in a hacking incident. The exchange’s wallets were compromised, leading to losses for its users and a subsequent investigation into the breach. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Mogilevich Ransomwar ...

 Firewall Daily

The Mogilevich ransomware group has claimed responsibility for a cyberattack on Bazaarvoice, a leading platform connecting brands and retailers with their customers. The group boasted of successfully infiltrating Bazaarvoice’s systems and flaunted the organization’s revenue, totaling a staggering $350.2   show more ...  

million. According to the ransomware group’s message, they have compromised a trove of sensitive data, including first names, last names, company names, business emails, and passwords. The size of the compromised data is reported to be a substantial 30GB. The message posted by the ransomware group left no room for doubt, stating, “We successfully pwned Bazaarvoice’s servers. Cyberattack on Bazaarvoice: In-detail Furthermore, the ransomware group has put the compromised data up for sale, with a message inviting interested parties to make a purchase. The ominous deadline set by the attackers only adds to the urgency of the situation. However, amidst the chaos, doubts have arisen regarding the authenticity of the claims. Upon accessing Bazaarvoice’s official website, it was found to be fully functional, raising questions about the veracity of the cyberattack. Source: Twitter Bazaarvoice, headquartered in Austin, Texas, has built a reputation for its people-first approach to advanced technology, connecting brands and retailers with the voices of their customers. If the claims of the attack on Bazaarvoice are proven true, the implications could be far-reaching, affecting not only Bazaarvoice but also the countless brands and retailers in its network. The potential fallout from the Bazaarvoice cyberattack extends beyond the organization itself, impacting its network of brands and retailers worldwide. As a trusted platform facilitating customer connections, a breach of Bazaarvoice’s systems could erode trust, leading to reputational damage and loss of business. Additionally, the breach could expose sensitive customer data, resulting in legal liabilities, regulatory fines, and financial losses. Previous Victim of Mogilevich Ransomware Group This latest incident comes on the heels of a similar cyberattack on Infiniti USA, the luxury vehicle division of Nissan, by the same ransomware group. The emergence of the Mogilevich ransomware group, potentially named after the notorious transnational crime boss Semion Mogilevich, adds a new layer of complexity to the cybersecurity landscape. The timing of the cyberattack, coinciding with the dismantling of the LockBit ransomware group by UK law enforcement agencies, raises concerns about the interconnected nature of cyber threats. The swift emergence of new threat actors like the Mogilevich group suggests a sophisticated network of cybercriminals collaborating on a global scale. The Cyber Express has reached out to Bazaarvoice for further information on the Bazaarvoice cyberattack and any associated threat actors. As of now, no official statement or response has been received, leaving the claims for the cyberattack unconfirmed. This is an ongoing story, and The Cyber Express remains committed to providing updates as new developments unfold. Stay tuned for the latest developments in this rapidly evolving cybersecurity saga. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

 Expert Blogs and Opinion

Security teams often rely on manual Excel work to manage their cybersecurity operations, despite the limitations and inefficiencies of using spreadsheets for such critical tasks.

 Trends, Reports, Analysis

A report from Coalition predicts a 25% increase in common vulnerabilities and exposures (CVEs) in 2024, reaching 34,888 vulnerabilities. This sharp rise in CVEs raises concerns about software vulnerability and the potential for ransomware attacks.

 Trends, Reports, Analysis

The education sector faces significant cybersecurity risks due to factors such as BYOD culture, vast student data troves, and resource scarcity, making strong cybersecurity measures crucial.

 Threat Intel & Info Sharing

NIST has updated the Cybersecurity Framework (CSF) to include quick-start guides, success stories, and a searchable catalog of references, making it more accessible and actionable for a wider range of organizations and sectors.

 Security Products & Services

The tool offers a wide range of features including IP info, SSL chain, DNS records, cookies, headers, server location, open ports, and more, making it a valuable resource for both OSINT investigations and general curiosity.

 Identity Theft, Fraud, Scams

Fake wallet apps for China's digital currency are circulating, leading to warnings from the Ministry of Industry and Information Technology about potential scams and data theft.

 Malware and Vulnerabilities

The new version of Pikabot features simpler encryption algorithms, anti-debugging methods, and plaintext bot configuration, indicating a new codebase with potential future improvements.

 Feed

Ubuntu Security Notice 6663-1 - As a security improvement, this update prevents OpenSSL from returning an error when detecting wrong padding in PKCS#1 v1.5 RSA, to prevent its use in possible Bleichenbacher timing attacks.

 Feed

Ubuntu Security Notice 6305-2 - USN-6305-1 fixed several vulnerabilities in PHP. This update provides the corresponding update for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. It was discovered that PHP incorrectly handled certain XML files. An attacker could possibly use this issue to expose sensitive information.

 Feed

Ubuntu Security Notice 6662-1 - Yi Yang discovered that the Hotspot component of OpenJDK 21 incorrectly handled array accesses in the C1 compiler. An attacker could possibly use this issue to cause a denial of service, execute arbitrary code or bypass Java sandbox restrictions. It was discovered that the Hotspot   show more ...  

component of OpenJDK 21 did not properly verify bytecode in certain situations. An attacker could possibly use this issue to bypass Java sandbox restrictions.

 Feed

Ubuntu Security Notice 6661-1 - Yi Yang discovered that the Hotspot component of OpenJDK 17 incorrectly handled array accesses in the C1 compiler. An attacker could possibly use this issue to cause a denial of service, execute arbitrary code or bypass Java sandbox restrictions. It was discovered that the Hotspot   show more ...  

component of OpenJDK 17 did not properly verify bytecode in certain situations. An attacker could possibly use this issue to bypass Java sandbox restrictions.

 Feed

Ubuntu Security Notice 6660-1 - Yi Yang discovered that the Hotspot component of OpenJDK 11 incorrectly handled array accesses in the C1 compiler. An attacker could possibly use this issue to cause a denial of service, execute arbitrary code or bypass Java sandbox restrictions. It was discovered that the Hotspot   show more ...  

component of OpenJDK 11 did not properly verify bytecode in certain situations. An attacker could possibly use this issue to bypass Java sandbox restrictions.

 Feed

Ubuntu Security Notice 6659-1 - It was discovered that libde265 could be made to write out of bounds. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service or execute arbitrary code. It was discovered that libde265 could   show more ...  

be made to read out of bounds. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service.

 Feed

Ubuntu Security Notice 6658-1 - It was discovered that libxml2 incorrectly handled certain XML documents. A remote attacker could possibly use this issue to cause libxml2 to crash, resulting in a denial of service, or possibly execute arbitrary code.

 Feed

Ubuntu Security Notice 6657-1 - Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered that Dnsmasq icorrectly handled validating DNSSEC messages. A remote attacker could possibly use this issue to cause Dnsmasq to consume resources, leading to a denial of service. It was discovered that Dnsmasq   show more ...  

incorrectly handled preparing an NSEC3 closest encloser proof. A remote attacker could possibly use this issue to cause Dnsmasq to consume resources, leading to a denial of service.

 Feed

Ubuntu Security Notice 6656-1 - It was discovered that PostgreSQL incorrectly handled dropping privileges when handling REFRESH MATERIALIZED VIEW CONCURRENTLY commands. If a user or automatic system were tricked into running a specially crafted command, a remote attacker could possibly use this issue to execute arbitrary SQL functions.

 Feed

Red Hat Security Advisory 2024-0989-03 - Red Hat Multicluster GlobalHub 1.0.2 General Availability release images, which fix bugs, provide security updates, and update container images. Issues addressed include denial of service and traversal vulnerabilities.

 Feed

A critical security flaw has been disclosed in a popular WordPress plugin called Ultimate Member that has more than 200,000 active installations. The vulnerability, tracked as CVE-2024-1071, carries a CVSS score of 9.8 out of a maximum of 10. Security researcher Christiaan Swiers has been credited with discovering and reporting the flaw. In an advisory published last week, WordPress

 Feed

Cybersecurity and intelligence agencies from the Five Eyes nations have released a joint advisory detailing the evolving tactics of the Russian state-sponsored threat actor known as APT29. The hacking outfit, also known as BlueBravo, Cloaked Ursa, Cozy Bear, Midnight Blizzard (formerly Nobelium), and The Dukes, is assessed to be affiliated with the Foreign Intelligence Service (SVR) of the

 Feed

Cybersecurity researchers have found that it's possible to compromise the Hugging Face Safetensors conversion service to ultimately hijack the models submitted by users and result in supply chain attacks. "It's possible to send malicious pull requests with attacker-controlled data from the Hugging Face service to any repository on the platform, as well as hijack any models that are submitted

 Feed

A security vulnerability has been disclosed in the LiteSpeed Cache plugin for WordPress that could enable unauthenticated users to escalate their privileges. Tracked as CVE-2023-40000, the vulnerability was addressed in October 2023 in version 5.7.0.1. "This plugin suffers from unauthenticated site-wide stored [cross-site scripting] vulnerability and could allow any unauthenticated user

 Feed

An "intricately designed" remote access trojan (RAT) called Xeno RAT has been made available on GitHub, making it available to other actors at no extra cost. Written in C# and compatible with Windows 10 and Windows 11 operating systems, the open-source RAT comes with a "comprehensive set of features for remote system management," according to its developer, who goes by the name moom825

 Feed

Processing alerts quickly and efficiently is the cornerstone of a Security Operations Center (SOC) professional's role. Threat intelligence platforms can significantly enhance their ability to do so. Let's find out what these platforms are and how they can empower analysts. The Challenge: Alert Overload The modern SOC faces a relentless barrage of security alerts generated by SIEMs and EDRs.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Sergiu Gatlan A cyberattack on UnitedHealth Group subsidiary Optum that led to an ongoing outage impacting the Change Healthcare payment exchange platform was linked to the BlackCat ransomware group by sources familiar with the investigation. Change Healthcare warned   show more ...  

customers on Wednesday that some of its services are offline because of a cybersecurity incident. […] La entrada UnitedHealth subsidiary Optum hack linked to BlackCat ransomware – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Bill Toulas A hacking group tracked as ‘UAC-0184’ was observed utilizing steganographic image files to deliver the Remcos remote access trojan (RAT) onto the systems of a Ukrainian entity operating in Finland. UAC-0184 are threat actors Trend Micro saw   show more ...  

carrying out attacks in late 2023 against the Armed Forces of Ukraine, […] La entrada New IDAT loader version uses steganography to push Remcos RAT – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Lawrence Abrams Image: Midjourney If you ever wanted to play DOOM on a lawnmower, you will soon have your chance with a new software update coming to Husqvarna’s robotic line of lawnmowers this spring. The lawnmower company announced last week that owners of the   show more ...  

Automower NERA series can now sign up for […] La entrada Mowing down demons: DOOM comes to Husqvarna smart lawnmowers – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Sergiu Gatlan Image: Midjourney The White House Office of the National Cyber Director (ONCD) urged tech companies today to switch to memory-safe programming languages, such as Rust, to improve software security by reducing the number of memory safety vulnerabilities.   show more ...  

Such vulnerabilities are coding errors or weaknesses within software that can lead […] La entrada White House urges devs to switch to memory-safe programming languages – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Bill Toulas Threat actors are exploiting a CMS editor discontinued 14 years ago to compromise education and government entities worldwide to poison search results with malicious sites or scams. Open redirects are when websites, whether intentionally or through a flaw,   show more ...  

allow arbitrary redirection requests that take users from the original site […] La entrada Hackers exploit 14-year-old CMS editor on govt, edu sites for SEO poisoning – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Sergiu Gatlan Image: Midjourney Members of the Five Eyes (FVEY) intelligence alliance warned today that APT29 Russian Foreign Intelligence Service (SVR) hackers are now switching to attacks targeting their victims’ cloud services. APT29 (also tracked as Cozy   show more ...  

Bear, Midnight Blizzard, The Dukes) breached multiple U.S. federal agencies following the SolarWinds supply-chain attack they orchestrated more […] La entrada Russian hackers shift to cloud attacks, US and allies warn – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Bill Toulas Steel giant ThyssenKrupp confirms that hackers breached systems in its Automotive division last week, forcing them to shut down IT systems as part of its response and containment effort. ThyssenKrupp AG is one of the world’s largest steel producers,   show more ...  

employing over 100,000 personnel and having an annual revenue of over […] La entrada Steel giant ThyssenKrupp confirms cyberattack on automotive division – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Sponsored by Specops Software Organizations recognize the cybersecurity risks posed by their end-users, so they invest in security and awareness training programs to help improve security and mitigate risks. However, cybersecurity training has its limitations,   show more ...  

especially when it comes to changing end-users’ behavior around passwords. Despite being educated on best practices, […] La entrada Cybersecurity Training Not Sticking? How to Fix Risky Password Habits – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

Source: www.bleepingcomputer.com – Author: Bill Toulas A massive ad fraud campaign named “SubdoMailing” is using over 8,000 legitimate internet domains and 13,000 subdomains to send up to five million emails per day to generate revenue through scams and malvertising. The campaign is called   show more ...  

“SubdoMailing, as the threat actors hijack abandoned subdomains and domains belonging to […] La entrada Hijacked subdomains of major brands used in massive spam campaign – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 academic papers

Source: www.schneier.com – Author: Bruce Schneier Apple announced PQ3, its post-quantum encryption standard based on the Kyber secure key-encapsulation protocol, one of the post-quantum algorithms selected by NIST in 2022. There’s a lot of detail in the Apple blog post, and more in Douglas Stabila’s   show more ...  

security analysis. I am of two minds about this. On […] La entrada Apple Announces Post-Quantum Encryption Algorithms for iMessage – Source: www.schneier.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cloud Security

Source: securityboulevard.com – Author: Jeffrey Burt Threat groups continue to look to open source software repositories to launch supply-chain attacks, with cybersecurity vendor Phylum reporting about two instances this month involving npm and the Python Package Index (PyPI). Attackers aim to get their   show more ...  

malicious code into software that is then used by users of the […] La entrada Malicious Packages in npm, PyPI Highlight Supply Chain Threat – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Marc Handelman Authors/Presenters: Jiyong Yu, Aishani Dutta, Trent Jaeger, David Kohlbrenner, Christopher W. Fletcher Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access.   show more ...  

Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel. […] La entrada USENIX Security ’23 – Synchronization Storage Channels (S2C): Timer-less Cache Side-Channel Attacks on the Apple M1 via Hardware Synchronization Instructions – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Ignyte Team If you are managing multiple GRC frameworks for multiple environments, then you know how powerful it is to have clearly-defined and repeatable work processes to enable teams to work together efficiently. To enable efficiency within the organization, Ignyte has   show more ...  

launched common control provider capabilities within the platform for 100+ […] La entrada Save Time and Steps with Ignyte’s Control Inheritance Automation – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Axio Hot Topics Malicious Packages in npm, PyPI Highlight Supply-Chain Threat USENIX Security ’23 – Synchronization Storage Channels (S2C): Timer-less Cache Side-Channel Attacks on the Apple M1 via Hardware Synchronization Instructions Making Companies Whole: The   show more ...  

Impact of Cyber Insurance on Materiality Randall Munroe’s XKCD ‘Light Leap Years’ USENIX Security ’23 – […] La entrada Making Companies Whole: The Impact of Cyber Insurance on Materiality – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Marc Handelman via the comic artistry and dry wit of Randall Munroe, creator of XKCD Permalink *** This is a Security Bloggers Network syndicated blog from Infosecurity.US authored by Marc Handelman. Read the original post at: https://xkcd.com/2897/ Original Post URL:   show more ...  

https://securityboulevard.com/2024/02/randall-munroes-xkcd-light-leap-years/ Category & Tags: Humor,Security Bloggers Network,Randall Munroe,Sarcasm,satire,XKCD – Humor,Security Bloggers […] La entrada Randall Munroe’s XKCD ‘Light Leap Years’ – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Marc Handelman Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access. Originating from the conference’s events situated at the Anaheim Marriott; and via the   show more ...  

organizations YouTube channel. *** This is a Security Bloggers Network syndicated blog from Infosecurity.US authored […] La entrada USENIX Security ’23 – Daniel Katzman, William Kosasih, Chitchanok Chuengsatiansup, Eyal Ronen, Yuval Yarom – The Gates of Time: Improving Cache Attacks with Transient Execution – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 BlackCat ransomware

Source: securityboulevard.com – Author: Jeffrey Burt The LockBit ransomware group is swinging back days after U.S. and UK law enforcement agencies announced they had disrupted the operations of the prolific cybercrime gang, including seizing infrastructure and public-facing websites, grabbing decryption keys,   show more ...  

and indicting two alleged members. LockBit operators reportedly are back up on new infrastructure […] La entrada LockBit Ransomware Group Returns After Law Enforcement Operation – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Application Security

Source: securityboulevard.com – Author: Gilad David Maayan Before we dive into the xSPM trend, let’s define what security posture management (SPM) is. SPM refers to the collective security measures an organization takes to protect its information systems. This involves the ongoing process of identifying,   show more ...  

assessing and managing cybersecurity risks. Security posture management is a dynamic […] La entrada The xSPM Trend: Security Posture Management for Everything – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Dancho Danchev The popular cybercrime-friendly xDedic service was recently shut down and in this analysis we’ll take an in-depth look inside the Internet-connected infrastructure of the xDedic cybercrime-friendly enterprise and will offer practical and relevant   show more ...  

technical insights making it easier for fellow researchers vendors and law enforcement to keep track of […] La entrada Profiling the xDedic Cybercrime Service Enterprise – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cloud Security

Source: www.techrepublic.com – Author: Cedric Pernet Highlights from CrowdStrike’s 2024 report: Identity-based and social engineering attacks still take center stage. Cloud-environment intrusions have increased by 75% from 2022 to 2023. Third-party relationships exploitation makes it easier for attackers to   show more ...  

hit hundreds of targets. CrowdStrike added 34 new threat actors in 2023. Attackers are compromising networks […] La entrada CrowdStrike 2024 Global Threat Report: 6 Key Takeaways – Source: www.techrepublic.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cloud Security

Source: www.techrepublic.com – Author: Luis Millares Best overall free VPN: Proton VPN Best for basic protection: hide.me VPN Best for multiple devices: Windscribe VPN Best beginner VPN: TunnelBear VPN In a world of targeted ads and intrusive malware, virtual private networks (VPNs) are one of the best ways to   show more ...  

keep your online activity secure. VPNs […] La entrada 4 Best Free VPNs for 2024 – Source: www.techrepublic.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Team Register Analysis Cybercriminals follow the money, and increasingly last year that led them to ransomware attacks against the manufacturing industry. Operational technology security firm Dragos, in its 2023 year-in-review report [PDF], found 70 percent of all industrial   show more ...  

org ransomware infections hit manufacturing companies.  Specifically: 638 entities across 33 unique manufacturing […] La entrada Cybercrims: When we hit IT, they sometimes pay, but when we hit OT… jackpot – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 broadcom

Source: go.theregister.com – Author: Team Register Broadcom has delivered on its 2023 teaser of integration between VMware’s SD-WAN and Symantec’s Security Service Edge, by today debuting the “VMware VeloCloud SASE, Secured by Symantec” at Mobile World Congress in Barcelona. The Symantec   show more ...  

Security Service Edge is already classified as a SASE, or Secure Access Service Edge […] La entrada Broadcom builds a better SASE out of VMware VeloCloud and Symantec – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 China

Source: go.theregister.com – Author: Team Register China’s Ministry of Industry and Information Technology has warned local netizens that fake wallet apps for the nation’s central bank digital currency (CBDC) are already circulating and being abused by scammers. The digital renminbi – aka the   show more ...  

e-Yuan or e-CNY – is already widely used in parts of China […] La entrada China warns of fake digital currency wallets fleecing netizens – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Access

Source: go.theregister.com – Author: Team Register A law firm acting on behalf of the Nevada Attorney General Aaron Ford has asked a state court to issue a temporary restraining order (TRO) denying minors access to encrypted communication in Meta’s Messenger application. The motion for a TRO follows   show more ...  

AG’s Ford announcement of civil lawsuits on January […] La entrada Nevada sues to deny kids access to Meta’s Messenger encryption – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 alphv

Source: go.theregister.com – Author: Team Register The ALPHV/BlackCat ransomware gang is reportedly responsible for the massive Change Healthcare cyberattack that has disrupted pharmacies across the US since last week. According to Reuters, citing “two people familiar with the matters,” the   show more ...  

notorious ransomware-as-a-service operation was behind the UnitedHealth owned business’ attack. The Register has not independently […] La entrada ALPHV/BlackCat responsible for Change Healthcare cyberattack – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Team Register Updated LockBit claims it’s back in action just days after an international law enforcement effort seized the ransomware gang’s servers and websites, and retrieved more than 1,000 decryption keys to assist victims. The crew’s latest leak site,   show more ...  

which debuted on Saturday, listed more than a dozen alleged victims including […] La entrada Back from the dead: LockBit taunts cops, threatens to leak Trump docs – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Team Register Webinar The original European Union Network and Information Security (NIS) Directive certainly led to an improvement in member states’ cybersecurity defences, but it struggled to do everything required as cyberattacks and threats scaled up with the growth   show more ...  

in digitalization. It’s successor, the NIS2 Directive, becomes law in October 2024 […] La entrada Everything you need to know about NIS2 – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Access Management

Source: heimdalsecurity.com – Author: Cristian Neagu While Datto is undoubtedly a powerful solution, it has certain limitations which can be frustrating for MSPs. Let’s learn more about some of these limitations, and explore alternative solutions you should consider.  Reasons MSPs Are Looking for Datto   show more ...  

Alternatives Datto is a data backup and recovery provider. They build […] La entrada The 9 Best Datto Alternatives in 2024 (for MSPs) – Source: heimdalsecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0 - CT - CISO Strategics - Cybersecurity

The content you are trying to access is private only to member users of the site. You must have a free membership at CISO2CISO.COM to access this content. You can register for free by clicking on the following link: Register for a free membership in CISO2CISO.COM Thank you so much. CISO2CISO Support Team. La entrada   show more ...  

The major cyberattacks on the telecommunications sector in 2023 se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0 - CT - CISO Strategics - Risk & Compli

The content you are trying to access is private only to member users of the site. You must have a free membership at CISO2CISO.COM to access this content. You can register for free by clicking on the following link: Register for a free membership in CISO2CISO.COM Thank you so much. CISO2CISO Support Team. La entrada Information risk catalogue se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0 - CT - CISO Strategics - Information S

The content you are trying to access is private only to member users of the site. You must have a free membership at CISO2CISO.COM to access this content. You can register for free by clicking on the following link: Register for a free membership in CISO2CISO.COM Thank you so much. CISO2CISO Support Team. La entrada   show more ...  

Confidentiality and Information Security Management Toolkit se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Matias Madou Source: ronstik via Alamy Stock Photo COMMENTARY Although cybersecurity has always been a critical area for organizations that write their own software, we’re rapidly approaching a near-perfect storm of various forces that are elevating the risk profile   show more ...  

of those organizations to unprecedented levels. Organizations that don’t respond by implementing secure-by-design programming […] La entrada 4 Ways Organizations Can Drive Demand for Software Security Training – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Elizabeth Montalbano, Contributing Writer Source: mauritius images GmbH via Alamy Stock Photo Attackers have compromised more than 8,000 subdomains from well-known brands and institutions to mount a sprawling phishing campaign that sends malicious emails numbering in the   show more ...  

millions each day. MSN, VMware, McAfee, The Economist, Cornell University, CBS, Marvel, and eBay […] La entrada eBay, VMware, McAfee Sites Hijacked in Sprawling Phishing Operation – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2024-02
Aggregator history
Tuesday, February 27
THU
FRI
SAT
SUN
MON
TUE
WED
FebruaryMarchApril