Skip to main content
To Customer Support To Customer Support

Welcome

News, Announcements, Tech Discussions

45084 Topics
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
New stealthy Pumakit Linux rootkit malware spotted in the wild

December 12, 2024 By Bill Toulas A new Linux rootkit malware called Pumakit has been discovered that uses stealth and advanced privilege escalation techniques to hide its presence on systems.The malware is a multi-component set that includes a dropper, memory-resident executables, a kernel module rootkit, and a shared object (SO) userland rootkit.Elastic Security discovered Pumakit in a suspicious binary ('cron') upload on VirusTotal, dated September 4, 2024, and reported having no visibility into who uses it and what it targets.Generally, these tools are used by advanced threat actors targeting critical infrastructure and enterprise systems for espionage, financial theft, and disruption operations.  >>Full Article<<

50
Jasper_The_Rasper
Moderator
13 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Bitcoin ATM firm Byte Federal hacked via GitLab flaw, 58K users exposed

December 12, 2024 By Bill Toulas US Bitcoin ATM operator Byte Federal has disclosed a data breach that exposed the data of 58,000 customers after its systems were breached using a GitLab vulnerability.Byte Federal is the largest US operator of Bitcoin ATMs across the United States, with over 1,200 ATMs located in forty-two states, allowing people to exchange cash for cryptocurrency.The company is now sending out data breach notifications warning that it suffered a data breach in November after hackers gained access to its systems by exploiting a GitLab vulnerability."On November 18, 2024, Byte Federal became aware of a security breach by a bad actor who gained unauthorized access to one of our servers by exploiting a vulnerability in GitLab, a third-party software platform commonly used by developers worldwide for project management and collaboration with comprehensive security features," reads the Byte Federal data breach notification letter. >>Full Article<<

30
Jasper_The_Rasper
Moderator
13 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
IoT Cloud Cracked by 'Open Sesame' Over-the-Air Attack

Researchers demonstrate how to hack Ruijie Reyee access points without Wi-Fi credentials or even physical access to the device.   December 12, 2024 By Becky Bracken Internet of Things (IoT) vendor Ruijie Networks has shored up its Reyee cloud management platform against 10 newly discovered vulnerabilities that could have given adversaries control of thousands of connected devices in a single cyberattack.The Fuzhou, China-based infrastructure maker's Ruijie Networks devices, are commonly used to provide free Wi-Fi in public settings like airports, schools, shopping malls, and governments across more than 90 countries.A pair of researchers from Claroty Team82 have developed an attack they named "Open Sesame" that they used to successfully take control of Rujie Networks devices through its cloud-based Web management portal for remote monitoring and configuration."The Ruijie Reyee cloud platform lets admins remotely manage their access points and routers," researchers Noam Moshe and Tomer

30
Jasper_The_Rasper
Moderator
13 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Thousands of sites remain unpatched against actively exploited WordPress plugin bug

Vulnerability with severity rating of 9.8 out of possible 10 still live on >8,000 sites. Dan Goodin – 12 Dec 2024 Thousands of sites running WordPress remain unpatched against a critical security flaw in a widely used plugin that was being actively exploited in attacks that allow for unauthenticated execution of malicious code, security researchers said.The vulnerability, tracked as CVE-2024-11972, is found in Hunk Companion, a plugin that runs on 10,000 sites that use the WordPress content management system. The vulnerability, which carries a severity rating of 9.8 out of a possible 10, was patched earlier this week. At the time this post went live on Ars, figures provided on the Hunk Companion page indicated that less than 12 percent of users had installed the patch, meaning nearly 9,000 sites could be next to be targeted. >>Full Article<<

40
Jasper_The_Rasper
Moderator
13 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Microsoft MFA Bypassed via AuthQuake Attack

Oasis Security has disclosed AuthQuake, a method for bypassing Microsoft MFA within an hour without user interaction. December 12, 2024 By Eduard KovacsNon-human identity management firm Oasis Security has disclosed the details of an attack that allowed its researchers to bypass Microsoft’s multi-factor authentication (MFA) implementation.The attack method, dubbed AuthQuake, was reported to Microsoft in late June and a temporary fix was rolled out a few days later. The tech giant released a permanent fix in October. According to Oasis, the vulnerability, which is described as critical, could have allowed threat actors to bypass Microsoft’s MFA and gain access to accounts — provided that they had the target’s username and password.The security firm noted that the MFA bypass could have been exploited to access Outlook emails, OneDrive files, Teams chats, and Azure cloud instances, and highlighted the potential impact by pointing out that Microsoft recently reported having more than 400 m

30
Jasper_The_Rasper
Moderator
13 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
US offers $5 million for info on North Korean IT worker farms

December 12, 2024 By Sergiu Gatlan ​The U.S. State Department is offering a reward of up to $5 million for information that could help disrupt the activities of North Korean front companies and employees generating millions via illegal remote IT work schemes.The two companies, Chinese-based Yanbian Silverstar and Volasys Silverstar from Russia, tricked businesses worldwide into employing North Korean staff as freelance IT workers.These illegally obtained funds are then laundered in violation of international sanctions and sent back to the Pyongyang regime to support the country's UN-prohibited nuclear missile programs. As the FBI, the State Department, and the Justice Department said in a May 2022 tri-seal advisory, each of North Korea's IT workers can earn up to $300,000 annually, generating hundreds of millions of dollars collectively every year."Yanbian Silverstar and Volasys Silverstar together employ more than 130 DPRK IT workers, who refer to themselves as 'IT warriors,'" the Sta

20
Jasper_The_Rasper
Moderator
13 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Attackers actively exploiting flaw(s) in Cleo file transfer software (CVE-2024-50623)

December 10, 2024 By Zeljka Zorz Attackers are exploiting a vulnerability (CVE-2024-50623) in file transfer software by Cleo – LexiCo, VLTransfer, and Harmony – to gain access to organizations’ systems, Huntress researchers warned on Monday.“We’ve discovered at least 10 businesses whose Cleo servers were compromised with a notable uptick in exploitation observed on December 8 around 07:00 UTC. After some initial analysis, however, we have found evidence of exploitation as early as December 3,” they shared, and noted that there are more potential vulnerable Cleo servers out there.What’s happening?Which vulnerability are the attackers exploiting? Huntress researchers say it’s CVE-2024-50623, an unrestricted file upload and download vulnerability, a fix for which Cleo pushed out in late October 2024 in v5.8.0.21 of Harmony, VLTrader, and LexiCom.Huntress researchers found that the patch provided by Cleo “does not mitigate the software flaw.”

81
Jasper_The_Rasper
Moderator
13 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
How Cryptocurrency Turns to Cash in Russian Banks

December 11, 2024 By Brian Krebs A financial firm registered in Canada has emerged as the payment processor for dozens of Russian cryptocurrency exchanges and websites hawking cybercrime services aimed at Russian-speaking customers, new research finds. Meanwhile, an investigation into the Vancouver street address used by this company shows it is home to dozens of foreign currency dealers, money transfer businesses, and cryptocurrency exchanges — none of which are physically located there.Richard Sanders is a blockchain analyst and investigator who advises the law enforcement and intelligence community. Sanders spent most of 2023 in Ukraine, traveling with Ukrainian soldiers while mapping the shifting landscape of Russian crypto exchanges that are laundering money for narcotics networks operating in the region.More recently, Sanders has focused on identifying how dozens of popular cybercrime services are getting paid by their customers, and how they are converting cryptocurrency revenue

20
Jasper_The_Rasper
Moderator
13 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Spain busts voice phishing ring for defrauding 10,000 bank customers

December 12, 2024 By Bill Toulas The Spanish police, working with colleagues in Peru, conducted a simultaneous crackdown on a large-scale voice phishing (vishing) scam ring in the two countries, arresting 83 individuals.Thirty-five of the arrested people were located across Spain, including in Madrid, Barcelona, Mallorca, Salamanca, and Vigo, and another 48 were arrested in Peru.The leader of the ring was also apprehended in Spain during the 29 simultaneous raids conducted by the cooperating police forces, which also seized cash, mobile phones, computers, and documents.Impersonating banksAccording to the announcement from the Spanish police (Policia Nacional), the scammers operated a large call operation that employed 50 people in three distinct call centers, defrauding at least 10,000 people and making €3,000,000 ($3.15M) in proceeds.The calling agents used stolen databases, pre-written social engineering, and scripts to trick the call recipients into giving away their sensitive banki

20
Jasper_The_Rasper
Moderator
13 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Krispy Kreme Doughnut Delivery Gets Cooked in Cyberattack

Threat actors punch holes in the company's online ordering systems, tripping up doughnut deliveries across the US after a late November breach.   December 11, 2024 By Becky Bracken US doughnut dealer Krispy Kreme suffered a cybersecurity incident that's made a mess of online ordering but spared retail operations that continue to serve up sugar-coated confections nationwide.A Securities and Exchange Commission filing from Krispy Kreme disclosed the company was subject to an "unauthorized activity on a portion of its information technology systems" in late November."The Company, along with its external cybersecurity experts, continues to work diligently to respond to and mitigate the impact from the incident, including the restoration of online ordering, and has notified federal law enforcement," the Krispy Kreme 8-K filing explained. "As the investigation of the incident is ongoing, the full scope, nature, and impact of the incident are not yet known." >>Full Article<<

40
Jasper_The_Rasper
Moderator
14 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Operation PowerOFF shuts down 27 DDoS-for-hire platforms

December 11, 2024 By Bill Toulas Law enforcement agencies from 15 countries have taken 27 DDoS-for-hire services offline, also known as "booters" or "stressers," arrested three administrators, and identified 300 customers of the platforms.The action is part of 'Operation PowerOFF,' an international initiative to combat cybercrime, specifically distributed denial-of-service (DDoS) attacks.DDoS-for-hire services are platforms that utilize botnets on compromised devices to launch attacks on behalf of paying customers against online targets of their choice.These attacks can cause service outages and business disruption to the targets, especially during the peak holiday season, where they can disrupt the increased online shopping."This multifaceted operation, coordinated by Europol and involving 15 countries, targeted all levels of those engaged in this crime," reads a press release from Europol."Three administrators behind these illicit platforms were arrested, and several actions were tak

30
Jasper_The_Rasper
Moderator
14 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Photobucket sold users’ biometric data without consent, lawsuit says

Class action could foil Photobucket’s plan to turn old photos into AI goldmine.Ashley Belanger – 11 Dec 2024 Photobucket was sued Wednesday after a recent privacy policy update revealed plans to sell users' photos—including biometric identifiers like face and iris scans—to companies training generative AI models.The proposed class action seeks to stop Photobucket from selling users' data without first obtaining written consent, alleging that Photobucket either intentionally or negligently failed to comply with strict privacy laws in states like Illinois, New York, and California by claiming it can't reliably determine users' geolocation.Two separate classes could be protected by the litigation. The first includes anyone who ever uploaded a photo between 2003—when Photobucket was founded—and May 1, 2024. Another potentially even larger class includes any non-users depicted in photographs uploaded to Photobucket, whose biometric data has also allegedly been sold without consent. >>

102
Jasper_The_Rasper
Moderator
14 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Critical Windows UI Automation Framework Vulnerability Let Hackers Bypass EDR

December 11, 2024 By Balaji N Security researchers have uncovered a novel attack method that exploits Microsoft’s UI Automation framework, potentially leaving millions of Windows users vulnerable.This technique, discovered by Akamai security researcher Tomer Peled, allows attackers to bypass endpoint detection and response (EDR) systems, opening up new avenues for cybercriminals to harvest sensitive data and manipulate user systems undetected.The UI Automation VulnerabilityThe UI Automation framework, originally designed to assist users with disabilities, has been found to have a significant security flaw.This framework, present in all Windows operating systems from XP onwards, possesses elevated permissions to interact with user interface elements. >>Full Article<<

20
Jasper_The_Rasper
Moderator
14 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Russian cyber spies hide behind other hackers to target Ukraine

December 11, 2024 By Bill Toulas Russian cyber-espionage group Turla, aka "Secret Blizzard," is utilizing other threat actors' infrastructure to target Ukrainian military devices connected via Starlink.Microsoft and Lumen recently exposed how the nation-state actor, who is linked to Russia's Federal Security Service (FSB), is hijacking and using malware and servers of the Pakistani threat actor Storm-0156.Microsoft released another report today focusing on separate Turla operations between March and April 2024, targeting devices in Ukraine used in military operations.In the latest campaign, Turla utilized the infrastructure for the Amadey botnet and another Russian hacking group known as "Storm-1837." This infrastructure was used to deploy Turla's custom malware families, including Tavdig and KazuarV2, on Ukrainian systems. >>Full Article<<

20
Jasper_The_Rasper
Moderator
14 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Atlassian, Splunk Patch High-Severity Vulnerabilities

Atlassian and Splunk on Tuesday announced patches for over two dozen vulnerabilities, including high-severity flaws. December 11, 2024 By Ionut Arghire Atlassian and Splunk on Tuesday announced patches for more than two dozen vulnerabilities across their product portfolios, including multiple high-severity flaws in third-party components.Atlassian released fixes for 10 high-severity vulnerabilities in Bamboo Data Center and Server, Bitbucket Data Center and Server, and Confluence Data Center and Server, all rated high-severity and affecting third-party dependencies.Bamboo Data Center and Server received patches for five bugs in Apache Commons Compress, AWS SDK for Java, Bouncy Castle Java Cryptography APIs, Apache Tomcat, and Connect2id Nimbus JOSE+JWT components. >>Full Article<<

20
Jasper_The_Rasper
Moderator
14 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
New EagleMsgSpy Android spyware used by Chinese police, researchers say

December 11, 2024 By Bill Toulas A previously undocumented Android spyware called 'EagleMsgSpy' has been discovered and is believed to be used by law enforcement agencies in China to monitor mobile devices.According to a new report by Lookout, the spyware was developed by Wuhan Chinasoft Token Information Technology Co., Ltd. and has been operational since at least 2017.Lookout presents abundant evidence linking EagleMsgSpy to its developers and operators, including IP addresses tied to C2 servers, domains, direct references in internal documentation, and also public contracts.The researchers also found clues for the existence of an iOS variant. However, they have yet to gain access to a sample for analysis. >>Full Article<<

30
Jasper_The_Rasper
Moderator
14 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Chinese national charged for hacking thousands of Sophos firewalls

December 11, 2024 By Pierluigi Paganini The U.S. has charged a Chinese national for hacking thousands of Sophos firewall devices worldwide in 2020.The U.S. has charged the Chinese national Guan Tianfeng (aka gbigmao and gxiaomao) for hacking thousands of Sophos firewall devices worldwide in 2020.Tianfeng worked at Sichuan Silence Information Technology Co., faces charges for developing and testing a zero-day exploit used to compromise approximately 81,000 firewalls.The man and co-conspirators exploited a zero-day vulnerability, tracked as CVE-2020-12271, in Sophos firewalls to deploy malware. The malware stole data and encrypted files to block remediation attempts. >>Full Article<<

50
Jasper_The_Rasper
Moderator
14 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Microsoft enforces defenses preventing NTLM relay attacks

December 11, 2024 By Zeljka Zorz Since making Kerberos the default Windows authentication protocol in 2000, Microsoft has been working on eventually retiring NTLM, its less secure and obsolete counterpart.Until NTLM gets disabled by default, Microsoft is working on shoring up defenses against NTLM relay attacks.How do NTLM relay attacks work?NTLM is a suite of Microsoft protocols that authenticate users and computers based on a challenge/response mechanism between the client (which seeks to be authenticated) and server (which makes sure the the correct user/computer is authenticated).The response by the client to the server’s challenge involves the use of the hash of the user’s pasword as an encryption key – and it’s that hash of the users’ login credentials that attackers can misuse.NTLM relay attacks allow attackers to send on the NTLM hash without needing to decrypt it and extract the user’s password. >>Full Article<<

20
Jasper_The_Rasper
Moderator
14 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Apple security updates and Rapid Security Responses 11th December 2024

Apple security updates and Rapid Security Responses 11th December 2024  Name and information link Available for Release date iOS 18.2 and iPadOS 18.2 iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later 11 Dec 2024 iPadOS 17.7.3 iPad Pro 12.9-inch 2nd generation, iPad Pro 10.5-inch, and iPad 6th generation 11 Dec 2024 macOS Sequoia 15.2 macOS Sequoia 11 Dec 2024 macOS Sonoma 14.7.2 macOS Sonoma 11 Dec 2024 macOS Ventura 13.7.2 macOS Ventura 11 Dec 2024 watchOS 11.2 Apple Watch Series 6 and later 11 Dec 2024 tvOS 18.2 Apple TV HD and Apple TV 4K (all models) 11 Dec 2024 visionOS 2.2 Apple Vision Pro 11 Dec 2024

20
Jasper_The_Rasper
Moderator
14 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Facebook, Instagram, WhatsApp hit by massive worldwide outage

December 11, 2024 By Lawrence Abrams Facebook, Instagram, Threads, and WhatsApp suffered a massive worldwide Wednesday afternoon, with services impacted in varying degrees based on user's region.According to DownDetector, the outage occurred at approximately 12:40 PM ET, with many users unable to access the services through the websites and apps or send messages through WhatsApp.When users attempted to access Facebook, they were greeted with errors stating, "Sorry, something went wrong. We're working on getting this fixed as soon as we can."Facebook outage errorSource: BleepingComptuer >>Full Article<<

40
Jasper_The_Rasper
Moderator
14 days ago
TripleHelix
Moderator
TripleHelixModerator
posted in Security Industry News
Google Chrome Stable Channel Update for Desktop Tuesday December 10, 2024

The Stable channel has been updated to 131.0.6778.139/.140 for Windows, Mac and 131.0.6778.139 for Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop_10.html Webroot users make sure to re-add back to Privacy Protection!  

50
TripleHelix
Moderator
15 days ago
TripleHelix
Moderator
TripleHelixModerator
posted in Security Industry News
Alert CISA Adds One Known Exploited Vulnerability to Catalog Release Date December 10, 2024

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.CVE-2024-49138Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow VulnerabilityThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure

30
TripleHelix
Moderator
15 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Chinese hackers use Visual Studio Code tunnels for remote access

December 10, 2024 By Bill Toulas Chinese hackers targeting large IT service providers in Southern Europe were seen abusing Visual Studio Code (VSCode) tunnels to maintain persistent remote access to compromised systems.VSCode tunnels are part of Microsoft's Remote Development feature, which enables developers to securely access and work on remote systems via Visual Studio Code. Developers can also execute command and access the file system of remote devices, making it a powerful development tool.The tunnels are established using Microsoft Azure infrastructure, with executables signed by Microsoft, providing trustworthy access.This rare tactic of abusing a legitimate Microsoft system to maintain persistent backdoor access to systems was observed by SentinelLabs and Tinexta Cyber, who dub the campaign 'Operation Digital Eye,' which took place between June and July 2024. >>Full Article<<

20
Jasper_The_Rasper
Moderator
15 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Ivanti warns of maximum severity CSA auth bypass vulnerability

December 10, 2024 By Sergiu Gatlan Today, Ivanti warned customers about a new maximum-severity authentication bypass vulnerability in its Cloud Services Appliance (CSA) solution.The security flaw (tracked as CVE-2024-11639 and reported by CrowdStrike's Advanced Research Team) enables remote attackers to gain administrative privileges on vulnerable appliances running Ivanti CSA 5.0.2 or earlier without requiring authentication or user interaction by circumventing authentication using an alternate path or channel.Ivanti advises admins to upgrade vulnerable appliances to CSA 5.0.3 using detailed information available in this support document."We are not aware of any customers being exploited by these vulnerabilities prior to public disclosure. These vulnerabilities were disclosed through our responsible disclosure program," the company said on Tuesday. "Currently, there is no known public exploitation of this these vulnerabilities that could be used to provide a list of indicators of comp

20
Jasper_The_Rasper
Moderator
15 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
‘AppLite Banker’ lures victims with job offers, infects devices with trojan

December 10, 2024 By Steve Zurier (Adobe Stock)Attackers posing as job recruiters have launched a mobile-targeted phishing (mishing) campaign that tricks victims into downloading a malicious dropper that installs an updated variant of the Antidot banking trojan on a victim’s Android mobile device.Researchers at Zimperium Labs said in a Dec. 10 post that the banking trojan variant — dubbed "AppLite Banker" — gives the attackers access to corporate credentials, applications, and data when the device gets used by an employee for remote access for their employer.Along with its ability to mimic enterprise companies, the researchers said AppLite Banker also masquerades as Chrome and TikTok apps, demonstrating its wide-ranging target vectors, including full device take-over and application access. >>Full Article<<

50
Jasper_The_Rasper
Moderator
15 days ago

Badges

Show all badges

Join the Conversation

Terms & Conditions