Skip to main content

Welcome

News, Announcements, Tech Discussions

44664 Topics
TripleHelix
Moderator
TripleHelixModerator
posted in Security Industry News
Vulnerability Summary for the Week of October 7, 2024 Released Oct 15, 2024

Document IDSB24-289The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:High: vulnerabilities with a CVSS base score of 7.0–10.0 Medium: vulnerabilities with a CVSS base score of 4.0–6.9 Low: vulnerabilities with a CVSS base score of 0.0–3.9Entries may include additional information provided by organizations and efforts sponsored by CISA. Thi

50
TripleHelix
Moderator
9 days ago
ProTruckDriver
Moderator
ProTruckDriverModerator
posted in Tech Talk
Can’t Open Microsoft Office Files in MacOS Sequoia? Fix Microsoft Word, Excel, Office File Associations

by: Paul Horowitz Some Mac users have noticed that Microsoft Office files and documents, whether that’s Word docs, Excel spreadsheets, Powerpoint presentations, or otherwise, are not opening in the intended apps, or properly associating with the relevant Microsoft Office app, after updating their Mac to MacOS Sequoia. To make matters worse, some users report that when attempting to open a Microsoft 365 or Microsoft Office file, like a docx or xls file on the Mac, they may see an alarming message that says some variation of “MacOS cannot verify that DocumentName.docx is free of malware”. ⇨⇨ Full Article ⇦⇦

222
MajorHavoc
Community Expert Advisor
10 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Jetpack fixes critical information disclosure flaw existing since 2016

October 14 2024 By Bill Toulas WordPress plugin Jetpack released a critical security update earlier today, addressing a vulnerability that allowed a logged-in user to access forms submitted by other visitors to the site.Jetpack is a popular WordPress plugin by Automattic that provides tools to enhance website functionality, security, and performance. According to the vendor, the plugin is installed on 27 million websites.The issue was discovered during an internal audit and impacts all Jetpack versions since 3.9.9, released in 2016."During an internal security audit, we found a vulnerability with the Contact Form feature in Jetpack ever since version 3.9.9, released in 2016," reads the security bulletin."This vulnerability could be used by any logged in users on a site to read forms submitted by visitors on the site."Automattic has released fixes for 101 impacted versions of Jetpack, all listed below:13.9.1, 13.8.2, 13.7.1, 13.6.1, 13.5.1, 13.4.4, 13.3.2, 13.2.3, 13.1.4, 13.0.1, 12.9.4

50
Jasper_The_Rasper
Moderator
10 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Trump campaign arms up with 'unhackable' phones after Iranian intrusion

Florida man gets his hands on 'the best ever' October 14 2024 By Iain Thomson With less than a month to go before American voters head to the polls to choose their next president, the Trump campaign has been investing in secure tech to make sure it doesn't get hacked again.Military kit supplier Green Hills Software has equipped Trump's team with supposedly unhackable phones and computers as the campaign attempts to avoid a repeat of earlier incidents where pro-Iranian attackers managed to steal emails and other data from the crew. The provider claims its software is impervious to any intrusion attempts and has also offered the technology to the Harris campaign team.The kit uses the Green Hills Integrity-178B operating system, which is used on the stealth B-2 bomber, F-22, and F-35 fighters, and appears to be one of the only commercially available OSes certified to Evaluation Assurance Level 6. The company says its security comes from tight coding and locking down absolutely everything

40
Jasper_The_Rasper
Moderator
10 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Pokemon dev Game Freak confirms breach after stolen data leaks online

October 14 2024 By Bill Toulas Japanese video game developer Game Freak has confirmed it suffered a cyberattack in August after source code and game designs for unpublished games were leaked online.Game Freak is best known for being the co-owner and the primary developing studio of the Pokémon series video game, which started in 1996 with the Pokémon Red and Blue for Nintendo Game Boy.The gaming studio has since released multiple titles in the Pokémon series for various Nintendo platforms like the 3DS, Switch, and iOS and Android (Pokémon Quest).Over the weekend, various leak sites and channels on Discord, Reddit, and X began posting screenshots of source code and development builds of upcoming Pokémon games developed by Game Freak. >>Full Article<<

20
Jasper_The_Rasper
Moderator
10 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
ConfusedPilot Attack Can Manipulate RAG-Based AI Systems

Attackers can introduce a malicious document in systems such as Microsoft 365 Copilot to confuse the system, potentially leading to widespread misinformation and compromised decision-making processes.   October 14 2024 By Elizabeth Montalbano Attackers can add a malicious document to the data pools used by artificial intelligence (AI) systems to create responses, which can confuse the system and potentially lead to misinformation and compromised decision-making processes within organizations.Researchers from the Spark Research Lab at the University of Texas (UT) at Austin discovered the attack vector, which they've dubbed ConfusedPilot because it affects all retrieval augmented generation (RAG)-based AI systems, including Microsoft 365 Copilot. This includes other RAG-based systems that use Llama, Vicuna, and OpenAI, according to the researchers. >>Full Article<<  

40
Jasper_The_Rasper
Moderator
10 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Gryphon Healthcare, Tri-City Medical Center Disclose Significant Data Breaches

Gryphon Healthcare and Tri-City Medical Center have disclosed data breaches collectively impacting over 500,000 individuals. October 14 2024 By Ionut Arghire Gryphon Healthcare and Tri-City Medical Center last week disclosed separate data breaches in which the personal information of more than 500,000 individuals was stolen.The Houston, Texas-based billing services provider Gryphon is notifying 393,358 individuals of an incident discovered on August 13, 2024, which involved an unnamed partner “that Gryphon provides medical billing services for.”The third-party data breach led to a threat actor accessing files containing information about patients “for whom Gryphon provides medical billing services,” the company notes in a notification letter to the impacted individuals, a copy of which was submitted to the Maine Attorney General’s Office. >>Full Article<<

40
Jasper_The_Rasper
Moderator
10 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Dutch police dismantled dual dark web market ‘Bohemia/Cannabia’

October 14 2024 By Pierluigi Paganini  Dutch police dismantled Bohemia/Cannabia, two major dark web markets for illegal goods, drugs, and cybercrime services.The Dutch police have announced the success of a new joint law enforcement operation that led to the shutdown of the dual dark web marketplace Bohemia/Cannabia. These are two of the largest and longest-running dark web platforms for the trade of illegal goods, drugs, and cybercrime services.Law enforcement agencies from the United Kingdom, United States, and Ireland participated in the operation that began towards the end of 2022.“The Dutch police have conducted a cybercrime investigation into the large dual dark web market ‘Bohemia/Cannabia’. This was a dark web market where illegal goods, such as drugs, and DDoS attacks were offered. It is the largest and longest running international dark web market of all time worldwide.” reads the announcement published by Polite. >>Full Article<<

40
Jasper_The_Rasper
Moderator
10 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
TrickMo malware steals Android PINs using fake lock screen

October 14 2024 By Bill Toulas Forty new variants of the TrickMo Android banking trojan have been identified in the wild, linked to 16 droppers and 22 distinct command and control (C2) infrastructures, with new features designed to steal Android PINs.This is being reported by Zimperium, following an earlier report by Cleafy that looked into some, but not all variants currently in circulation.TrickMo was first documented by IBM X-Force in 2020, but it is thought to have been used in attacks against Android users since at least September 2019. >>Full Article<<

40
Jasper_The_Rasper
Moderator
10 days ago
TripleHelix
Moderator
TripleHelixModerator
posted in Tech Talk
Microsoft to end Windows 10 support on October 14th, 2025

Another sign that a new version of Windows is on the way!Jun 14, 2021, 9:06am EDT Microsoft is ending support for Windows 10 on October 14th, 2025. It will mark just over 10 years since the operating system was first introduced. Microsoft revealed the retirement date for Windows 10 in an updated support life cycle page for the OS. Thurrott reports that this is the first time Microsoft has ever described the end of support for Windows 10.It’s not clear exactly when the support document was updated, but Thurrott reports it only previous documented “when specific Windows 10 versions would leave support,” and not the entire OS. It could be another hint that a new version of Windows is on the way.Microsoft keeps dropping Windows 11 hintsMicrosoft has been dropping lots of hints that it’s ready to launch Windows 11. The software maker is holding a special Windows event to reveal the “next generation” of the OS next week. The event starts at 11AM ET, and the event invite includes a window tha

41446
TripleHelix
Moderator
10 days ago
TripleHelix
Moderator
TripleHelixModerator
posted in Security Industry News
Mozilla Firefox 131.0.3 Released Oct 14, 2024

Version 131.0.3, first offered to Release channel users on October 14, 2024 https://www.mozilla.org/en-US/firefox/131.0.3/releasenotes/ Security Fixes: https://www.mozilla.org/en-US/security/advisories/mfsa2024-53/

203
TripleHelix
Moderator
10 days ago
TylerM
Administrator
TylerMSr. Security Analyst & Community Manager
published in Community 101
Beta TestersBETA

Welcome Beta Testers! Thank you for your interest in trying Webroot release candidates! Webroot release candidates are fully tested Webroot builds that Webroot will be releasing to its entire customer population in the near future. This program enables qualified testers an opportunity to preview these builds before they are generally available.If you are not already a Webroot Community member, please see how to set up a free account here.To gain access to these groups, please message an admin (like me) and we will get back to you shortly. Once approved you will gain access to all things beta. Those of you who are already enrolled in Beta testing will find that you can access this area.                                               >>Beta Forums<<  

138940
TripleHelix
Moderator
10 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Iranian hackers now exploit Windows flaw to elevate privileges

October 13 2024 By Bill Toulas The Iranian state-sponsored hacking group APT34, aka OilRig, has recently escalated its activities with new campaigns targeting government and critical infrastructure entities in the United Arab Emirates and the Gulf region.In these attacks, spotted by Trend Micro researchers, OilRig deployed a novel backdoor, targeting Microsoft Exchange servers to steal credentials, and also exploited the Windows CVE-2024-30088 flaw to elevate their privileges on compromised devices.Apart from the activity, Trend Micro has also made a connection between OilRig and FOX Kitten, another Iran-based APT group involved in ransomware attacks. >>Full Article<<

50
Jasper_The_Rasper
Moderator
11 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
US, UK warn of Russian APT29 hackers targeting Zimbra, TeamCity servers

October 10 2024 By Sergiu Gatlan U.S. and U.K. cyber agencies warned today that APT29 hackers linked to Russia's Foreign Intelligence Service (SVR) target vulnerable Zimbra and JetBrains TeamCity servers "at a mass scale."A joint advisory issued by the NSA, the FBI, the U.S. Cyber Command's Cyber National Mission Force (CNMF), and the U.K.'s NCSC warns network defenders to patch exposed servers to block these ongoing attacks.The four cyber agencies said the hacking group targets unpatched Zimbra and TeamCity servers exposed online "at a mass scale to target victims worldwide across a variety of sectors " using CVE-2022-27924 and CVE-2023-42793 exploits.CVE-2022-27924 has been exploited since at least August 2022 to steal email account credentials from unpatched Zimbra Collaboration instances, while CVE-2023-42793 was exploited by both ransomware gangs and North Korean hacking groups for initial access and attempted supply-chain attacks. >>Full Article<<

20
Jasper_The_Rasper
Moderator
13 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Marriot & Starwood Face $52M Settlement After Security Breaches

The hotel giant will be held to higher security standards in a series of proposed requirements, including implementing a new annually reviewed security program.  October 11 2024 By Dark Reading Staff Marriott and its subsidiary Starwood Hotels have agreed to pay $52 million in fines and create a revamped information security program, in an Federal Trade Commission (FTC)-led settlement with 344 million customers who were impacted by three data breaches occurring between 2014 and 2020.The hotel giant also agreed to provide its US customers with a way to request deletion of their personal information associated with their loyalty rewards account number or email address. In addition, they must implement a policy to retain the personal information of its customer only for as long as necessary to fulfill its purpose. Marriott also will be required to review loyalty rewards accounts upon request, and also reimburse stolen loyalty points. >>Full Article<<

30
Jasper_The_Rasper
Moderator
13 days ago
TripleHelix
Moderator
TripleHelixModerator
posted in Water Cooler
Supercharged northern lights displays may be visible as far south as California or even Alabama.

Solar storm bombarding Earth now may reach 'extreme' levels, sparking auroras down to Alabama and straining hurricane-weakened power grids Update for Oct. 11: The severe G3 geomagnetic storm has sparked dazzling auroras around the world for skywatchers. Read our full story and see northern lights photos from Space.com readers.A severe solar storm sparked by an intense flare from the sun could reach "extreme" levels as it bombards Earth, officials with the U.S. National Oceanic and Atmospheric Administration (NOAA) warned on Thursday (Oct. 10). Scientists with NOAA's Space Weather Prediction Group (SWPC) said that a cloud of charged solar material, called a coronal mass ejection, slammed into Earth around midday, triggering a "severe" geomagnetic storm that could impact power grids and GPS and radio communications systems, as well as amplify aurora displays in regions that typically don't see them."When skies are clear, the aurora (northern lights) could be visible as far south as Alaba

163
Jasper_The_Rasper
Moderator
13 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Recent Veeam Vulnerability Exploited in Ransomware Attacks

Sophos warns of ransomware operators exploiting a critical code execution vulnerability in Veeam Backup & Replication. October 11 2024 By Ionut Arghire Ransomware operators are exploiting a critical-severity vulnerability in Veeam Backup & Replication to create rogue accounts and deploy malware, Sophos warns.The issue, tracked as CVE-2024-40711 (CVSS score of 9.8), can be exploited remotely, without authentication, for arbitrary code execution, and was patched in early September with the release of Veeam Backup & Replication version 12.2 (build 12.2.0.334).While neither Veeam, nor Code White, which was credited with reporting the bug, have shared technical details, attack surface management firm WatchTowr performed an in-depth analysis of the patches to better understand the vulnerability. >>Full Article<<

20
Jasper_The_Rasper
Moderator
13 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
GitLab fixed a critical flaw that could allow arbitrary CI/CD pipeline execution

October 11 2024 By Pierluigi Paganini GitLab issued updates for CE and EE to address multiple flaws, including a critical bug allowing CI/CD pipeline runs on unauthorized branches.GitLab released security updates for Community Edition (CE) and Enterprise Edition (EE) to address multiple vulnerabilities, including a critical bug, tracked as CVE-2024-9164 (CVSS score of 9.6), allowing CI/CD pipeline runs on unauthorized branches.“An issue was discovered in GitLab EE affecting all versions starting from 12.5 prior to 17.2.9, starting from 17.3, prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows running pipelines on arbitrary branches. This is a critical severity issue. It is now mitigated in the latest release and is assigned CVE-2024-9164.” reads the advisory. >>Full Article<<

00
Jasper_The_Rasper
Moderator
13 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
EU adopts Cyber Resilience Act to secure connected products

October 11 2024 By Zeljka Zorz The EU Council has adopted the Cyber Resilience Act (CRA), a new law that aims to make consumer products with digital components safe(r) to use.CRA requirementsThe CRA outlines EU-wide cybersecurity standards for digital products, i.e. products that are connected – either directly or indirectly – to another device or to a network. This category includes “smart” home appliances, TVs, thermostats, toys, wearable health technology, baby monitoring systems, and so on.Some connected products – e.g., medical devices, networking devices, cars, aeronautical products, products for national security or defense purposes – are exempt from the CRA because existing EU laws already specify their cybersecurity requirements. >>Full Article<<

20
Jasper_The_Rasper
Moderator
13 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Ukraine arrests rogue VPN operator providing access to Runet

October 11 2024 By Bill Toulas Ukraine's cyber police have arrested a 28-year-old man who operated a massive virtual private network (VPN) service, allowing people from within the country to access the Russian internet (Runet).Runet is the portion of the internet that includes Russian sites on the ".ru" and ".su" top-level domains, including government sites, social media platforms, search engines, and various news platforms from the country. The Russian government has taken steps to control, restrict, monitor, and isolate from the broader global internet,Per restrictions and sanctions imposed by Ukraine's National Security and Defense Council (NSDC), access to the Runet is forbidden. Hence, Ukrainian internet service providers (ISPs) block access to Russian platforms from within the country. >>Full Article<<

30
Jasper_The_Rasper
Moderator
13 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
ShadowLogic Attack Targets AI Model Graphs to Create Codeless Backdoors

HiddenLayer details ShadowLogic, a new method of creating codeless backdoors in AI models by manipulating their graphs. October 11 2024 By Ionut Arghire Manipulation of an AI model’s graph can be used to implant codeless, persistent backdoors in ML models, AI security firm HiddenLayer reports.Dubbed ShadowLogic, the technique relies on manipulating a model architecture’s computational graph representation to trigger attacker-defined behavior in downstream applications, opening the door to AI supply chain attacks.Traditional backdoors are meant to provide unauthorized access to systems while bypassing security controls, and AI models too can be abused to create backdoors on systems, or can be hijacked to produce an attacker-defined outcome, albeit changes in the model potentially affect these backdoors.By using the ShadowLogic method, HiddenLayer says, threat actors can implant codeless backdoors in ML models that will persist across fine-tuning and which can be used in highly targeted

20
Jasper_The_Rasper
Moderator
13 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Modern TVs have “unprecedented capabilities for surveillance and manipulation,” group reveals

 October 11 2024 By Pieter Arntz Your television is debuting the latest, most captivating program: You.In a report titled “How TV Watches Us: Commercial Surveillance in the Streaming Era,” the Center for Digital Democracy (CDD) spotlighted a massive data-driven surveillance apparatus that ensnares the public through modern television sets.“The widespread technological and business developments that have taken place during the last five years have created a connected television media and marketing system with unprecedented capabilities for surveillance and manipulation.”In cooperation with data brokers, streaming video programming networks, Connected Television (CTV) device companies, and smart TV manufacturers are creating detailed digital dossiers about viewers, based on a person’s identity information, viewing choices, purchasing patterns, and thousands of online and offline behaviors. >>Full Article<<

20
Jasper_The_Rasper
Moderator
13 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Iran and China-linked actors used ChatGPT for preparing attacks

October 11 2024 By Pierluigi Paganini OpenAI disrupted 20 cyber and influence operations in 2023, revealing Iran and China-linked actors used ChatGPT for planning ICS attacks.OpenAI announced the disruption of over 20 cyber and influence operations this year, involving Iranian and Chinese state-sponsored hackers.The company uncovered the activities of three threat actors abusing ChatGPT to launch cyberattacks. One of these groups is CyberAv3ngers, which is a threat actor linked to the Iranian Iranian Islamic Revolutionary Guard Corps (IRGC).In the past, the group targeted industrial control systems at water utilities in Ireland and the U.S.. Rather than using advanced hacking techniques, they exploited systems with default credentials to compromise target networks. >>Full Article<<

40
Jasper_The_Rasper
Moderator
13 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Casio Hit by Cyberattack

Casio says a recent cyberattack has caused some system disruptions and it’s investigating whether a data breach has occurred.  October 10, 2024 By Eduard Kovacs Japanese electronics giant Casio revealed on Tuesday that a recent cyberattack caused some disruptions. The company said it detected unauthorized access to its network on October 5. The intrusion resulted in a system failure and led to the disruption of some services.Casio has launched an investigation and is trying to determine whether any personal or other sensitive information has been compromised as a result of the cyberattack. Authorities have been notified and the company has restricted external access to its systems as part of its incident response. >>Full Article<<

51
Jasper_The_Rasper
Moderator
13 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Burning Zero Days: Suspected Nation-State Adversary Targets Ivanti CSA

By Faisal Abdul Malik Qureshi, John Simmons, Jared Betts, Luca Pugliese, Trent Healy, Ken Evans and Robert Reyes | October 11, 2024 Affected Platforms: Ivanti Cloud Services Appliance version 4.6 and priorImpacted Users: Any organizationImpact: Remote attackers gain control of the vulnerable systemsSeverity Level: Critical Today FortiGuard Labs is releasing this blog post about a case where an advanced adversary was observed exploiting three vulnerabilities affecting the Ivanti Cloud Services Appliance (CSA). At the time of our investigation, two out of the three identified vulnerabilities were not publicly known. This incident is a prime example of how threat actors chain zero-day vulnerabilities to gain initial access to a victim’s network. BackgroundIn a recent incident response engagement, FortiGuard Incident Response (FGIR) services were engaged by a customer to investigate malicious communication originating from their network. During the investigation, FGIR came across an advers

30
Jasper_The_Rasper
Moderator
13 days ago

Badges

Show all badges

Join the Conversation

Terms & Conditions