Skip to main content
To Customer Support To Customer Support

Welcome

News, Announcements, Tech Discussions

44858 Topics
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
1,000+ web shops infected by “Phish ‘n Ships” criminals who create fake product listings for in-demand products

 November 1, 2024 By Pieter Arntz  Researchers at the Satori Threat Intelligence and Research team have published their findings about a group of cybercriminals that infect legitimate web shops to create and promote fake product listings.The threat, dubbed “Phish ‘n Ships” by the researchers, reportedly infected more than 1,000 websites and built 121 fake web stores to trick consumers. Estimated losses are in the region of tens of millions of dollars over the past five years.The group infected legitimate web shops with a malicious payload that would redirect visitors to web shops under their own control. While visiting such an affected web shop the visitor would be served fake product listings. When they clicked on the link for that item, hundreds of thousands of victims were redirected.The fraudsters also made sure that their fake product listings contained metadata that put them near the top of search engine rankings for those items. SEO poisoning is a technique employed by cybercrim

30
Jasper_The_Rasper
Moderator
20 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
US, Israel Describe Iranian Hackers’ Targeting of Olympics, Surveillance Cameras

The US and Israel have published an advisory describing the latest activities of Iranian cyber firm Emennet Pasargad, now called Aria Sepehr Ayandehsazan. November 1, 2024 By Eduard Kovacs   The United States and Israel this week published a cybersecurity advisory describing the latest activities of an Iranian threat group, including attacks targeting the recent Olympics and surveillance cameras.The FBI has been tracking this group’s activities since 2020. The threat actor is known in the private sector as Cotton Sandstorm, Marnanbridge, and Haywire Kitten, but it’s probably best known as Emennet Pasargad, the name of the company that was until recently used as a front for the group’s activities.According to the new advisory written by the FBI, the US Department of Treasury and Israel’s National Cyber Directorate, since mid-2024 the name of the front company has been Aria Sepehr Ayandehsazan (ASA). The company, which has been legally registered in Iran, is used for finance-related and

20
Jasper_The_Rasper
Moderator
20 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
LottieFiles confirmed a supply chain attack on Lottie-Player

November 1, 2024 By Pierluigi Paganini LottieFiles confirmed a supply chain attack on Lottie-Player, and threat actors targeted cryptocurrency wallets to steal funds.LottieFiles confirmed that threat actors have hacked the Lottie-Player software in a supply chain attack.Lottie-Player is a web component from LottieFiles designed to render Lottie animations, which are lightweight, vector-based animations in JSON format. These animations are widely used in web and mobile applications because they are scalable, smooth, and efficient, typically more compact than traditional image or video formats.Developers can integrate Lottie-Player into their websites or applications to add animations without heavy file sizes, enhancing user experience with interactive visuals.  >>Full Article<<

30
Jasper_The_Rasper
Moderator
20 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
qBittorrent fixes flaw exposing users to MitM attacks for 14 years

October 31, 2024 By Bill Toulas  qBittorrent has addressed a remote code execution flaw caused by the failure to validate SSL/TLS certificates in the application's DownloadManager, a component that manages downloads throughout the app.The flaw, introduced in a commit on April 6, 2010, was eventually fixed in the latest release, version 5.0.1, on October 28, 2024, more than 14 years later.qBittorrent is a free, open-source client for downloading and sharing files over the BitTorrent protocol. Its cross-platform nature, IP filtering, integrated search engine, RSS feed support, and modern Qt-based interface have made it particularly popular.However, as security researcher Sharp Security highlighted in a blog post, the team fixed a notable flaw without adequately informing the users about it and without assigning a CVE to the problem. >>Full Article<<

50
Jasper_The_Rasper
Moderator
21 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Sophos Discloses Half Decade of Sustained Chinese Attack

Volt Typhoon, APT31, APT41 Targeted Sophos Edge Devices October 31, 2024 By Akshaya Asokan Firewall maker Sophos disclosed Thursday a half-decade worth of efforts by multiple nation-state Chinese hacking groups to infiltrate its appliances, calling the admission a wake-up call for the cybersecurity industry.The campaigns are also further evidence that Chinese nation-state hackers draw from a common pool of vulnerabilities, buttressing what's called the "quartermaster" theory positing that a central organization within the Chinese government disseminates exploits to multiple cyberespionage hacking groups. >>Full Article<<

30
Jasper_The_Rasper
Moderator
21 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Hackers target critical zero-day vulnerability in PTZ cameras

October 31, 2024 By Bill Toulas Hackers are attempting to exploit two zero-day vulnerabilities in PTZOptics pan-tilt-zoom (PTZ) live streaming cameras used in industrial, healthcare, business conferences, government, and courtroom settings.In April 2024, GreyNoise discovered CVE-2024-8956 and CVE-2024-8957 after its AI-powered threat detection tool, Sift, detected unusual activity on its honeypot network that did not match any known threats.Upon examination of the alert, GreyNoise researchers uncovered an exploit attempt that targeted the camera's CGI-based API and embedded 'ntp_client' aiming to achieve command injection.A technical deep-dive by GreyNoise researcher Konstantin Lazarev provides more info on the two flaws.CVE-2024-8956 is a weak authentication problem in the camera's 'lighthttpd' web server, allowing unauthorized users to access the CGI API without an authorization header, which exposes usernames, MD5 password hashes, and network configurations.CVE-2024-8957 is caused b

30
Jasper_The_Rasper
Moderator
21 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Canada Grapples With 'Second-to-None' PRC-Backed Threat Actors

Chinese APTs lurked in Canadian government networks for five years — and that's just one among a whole host of threats from Chinese bad actors.   October 31, 2024 By Dark Reading Staff Chinese state-backed actors have become Canada's most pressing cyber threat, with the People's Republic of China (PRC) collecting data from Canada's government networks for the past five years.The Canadian Centre for Cyber Security's National Cyber Threat Assessment calls Beijing's cyber operations "second to none," and noted that at least 20 Canadian government agencies and departments have been breached by PRC state-backed actors. The cyberattackers are mainly attempting to gain information that could lead to strategic, economic, and diplomatic advantages — a play that has only grown in its intensity due to escalating tensions between the West and the PRC. >>Full Article<<

81
TripleHelix
Moderator
21 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Honeypot Surprise: Researchers Catch Attackers Exposing 15,000 Stolen Credentials in S3 Bucket

Sysdig researchers trace a bizarre S3 bucket misconfiguration to EmeraldWhale, exposing 1.5 terabytes of stolen credentials and script. October 31, 2024 By Kevin Townsend Researchers found a misconfigured S3 bucket containing around 15,000 stolen cloud service credentials.The discovery of a massive trove of stolen credentials was strange. An attacker used a ListBuckets call to target his own cloud storage of stolen credentials. This was caught in a Sysdig honeypot (the same honeypot that exposed RubyCarp in April 2024).“The weird thing,” Michael Clark, senior director of threat research at Sysdig, told SecurityWeek, “was that the attacker was asking our honeypot to list objects in an S3 bucket we did not own or operate. Even more weird was that it wasn’t necessary, since the bucket in question is public and you can just go and look.” >>Full Article<<

30
Jasper_The_Rasper
Moderator
21 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Threat actor says Interbank refused to pay the ransom after a two-week negotiation

October 31, 2024 By Pierluigi Paganini Peruvian Interbank confirmed a data breach after threat actors accessed its systems and leaked stolen information online.Interbank, formally the Banco Internacional del Perú Service Holding S.A.A. is a leading Peruvian provider of financial services has over 2 million customers.Interbank disclosed a data breach after a threat actor claimed the hack of the organization and leaked stolen data online. A threat actor that uses the moniker ‘kzoldyck’ claims the leak of 3.7 TB of company data related to 3 million customers. Alleged stolen data includes personal info, credit card details, CVVs, passwords, and API credentials. >>Full Article<<

10
Jasper_The_Rasper
Moderator
21 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Microsoft: Chinese hackers use Quad7 botnet to steal credentials

October 31, 2024 By Lawrence Abrams Microsoft warns that Chinese threat actors use the Quad7 botnet, compromised of hacked SOHO routers, to steal credentials in password-spray attacks.Quad7, also known as CovertNetwork-1658 or xlogin, is a botnet first discovered by security researcher Gi7w0rm that consists of compromised SOHO routers.Later reports by Sekoia and Team Cymru reported that the threat actors are targeting routers and networking devices from TP-Link, ASUS, Ruckus wireless devices, Axentra NAS devices, and Zyxel VPN appliances.When the devices are compromised, the threat actors deploy custom malware that allows remote access to the devices over Telnet, which display unique welcome banners based on the compromised device:xlogin – Telnet bound to TCP port 7777 on TP-Link routers alogin – Telnet bound to TCP port 63256 on ASUS routers rlogin – Telnet bound to TCP port 63210 on Ruckus wireless devices. axlogin – Telnet banner on Axentra NAS devices (port unknown as not seen in t

40
Jasper_The_Rasper
Moderator
21 days ago
TripleHelix
Moderator
TripleHelixModerator
posted in Security Industry News
Alert CISA Releases Four Industrial Control Systems Advisories Release Date October 31, 2024

CISA released four Industrial Control Systems (ICS) advisories on October 31, 2024. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.ICSA-24-305-01 Rockwell Automation FactoryTalk ThinManager ICSA-24-030-02 Mitsubishi Electric FA Engineering Software Products (Update A) ICSA-24-135-04 Mitsubishi Electric Multiple FA Engineering Software Products (Update A) ICSA-23-157-02 Mitsubishi Electric MELSEC iQ-R Series/iQ-F Series (Update B)CISA encourages users and administrators to review newly released ICS advisories for technical details and mitigations.This product is provided subject to this Notification and this Privacy & Use policy.Vendor Rockwell Automation Mitsubishi Electrichttps://www.cisa.gov/news-events/alerts/2024/10/31/cisa-releases-four-industrial-control-systems-advisories

40
TripleHelix
Moderator
21 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Recent Version of LightSpy iOS Malware Packs Destructive Capabilities

 A newer version of the LightSpy malware for iOS includes over a dozen new plugins, many with destructive capabilities. October 30, 2024 By Eduard Kovacs A recent iOS-targeting version of the LightSpy malware includes over a dozen new plugins, many with destructive capabilities, according to cybersecurity firm ThreatFabric.The LightSpy malware came to light in 2020, after it was observed targeting the iPhones of users in Hong Kong. Threat actors had been attempting to take over devices and steal data using the malware.The attackers at the time had exploited iOS vulnerabilities to deliver the spyware and collect a wide range of information from compromised devices, including location, call and browser history, messages, and passwords.More recent research led to the discovery of Android and macOS versions of LightSpy as well.  >>Full Article<<

40
Jasper_The_Rasper
Moderator
22 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
New Windows Themes zero-day gets free, unofficial patches

October 29, 2024 By Sergiu Gatlan Free unofficial patches are now available for a new Windows Themes zero-day vulnerability that allows attackers to steal a target's NTLM credentials remotely.NTLM has been extensively exploited in NTLM relay attacks, where threat actors force vulnerable network devices to authenticate against servers under their control, and pass-the-hash attacks, where they exploit system vulnerabilities or deploy malicious software to acquire NTLM hashes (which are hashed passwords) from targeted systems.Once they have the hash, the attackers can authenticate as the compromised user, gaining access to sensitive data and spreading laterally on the now-compromised network. One year ago, Microsoft announced that it plans to kill off the NTLM authentication protocol in Windows 11 in the future. >>Full Article<<

20
Jasper_The_Rasper
Moderator
22 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Colorado Accidentally Put Voting System Passwords Online, but Officials Say Election Is Secure

Voting system passwords were mistakenly put on the Colorado Secretary of State’s website for several months before being spotted and taken down. October 30, 2024 By Associated Press Voting system passwords were mistakenly put on the Colorado Secretary of State’s website for several months before being spotted and taken down, but the lapse did not pose an immediate threat to the upcoming election, said state election officials Tuesday.The passwords were only one of two that are needed to access any component of Colorado’s voting systems, and are just one part of a layered security system, said Jack Todd, spokesperson for the the Secretary of State’s office, in a statement. The two passwords are “kept in separate places and held by different parties,” he said.“This is not a security threat,” said Colorado Secretary of State Jena Griswold in an interview on 9News Tuesday evening. She said her office is investigating, that not all of the passwords in the spreadsheet were active and there i

20
Jasper_The_Rasper
Moderator
22 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Hackers steal 15,000 cloud credentials from exposed Git config files

October 30, 2024 By Bill Toulas A large-scale malicious operation named "EmeraldWhale" scanned for exposed Git configuration files to steal over 15,000 cloud account credentials from thousands of private repositories.According to Sysdig, who discovered the campaign, the operation involves using automated tools that scan IP ranges for exposed Git configuration files, which may include authentication tokens.These tokens are then used to download repositories stored on GitHub, GitLab, and BitBucket, which are scanned for further credentials.The stolen data was exfiltrated to Amazon S3 buckets of other victims and was subsequently used in phishing and spam campaigns and sold directly to other cybercriminals.While exposing Git authentication tokens can allow data theft, it could also lead to full-blown data breaches like we recently saw with the Internet Archive. >>Full Article<<

20
Jasper_The_Rasper
Moderator
22 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Ex-Disney Employee Charged With Hacking Menu Database

 In a vengeful move against the happiest place on Earth, the former employee allegedly used his old credentials to make potentially deadly changes. October 30, 2024 By Dark Reading Staff A former Disney employee was arrested and charged after allegedly hacking into the company's systems and altering its restaurant menus.Michael Scheuer, an ex-menu production manager at Disney, was charged with violating the Computer Fraud and Abuse Act (CFAA) on three different occasions.He was fired from this position in June, after unspecified misconduct; his dismissal was described as "contentious" and "not considered to be amicable," according to court documents.Scheuer allegedly used his work credentials, which were still functioning after his termination, to log into the Disney menu creation system contracted by a third-party company and change the fonts in the system to Wingdings symbols. >>Full Article<<

20
Jasper_The_Rasper
Moderator
22 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Change Healthcare Ransomware Attack Impacts 100 Million People

UnitedHealth told the US health department that hackers stole the information of 100 million people in a February ransomware attack. October 25, 2024 By Ionut Arghire Change Healthcare parent company UnitedHealth Group has revealed that the personal information of 100 million individuals was compromised in the February 2024 ransomware attack.Disclosed on February 21, the attack resulted in widespread network disruptions that impacted over 100 Change Healthcare applications across clinical, dental, medical record, patient engagement, pharmacy, and payment services. Thousands of pharmacies and healthcare providers were affected.The attackers used leaked credentials to access a Citrix portal account that was not protected with multi-factor authentication, and lurked in Change Healthcare’s network for nine days, moving laterally and exfiltrating data before deploying file-encrypting ransomware. >>Full Article<<

81
Jasper_The_Rasper
Moderator
22 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Russia-linked Midnight Blizzard APT targeted 100+ organizations with a spear-phishing campaign using RDP files

October 30, 2024 By Pierluigi Paganini Microsoft warns of a new phishing campaign by Russia-linked APT Midnight Blizzard targeting hundreds of organizations.Microsoft warns of a large-scale spear-phishing campaign by Russia-linked APT Midnight Blizzard (aka APT29, SVR group, BlueBravo, Cozy Bear, Nobelium, Midnight Blizzard, and The Dukes), targeting 1,000+ users across 100+ organizations for intelligence gathering.The Midnight Blizzard group along with APT28 cyber espionage group was involved in the Democratic National Committee hack and the wave of attacks aimed at the 2016 US Presidential Elections. The group is known for the SolarWinds supply chain attack that in 2020 hit more than 18,000 customer organizations, including Microsoft. >>Full Article<<

20
Jasper_The_Rasper
Moderator
22 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Android malware "FakeCall" now reroutes bank calls to attackers

October 30, 2024 By Bill Toulas A new version of the FakeCall malware for Android hijacks outgoing calls from a user to their bank, redirecting them to the attacker's phone number instead.The goal of the latest version remains to steal people's sensitive information and money from their bank accounts.FakeCall (or FakeCalls) is a banking trojan with a focus on voice phishing, in which victims are deceived through fraudulent calls impersonating banks, asking them to convey sensitive information. >>Full Article<<

50
Jasper_The_Rasper
Moderator
22 days ago
TripleHelix
Moderator
TripleHelixModerator
posted in Security Industry News
Alert Fortinet Updates Guidance and Indicators of Compromise following FortiManager Vulnerability Exploitation Release Date October 30, 2024

Fortinet has updated their security advisory addressing a critical FortiManager vulnerability (CVE-2024-47575) to include additional workarounds and indicators of compromise (IOCs). A remote, unauthenticated cyber threat actor could exploit this vulnerability to gain access to sensitive files or take control of an affected system. At this time, all patches have been released.CISA previously added this vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation, as confirmed by Fortinet.CISA strongly encourages users and administrators to apply the necessary updates, hunt for any malicious activity, assess potential risk from service providers, report positive findings to CISA, and review the following articles for additional information: Fortinet Advisory FG-IR-24-423·  , ·  CISA alert on the Fortinet FortiManager Missing Authentication Vulnerability, ·  Google Threat Intelligence article Investigating FortiManager Zero-Day Exploitation (CVE-2

40
TripleHelix
Moderator
22 days ago
D
Fresh Face
devinelsonFresh Face
asked in Community 101
keycode doesn't work ..... Webroot Internet Security Complete (expires Jul 21, 2025)

My current subscription expires in two days.  I have another another account that expires next July however the activation code doesn’t work.  I mistakenly renewed a couple months early but regardless...activation code doesn’t work???

462
D
Fresh Face
22 days ago
TripleHelix
Moderator
TripleHelixModerator
posted in Security Industry News
Google Chrome Stable Channel Update for Desktop Tuesday October 29, 2024

The Stable channel has been updated to 130.0.6723.91/.92 for Windows, Mac and 130.0.6723.91 for Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log.The Extended Stable channel has been updated to 130.0.6723.92 for Windows and Mac which will roll out over the coming days/weeks. This update includes 2 security fixes. https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_29.html Webroot users make sure to re-add back to Privacy Protection!  

50
TripleHelix
Moderator
23 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Multiple Exynos Galaxy phones and watches in danger of being hacked, warns Samsung

October 29, 2024 By Abdullah Asim A vulnerability labeled as high risk has made many Exynos-powered Galaxy smartphones and watches susceptible to being hacked, Samsung has warned. The company is also urging users of the affected devices to update to the latest security patches immediately and is working to resolve the exploit.Affected Exynos processors include: 9820 9825 980 990 850 W920And if that all sounds like gibberish, you’re not alone. What you really need to know is that the devices vulnerable to this exploit include: Galaxy S20 phones Galaxy Note 20 phones Galaxy S10 phones Galaxy Note 10 phones Galaxy A21 Galaxy A51 Galaxy A71 Galaxy Watch 5 Galaxy Watch FE And Galaxy Watch 4That is quite the list. Thankfully, after almost a month since its first report, Samsung is rolling out security updates that should hopefully patch the vulnerability. >>Full Article<<

70
Jasper_The_Rasper
Moderator
23 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Nvidia GPU owners told to update now to patch a range of serious security flaws

October 29, 2024 By Sead Fadilpašić Eight vulnerabilities addressed by Nvidia in total (Image credit: Jakub Porzycki/NurPhoto via Getty Images) Nvidia has released a new patch for its GPU Display Driver for Windows and Linux to fix a handful of rather serious vulnerabilities.If exploited, the vulnerabilities mostly lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering, which means they are rather serious. Among them is CVE‑2024‑0126, which has a severity score of 8.2 (high severity).Another six vulnerabilities are scored 7.8, while the final one is scored 7.1. Of the total eight flaws, five affect the Windows ecosystem. They are all user mode layer exploits, in which threat actors could initiate out-of-bound reads and thus execute code remotely. One exploit was for both Windows and Linux. >>Full Article<<

40
Jasper_The_Rasper
Moderator
23 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
China's 'Evasive Panda' APT Debuts High-End Cloud Hijacking

A professional-grade tool set, appropriately dubbed "CloudScout," is infiltrating cloud apps like Microsoft Outlook and Google Drive, targeting sensitive info for exfiltration.  October 29, 2024 By Tara Seals The China-sponsored Evasive Panda hacking crew has debuted CloudScout, a sleek, professional post-compromise toolset that retrieves data from various cloud services by leveraging stolen Web session cookies.That's according to researchers at ESET, who uncovered CloudScout while investigating a pair of past breaches in Taiwan (targeting a religious institution and a government entity).CloudScout is written in .NET, and it's designed to work seamlessly with MgBot, Evasive Panda’s proprietary malware framework. Via a plug-in architecture, MgBot feeds CloudScout previously stolen cookies, which it then uses to access and infiltrate data from the cloud, using the pass-the-cookie technique to hijack authenticated sessions from Web browsers. >>Full Article<<

30
Jasper_The_Rasper
Moderator
23 days ago

Badges

Show all badges

Join the Conversation

Terms & Conditions