To Customer Support To Customer Support

Events
Leaderboard
Customer Support

Home
Community overview
Welcome

Welcome

News, Announcements, Tech Discussions

44866 Topics

Recently active

Most replies Most views Newest first

Jasper_The_RasperModerator

posted in Security Industry News

Large scale Google Ads campaign targets utility software

October 7, 2024 By Jérôme Segura After what seemed like a long hiatus, we’ve observed threat actors returning to malvertising to drop malware disguised as software downloads. The campaign we identified is high-impact, going after utility software such as Slack, Notion, Calendly, Odoo, Basecamp, and others. For this blog, we decided to focus on the Mac version of communication tool Slack.Following the creation of advertiser identities belonging to real businesses, the threat actors launch their malicious ads, hiding their infrastructure behind several layers of fingerprinting and cloaking.We have reported these incidents to Google and the related advertisers have been banned. However, we are still finding new malicious ads and hearing from others seeing the same, indicating that this campaign is not over yet. >>Full Article<<

1 month ago

Jasper_The_RasperModerator

posted in Security Industry News

China’s Salt Typhoon Hacked AT&T, Verizon: Report

The China-linked group Salt Typhoon hacked AT&T and Verizon, possibly compromising wiretap systems, according to WSJ. October 7, 2024 By Eduard Kovacs The China-linked threat group known as Salt Typhoon has hacked into the networks of several major broadband providers in the United States, potentially compromising wiretap systems, according to The Wall Street Journal. The publication reported last month that Salt Typhoon had compromised the systems of unnamed ISPs in the US in search of sensitive information. Salt Typhoon is believed to be a Chinese state-sponsored APT. The WSJ had a follow-up article (paywalled) over the weekend, revealing — based on information from people familiar with the matter — that the threat actor breached the networks of major American telecom companies such as Verizon, AT&T and Lumen Technologies, as well as some service providers outside the US. >>Full Article<<

1 month ago

Jasper_The_RasperModerator

posted in Security Industry News

Kyiv’s hackers launched an unprecedented cyber attack on Russian state media VGTRK on Putin’s birthday

October 7, 2024 By Pierluigi Paganini Russian state media VGTRK faced a major cyberattack, which a Ukrainian source claimed was conducted by Kyiv’s hackers.A Ukrainian government source told Reuters that Kyiv’s hackers are behind the cyber attack that disrupted operations at the Russian state media company VGTRK on Putin’s birthday.The All-Russia State Television and Radio Broadcasting Company (VGTRK, Russian: ВГТРК) or Russian Television and Radio Broadcasting Company, also known as Russian Television and Radio, is a national state-owned broadcaster which operates many television and radio channels in 53 of Russia’s languages. The company was founded in 1990 and is based in Moscow.Kremlin spokesman Dmitry Peskov told media that an “unprecedented hacker attack on its digital infrastructure” is the root cause of the disruption.The cyberattack on VGTRK disrupted online broadcasts, internal services, and communications, reportedly wiping servers and backups.Early on Monday, the cyber att

1 month ago

Jasper_The_RasperModerator

posted in Security Industry News

Qualcomm patches high-severity zero-day exploited in attacks

October 7, 2024 By Sergiu Gatlan Qualcomm has released security patches for a zero-day vulnerability in the Digital Signal Processor (DSP) service that impacts dozens of chipsets.The security flaw (CVE-2024-43047) was reported by Google Project Zero's Seth Jenkins and Amnesty International Security Lab's Conghui Wang, and it is caused by a use-after-free weakness that can lead to memory corruption when successfully exploited by local attackers with low privileges."Currently, the DSP updates header buffers with unused DMA handle fds. In the put_args section, if any DMA handle FDs are present in the header buffer, the corresponding map is freed," as explained in a DSP kernel commit."However, since the header buffer is exposed to users in unsigned PD, users can update invalid FDs. If this invalid FD matches with any FD that is already in use, it could lead to a use-after-free (UAF) vulnerability." >>Full Article<<

1 month ago

TripleHelixModerator

posted in Security Industry News

Gmail Hackers Have Control Of 2FA, Email & Number? Here’s What To Do

Oct 7, 2024,07:31am EDT Here's how to recover your hacked Gmail account.SOPA Images/LightRocket via Getty ImagesSearch any of the Gmail support forums online, from social media platforms such as the Gmail subreddit or the official Gmail community help from Google itself, and one question comes up time and time again: my Gmail account has been hacked, how can I recover it? Disregarding the inevitable dodgy attempts at uncovering some magic way to hack into someone else’s account, the majority are still likely to be genuine requests for help. Take this example, published to the Gmail subreddit Oct. 06, which is analogous to many: “A friend of mine's Google account got stolen. The hacker changed the recovery phone number and email address.” The poster explains that the friend in question had enabled two-factor authentication and asks if anything can be done to recover the account now, “or is he cooked?” Full Story

101

1 month ago

TripleHelixModerator

posted in Security Industry News

Vulnerability Summary for the Week of September 30, 2024 Released Oct 07, 2024

Document IDSB24-281The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:High: vulnerabilities with a CVSS base score of 7.0–10.0 Medium: vulnerabilities with a CVSS base score of 4.0–6.9 Low: vulnerabilities with a CVSS base score of 0.0–3.9Entries may include additional information provided by organizations and efforts sponsored by CISA. Thi

1 month ago

Jasper_The_RasperModerator

posted in Water Cooler

Dame Maggie Smith obituary: A formidable star on stage and screen

Today we lost a true legend with the death of Dame Maggie Smith. Image source,AlamyDame Maggie Smith played the formidable Dowager Countess of Grantham in Downton Abbey https://www.bbc.co.uk/news/articles/crggzy42v30o

101

1 month ago

SsherjjModerator

posted in Water Cooler

HAPPY BIRTHDAY PROTRUCKDRIVER!!!!

Happy Birthday @ProTruckDriver !!!!DAVE Have a great day!!

7210

1 month ago

TripleHelixModerator

posted in Security Industry News

Microsoft September 2024 Security Updates (Patch Tuesday)

This release consists of the following 79 Microsoft CVEs:Tag CVE Base Score CVSS Vector Exploitability FAQs? Workarounds? Mitigations? Windows TCP/IP CVE-2024-21416 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No SQL Server CVE-2024-26186 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No SQL Server CVE-2024-26191 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No Windows Security Zone Mapping CVE-2024-30073 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No SQL Server CVE-2024-37335 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Exploitation Less Likely Yes No No SQL Server CVE-2024-37337 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L/E:U/RL:O/RC:C Exploitation Less Likely Yes No

7713

1 month ago

Jasper_The_RasperModerator

posted in Security Industry News

DPRK's APT37 Targets Cambodia With Khmer, 'VeilShell' Backdoor

It's North Korea versus Cambodia, with Windows default settings and sheer patience allowing the bad guys to avoid easy detection. October 4, 2024 By Nate Nelson The North Korean state-sponsored threat actor known as APT37 has been carefully spreading a novel backdoor, dubbed "VeilShell." Of note is its target: Most North Korean advanced persistent threats (APTs) have a history of targeting organizations in South Korea or Japan, but APT37's latest campaign seems to be directed at a nation Kim Jong-Un has more complex relations with: Cambodia.While Pyongyang still maintains an embassy in Phnom Penh and the two nations share a history of Soviet ties in the region, the modern-day relationship between the two is far from cozy. The DPRK's nuclear weapons program, ongoing missile tests, cyber activities, and general aggression towards its neighbors contradicts Cambodia's stance on weapons of mass destruction (WMDs) and its call for meaningful diplomatic dialogue between all countries in the

1 month ago

Jasper_The_RasperModerator

posted in Security Industry News

Criminals Are Testing Their Ransomware Campaigns in Africa

The booming economies of Africa, rich in natural resources and brimming with potential, are attracting not just investors but also cybercriminals. October 4, 2024 By Kolawole Samuel Adebayo The industry consensus about ransomware is that it's not going away anytime soon, evidenced by the consistent growth of ransomware attacks over the past decade. We've seen some of the biggest ransomware attacks in history — including the JBS, Colonial Pipeline, and Equifax breaches — over the past five years. What's more, between 2023 and 2024, there was an 81% year-on-year jump in the number of recorded ransomware attacks, according to cybersecurity research firm Black Kite.And according to a report earlier this year by cybersecurity research firm Performanta, ransomware gangs have a new strategy: Ransomware-as-a-service (RaaS) organizations are focusing on African nations as initial targets for nation-state attacks before launching malicious campaigns in more developed climes. >>Full Articl

1 month ago

Jasper_The_RasperModerator

posted in Security Industry News

Microsoft and DOJ seized the attack infrastructure used by Russia-linked Callisto Group

October 4, 2024 By Pierluigi Paganini Microsoft and the U.S. DoJ seized over 100 domains used by the Russia-linked Callisto Group for launching attacks on U.S. government and nonprofits.The Justice Department revealed the unsealing of a warrant to seize 41 domains used by Russia-linked Callisto Group (formerly SEABORGIUM, also known as COLDRIVER) for computer fraud in the United States.US DoJ coordinated its operation with Microsoft, this IT giant took civil action to restrain 66 additional domains.“Microsoft’s Digital Crimes Unit (DCU) is disrupting the technical infrastructure used by a persistent Russian nation-state actor Microsoft Threat Intelligence tracks as Star Blizzard. Today, the United States District Court for the District of Columbia unsealed a civil action brought by Microsoft’s DCU, including its order authorizing Microsoft to seize 66 unique domains used by Star Blizzard in cyberattacks targeting Microsoft customers globally, including throughout the United States.” re

1 month ago

Jasper_The_RasperModerator

posted in Security Industry News

Recently patched CUPS flaw can be used to amplify DDoS attacks

October 3, 2024 By Sergiu Gatlan A recently disclosed vulnerability in the Common Unix Printing System (CUPS) open-source printing system can be exploited by threat actors to launch distributed denial-of-service (DDoS) attacks with a 600x amplification factor.As Akamai security researchers found, a CVE-2024-47176 security flaw in the cups-browsed daemon that can be chained with three other bugs to gain remote code execution on Unix-like systems via a single UDP packet can also be leveraged to amplify DDoS attacks.The vulnerability is triggered when an attacker sends a specially crafted packet, tricking a CUPS server into treating a target as a printer to be added. Each packet sent to vulnerable CUPS servers prompts them to generate larger IPP/HTTP requests aimed at the targeted device. This impacts both the target and the CUPS server, consuming their bandwidth and CPU resources. >>Full Article<<

1 month ago

Jasper_The_RasperModerator

posted in Security Industry News

Apple security updates and Rapid Security Responses 3rd October 2024

Apple security updates and Rapid Security Responses 3rd October 2024 Name and information link Available for Release date iOS 18.0.1 and iPadOS 18.0.1 iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later 03 Oct 2024 macOS Sequoia 15.0.1 This update has no published CVE entries. macOS Sequoia 03 Oct 2024 watchOS 11.0.1 This update has no published CVE entries. Apple Watch Series 6 and later 03 Oct 2024 visionOS 2.0.1 This update has no published CVE entries. Apple Vision Pro 03 Oct 2024 Safari 18.0.1 This update has no published CVE entries. macOS Ventura and macOS Sonoma 03 Oct 2024 https://support.apple.com/en-us/100100

1 month ago

TripleHelixModerator

posted in Security Industry News

Release notes for Microsoft Edge Security Updates October 3, 2024

Microsoft has released the latest Microsoft Edge Stable Channel (Version 129.0.2792.79) and Microsoft Edge Extended Stable Channel (128.0.2739.107) which incorporate the latest updates of the Chromium project. For more information, see the Security Update Guide. https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security Make sure to re-add back in the Privacy Protection area after every update. Click on GIF to see full size!

130

1 month ago

Jasper_The_RasperModerator

posted in Security Industry News

North Korea's 'Stonefly' APT Swarms US Private Co's. for Profit

Despite a $10 million bounty on one member, APT45 is not slowing down, pivoting from intelligence gathering to extorting funds for Kim Jong-Un's regime. October 2, 2024 By Tara Seals A well-known North Korean advanced persistent threat (APT) has shifted its focus to targeting private companies in the US for financial gain.Researchers at Symantec's Threat Hunter Team said this week that the state-sponsored group it tracks as "Stonefly" (aka Andariel, APT45, Silent Chollima, and Onyx Sleet) is flaunting an indictment and a $10 million bounty from the US Department of Justice (DoJ), in order to rack up more funds for the Kim Jong-Un regime."Sometimes when you see an indictment against a certain actor, they'll disappear or retool, even if they're based in another jurisdiction," Dick O’Brien, part of the Threat Hunters team at Symantec, tells Dark Reading. "In this case, it seems to be very much business as usual for Stonefly." >>Full Article<<

1 month ago

Jasper_The_RasperModerator

posted in Security Industry News

Linux malware “perfctl” behind years-long cryptomining campaign

October 3, 2024 By Bill Toulas A Linux malware named "perfctl" has been targeting Linux servers and workstations for at least three years, remaining largely undetected through high levels of evasion and the use of rootkits.According to Aqua Nautilus researchers who discovered perfctl, the malware likely targeted millions of Linux servers in recent years and possibly caused infections in several thousands of them.This is based on numerous reports by victims of the malware submitted to online discussion forums, all containing indicators of compromise exclusively associated with perfctl activity.According to Aqua Nautilus, the primary purpose of perfctl is for cryptomining, using the compromised servers to mine the hard-to-trace Monero cryptocurrency. However, it could be easily used for more damaging operations. >>Full Article<<

1 month ago

Jasper_The_RasperModerator

posted in Security Industry News

North Korea ‘Shrouded Sleep’ malware campaign targeting Cambodia, other Southeast Asian nations

October 3, 2024 By Jonathan Greig North Korean government hackers have targeted several Southeast Asian countries — even perceived allies like Cambodia — with a malware campaign over the last year designed to create backdoors into systems at important organizations. Cybersecurity experts at Securonix published a 22-page examination of a campaign they call “Shrouded Sleep,” which they attributed to APT37. Allegedly housed within North Korea’s Ministry of State Security, the group is one of the country’s most prolific hacking operations.“Cambodia appears to be the primary target for this campaign, however, it could extend into other Southeast Asian countries. This is based on the language and countries referenced within the phishing lures, and geographical telemetry data based on related identified samples,” they said. >>Full Article<<

1 month ago

Jasper_The_RasperModerator

posted in Security Industry News

Microsoft and DOJ disrupt Russian FSB hackers' attack infrastructure

October 3, 2024 By Sergiu Gatlan Microsoft and the Justice Department have seized over 100 domains used by the Russian ColdRiver hacking group to target United States government employees and nonprofit organizations from Russia and worldwide in spear-phishing attacks.In December, the United Kingdom and its Five Eyes allies linked this threat group to Russia's Federal Security Service (FSB), the country's internal security and counterintelligence service.According to a partially unsealed affidavit, they attacked a wide range of targets, including United States-based companies and former and current employees of the United States Intelligence Community, Department of Defense, and Department of State, as well as staff at the Department of Energy and U.S. military defense contractors. >>Full Article<<

1 month ago

Jasper_The_RasperModerator

posted in Security Industry News

‘Pig butchering’ trading apps found on Google Play, App Store

October 3, 2024 By Bill Toulas Fake trading apps on Google Play and Apple's App Store lure victims into “pig butchering” scams that have a global reach.The apps have been removed from the official Android and iOS stores after accumulating several thousand downloads, say researcher at cybersecurity company Group-IB, who discovered the fraud.Pig butchering is the name of a scam where the victim is led to believe they are getting high investment returns on a fake trading platform that displays fabricated information. Fraudsters use social engineering to keep the victim depositing funds and prevent them from withdrawing the displayed "profit."The scam is revealed when the victim attempts to cash their money, which the fraudsters have already moved to their accounts. >>Full Article<<

1 month ago

TripleHelixModerator

posted in Security Industry News

Alert CISA Adds One Known Exploited Vulnerability to Catalog Release Date October 03, 2024

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.CVE-2024-45519Synacor Zimbra Collaboration Command Execution VulnerabilityThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing tim

1 month ago

Jasper_The_RasperModerator

posted in Security Industry News

Cisco Patches Critical Vulnerability in Data Center Management Product

A critical-severity vulnerability in Cisco NDFC could allow attackers to execute commands with elevated privileges. October 3, 2024 By Ionut Arghire Cisco on Wednesday announced patches for multiple vulnerabilities across its products, including a critical-severity flaw in Cisco Nexus Dashboard Fabric Controller (NDFC).Tracked as CVE-2024-20432 (CVSS score of 9.9), the critical bug affects the REST API and web UI of NDFC and could allow an authenticated, remote attacker to execute arbitrary commands on an affected device with network-admin privileges.“This vulnerability is due to improper user authorization and insufficient validation of command arguments. An attacker could exploit this vulnerability by submitting crafted commands to an affected REST API endpoint or through the web UI,” Cisco explains in its advisory. >>Full Article<<

1 month ago

Jasper_The_RasperModerator

posted in Security Industry News

A Single Cloud Compromise Can Feed an Army of AI Sex Bots

October 3, 2024 By Brian Krebs Organizations that get relieved of credentials to their cloud environments can quickly find themselves part of a disturbing new trend: Cybercriminals using stolen cloud credentials to operate and resell sexualized AI-powered chat services. Researchers say these illicit chat bots, which use custom jailbreaks to bypass content filtering, often veer into darker role-playing scenarios, including child sexual exploitation and rape.Image: Shutterstock.Researchers at security firm Permiso Security say attacks against generative artificial intelligence (AI) infrastructure like Bedrock from Amazon Web Services (AWS) have increased markedly over the last six months, particularly when someone in the organization accidentally exposes their cloud credentials or key online, such as in a code repository like GitHub.Investigating the abuse of AWS accounts for several organizations, Permiso found attackers had seized on stolen AWS credentials to interact with the large la

1 month ago

Jasper_The_RasperModerator

posted in Security Industry News

Over 4,000 Adobe Commerce, Magento shops hacked in CosmicSting attacks

October 3, 2024 By Bill Toulas Adobe Commerce and Magento online stores are being targeted in "CosmicSting" attacks at an alarming rate, with threat actors hacking approximately 5% of all stores.The CosmicSting vulnerability (CVE-2024-32102) is a critical severity information disclosure flaw; when chained with CVE-2024-2961, a security issue in glibc's iconv function, an attacker can achieve remote code execution on the target server.The critical flaw impacts the following products:Adobe Commerce 2.4.7 and earlier, including 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 Adobe Commerce Extended Support 2.4.3-ext-7 and earlier, 2.4.2-ext-7 and earlier, 2.4.1-ext-7 and earlier, 2.4.0-ext-7 and earlier, 2.3.7-p4-ext-7 and earlier. Magento Open Source 2.4.7 and earlier, including 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 Adobe Commerce Webhooks Plugin versions 1.2.0 to 1.4.0Website security company Sansec has been tracking the attacks since June 2024 and observed 4,275 stores breached in CosmicSting attacks, high-profil

1 month ago

Jasper_The_RasperModerator

posted in Security Industry News

Attackers exploit critical Zimbra vulnerability using cc’d email addresses

When successful, attacks install a backdoor. Getting it to work reliably is another matter. Dan Goodin – 2 Oct 2024 Attackers are actively exploiting a critical vulnerability in mail servers sold by Zimbra in an attempt to remotely execute malicious commands that install a backdoor, researchers warn.The vulnerability, tracked as CVE-2024-45519, resides in the Zimbra email and collaboration server used by medium and large organizations. When an admin manually changes default settings to enable the postjournal service, attackers can execute commands by sending maliciously formed emails to an address hosted on the server. Zimbra recently patched the vulnerability. All Zimbra users should install it or, at a minimum, ensure that postjournal is disabled.Easy, yes, but reliable?On Tuesday, Security researcher Ivan Kwiatkowski first reported the in-the-wild attacks, which he described as “mass exploitation.” He said the malicious emails were sent by the IP address 79.124.49[.]86 and, when suc

1 month ago

1
...
12
13
14
15
16
17
18
...
1795

Page 15 / 1795

Badges

pierrequiroulehas earned the badge Beta To The Max
Daves Big Machas earned the badge Bear Bell (Tech Talk Badge)
russell.harrishas earned the badge Product Help: Posted 50 comments!
JAQ-PChas earned the badge Beta To The Max
tmcmullenhas earned the badge News: Posted 50 comments!

Show all badges

Join the Conversation

Tweets by Webroot

Terms & Conditions

Sign up

Already have an account? Login

Username *

E-mail address *

Password *

I accept the terms & conditions

loginBox.register.email_repeat

Login to the community

No account yet? Create an account

Username or Email

Password

Remember me

Forgot password?

Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.

Enter your e-mail address

Back to overview

Scanning file for viruses.

Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.

This file cannot be downloaded

Sorry, our virus scanner detected that this file isn't safe to download.

Cybersecurity Solutions OpenText Cybersecurity 2024 Threat Report Cyber Resilience Program

LinkedIn Twitter YouTube