Welcome

News, Announcements, Tech Discussions

Botnet exploits GeoVision zero-day to install Mirai malware

November 15, 2024 By Bill Toulas A malware botnet is exploiting a zero-day vulnerability in end-of-life GeoVision devices to compromise and recruit them for likely DDoS or cryptomining attacks.The flaw is tracked as CVE-2024-11120 and was discovered by Piort Kijewski of The Shadowserver Foundation. It is a critical severity (CVSS v3.1 score: 9.8) OS command injection problem, allowing unauthenticated attackers to execute arbitrary system commands on the device."Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device," warns Taiwan's CERT."Moreover, this vulnerability has already been exploited by attackers, and we have received related reports."According to TWCERT, the vulnerability impacts the following device models:GV-VS12: A 2-channel H.264 video server that converts analog video signals into digital streams for network transmission. GV-VS11: A single-channel video server designed to digitize analog video for net

20 days ago

Jasper_The_RasperModerator

posted in Security Industry News

An Interview With the Target & Home Depot Hacker

November 14, 2024 By Brian Krebs In December 2023, KrebsOnSecurity revealed the real-life identity of Rescator, the nickname used by a Russian cybercriminal who sold more than 100 million payment cards stolen from Target and Home Depot between 2013 and 2014. Moscow resident Mikhail Shefel, who confirmed using the Rescator identity in a recent interview, also admitted reaching out because he is broke and seeking publicity for several new money making schemes.Mikhail “Mike” Shefel’s former Facebook profile. Shefel has since legally changed his last name to Lenin.Mr. Shefel, who recently changed his legal surname to Lenin, was the star of last year’s story, Ten Years Later, New Clues in the Target Breach. That investigation detailed how the 38-year-old Shefel adopted the nickname Rescator while working as vice president of payments at ChronoPay, a Russian financial company that paid spammers to advertise fake antivirus scams, male enhancement drugs and knockoff pharmaceuticals. >>Fu

20 days ago

TripleHelixModerator

posted in Security Industry News

Release notes for Microsoft Edge Security Updates November 14, 2024

Microsoft has released the latest Microsoft Edge Stable Channel (Version 131.0.2903.48) which incorporates the latest updates of the Chromium project.This update contains the following Microsoft Edge-specific update:CVE-2024-49025 https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security Make sure to re-add back in the Privacy Protection area after every update. Click on GIF to see full size!

21 days ago

TripleHelixModerator

posted in Security Industry News

Alert CISA Adds Two Known Exploited Vulnerabilities to Catalog Release Date November 14, 2024

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.CVE-2024-9463· Palo Alto Networks Expedition OS Command Injection Vulnerability· CVE-2024-9465 Palo Alto Networks Expedition SQL Injection VulnerabilityThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.Although BOD 22-01 only applies to FCEB agencies, CISA strongly ur

21 days ago

Jasper_The_RasperModerator

posted in Security Industry News

Leaked info of 122 million linked to B2B data aggregator breach

November 13, 2024 By Bill Toulas The business contact information for 122 million people circulating since February 2024 is now confirmed to have been stolen from a B2B demand generation platform.The data comes from DemandScience (formerly Pure Incubation), a B2B demand generation company that aggregates data.Data aggregation is the process of collecting, compiling, and organizing data from public sources to create a comprehensive dataset valuable for digital marketers and advertisers in creating rich "profiles" used to generate leads or marketing information.In the case of DemandScience, the firm collected business data from public sources and third parties, including full names, physical addresses, email addresses, telephone numbers, job titles and functions, and social media links.In February 2024, a threat actor named 'KryptonZambie'’ began selling 132.8 million records on BreachForums, claiming they were stolen from an exposed system belonging to Pure Incubation. >>Full Arti

21 days ago

Jasper_The_RasperModerator

posted in Security Industry News

Kids' shoemaker Start-Rite trips over security again, spilling customer card info

Full details exposed, putting shoppers at serious risk of fraud November 14, 2024 By Connor Jones Children's shoemaker Start-Rite is dealing with a nasty "security incident" involving customer payment card details, its second significant lapse during the past eight years.That's according to a recent notification sent to customers, seen by The Register, which didn't clarify exactly what the nature of that trouble was, although we know it involved the website's payment page.The intrusion occurred between October 14 and November 7, the notification reads, and the information understood to be potentially compromised includes customer names as displayed on their payment cards, the address to which the card is registered, the card number, its expiry date, and card verification value (CVV). >>Full Article<<

21 days ago

Jasper_The_RasperModerator

posted in Security Industry News

WordPress Security Plugin Vulnerability Endangers 4 Million+ Sites

A WordPress Security Plugin allows attackers to bypass login and get administrator-level access to websites November 14, 2024 By Roger Montti A critical vulnerability was discovered in a popular WordPress security plugin with over 4 million installations. The flaw allows attackers to log in as any user, including administrators, and gain full access to their site-level permissions. Assigned a threat score of 9.8 out of 10, it underscores the ease of exploitation and the potential for full site compromise, including malware injection, unauthorized content changes, and attacks on site visitors. >>Full Article<<

21 days ago

Jasper_The_RasperModerator

posted in Security Industry News

Low-Code, High Risk: Millions of Records Exposed via Misconfigured Microsoft Power Pages

Security researcher investigated Microsoft Power Pages installations and found several with misconfigurations allowing unintentional access to confidential data. November 14, 2024 By Kevin Townsend Researchers have discovered multiple misconfigured implementations of Microsoft Power Pages, and suspect the problem may be widespread.Power Pages is a low code tool that enables easy generation of web portals, typically fronting Microsoft’s Dataverse relational database. It is widely used by government entities, educational institutions, and private organizations around the world – sometimes to allow public interaction with the organization, and sometimes to provide remote access to data for employees.Aaron Costello, chief of SaaS security research at AppOmni, investigated a small number of installations and rapidly found several with misconfigurations allowing unintentional access to confidential data. He found around 7 million exposed records in about half a dozen implementations. For exa

21 days ago

Jasper_The_RasperModerator

posted in Security Industry News

Ahold Delhaize Cybersecurity Incident Impacts Giant Food, Hannaford

Cybersecurity incident impacts Giant Food, Hannaford, and other Ahold Delhaize USA brands, including pharmacies and e-commerce services. November 12, 2024 By Ionut Arghire Several US pharmacies and supermarket chains owned by Dutch food giant Ahold Delhaize have been affected by a cybersecurity incident disclosed on Friday.Giant Food pharmacies and Hannaford supermarkets are among the impacted brands that have reported network issues as result of the incident, but other brands might be affected as well.One of the largest food retailers in the world, Ahold Delhaize operates several supermarkets and ecommerce sites in the US, including Food Lion, Giant Food, Hannaford, Stop & Shop, and The Giant Company. >>Full Article<<

151

21 days ago

Jasper_The_RasperModerator

posted in Security Industry News

China-linked threat actors compromised multiple telecos and spied on a limited number of U.S. government officials

November 14, 2024 By Pierluigi Paganini China-linked threat actors breached U.S. broadband providers and gained access to private communications of a limited number of U.S. government officials.The FBI and CISA continues to investigate a large-scale cyber-espionage campaign by China-linked threat actors targeting U.S. telecoms, compromising networks to steal call records and access private communications, mainly of government and political figures.The US agencies confirmed that Chinese threat actors have compromised the private communications of a “limited number” of government officials following the compromise of multiple U.S. broadband providers. The cyber spies stole information belonging to targeted individuals that was subject to U.S. law enforcement requests pursuant to court orders.“The US government’s continued investigation into the People’s Republic of China (PRC) targeting of commercial telecommunications infrastructure has revealed a broad and significant cyber espionage c

21 days ago

Jasper_The_RasperModerator

posted in Security Industry News

Infoblox: 800,000 domains vulnerable to hijacking attack

While the 'Sitting Ducks' attack vector continues to pose a problem, Infoblox says domain registrars, DNS providers and government bodies remain inactive. November 14, 2024 By Arielle Waldman Infoblox warned that threat actors are increasingly exploiting misconfigured DNS name servers to hijack domains using a technique that's difficult for victims to detect.The network security vendor published a new report Thursday titled "DNS Predators Attack: Vipers and Hawks Hijack Sitting Ducks." The report expands on an attack vector dubbed "Sitting Ducks" that Infoblox and Eclypsium initially disclosed in July. During these attacks, threat actors take advantage of DNS configuration flaws to gain full control of a domain.After gaining control of vulnerable domains for major companies such as McDonald's and Paramount Global, threat actors pose as the legitimate domain owners and use the domains to deliver malware, conduct phishing campaigns and exfiltrate data. While Sitting Ducks continues to be

21 days ago

Jasper_The_RasperModerator

posted in Security Industry News

Hackers use macOS extended file attributes to hide malicious code

November 13, 2024 By Bill Toulas Hackers are using a novel technique that abuses extended attributes for macOS files to deliver a new trojan that researchers call RustyAttr.The threat actor is hiding malicious code in custom file metadata and also uses decoy PDF documents to help evade detection.The new technique is similar to how the Bundlore adware in 2020 hid its payloads in resource forks to hide payloads for macOS. It was discovered in a few malware samples in the wild by researchers at cybersecurity company Group-IB.Based on their analysis and because they could not confirm any victims, the researchers attribute the samples to the North Korean threat actor Lazarus with moderate confidence. They believe that the attacker may be experimenting with a new malware delivery solution.The method is uncommon and proved to be efficient against detection, as none of the security agents on the Virus Total platform flagged the malicious files. >>Full Article<<

21 days ago

Jasper_The_RasperModerator

posted in Security Industry News

Lapse in computer security at Atlanta VA leaves millions of veterans’ records unprotected, report finds

November 13, 2024 By Linda F. Hersey Sixty different versions of unapproved software were installed 169 times on computers at the Health Eligibility Center run by the Department of Veterans Affairs in Atlanta, according to a new report by the VA Office of Inspector General. The report also described a lack of encryption and other lapses in computer security that left the records of more than 3 million veterans unprotected. (Stars and Stripes) WASHINGTON — A Department of Veterans Affairs office in Atlanta that determines health care coverage for veterans failed to encrypt the records of more than 3 million former service members, ran outdated computer programs not securely configured and permitted unauthorized software on its networks, according to an audit.A report issued Wednesday by the VA Office of Inspector General cited security lapses at the Health Eligibility Center that have led to weaknesses in the computer system and made records vulnerable to unauthorized access, modificati

22 days ago

Jasper_The_RasperModerator

posted in Security Industry News

Iranian Cybercriminals Target Aerospace Workers via LinkedIn

The group seeks out aerospace professionals by impersonating job recruiters — a demographic it has targeted in the past as well — then deploys the SlugResin backdoor malware. November 13, 2024 By Dark Reading Staff A phishing campaign, active since last September, is targeting users on LinkedIn and other platforms by impersonating job recruiters in the aerospace industry.ClearSky attributed the campaign to Iranian-linked threat actor TA455, which uses a spear-phishing approach to target and lure individuals. Once connected with its victims, the threat actors encourage them to download a zip file called "SIgnedConnection.zip."Along with this, the threat actors also provide a PDF guide to their victims to instruct them on how to safely download and open the zip files.The zip file contains an executable file that loads the malware onto the victim's device through DLL side-loading. A DLL file called "secure32[.]dll" is loaded onto their system, allowing the attacker access to run an undet

22 days ago

Jasper_The_RasperModerator

posted in Security Industry News

300,000 Patients Impacted By Law Firm Data Breach

November 13, 2024 By Lars Daniel Thompson Coburn Law Firm Data Breach Impacts 300,000 Presbyterian Healthcare PatientsgettyThe law firm Thompson Coburn LLP and its client, Presbyterian Healthcare Services, or PHS, have become the focus of a class-action lawsuit following a significant data breach that compromised the personal information of over 300,000 individuals.Filed on Nov. 12 in an Illinois federal court, the lawsuit accuses both parties of failing to secure sensitive personal and medical data, thereby leaving it vulnerable to cybercriminal activity.The data breach, which occurred between May 28 and May 29, 2024, involved unauthorized access to Thompson Coburn’s network. As a result, a wide array of sensitive data including names, Social Security numbers, dates of birth, medical record numbers, patient account details, prescription information, and health insurance information was exposed. >>Full Article<<

22 days ago

Jasper_The_RasperModerator

posted in Security Industry News

Ransomware fiends boast they've stolen 1.4TB from US pharmacy network

American Associated Pharmacies yet to officially confirm infection November 13, 2024 By Connor Jones American Associated Pharmacies (AAP) is the latest US healthcare organization to have had its data stolen and encrypted by cyber-crooks, it is feared.The criminals over at the Embargo ransomware operation claimed responsibility for the hit job, allegedly stealing 1.469 TB of AAP's data, scrambling its files, and demanding payment to restore the information.AAP, which oversees a few thousand independent pharmacies in the country, hasn't officially confirmed an attack, nor has it responded to The Register's request for input on the claims. At the time of writing, its website warns all user passwords were recently force-reset. It did not explain why the resets were forced nor mention a cyberattack."All user passwords associated with both APIRx.com and RxAAP.com have been reset, so existing credentials will no longer be valid to access the sites," a website notice reads. "Please click 'forg

22 days ago

Jasper_The_RasperModerator

posted in Security Industry News

Chinese Hackers Target Tibetan Websites in Malware Attack, Cybersecurity Group Says

A hacking group believed to be Chinese state-sponsored has compromised two websites with ties to the Tibetan community in an attack meant to install malware on computers. November 13, 2024 By Associated Press A hacking group that is believed to be Chinese state-sponsored has compromised two websites with ties to the Tibetan community in an attack meant to install malware on users’ computers, according to findings released Wednesday by a private cybersecurity firm.The hack of the Tibet Post and Gyudmed Tantric University websites appears geared toward obtaining access to the computers of people visiting to obtain information on them and their activities, according to the analysis by the Insikt Group, the threat research division of the Massachusetts-based cybersecurity consultancy Recorded Future.The hackers, known in the report as TAG-112, compromised the websites so that visitors are prompted to download a malicious executable file disguised as a security certificate, Insikt Group sai

22 days ago