Skip to main content
To Customer Support To Customer Support

Welcome

News, Announcements, Tech Discussions

44868 Topics
TripleHelix
Moderator
TripleHelixModerator
posted in Security Industry News
Google Chrome Stable Channel Update for Desktop Tuesday November 19, 2024

Tuesday, November 19, 2024The Stable channel has been updated to 131.0.6778.85/.86 for Windows, Mac and 131.0.6778.85 for Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop_19.html Webroot users make sure to re-add back to Privacy Protection!  

50
TripleHelix
Moderator
2 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
MITRE shares 2024's top 25 most dangerous software weaknesses

November 20, 2024 By Sergiu Gatlan MITRE has shared this year's top 25 list of the most common and dangerous software weaknesses behind more than 31,000 vulnerabilities disclosed between June 2023 and June 2024.Software weaknesses refer to flaws, bugs, vulnerabilities, and errors found in software's code, architecture, implementation, or design.Attackers can exploit them to breach systems where the vulnerable software is running, enabling them to gain control over affected devices and access sensitive data or trigger denial-of-service attacks."Often easy to find and exploit, these can lead to exploitable vulnerabilities that allow adversaries to completely take over a system, steal data, or prevent applications from working," MITRE said today."Uncovering the root causes of these vulnerabilities serves as a powerful guide for investments, policies, and practices to prevent these vulnerabilities from occurring in the first place — benefiting both industry and government stakeholders."To

40
Jasper_The_Rasper
Moderator
2 days ago
TripleHelix
Moderator
TripleHelixModerator
posted in Security Industry News
Alert CISA Adds Two Known Exploited Vulnerabilities to Catalog Release Date November 20, 2024

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.CVE-2024-38812 VMware vCenter Server Heap-Based Buffer Overflow VulnerabilityCVE-2024-38813 VMware vCenter Server Privilege Escalation VulnerabilityThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges al

30
TripleHelix
Moderator
2 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Attackers wield password-spray attacks to zero-in on targets, research finds

Attackers most frequently targeted education, energy and transportation organisations November 20, 2024 By Cybersecurity Dive Password-spray attacks yielded prolific results for attackers across multiple sectors in North America and Europe during Q2 and Q3, the Trellix Advanced Research Center said in a report.The attack surface for password-spray attacks is vast, Trellix found. Attackers commonly target cloud-based systems, including Microsoft 365, Okta, Google Workspace, VPNs, Windows Remote Desktop, AWS, Google Cloud Platform and Microsoft Azure.Attackers most frequently targeted password-spray attacks at education, energy and transportation organisations during the six-month period, the report found. >>Full Article<<

30
Jasper_The_Rasper
Moderator
2 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Ubuntu Linux impacted by decade-old 'needrestart' flaw that gives root

November 20, 2024 By Bill Toulas Five local privilege escalation (LPE) vulnerabilities have been discovered in the needrestart utility used by Ubuntu Linux, which was introduced over 10 years ago in version 21.04.The flaws were discovered by Qualys and are tracked as CVE-2024-48990, CVE-2024-48991, CVE-2024-48992, CVE-2024-10224, and CVE-2024-11003. They were introduced in needrestart version 0.8, released in April 2014, and fixed only yesterday, in version 3.8.Needrestart is a utility commonly used on Linux, including on Ubuntu Server, to identify services that require a restart after package updates, ensuring that those services run the most up-to-date versions of shared libraries.Summary of LPE flawsThe five flaws Qualys discovered allow attackers with local access to a vulnerable Linux system to escalate their privilege to root without user interaction.Complete information about the flaws was made available in a separate text file, but a summary can be found below:CVE-2024-48990: N

30
Jasper_The_Rasper
Moderator
2 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Fintech Giant Finastra Investigating Data Breach

November 19, 2024 By Brian Krebs The financial technology firm Finastra is investigating the alleged large-scale theft of information from its internal file transfer platform, KrebsOnSecurity has learned. Finastra, which provides software and services to 45 of the world’s top 50 banks, notified customers of the security incident after a cybercriminal began selling more than 400 gigabytes of data purportedly stolen from the company.London-based Finastra has offices in 42 countries and reported $1.9 billion in revenues last year. The company employs more than 7,000 people and serves approximately 8,100 financial institutions around the world. A major part of Finastra’s day-to-day business involves processing huge volumes of digital files containing instructions for wire and bank transfers on behalf of its clients.On November 8, 2024, Finastra notified financial institution customers that on Nov. 7 its security team detected suspicious activity on Finastra’s internally hosted file transfe

20
Jasper_The_Rasper
Moderator
2 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
“Sad announcement” email leads to tech support scam

 November 20, 2024 By Pieter Arntz Tech support scammers are again stooping low with their email campaigns. This particular one hints that one of your contacts may have met an untimely end.It all starts with an email titled “Sad announcement” followed by a full name of someone you know. The email may appear to come from the person themselves.A co-worker who received such an email pointed it out to our team. Looking around, I found the first report about such an email in a tweet dating back to February 5, 2024.With some more information about what I was looking for, I managed to find several more.There is a great deal of variation between the emails, but we do have enough samples to show you a pattern which looks like this:Subject: Sad announcement: <First name><Last name>Sometimes the colon is replaced by the word “from”.Then a short sentence to pique the reader’s curiosity, which often references photos. Here are some examples: >>Full Article<<

20
Jasper_The_Rasper
Moderator
2 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Unsecured JupyterLab and Jupyter Notebooks servers abused for illegal streaming of Sports events

November 20, 2024 By Pierluigi Paganini Threat actors exploit misconfigured JupyterLab and Jupyter Notebooks servers to rip sports streams and illegally redistribute them.Researchers from security firm Aqua observed threat actors exploiting misconfigured JupyterLab and Jupyter Notebook servers to hijack environments, deploy streaming tools, and duplicate live sports broadcasts on illegal platforms.“threat actors using misconfigured servers to hijack environments for streaming sports events. By exploiting misconfigured JupyterLab and Jupyter Notebook applications, attackers drop live streaming capture tools and duplicate the broadcast on their illegal server, thus conducting stream ripping” reads the report published by Aqua.JupyterLab and Jupyter Notebook are widely used interactive tools for data science. While essential for data operations, improper security configurations can expose organizations to risks, making secure deployment critical.  >>Full Article<<

20
Jasper_The_Rasper
Moderator
2 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
New Ghost Tap attack abuses NFC mobile payments to steal money

November 20, 2024 By Bill Toulas Cybercriminals have devised a novel method to cash out from stolen credit card details linked to mobile payment systems such as Apple Pay and Google Pay, dubbed 'Ghost Tap,' which relays NFC card data to money mules worldwide.The tactic builds upon the methods previously deployed by mobile malware like NGate, documented by ESET in August, which involved relaying Near Field Communication (NFC) signals from payment cards.Ghost Tap is more obfuscated and more challenging to detect, does not require the card or the victim's device, doesn't need continual victim interchange, and involves money mules on multiple remote locations interacting with Point of Sale (PoS) terminals.Mobile security firm Threat Fabric discovered Ghost Tap, which warns about the increasing adoption and potential of the new tactic, telling BleepingComputer it has recently seen a spike in using this tactic in the wild. >>Full Article<<

20
Jasper_The_Rasper
Moderator
2 days ago
ProTruckDriver
Moderator
ProTruckDriverModerator
posted in Tech Talk
Hidden Mac keyboard shortcuts you might not know

 Mac keyboard shortcuts are a great way to speed yourself up when you’re using your computer. Mastering them means more time spent getting things done and less time spent moving your hands back and forth between keyboard and trackpad.There are the basic Mac keyboard shortcuts like Command-C and Command-V for copy and paste; Command-B, Command-I and Command-U for bold, italics and underline; Command-Z and Shift-Command-Z for undo and redo. But for a lot of people, that’s where their knowledge ends.You can do so much more than you may know. Here’s a guide to the best Mac keyboard shortcuts. ⇨⇨ Full Article ⇦⇦

192
russell.harris
Popular Voice
2 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Botnet fueling residential proxies disrupted in cybercrime crackdown

November 19, 2024 By Ionut Ilascu The Ngioweb botnet, which supplies most of the 35,000 bots in the cybercriminal NSOCKS proxy service, is being disrupted as security companies block traffic to and from the two networks.Following an investigation of more than one year, researchers identified the complete architecture and traffic of the Ngioweb botnet proxy server, which was first observed in 2017.Ngioweb supplying 80% of NSOCKS proxiesSince late 2022, the proxy service at nsocks[.]net has been providing residential gateways for malicious activity under the NSOCKS name.Multiple cybersecurity companies have reported that many of the proxies offered by NSOCKS were from the Ngioweb botnet but not all its command-and-control (C2) nodes were discovered. Ngioweb post-compromise activitysource: Lumen >>Full Article<<

50
Jasper_The_Rasper
Moderator
3 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Apple Confirms Zero-Day Attacks Hitting macOS Systems

See Also Apple security updates and Rapid Security Responses 19th November 2024 Apple rushes out out major macOS and iOS security updates to cover a pair of vulnerabilities already being exploited in the wild. November 19, 2024 By Ryan Naraine  Apple has rushed out major macOS and iOS security updates to cover a pair of vulnerabilities already being exploited in the wild.The vulnerabilities, credited to Google’s TAG (Threat Analysis Group), are being actively exploited on Intel-based macOS systems, Apple confirmed in an advisory released on Tuesday.As is customary, Apple’s security response team did not provide any details on the reported attacks or indicators of compromise (IOCs) to help defenders hunt for signs of infections.Raw details on the patched vulnerabilities:CVE-2024-44308 — JavaScriptCore — Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.CV

20
Jasper_The_Rasper
Moderator
3 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Helldown ransomware exploits Zyxel VPN flaw to breach networks

November 19, 2024 By Bill Toulas The new 'Helldown' ransomware operation is believed to target vulnerabilities in Zyxel firewalls to breach corporate networks, allowing them to steal data and encrypt devices.French cybersecurity firm Sekoia is reporting this with medium confidence based on recent observations of Helldown attacks.Although not among the major players in the ransomware space, Helldown has quickly grown since its launch over the summer, listing numerous victims on its data extortion portal.Victim announcementsSource: Sekoia >>Full Article<<

20
Jasper_The_Rasper
Moderator
3 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Microsoft launches ‘Zero Day Quest’ competition to enhance cloud and AI security

The tech giant is upping the bounties attached to several popular systems. November 19, 2024 By Greg Otto Microsoft has announced the launch of Zero Day Quest, a significant expansion of its bug bounty programs, focused on uncovering high-impact security vulnerabilities in cloud and AI technologies. Under the program, Microsoft will double the bounty rewards for eligible AI vulnerabilities from Nov. 19, 2024, to Jan. 19, 2025, and give researchers direct access to the company’s dedicated AI engineers and the AI Red Team, which specializes in probing AI systems for potential security flaws. The initiative is part of Microsoft’s broader Secure Future Initiative, launched to pre-emptively address security vulnerabilities across its extensive suite of products and services.Microsoft will also be adding bonus bounty multipliers for valid, important or critical severity issues across Microsoft’s AI, Azure, Microsoft Identity, M365, Dynamics 365, and Power Platform for the length of the chall

20
Jasper_The_Rasper
Moderator
3 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Palo Alto Patches Firewall Zero-Day Exploited in Operation Lunar Peek

See Also Palo Alto Networks warns of critical RCE zero-day exploited in attacks Palo Alto Networks has released patches and CVEs for the firewall zero-days exploited in what the company calls Operation Lunar Peek. November 19, 2024 By Eduard Kovacs Palo Alto Networks on Monday released patches and assigned CVE identifiers for the firewall zero-days that have been exploited in what the company is tracking as Operation Lunar Peek.The security firm reported learning about a potential zero-day in early November — possibly after seeing a sales offer on a cybercrime forum — and confirmed in-the-wild exploitation of a new vulnerability on November 15. On Monday, the cybersecurity giant informed customers that two PAN-OS vulnerabilities have been exploited in these attacks, which targeted “a limited number of management web interfaces that are exposed to internet traffic coming from outside the network”.One of the zero-days is CVE-2024-0012, a critical authentication bypass flaw that allows an

30
Jasper_The_Rasper
Moderator
3 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Ford investgates alleged breach following customer data leak

November 19, 2024 By Bill Toulas Ford is investigating allegations that it suffered a data breach after a threat actor claimed to leak 44,000 customer records on a hacking forum.The leak was announced on Sunday by threat actor 'EnergyWeaponUser,' also implicating the hacker 'IntelBroker,' who supposedly took part in the November 2024 breach.The threat actors leaked on BreachForums 44,000 Ford customer records containing customer information, including full names, physical locations, purchase details, dealer information, and record timestamps.The exposed records aren't extremely sensitive, but they still contain personally identifiable information that could empower phishing and social engineering attacks targeting the exposed individuals. >>Full Article<<

20
Jasper_The_Rasper
Moderator
3 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Apple security updates and Rapid Security Responses 19th November 2024

Apple security updates and Rapid Security Responses 19th November 2024  Name and information link Available for Release date visionOS 2.1.1 Apple Vision Pro 19 Nov 2024 iOS 18.1.1 and iPadOS 18.1.1 iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later 19 Nov 2024 iOS 17.7.2 and iPadOS 17.7.2 iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later 19 Nov 2024 macOS Sequoia 15.1.1 macOS Sequoia 19 Nov 2024  https://support.apple.com/en-us/100100

40
Jasper_The_Rasper
Moderator
3 days ago
TripleHelix
Moderator
TripleHelixModerator
posted in Security Industry News
Alert CISA Adds Three Known Exploited Vulnerabilities to Catalog Release Date November 18, 2024

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.CVE-2024-1212·  Progress Kemp LoadMaster OS Command Injection Vulnerability·  CVE-2024-0012·  Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability·  CVE-2024-9474 Palo Alto Networks PAN-OS Management Interface OS Command Injection VulnerabilityUsers and administrators are also encouraged to review the Palo Alto Threat Brief: Operation Lunar Peekrelated to CVE-2024-0012 for additional information. These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 re

20
TripleHelix
Moderator
4 days ago
TripleHelix
Moderator
TripleHelixModerator
posted in Security Industry News
Vulnerability Summary for the Week of November 11, 2024 Released Nov 18, 2024

Document IDSB24-323The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores.Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:High: vulnerabilities with a CVSS base score of 7.0–10.0 Medium: vulnerabilities with a CVSS base score of 4.0–6.9 Low: vulnerabilities with a CVSS base score of 0.0–3.9Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletin is compi

30
TripleHelix
Moderator
4 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Ransomware Attack on Oklahoma Medical Center Impacts 133,000

Great Plains Regional Medical Center says the personal information of 133,000 individuals was compromised in a ransomware attack. November 18, 2024 By Ionut Arghire Great Plains Regional Medical Center in Oklahoma is notifying over 133,000 individuals that their personal information was compromised in a ransomware attack.The public, not-for-profit healthcare system discovered the attack on September 8, 2024, when ransomware was deployed, but the attackers had access to its systems for at least three days prior.According to the medical center, the attackers accessed and encrypted certain files between September 5 and September 8, and exfiltrated information from its systems.“We learned that the bad actor copied some of those files. We quickly restored our systems and returned to normal operations, but we also determined that a limited amount of patient information was not recoverable,” Great Plains Regional Medical Center says in an incident notice. >>Full Article<<

30
Jasper_The_Rasper
Moderator
4 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Chinese hackers exploit Fortinet VPN zero-day to steal credentials

November 18 2024 By Bill Toulas Chinese threat actors use a custom post-exploitation toolkit named 'DeepData' to exploit a zero-day vulnerability in Fortinet's FortiClient Windows VPN client that steal credentials.The zero-day allows the threat actors to dump the credentials from memory after the user authenticated with the VPN deviceVolexity researchers report that they discovered this flaw earlier this summer and reported it to Fortinet, but the issue remains unfixed, and no CVE has been assigned to it."Volexity reported this vulnerability to Fortinet on July 18, 2024, and Fortinet acknowledged the issue on July 24, 2024," explains the report."At the time of writing, this issue remains unresolved and Volexity is not aware of an assigned CVE number." >>Full Article<<

30
Jasper_The_Rasper
Moderator
4 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Akira Ransomware Racks Up 30+ Victims in a Single Day

 Of the numerous victims, at least three refused to pay the demanded ransom, with the rest seemingly in talks with the cybercriminal group. November 18 2024 By Dark Reading Staff Akira ransomware group has updated its data-leak website on Nov. 13-14, listing more than 30 of its latest victims — the highest single-day total since the gang first began its malicious operations in March of last year.The group spares no one, targeting a variety of industries globally, and operates using a ransomware-as-a-service (RaaS) model, stealing sensitive data before encrypting it.Twenty-five of the latest victims are from the United States, two are from Canada, and the remaining originate from Uruguay, Denmark, Germany, the UK, Sweden, the Czech Republic, and Nigeria. >>Full Article<<

40
Jasper_The_Rasper
Moderator
4 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
QuickBooks popup scam still being delivered via Google ads

 November 18 2024 By Jérôme Segura Accounting software QuickBooks, by Intuit, is a popular target for India-based scammers, only rivaled for top spot by the classic Microsoft tech support scams.We’ve seen two main lures, both via Google ads: the first one is simply a website promoting online support for QuickBooks and shows a phone number, while the latter requires victims to download and install a program that will generate a popup, also showing a phone number. In both instances, that number is fraudulent.The fake QuickBooks popup was previously described in detail by eSentire and reveals how scammers are able to hijack the software functionality by generating bogus alert messages.We ran into an active malvertising campaign recently, indicating that this scheme is still very much alive and well. In this blog post, we review how QuickBooks users that downloaded the program from a malicious ad will be plagued with a popup generated at certain intervals, instilling fear that their data m

20
Jasper_The_Rasper
Moderator
4 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
T-Mobile is one of the victims of the massive Chinese breach of telecom firms

November 18 2024 By Pierluigi Paganini T-Mobile confirmed being a victim of recent hacking campaigns linked to China-based threat actors targeting telecom companies.T-Mobile confirms it was hacked as part of a long-running cyber espionage campaign targeting Telco companies.Recently, the FBI and CISA announced they are continuing to investigate a large-scale cyber-espionage campaign by China-linked threat actors targeting U.S. telecoms, compromising networks to steal call records and access private communications, mainly of government and political figures.The US agencies confirmed that Chinese threat actors had compromised the private communications of a “limited number” of government officials following the compromise of multiple U.S. broadband providers. The cyber spies stole information belonging to targeted individuals that was subject to U.S. law enforcement requests pursuant to court orders. >>Full Article<<

20
Jasper_The_Rasper
Moderator
4 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Critical RCE bug in VMware vCenter Server now exploited in attacks

November 18 2024 By Sergiu Gatlan ​Broadcom warned today that attackers are now exploiting two VMware vCenter Server vulnerabilities, one of which is a critical remote code execution flaw.TZL security researchers reported the RCE vulnerability (CVE-2024-38812) during China's 2024 Matrix Cup hacking contest. It is caused by a heap overflow weakness in the vCenter's DCE/RPC protocol implementation and affects products containing vCenter, including VMware vSphere and VMware Cloud Foundation.The other vCenter Server flaw now exploited in the wild (reported by the same researchers) is a privilege escalation flaw tracked as CVE-2024-38813 that enables attackers to escalate privileges to root with a specially crafted network packet."Updated advisory to note that VMware by Broadcom confirmed that exploitation has occurred in the wild for CVE-2024-38812 and CVE-2024-38813," Broadcom said on Monday.The company released security updates in September to fix both vulnerabilities. Still, roughly one

20
Jasper_The_Rasper
Moderator
4 days ago

Badges

Show all badges

Join the Conversation

Terms & Conditions