Stay ConnectedCyber Security moves much too quickly to wait for a weekly news recap. That’s why we’re here each and every weekday bringing you the relevant Information Security stories from overnight.
Make InfoSec Overnights part of your daily routine to ensure you and your team are up to the minute on the threats attacking your organization.
Copyright: © Copyright Paul Torgersen
A daily look at the relevant information security news from overnight - 29 July, 2022
Episode 276 - 29 July 2022
Kimsuky Stealing Emails- https://www.bleepingcomputer.com/news/security/cyberspies-use-google-chrome-extension-to-steal-emails-undetected/
NPM Cards Discord -
https://www.infosecurity-magazine.com/news/malicious-npm-packages-steal/
Trojan Play Store Apps -
https://thehackernews.com/2022/07/over-dozen-android-apps-on-google-play.html
Phishing Countdown- https://www.zdnet.com/article/this-phishing-attack-uses-a-countdown-clock-to-panic-you-into-handing-over-passwords/
IP Camera Hack -
https://thehackernews.com/2022/07/dahua-ip-camera-vulnerability-could-let.html
Hi, I’m Paul Torgersen. It’s Friday July 29th, 2022 and this is a look at the information security news from overnight.
From BleepingComputer.com:
A North Korean-backed threat group tracked as Kimsuky is using a malicious browser extension to steal emails from Google Chrome or Microsoft Edge users reading their webmail. The malware, called SHARPEXT supports Chrome, Edge and Whale browsers and can steal mail from Gmail and AOL accounts. Details in the article.
From InfoSecurity-Magazine.com:
Researchers have discovered a supply chain attack using malicious npm packages, this time targeting Discord users. The purpose of the campaign, named LofyLife, appears to be to steal Discord tokens and users’ credit card data. Kaspersky said it identified four suspicious packages which feature obfuscated Python and JavaScript code. Details and a link to the write up inside.
From TheHackerNews.com:
Another 17 so-called productivity apps have been uncovered and removed from the Google Play store. The apps did perform some basic tasks they advertise, but they were also dropping in malicious apps like Octo, Hydra, Ermac, and TeaBot. See the full list of affected apps in the article and make sure you delete those puppies.
From ZDNet.com:
A new phishing attack has taken a page out of the ransomware playbook by using a countdown clock to pressure victims into entering their username and password. At the end of the countdown they would be permanently locked out of whatever account is being targeted. Obviously nothing actually changes when the countdown reaches zero, but for some less sophisticated users, this could be very compelling.
And last, from TheHackerNews.com:
A security vulnerability in Dahua's Open Network Video Interface Forum standard implementation (ONVIF), can lead to a threat actor seizing control of IP cameras. ONVIF governs an open standard for how IP-based physical security products communicate with one another in a vendor-agnostic manner. I’m sure you can understand how some nation-state bad guys would be very interested in tapping into live video feeds. Get your patch on kids.
That’s all for me. Have a great weekend. If you like this podcast, please spread the word, and until next time, be safe out there.
A daily look at the relevant information security news from overnight - 28 July, 2022
Episode 275 - 28 July 2022
NetStandard Knocked Offline- https://www.bleepingcomputer.com/news/security/kansas-msp-shuts-down-cloud-services-to-fend-off-cyberattack/
Moxa NPort Flaws -
https://www.securityweek.com/moxa-nport-device-flaws-can-expose-critical-infrastructure-disruptive-attacks
Post Macro Tactics -
https://www.infosecurity-magazine.com/news/hackers-change-tactics-for-new/
Naughty Knotweed- https://thehackernews.com/2022/07/microsoft-uncover-austrian-company.html
Twitter Data Sale -
https://www.infosecurity-magazine.com/news/criminal-twitter-users-data/
Hi, I’m Paul Torgersen. It’s Thursday July 28th, 2022 and this is a look at the information security news from overnight.
From BleepingComputer.com:
Managed service provider NetStandard suffered a cyberattack causing the company to shut down its MyAppsAnywhere cloud services. The company said Hosted GP, Hosted CRM, Hosted Exchange, and Hosted Sharepoint will be offline until further notice, but that no other services were impacted. That being said, their main website remains down as well. No word on threat actor or malware involved, but it is assumed to be a ransomware hit.
From SecurityWeek.com:
Two high severity flaws have been found in the NPort 5110 device servers from Moxa. The vulnerabilities can be exploited remotely to cause the targeted device to enter a denial of service condition. The only way to regain control of the device is to physically power it down, which might present a challenge as many of these devices are in very remote locations. These things are designed to connect to Ethernet networks and should not be exposed to the internet. However, a Shodan search found at least 5,300 of them that are. Now some of these may be honeypots, but they’re not ALL honeypots. Customers should contact Moxa for a security patch.
From InfoSecurity-Magazine.com:
Since Microsoft announced they would disable macros by default, the use of macro-enabled attachments by threat actors decreased by around 66% between October 2021 and June 2022. Awesome. But, where there’s a will there's a way. In that same timeframe, the number of malicious campaigns using container file formats jumped up 176%. These formats include ISO, RAR, ZIP and IMG files that contain macro-enabled docs. Now the ISO and RAR formats will still have the Mark of the Web, meaning they originated from the internet and their macros would be blocked, but the files within them would not. Link to the ProofPoint research in the article.
From TheHackerNews.com:
A threat actor tracked as Knotweed, used several Windows and Adobe zero-day exploits in highly-targeted attacks against targets in Europe and Central America. They are actually an Austrian outfit called DSIRF that supposedly sells general security and information analysis services to commercial customers. As a side gig, they created a cyberweapon called Subzero, which can hack phones, computers, and internet-connected devices. Talk about vertical integration.
And last, from InfoSecurity-Magazine.com:
A user named devil is selling a database of 5.4 million Twitter users' information on the Breached Forums site. They say it contains the phone numbers and email addresses of users, including celebrities and companies, and is asking for $30,000. Twitter is investigating the issue, which the seller said exploited a vulnerability in its systems that allows someone to find additional user information, even if that user has it hidden in privacy settings.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight - 27 July, 2022
Episode 274 - 27 July 2022
WordFly Breach- https://www.securityweek.com/mailing-list-provider-wordfly-scrambling-recover-following-ransomware-attack
Now IIS See You -
https://www.bleepingcomputer.com/news/microsoft/microsoft-exchange-servers-increasingly-hacked-with-iis-backdoors/
Messaging Threats -
https://threatpost.com/messaging-apps-cybercriminals/180303/
Robin Banks Phishing Service- https://www.bleepingcomputer.com/news/security/new-robin-banks-phishing-service-targets-bofa-citi-and-wells-fargo/
No Knock Nuki -
https://www.securityweek.com/nuki-smart-lock-vulnerabilities-allow-hackers-open-doors
Hi, I’m Paul Torgersen. It’s Wednesday July 27th, 2022 and this is a look at the information security news from overnight.
From SecurityWeek.com:
Mailing list provider WordFly has been offline for more than two weeks after a ransomware attack encrypted data on some of its systems. The attack hit on July 10, and the company hasn’t been able to restore service since. The company confirms data was exfiltrated, but believes it was subsequently deleted. They expect to be down at least another few days before they get systems operational again. No word on the malware or threat actor.
From BleepingComputer.com:
Attackers are increasingly using Internet Information Services, IIS, web server extensions to backdoor unpatched Exchange servers. Being installed in the exact location and using the same structure as legitimate modules, they provide attackers' with a perfect and durable persistence mechanism. Details and a link to the Microsoft report in the article.
From ThreatPost.com:
Threat actors are tapping the multi-feature nature of messaging apps such as Telegram and Discord as a foundation in persistent campaigns that threaten users. Intel 471 identified three key ways in which threat actors are leveraging the apps: storing stolen data, hosting malware payloads, and using bots that perform the dirty work. Details and a link inside.
From BleepingComputer.com:
A new phishing as a service platform has shown up with the name Robin Banks. As you may have guessed, it offers ready-made phishing kits targeting the customers of well-known banks. Companies like Citibank, Bank of America, Capital One, Wells Fargo, etc. Oh, they also offer templates to steal Microsoft, Google, Netflix, and T-Mobile accounts. Pricing from $50 to $200 a month.
And last, from SecurityWeek.com:
Security researchers have documented 11 vulnerabilities impacting Nuki smart lock products, you may not be able to see my air quotes. Nuki Smart Lock and Nuki Bridge, allow users to unlock their doors with their smartphones by simply walking in range. Brilliant. Exploiting the found vulnerabilities could result in a fully compromised device, including the ability to open and close the door without the owner even noticing. After being notified of the flaws in April, Nuki has issued patches this month.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight - 26 July, 2022
Episode 273 - 26 July 2022
Grails RCE Vuln- https://portswigger.net/daily-swig/critical-security-vulnerability-in-grails-could-lead-to-remote-code-execution
PrestaShop Skimmer -
https://thehackernews.com/2022/07/hackers-exploit-prestashop-zero-day-to.html
LinkedIn Phishing for Admins -
https://www.bleepingcomputer.com/news/security/linkedin-phishing-target-employees-managing-facebook-ad-accounts/
PolicyBazaar Breached- https://www.infosecurity-magazine.com/news/indian-insurance-policybazaar/
FileWave Crit Flaws -
https://thehackernews.com/2022/07/critical-filewave-mdm-flaws-open.html
Hi, I’m Paul Torgersen. It’s Tuesday July 26th, 2022 and from Denver, this is a look at the information security news from overnight.
From PortSwigger.net:
A critical vulnerability within a Grails application runtime could allow an attacker to gain remote code execution. The attack exploits a section of the Grails data-binding logic, and has been confirmed on Grails framework versions 3.3.10 and higher, including Grails framework 4 and 5, that are running on Java 8. It has been observed in both the embedded Tomcat runtime and applications deployed as a Web Archive to a Tomcat instance. The company urges all users, even those using unaffected versions, to update as soon as possible.
From TheHackerNews.com:
Threat actors are exploiting a previously unknown security flaw in the open source PrestaShop e-commerce platform to inject malicious skimmer code. PrestaShop is the leading open-source e-commerce solution in Europe and Latin America, used by nearly 300,000 online merchants worldwide. The company said they found a zero-day flaw in its service that has been addressed in version 1.7.8.7, although they are not sure that was the only flaw vulnerable to the attack.
From BleepingComputer.com:
A new spear phishing campaign named Ducktail is targeting professionals on LinkedIn to take over Facebook business accounts. The threat actors are specifically targeting people who have admin privileges on their employer’s social media accounts. Fingers point to a Vietnamese threat actor that has been active since at least 2021 and maybe back as far as 2018.
From Infosecurity-Magazine.com:
Indian insurance company Policybazaar has advised that it suffered a data breach, confirming an unauthorized access to their systems on July 19. The company has found and fixed the exploited vulnerability and claims that no significant customer data was exposed.
And last, from TheHackerNews.com:
FileWave's mobile device management system has been found vulnerable to two critical security flaws that could be leveraged to carry out remote attacks and seize control of a fleet of devices connected to it. The two flaws relate to an authentication bypass, and the use of a hard-coded cryptographic key. There are more than 1,100 internet-facing FileWave servers that are vulnerable to the attack. Get your patch on kids.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight - 25 July, 2022
Episode 272 - 25 July 2022
Entrust Breached- https://www.bleepingcomputer.com/news/security/digital-security-giant-entrust-breached-by-ransomware-gang/
UEFI Rootkit -
https://thehackernews.com/2022/07/experts-uncover-new-cosmicstrand-uefi.html
Urgent SonicWall Patch -
https://www.securityweek.com/sonicwall-warns-critical-gms-sql-injection-vulnerability
Cisco Nexus Patches Three- https://portswigger.net/daily-swig/cisco-patches-dangerous-bug-trio-in-nexus-dashboard
Racoon Gets Buff -
https://thehackernews.com/2022/07/racoon-stealer-is-back-how-to-protect.html
Hi, I’m Paul Torgersen. It’s Monday July 25th, 2022, this is a look at the information security news from overnight.
From BleepingComputer.com:
Identity and access management company Entrust has confirmed that it was the victim of a cyberattack. Threat actors were able to breach their network and steal data from internal systems. The company says they have found no indication that the breach has impacted their operation or their products and services. No word on malware strain or threat actor involved. More to come I’m sure.
From TheHackerNews.com:
An unknown Chinese-speaking threat actor has been attributed with a new kind of UEFI firmware rootkit called CosmicStrand. The rootkit is located in the firmware images of Gigabyte or ASUS motherboards, and are related to designs using the H81 chipset. Victims identified so far are just individuals in China, Vietnam, Iran and Russia, with no discernable ties to business or government agencies. A link to the Kaspersky research in the article.
From SecurityWeek.com:
SonicWall has issued urgent patches for a critical flaw in its Global Management System software, warning that the issue exposes businesses to remote attacks. The 9.4 severity flaw provides a pathway for a remote attacker to execute arbitrary SQL queries in the database. The vulnerability exists due to insufficient sanitization of user-supplied data.
From PortSwigger.net:
Serious vulnerabilities in Cisco Nexus Dashboard give attackers a viable path to executing arbitrary commands as root, uploading container image files, or performing cross-site request forgery attacks. Cisco has issued patches for the three bugs, one of them carrying a 9.8 severity rating. The company said it was not aware of any of these bugs being exploited in-the-wild. Get your patch on kids.
And last, from TheHackerNews.com:
The new and vastly improved version of Raccoon Stealer has hit the scene. Not only can it steal browser passwords, cookies, and auto-fill data, it can now also steal credit card numbers, cryptocurrency and crypto wallets, harvest file data, drop files onto the system, list apps installed on the machine, and take screenshots. Fortunately, just like with the real world rodents, basic precautions should keep the varmint at bay: beware of spoofed messages and don’t click any links you didn’t know were specifically coming.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight - 22 July, 2022
Episode 271 - 22 July 2022
Drupal Updates- https://www.securityweek.com/code-execution-and-other-vulnerabilities-patched-drupal
Zyxel Firewall Patches -
https://portswigger.net/daily-swig/zyxel-firewall-vulnerabilities-left-business-networks-open-to-abuse
PayPal Double Spear Phishing -
https://www.infosecurity-magazine.com/news/paypal-used-send-malicious-double/
Okta Too Open- https://threatpost.com/risks-okta-sso/180249/
Candiru’s DevilsTongue -
https://www.bleepingcomputer.com/news/security/chrome-zero-day-used-to-infect-journalists-with-candiru-spyware/
Hi, I’m Paul Torgersen. It’s Friday July 22nd, 2022, and from Victoria one last time, this is a look at the information security news from overnight.
From SecurityWeek.com:
Drupal has released patches for four vulnerabilities. The most critical flaw affects Drupal 9.3 and 9.4. and it can lead to arbitrary PHP code execution on Apache web servers. The other three vulnerabilities also impact the Drupal core and can lead to cross-site scripting attacks, information disclosure, or access bypass. Get your patch on kids.
From PortSwigger.net:
Zyxel has released patches for several of its firewall products following the discovery of two security vulnerabilities that left business networks open to exploitation. One is an authenticated directory traversal vulnerability in the Common Gateway Interface, and the other is a local privilege escalation vulnerability that was identified in the command-line interface. You should update to the latest versions as soon as you can.
From Infosecurity-Magazine.com:
Threat actors are using PayPal to send out phishing invoices. PayPal domains are usually “allow-listed” by organizations’ email filters, so cyber-criminals are registering accounts and composing malicious invoices on the platform. Many are spoofing Norton products, but substituting their own information for payments. They even have someone answering the included Customer Service number to continue the charade to extract dollars from their victims.
From ThreatPost.com:
Four newly discovered attack paths in the products for IAM vendor Okta could lead to PII exposure, account takeover, or even organizational data destruction. Note that the researchers call these “attack paths” and not vulnerabilities. Okta says this is a non issue and all you need to do is tweak up your security profile a little, which is beyond what they offer as their default settings. You can see the details in the article.
And last, from BleepingComputer.com:
The Israeli spyware vendor Candiru was found using a Google Chrome zero day to spy on journalists and other high-interest individuals in the Middle East with their 'DevilsTongue' spyware. Threat researchers from Avast, who discovered the vulnerability and reported it to Google, revealed that they unearthed the flaw after investigating spyware attacks on their clients. The vuln was patched on July 4. Details and a link to the research in the article.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until next next time, be safe out there.
A daily look at the relevant information security news from overnight - 21 July, 2022
Episode 270 - 21 July 2022
Patched Atlassian- https://www.bleepingcomputer.com/news/security/atlassian-fixes-critical-confluence-hardcoded-credentials-flaw/
Linux Hit by Lightning -
https://thehackernews.com/2022/07/new-linux-malware-framework-let.html
Renewed Redeemer -
https://www.bleepingcomputer.com/news/security/new-redeemer-ransomware-version-promoted-on-hacker-forums/
Apple Pushed Update- https://www.securityweek.com/apple-ships-urgent-security-patches-macos-ios
Neopets Nabbed -
https://www.bleepingcomputer.com/news/security/neopets-data-breach-exposes-personal-data-of-69-million-members/
Hi, I’m Paul Torgersen. It’s Thursday July 21st, 2022, and from Victoria, this is a look at the information security news from overnight.
From BleepingComputer.com:
Atlassian has patched a critical hardcoded credentials vulnerability in Confluence Server and Data Center that could let remote, unauthenticated attackers log into vulnerable servers. The hardcoded password is added after installing the Questions for Confluence app, for an account with the username disabledsystemuser. It was designed to help admins with the migration of data from the app to the Confluence Cloud.
From TheHackerNews.com:
A never-before-seen malware called Lightning Framework targets Linux machines to install rootkits. The malware has been dubbed a "Swiss Army Knife" and is equipped with a plethora of features, making it one of the most intricate frameworks developed for targeting Linux systems. Details and a link to the research report in the article.
From BleepingComputer.com:
A threat actor is promoting a new version of their free-to-use Redeemer ransomware builder on hacker forums. According to its author, the 2.0 release was written entirely in C++ and works on Windows Vista, 7, 8, 10, and 11. This offers unskilled threat actors an easy entry to the world of encryption-backed extortion attacks. All they pay is 20% of any ransom they manage to collect.
From SecurityWeek.com:
Apple's security response team has pushed out software fixes for at least 39 vulnerabilities impacting macOS Catalina, iOS and iPadOS platforms. The patches provide updates for numerous memory safety flaws, some serious enough to expose users to remote code execution attacks. Apple is urging users to update straight away. Get your patch on kids.
And last today, from BleepingComputer.com:
Neopets has suffered a data breach leading to the theft of source code as well as a database containing the personal information of over 69 million members. A hacker known as 'TarTarX' began selling the source code and database for four bitcoins, about $94,000 at current prices. He did not confirm his attack vector, but it appears he still has active access to the database.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until next tomorrow, be safe out there.
A daily look at the relevant information security news from overnight - 20 July, 2022
Episode 269 - 20 July 2022
Knauf Knocked Out- https://www.bleepingcomputer.com/news/security/building-materials-giant-knauf-hit-by-black-basta-ransomware-gang/
Rusty Luna -
https://thehackernews.com/2022/07/new-rust-based-ransomware-family.html
GPS Over-Tracking -
https://www.zdnet.com/article/flaws-in-a-popular-gps-tracker-could-allow-hackers-to-track-or-stop-vehicles-say-security-researchers/
Oracle Patchfest- https://www.securityweek.com/oracle-releases-349-new-security-patches-july-2022-cpu
Magicart Skim -
https://docs.google.com/document/d/1Kse6lMi7hJEg1wDnVS_ZEND2pZOEMT4a9We3erCPsXE/edit
Hi, I’m Paul Torgersen. It’s Wednesday July 20th, 2022, and from Victoria, this is a look at the information security news from overnight.
From BleepingComputer.com:
The Knauf Group, a large Germany based building materials company, has announced it has been the target of a cyberattack that has disrupted its business operations. Their global IT team has shut down all systems to isolate the incident. Knauf has not confirmed it is a ransomware attack, but the Black Basta group has claimed responsibility for the attack on their extortion site. So far they claim to have released about 20% of the information they stole, which indicates they are likely still hopeful to receive a ransom from the victim.
From TheHackerNews.com:
Researchers have disclosed a brand-new ransomware family written in Rust, that Kaspersky Labs has named Luna. The ransomware is fairly simple and appears to be in its early development. It is designed to be used by Russian speaking threat actors, and can run on Windows, Linux, and ESXi systems.
From ZDNet.com:
Critical security vulnerabilities in the MiCODUS MV720 vehicle GPS tracker could be used to remotely track, stop or even take control of vehicles in which it is installed. These devices are popular with large companies and government entities, with approximately 1.5 million of them currently in use in 169 countries. Researchers at BitSight, who found the flaws, say these devices should not be used until patches are available. No word from MiCODUS on when that might be.
From SecurityWeek.com:
Oracle’s quarterly Critical Patch Update has a total of 349 new security patches, including 230 for vulnerabilities that can be exploited by remote, unauthenticated attackers. 64 of the vulnerabilities are rated critical, with four of those scoring a ten out of ten. Financial Services Applications received the largest number of fixes, followed by Oracle Communications, then Fusion Middleware. Get your patch on kids.
And last today, from ThreatPost.com:
A Magecart campaign has been skimming payment-card credentials from customers using three online restaurant-ordering systems. The attack has affected over 300 restaurants and compromised at least 50,000 cards so far, which have already been offered up for sale on the dark web. The platforms impacted are MenuDrive, Harbortouch, and InTouchPOS.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until next tomorrow, be safe out there.
A daily look at the relevant information security news from overnight - 19 July, 2022
Episode 268 - 19 July 2022
Mac is Back-Doored- https://www.bleepingcomputer.com/news/security/elastix-voip-systems-hacked-in-massive-campaign-to-install-php-web-shells/
Fake Crypto Apps -
https://www.zdnet.com/article/fbi-these-fake-apps-are-trying-to-steal-your-crypto-heres-what-to-watch-out-for/
FlipKart Breach -
https://techcrunch.com/2022/07/18/cleartrip-data-breach-dark-web/
SATAn Air Gapped Attack- https://thehackernews.com/2022/07/new-air-gap-attack-uses-sata-cable-as.html
Russians Hiding on the Cloud -
https://www.bleepingcomputer.com/news/security/russian-svr-hackers-use-google-drive-dropbox-to-evade-detection/
Hi, I’m Paul Torgersen. It’s Tuesday July 19th, 2022, and from Port Angeles, this is a look at the information security news from overnight.
From BleepingComputer.com:
Unknown threat actors are using a previously undetected malware to backdoor macOS devices and exfiltrate information. ESET researchers named the malware CloudMensis because it uses pCloud, Yandex Disk, and Dropbox public cloud storage services for C2 communications. It is not known yet how the malware is distributed. Details in the article.
From ZDNet.com:
The FBI has warned that criminal groups are creating fraudulent apps that mimic real financial services brands that have so far duped investors into parting with $42.7 million over the past six months. Many of these are mimicking cryptocurrency services as there continue to be a flood of new players in the space and some ambiguity around crypto investing. Details and links to the advisory in the article.
From TechCrunch.com:
Cleartrip, a popular travel-booking platform in India, has confirmed a data breach after hackers claimed to post the stolen data on the dark web. Exact details of the stolen data are not yet known, however analysis of the screenshots posted make it appear that significant amounts of data were accessed, including forward looking information, which may indicate an insider was involved.
From TheHackerNews.com:
Researchers have developed a new method to steal data from an air gapped machine using the Serial ATA cable. Dubbed SATAn, the attack uses the SATA cable as a covert channel to emanate electromagnetic signals and transfer information to a nearby receiver just over a meter away. Fortunately, this technique does require physical access to the machine initially, which obviously makes it much more difficult. On the other hand, Stuxnet required physical access as well, so you never know.
And last today, from BleepingComputer.com:
State-backed Russian hackers have started using legitimate Google Drive cloud storage services to evade detection. It is akin to hiding in plain sight by getting lost in the crowd. Google cloud storage is ubiquitous and pretty much universally trusted. Russian threat actors are abusing that trust to render their attacks exceedingly difficult, if not impossible, to detect and block.
That’s all for me. Have a great rest of your day. Like and subscribe, and until next time, be safe out there.
A daily look at the relevant information security news from overnight - 18 July, 2022
Episode 267 - 18 July 2022
Elastix VoIP Attack- https://www.bleepingcomputer.com/news/security/elastix-voip-systems-hacked-in-massive-campaign-to-install-php-web-shells/
Botnet Targeting ICS -
https://thehackernews.com/2022/07/hackers-distributing-password-cracking.html
Play Store Purge -
https://threatpost.com/google-boots-malware-marketplace/180241/
Juniper Patches- https://www.securityweek.com/juniper-networks-patches-over-200-third-party-component-vulnerabilities
Blitz.JS Polluted -
https://portswigger.net/daily-swig/prototype-pollution-in-blitz-js-leads-to-remote-code-execution
Hi, I’m Paul Torgersen. It’s Monday July 18th, 2022, and from Port Angeles, this is a look at the information security news from overnight.
From BleepingComputer.com:
Threat analysts have uncovered a large-scale campaign targeting Elastix VoIP telephony servers with more than 500,000 malware samples over a period of about three months. The attackers are likely exploiting CVE-2021-45461, a remote code execution vulnerability with a 9.8 severity. The goal is to plant a PHP web shell that could run arbitrary commands on the compromised communications server. Details in the article.
From TheHackerNews.com:
Industrial engineers and operators are the target of a new campaign that leverages password cracking software to seize control of Programmable Logic Controllers and co-opt the machines to a botnet. Attackers are exploiting a vulnerability in the firmware which allows it to retrieve the password on command. They then drop the Sality malware and turn the host into a peer in Sality's peer-to-peer botnet. More details inside.
From ThreatPost.com:
Google has removed eight apps from its Play store that were propagating a new variant of the Joker spyware. Unfortunately those apps had already accounted for a total of over 3 million downloads. Those apps are: Vlog Star Video Editor, Creative 3D Launcher, Wow Beauty Camera, Gif Emoji Keyboard, (yes I said gif not jif) Freeglow Camera, Coco Camera, Funny Camera, and Razer Keyboard & Theme.
From SecurityWeek.com:
Juniper Networks has published 21 security advisories to inform customers about patches for more than 200 vulnerabilities. Six of those advisories impact their own products, including Junos OS, Junos Space, Contrail Networking, and Northstar Controller products. The rest were vulnerabilities affecting third-party components such as Nginx, OpenSSL, Samba, Java SE, SQLite and Linux. Details in the article.
And last today, from PortSwigger.net:
Blitz.js, a JavaScript web application framework, has patched a dangerous prototype pollution vulnerability that could lead to remote code execution on Node.js servers. The bug allows attackers to manipulate the code in the Blitz.js app to create a reverse shell and run arbitrary commands on the server. You can find all the dirty details in the article.
That’s all for me. Have a great rest of your day. Like and subscribe, and until next time, be safe out there.
A daily look at the relevant information security news from overnight - 15 July, 2022
Episode 266 - 15 July 2022
Hive Five Decryptor- https://www.techtarget.com/searchsecurity/news/252522715/Researcher-develops-Hive-ransomware-decryption-tool
WordPress Scan -
https://www.bleepingcomputer.com/news/security/attackers-scan-16-million-wordpress-sites-for-vulnerable-plugin/
SMB H0lyGh0st -
https://thehackernews.com/2022/07/north-korean-hackers-targeting-small.html
Spoofing GitHub Commits- https://www.securityweek.com/supply-chain-attack-technique-spoofs-github-commit-metadata
WordPress Phishes PayPal -
https://www.bleepingcomputer.com/news/security/paypal-phishing-kit-added-to-hacked-wordpress-sites-for-full-id-theft/
Hi, I’m Paul Torgersen. It’s Friday July 15th, 2022, and this is a look at the information security news from overnight.
From TechTarget.com:
A malware researcher known as reecDeep, or reecDeep, I’m sorry if I am mispronouncing your handle, has developed and published a decryption tool on GitHub for version 5 of the Hive ransomware. reecDeep developed the tool with a fellow anonymous malware researcher known as rivitna. The post includes technical details of how Hive v5 works as well as how the researchers developed their brute-force decryption tool.
From BleepingComputer.com:
Security researchers have detected a massive campaign that scanned close to 1.6 million WordPress sites for the presence of a vulnerable plugin that allows uploading files without authentication. They were specifically targeting the Kaswara Modern WPBakery Page Builder, which had been abandoned by its author before receiving a patch for a critical severity flaw uncovered last year. Exploitation of the flaw could lead to a complete takeover of the site.
From TheHackerNews.com:
An emerging threat cluster originating from North Korea, which calls itself H0lyGh0st has been linked to developing and using ransomware with that same payload name targeting small businesses since September of last year. Targeted entities primarily include SMB such as manufacturing organizations, banks, schools, and event and meeting planning companies.
From SecurityWeek.com:
Security researchers are warning of a new supply chain attack technique that relies on spoofed commit metadata to add legitimacy to malicious GitHub repositories. Threat actors could tamper with commit data so that a repository would appear to be older than it actually is, or that reputable contributors have been involved in its maintenance.
And last this week, from BleepingComputer.com
A newly discovered phishing kit is targeting PayPal users in an attempt to steal your PII. The kit is hosted on legitimate WordPress websites that have been hacked, which allows it to evade detection, at least for a little while. The threat actor targets poorly secured WordPress sites and brute-forces their log in. They’ve also done a pretty nice job on the PayPal spoof site, which includes a Captcha challenge for a whiff of legitimacy. The ultimate goal is not only gathering login info, but financial and address details as well.
That’s all for me. Have a great weekend. Like and subscribe, and until next time, be safe out there.
A daily look at the relevant information security news from overnight - 14 July, 2022
Episode 265 - 14 July 2022
Lilith Not-Fair- https://www.bleepingcomputer.com/news/security/new-lilith-ransomware-emerges-with-extortion-site-lists-first-victim/
Retbleed Spectre -
https://www.securityweek.com/retbleed-new-speculative-execution-attack-targets-intel-amd-processors
AWS Kubernetes Flaw -
https://portswigger.net/daily-swig/vulnerability-in-aws-iam-authenticator-for-kubernetes-could-allow-user-impersonation-privilege-escalation-attacks
Teams Sticker Shock- https://portswigger.net/daily-swig/microsoft-teams-security-vulnerability-left-users-open-to-xss-via-flawed-stickers-feature
Bandai Namco Gamed -
https://www.bleepingcomputer.com/news/security/bandai-namco-confirms-hack-after-alphv-ransomware-data-leak-threat/
Hi, I’m Paul Torgersen. It’s Thursday July 14th 2022, and this is a look at the information security news from overnight.
From BleepingComputer.com:
There’s a new ransomware group that has just hit the scene named Lilith. They have created the standard double-extortion leak site and added their first victim, a large construction group in South America, which has since been removed from the site. Analysis of the new family shows it does not appear to introduce any novelties, but another someone to keep an eye on. Details in the article.
From SecurityWeek.com:
Researchers have devised a new speculative execution attack called Retbleed, that can lead to information leaks and works on both Intel and AMD processors. The attack targets retpolines, or return trampolines, which was one of the defenses proposed in back 2018 to mitigate the Spectre side-channel attacks. You can see all the details and a link to the research paper in the article.
From PortSwigger.net:
A vulnerability in AWS IAM Authenticator for Kubernetes could allow a malicious actor to impersonate other users and escalate privileges in Kubernetes clusters. This impacts Elastic Kubernetes Service clusters configured with the AccessKeyID template parameter. If this is you, make sure you are running version 0.5.9.
Also from PortSwigger.net:
Attackers could abuse the sticker feature in Microsoft Teams to conduct cross-site scripting attacks. The Teams platform converts stickers into an image and uploads the content as RichText/HTML in the subsequent message. This can be manipulated for a potential HTML injection attack against multiple domains. All the sticky details in the article.
And last today, from BleepingComputer.com
Japanese game publishing giant Bandai Namco has confirmed that they suffered a cyberattack. The BlackCat ransomware gang has claimed responsibility for the attack on their data leak site. The company says the breach occurred on July 3rd to their internal systems in Asian regions other than Japan, and they are still evaluating the scope and type of information compromised.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight - 13 July, 2022
Episode 264 - 13 July 2022
Qakbot Glows Up- https://thehackernews.com/2022/07/researchers-uncover-new-attempts-by.html
AiTM Phishing -
https://threatpost.com/large-scale-hishing-bypasses-mfa/180212/
Lenovo Firmware Flaw -
https://thehackernews.com/2022/07/new-uefi-firmware-vulnerabilities.html
Microsoft Patches Zero Day- https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2022-patch-tuesday-fixes-exploited-zero-day-84-flaws/
Luna Moth Flutters In -
https://www.bleepingcomputer.com/news/security/new-luna-moth-hackers-breach-orgs-via-fake-subscription-renewals/
Hi, I’m Paul Torgersen. It’s Wednesday July 13th 2022, and this is a look at the information security news from overnight.
From TheHackerNews.com
Researchers at Zscaler have found that the operators behind the Qakbot malware are trying to sidestep detection by altering their delivery vectors. Most recently by using ZIP file extensions, code obfuscation, utilizing multiple URLs, and using unknown file extensions such as .OCX, .ooccxx, .gyp, etc. Looks like this little workhorse just won't go away. A link to that research in the article.
From ThreatPost.com:
Microsoft has uncovered a massive phishing campaign that can steal credentials even if you have multi-factor authentication enabled. The campaign uses adversary-in-the-middle phishing sites to hijack session cookies so the attacker gets authenticated to a session on the user’s behalf regardless of the sign-in method used. The ultimate goal seems to be payment fraud through Business Email Compromise attacks and has targeted over 10,000 organizations to date. Details in the article.
From TheHackerNews.com:
Lenovo rolled out fixes for three security flaws in its UEFI firmware affecting over 70 product models. The vulnerabilities can be exploited to achieve arbitrary code execution in the early phases of the platform boot. All three bugs relate to buffer overflow vulnerabilities. Lenovo had to patch three UEFI vulnerabilities earlier this year as well.
From BleepingComputer.com
Microsoft's July Patch Tuesday included fixes for 84 total vulnerabilities. Four of those were critical, one of which was a zero day being actively exploited in the wild. That one could gain an attacker SYSTEM privileges, but no attack details were provided. This is in addition to fixes rolled out from SAP, Siemens, Schneider and others. Get your patch on kids.
And last today, also from BleepingComputer.com
A new data extortion group has been trying to breach companies to steal confidential information. The group, called Luna Moth, has been active since at least March with phishing campaigns that claim to be subscription renewal invoices, but really deliver remote access tools. The emails spoof the relevant brand, but actually all come from gmail accounts. The techniques and tools used indicate these guys are not very sophisticated. On the other hand, sometimes our users are not very sophisticated, so better to be aware.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight - 12 July, 2022
Episode 263 - 12 July 2022
OAuth Dirty Dancing- https://portswigger.net/daily-swig/dirty-dancing-in-oauth-researcher-discloses-how-cyber-attacks-can-lead-to-account-hijacking
Crypto Mining in the Cloud -
https://thehackernews.com/2022/07/cloud-based-cryptocurrency-miners.html
Rolling-PWN a Honda -
https://www.bleepingcomputer.com/news/security/hackers-can-unlock-honda-cars-remotely-in-rolling-pwn-attacks/
Amazon Scam Days- https://www.infosecurity-magazine.com/news/spike-amazon-prime-scams/
Ransom Return -
https://www.bleepingcomputer.com/news/security/new-0mega-ransomware-targets-businesses-in-double-extortion-attacks/
Hi, I’m Paul Torgersen. It’s Tuesday July 12th 2022, and this is a look at the information security news from overnight.
From PortSwigger.net
A researcher has discovered a way to perform single-click account hijacking by abusing the OAuth process flow. He calls it Dirty Dancing because attackers can dance around the OAuth authentication process and how it communicates between a browser and a service provider. All the dirty details in the article.
From TheHackerNews.com:
GitHub Actions and Azure virtual machines are being leveraged for cloud-based crypto mining operations. At least 1,000 repositories and 550 code samples have been found taking advantage of the GitHub runners for mining. No number was provided for the Azure VMs. Details and a link to the Trend Micro research in the article.
From BleepingComputer.com:
Researchers found that several modern Honda models have a vulnerable rolling code mechanism that allows unlocking the cars or even starting the engine remotely. It has to do with intercepting signals from the fob and how the pseudorandom number generator works. The Hondas will re-sync when the car gets lock/unlock commands in succession, which allow codes from a previous session to be successful instead of invalidated. Details inside.
From Infosecurity-Magazine.com
With Amazon Prime Days come Amazon Prime Days scams. In 2021 there was nearly double the amount of phishing scams related to the sale than typical Amazon focused attempts. Be on the lookout for imposter websites and lots of “get an Amazon gift card if you fill out this survey.” Remember, if something looks too good to be true, it probably is.
And last today, from BleepingComputer.com
In a bit of good news, back in December of 2019, Maastricht University, a Dutch university with more than 22,000 students, fell victim to a ransomware attack. To get their files decrypted, they paid a ransom of 30 bitcoins, about 200,000 Euro at the time. Flash forward to February of this year when Dutch authorities found a wallet containing part of the paid ransom, which they promptly returned to the university. But because of the increase in value of the crypto, the amount returned was right about 500,000 Euro. Sometimes being the victim of a crime does pay.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight - 11 July, 2022
Episode 262 - 11 July 2022
Mangatoon Mega Breach- https://www.bleepingcomputer.com/news/security/mangatoon-data-breach-exposes-data-from-23-million-accounts/
Security Companies as Phishing Bait -
https://www.zdnet.com/article/brazen-crooks-are-now-posing-as-cybersecurity-companies-to-trick-you-into-installing-malware/
La Poste Mobile Attacked -
https://www.infosecurity-magazine.com/news/ransomware-french-telecomes/
Edge Zero Day Patch- https://www.techradar.com/news/microsoft-edge-gets-emergency-patch-for-severe-zero-day-vulnerability
0mega Ransomware -
https://www.bleepingcomputer.com/news/security/new-0mega-ransomware-targets-businesses-in-double-extortion-attacks/
Hi, I’m Paul Torgersen. It’s Monday July 11th 2022, and this is a look at the information security news from overnight.
From BleepingComputer.com
Comic reading platform Mangatoon has suffered a data breach that exposed information belonging to 23 million user accounts. It appears to have been stolen from an unsecured Elasticsearch database. There has been no response whatsoever from the company, so if you want to know if your information was involved you will have to head over to haveibeenpwned (.) com to check.
From ZDNet.com:
Criminals are posing as cybersecurity companies in phishing campaigns which claim that the recipient has been hit by a cyber attack. They are urged to respond in order to protect their network from being further compromised. Of course that response then opens the door to the hackers to actually compromise their network. The article has a link to the research by Crowdstrike, who also happens to be one of the companies being impersonated.
From Infosecurity-Magazine.com:
A ransomware attack, most likely LockBit, has hit French telecoms operator La Poste Mobile. The company took down their public facing website and customer area as a precaution and they remain down a week later. They claim their routers were secure, but employee desktops may have been breached. They are urging customers to be extra alert for targeted phishing or identity theft attacks.
From TechRadar.com
A few days after Google patched a zero day flaw in Chrome, Microsoft has now patched that same flaw in Edge. While both companies are keeping mum on details, we do know it is a heap-based buffer overflow weakness and it has been compromised in the wild. Get your patch on kids.
And last today, from BleepingComputer.com
A new ransomware operation named 0mega, with a zero instead of an O, targets organizations worldwide in double-extortion attacks. No sample has yet been examined, so there is not a lot of data about how the ransomware encrypts files. We do know that it appends the .0mega extension to the encrypted file’s names and creates ransom notes named DECRYPT-FILES.txt. These notes are customized per victim, usually containing the company name and describing the different types of data stolen in the attack. Victims are directed to a Tor payment site with a support chat that they can use to contact the ransomware gang.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight - 08 July, 2022
Episode 261 - 08 July 2022
QNAP Calls Checkmate- https://www.bleepingcomputer.com/news/security/qnap-warns-of-new-checkmate-ransomware-targeting-nas-devices/
Fake Google Delivers HavanaCrypt -
https://www.securityweek.com/new-havanacrypt-ransomware-distributed-fake-google-software-update
IcedID on Yandex -
https://www.bleepingcomputer.com/news/security/fake-copyright-complaints-push-icedid-malware-using-yandex-forms/
ABCsoup Browser- https://thehackernews.com/2022/07/experts-uncover-350-browser-extension.html
Node.js Patch -
https://portswigger.net/daily-swig/node-js-fixes-multiple-bugs-that-could-lead-to-rce-http-request-smuggling
Hi, I’m Paul Torgersen. It’s Friday July 8th 2022, and this is a look at the information security news from overnight.
From BleepingComputer.com
QNAP is warning customers to secure their network attached storage devices against attacks using Checkmate ransomware. The company says the attacks are focused on Internet-exposed devices with the SMB service enabled, and accounts with weak passwords that can be cracked in brute-force, or dictionary attacks. Ransom notes seen so far put the price tag of the decryptor at about $15,000 of bitcoin.
From SecurityWeek.com:
Security researchers have identified a new ransomware family called HavanaCrypt, that is being delivered as a fake Google Software Update application. The ransomware performs multiple anti-virtualization checks and uses a Microsoft web hosting service IP address for its C2 server, which helps it to evade detection. More details in the article.
From BleepingComputer.com:
Website owners are being targeted with fake copyright infringement complaints to distribute the IcedID banking malware, as well as the BazarLoader and BumbleBee loaders. Instead of using Google Drive or Google Sites to host their alleged reports, this time around the threat actors are using Yandex Forms. Details in the article.
From TheHackerNews.com
Researchers uncovered a malicious browser extension with 350 variants that is masquerading as a Google Translate add-on. The malware family, dubbed ABCsoup, is part of an adware campaign targeting Russian users of Chrome, Opera, and Firefox browsers. The threat group appears to be well organized and originating out of Eastern Europe or Russia.
And last today, from PortSwigger.net
The maintainers of Node.js have released multiple fixes for vulnerabilities in the JavaScript runtime environment. Exploitation of the seven newly patched bugs could lead to arbitrary code execution and HTTP request smuggling, among other attacks. The flaws impact all versions of the 18.x, 16.x and 14.x releases. Get your patch on kids.
That’s all for me this week. Have a fantastic weekend. Like and subscribe, and until next time, be safe out there.
A daily look at the relevant information security news from overnight - 07 July, 2022
Episode 260 - 07 July 2022
North Korean Maui Zowie- https://www.zdnet.com/article/fbi-these-hackers-are-targeting-healthcare-records-and-it-systems-with-maui-ransomware/
Linux and Windows RedAlert -
https://www.bleepingcomputer.com/news/security/new-redalert-ransomware-targets-windows-linux-vmware-esxi-servers/
CuteBoi NPM Mining -
https://thehackernews.com/2022/07/over-1200-npm-packages-found-involved.html
SHI Attacked- https://www.bleepingcomputer.com/news/security/it-services-giant-shi-hit-by-professional-malware-attack/
Linux in OrBit -
https://thehackernews.com/2022/07/researchers-warn-of-new-orbit-linux.html
Hi, I’m Paul Torgersen. It’s Thursday July 7th 2022, and this is a look at the information security news from overnight.
From ZDNet.com
Several US agencies have issued an alert that North Korean sponsored attackers are targeting healthcare and public health organizations with the Maui ransomware. The warnings say these attacks have been going on since at least May of 2021, but they are still not sure of the initial attack vector. Early analysis suggests the malware is designed for attackers to manually select files for encryption, as opposed to encrypting all files wholesale. Details and a link to the advisory in the article.
From BleepingComputer.com:
A new ransomware operation called RedAlert, or N13V, targets both Windows and Linux VMWare ESXi servers with command-line options that allow the threat actors to shut down any running virtual machines before encrypting files. Victims are directed to a TOR site to pay a ransom in Monero to receive the decryptors. Details in the article.
From TheHackerNews.com:
Researchers have found a large-scale crypto mining campaign targeting the NPM JavaScript package repository. The malicious activity, attributed to a threat actor called CuteBoi, involves an array of 1,283 rogue modules from over 1,000 different user accounts using automation which includes the ability to pass the NPM 2FA challenge. Much of the source code in this attack is nearly identical to EazyMiner.
From BleepingComputer.com
SHI International has confirmed that a malware attack forced them to bring some of their systems, including email and public websites, offline. They described it as a coordinated and professional malware attack. The company says no customer data was exfiltrated and that third party systems in its supply chain were unaffected. No word on the threat actor or malware strain involved.
And last today, from TheHackerNews.com
Researchers have uncovered a new Linux threat dubbed OrBit, the fourth Linux targeting malware discovered in the past three months. This one can be installed either with persistence capabilities or as a volatile implant, and implements advanced evasion techniques. It ultimately provides the threat actors with remote access capabilities over SSH, harvests credentials, and logs TTY commands. Details on the article.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight - 06 July, 2022
Episode 259 - 06 July 2022
Spring Data Bad SpEL- https://portswigger.net/daily-swig/spring-data-mongodb-hit-by-another-critical-spel-injection-flaw
Hive Gets Rust-ed -
https://thehackernews.com/2022/07/hive-ransomware-upgrades-to-rust-for.html
Silent Shadow Fix -
https://www.bleepingcomputer.com/news/microsoft/microsoft-quietly-fixes-shadowcoerce-windows-ntlm-relay-bug/
Google to Delete Sensitive Tracking- https://www.infosecurity-magazine.com/news/british-army-social-media-accounts/
Cozy Bear Leverages BRc4 -
https://thehackernews.com/2022/07/hackers-abusing-brc4-red-team.html
Hi, I’m Paul Torgersen. It’s Wednesday July 6th 2022, and this is a look at the information security news from overnight.
From PortSwigger.net
A critical SpEL injection vulnerability has been patched in Spring Data MongoDB. The 9.8 severity bug could be exploited to achieve remote code execution. First.org has ranked the flaw among the top 10 CVEs likely to be used in the wild over the last 30 days. The ease-of-exploitation and the number of proof of concepts available will likely make this vulnerability very popular. Get your patch on kids.
From TheHackerNews.com:
The operators of the Hive ransomware have completely rewritten the malware, moving from the Go language to Rust. This gains them the benefit of memory safety and deeper control over low-level resources as well as making use of a wide range of cryptographic libraries. It also makes it more difficult to reverse engineer. These changes continue to show Hive as one of the fastest evolving ransomware families out there.
From ZDNet.com:
Four more Android apps have been removed from the Google Play store after it was discovered they were being used to deliver the Joker malware to smartphones. The apps, which have over 100,000 downloads between them are: Smart SMS Messages, Blood Pressure Monitor, Voice Language Translator and Quick Text SMS. They join at least 11 other apps that have been removed recently for the same issue. Details in the article.
From BleepingComputer.com
Microsoft has confirmed that they silently patched the ShadowCoerce vulnerability as part of their June 2022 updates. They say the vuln was mitigated along with CVE-2022-30154 because they both affect the same component. The question is, why have they not yet publicly provided any details, or even assigned a CVE ID. Strange actions for a vulnerability of this magnitude. No clarification yet from Redmond.
And last today, from TheHackerNews.com
Malicious actors have been observed abusing Brute Ratel C4, a relatively new and quite sophisticated toolkit designed to avoid detection by EDR and AV capabilities. BRc4 is a customized command-and-control center for red team and adversary simulation. Evidently the bad guys thought it was ready for prime time. The bad guys in this case probably being APT29, or Cozy Bear. You may remember them from the SolarWinds supply chain attack last year.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight - 05 July, 2022
Episode 258 - 05 July 2022
WeWork Exposure- https://techcrunch.com/2022/07/04/wework-exposed-visitors-data/
Django Injection -
https://www.bleepingcomputer.com/news/security/django-fixes-sql-injection-vulnerability-in-new-releases/
AstraLocker Expires -
https://www.bleepingcomputer.com/news/security/astralocker-ransomware-shuts-down-and-releases-decryptors/
Google to Delete Sensitive Tracking- https://www.infosecurity-magazine.com/news/british-army-social-media-accounts/
Google Zero-Day Patch -
https://threatpost.com/actively-exploited-chrome-bug/180118/
Hi, I’m Paul Torgersen. It’s Tuesday July 5th 2022, and this is a look at the information security news from overnight.
From TechCrunch.com
WeWork India had a security lapse that exposed the personal information and selfies of tens of thousands of people who used the WeWork coworking spaces in the country. The bug made it possible to access the check-in record of any visitor by manually typing in a check-in ID, with no safeguards against accessing the data in bulk. The company is fixing the issue.
From BleepingComputer.com:
Django, an open source Python-based web framework, has patched a high-severity SQL injection vulnerability. The flaw affects Django's main branch, and versions 4.1 (currently in beta), 4.0, and 3.2. Developers are urged to upgrade to Django versions 4.0.6 and 3.2.14 as soon as possible.
Also from BleepingComputer.com:
The threat actor behind the AstraLocker ransomware says they're shutting down the operation and plan to switch to cryptojacking. The ransomware's developer even submitted a ZIP archive with the AstraLocker decryptors to VirusTotal. The decryptors appear to be legit and worked on the one sample the team at BleepingComputer tried out. Details and a link to that zip file in the article.
From ZDNet.com
Google says it will automatically wipe user location history for visits to healthcare clinics, including abortion and fertility clinics, domestic abuse shelters, and other sensitive areas. The fear is that, in a post-Roe world, this location tracking data could be used in persecutions, excuse me, prosecutions. These changes will be rolling out in the coming weeks.
And last today, from ThreatPost.com
Google quietly rolled out a stable channel update for Chrome to patch an actively exploited zero-day vulnerability. This is the fourth such flaw the vendor has had to patch so far this year. The bug is a buffer overflow that was just reported on July 1. The company also tidied up a few other bugs while it was at it.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight - 04 July, 2022
Episode 257 - 04 July 2022
Giant China Data Breach- https://www.zdnet.com/article/giant-data-breach-leaked-personal-data-of-one-billion-people-has-been-spotted-for-sale-on-the-dark-web/
Raspberry Robin -
https://www.bleepingcomputer.com/news/security/microsoft-finds-raspberry-robin-worm-in-hundreds-of-windows-networks/
British Army Hawks Crypto Scam- https://www.infosecurity-magazine.com/news/british-army-social-media-accounts/
LockBit Black -
https://www.itpro.co.uk/security/ransomware/368418/latest-lockbit-ransomware-strain-strikingly-similar-to-blackmatter
Microsoft Backdoor -
https://thehackernews.com/2022/07/new-sessionmanager-backdoor-targeting.html
Zoho RCE POC -
https://www.bleepingcomputer.com/news/security/zoho-manageengine-adaudit-plus-bug-gets-public-rce-exploit/
Hi, I’m Paul Torgersen. It’s Monday July 4th 2022, happy birthday America, and this is a look at the information security news from overnight.
From zdnet.com
Detailed personal information for 1 billion Chinese residents has been found for sale on the dark web. Obviously this would be one of the largest data breaches in history. The information in the 23 terabytes of data includes names, addresses, national ID numbers, mobile phone numbers, as well as police and medical records. Hackers claim the information came from the Shanghai National Police database and are offering it for sale for 10 bitcoin, which right now is less than $200,000.
From BleepingComputer.com:
Microsoft recently spotted a Windows worm on the networks of hundreds of organizations from various industry sectors. The malware, Raspberry Robin, spreads via infected USB devices, you know, those ones the boss finds lying in the parking lot and plugs in to see what’s on it? Microsoft observed the malware connecting to addresses on the Tor network, although it appears the threat actors are yet to exploit any access they gained to victims' networks. Details in the article.
From Infosecurity-Magazine.com:
The British Army confirmed its Twitter and YouTube accounts were compromised by a third party and used to direct visitors to cryptocurrency scams. There are reports that their Facebook account was compromised also. The YouTube account was completely rebranded to resemble investment firm Ark Invest, posting live stream videos featuring Elon Musk and Jack Dorsey. The social media accounts all appear to be back under proper control.
From ITPro.co.uk
Security researchers have acquired a sample of LockBit 3.0, which the hacking group internally calls LockBit Black. Analysis shows that large portions of the code are ripped straight from the BlackMatter ransomware developed by the Darkside group. You will remember them as the group that shut down last year after their huge Colonial Pipeline hit brought a lot of national security heat down on them. Evidently LockBit hired some of those developers. Details and a link to the analysis in the article.
And last today, from BleepingComputer.com
Security researchers have published technical details and proof-of-concept for a critical vulnerability in the Zoho ManageEngine ADAudit Plus tool for monitoring activities in the Active Directory. The vulnerability could lead to remote code execution and compromise of Active Directory accounts, and comes with a severity score of 9.8. Get your patch on kids.
That’s all for me today. Have a great Fourth of July, and until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight - 01 July, 2022
Episode 256 - 01 June 2022
Critical Gitlab Patch- https://portswigger.net/daily-swig/gitlab-patches-critical-rce-bug-in-latest-security-release
Jenkins Janky Plugins -
https://www.bleepingcomputer.com/news/security/jenkins-discloses-dozens-of-zero-day-bugs-in-multiple-plugins/
WAP Fraud- https://www.zdnet.com/article/microsoft-this-android-malware-will-switch-off-your-wi-fi-empty-your-wallet/
Macmillan Incident -
https://www.securityweek.com/brocade-vulnerabilities-could-impact-storage-solutions-several-major-companies
Microsoft Backdoor -
https://thehackernews.com/2022/07/new-sessionmanager-backdoor-targeting.html
Dangling Chromium -
https://portswigger.net/daily-swig/chromium-browsers-vulnerable-to-dangling-markup-injection
Hi, I’m Paul Torgersen. It’s Friday July 1st 2022, and this is a look at the information security news from overnight.
From PortSwigger.net
Gitlab has patched a vulnerability that could allow remote code execution. The critical severity flaw affects all versions of GitLab. A fix has been released for this and a number of other vulnerabilities, including two separate cross-site scripting bugs. Link to the Gitlab advisory in the article.
From BleepingComputer.com:
Jenkins announced 34 security vulnerabilities affecting 29 plugins for the Jenkins open source automation server, 29 of the bugs being zero-days still waiting to be patched. Jenkins supports over 1,700 plugins, with those affected by this disclosure having more than 22,000 installs. Fortunately none of these are rated critical as there are no fixes as of yet for most of them. See the list of affected plugins in the article.
From ZDNet.com:
Microsoft shared its detailed technical analysis of what it says is one of the most prevalent types of Android malware. It’s called 'toll billing', or Wireless Application Protocol fraud. This involves using an infected device to connect to payment pages of a premium service via a device's WAP connection. From there, payments are automatically charged to a device's phone bill. Details and a link to the analysis in the article.
From BleepingComputer.com
Publishing giant Macmillan was forced to shut down their network and offices while recovering from a security incident. In emails to customers, Macmillan stated the incident involves the encryption of certain files on their network, so this is almost certainly a ransomware attack. No word on the threat actor as Macmillian has slowly started to bring systems back online.
And last today, from TheHackerNews.com
A newly discovered malware called SessionManager, has backdoored Microsoft Exchange servers since at least March of 2021. If you recall, that was right after the ProxyLogon flaw was discovered. The malware masquerades as a module for Internet Information Services, with capabilities to read, write, and delete arbitrary files; execute binaries from the server; and establish communications with other endpoints in the network.
That’s all for me this week. Have a great Fourth of July long weekend, and until next time, be safe out there.
A daily look at the relevant information security news from overnight - 30 June, 2022
Episode 255 - 30 June 2022
OpenSea Makes Waves- https://techcrunch.com/2022/06/30/nft-opensea-data-breach/
XFiles XPands -
https://www.bleepingcomputer.com/news/security/xfiles-info-stealing-malware-adds-support-for-follina-delivery/
8220 Miner Upgrade- https://www.zdnet.com/article/microsoft-warning-this-malware-that-targets-linux-just-got-a-big-update/
Brocade Broken -
https://www.securityweek.com/brocade-vulnerabilities-could-impact-storage-solutions-several-major-companies
AstraLocker Attack -
https://www.bleepingcomputer.com/news/security/astralocker-20-infects-users-directly-from-word-attachments/
Dangling Chromium -
https://portswigger.net/daily-swig/chromium-browsers-vulnerable-to-dangling-markup-injection
Hi, I’m Paul Torgersen. It’s Thursday June 30th 2022, happy birthday Jayden, and this is a look at the information security news from overnight.
From TechCrunch.com
NFT marketplace OpenSea, has suffered a massive data breach. It seems a staffer at their vendor Customer.io shared the entire email database with a third party. If you have shared your email with OpenSea at any time in the past, you should assume you were impacted. Be on the lookout for targeted phishing emails coming your way.
From BleepingComputer.com:
These next two are quick hits on malware strains upgrading their exploits. The XFiles info-stealer has added a delivery module that exploits the Windows Follina vulnerability. On a side note, XFiles has also recruited new members recently and is launching new products. Details in the article.
From ZDNet.com:
Along those same lines, Microsoft is warning about notable updates to malware targeting Linux servers to install cryptominers and IRC bots. The 8220 gang has added new functionality to exploit the recent Confluence vulnerability, as well as an old 2019 WebLogic bug. Details in the article.
From SecurityWeek.com:
Broadcom revealed that the Brocade SANnav storage area network is affected by nine vulnerabilities, some of which could impact the products of their partner companies, such as HPE, NetApp, Oracle, Dell, Fujitsu, IBM, Lenovo and others. There is no evidence as of yet that these have been exploited in the wild, but get your patch on kids.
From BleepingComputer.com
The ransomware strain called AstraLocker has recently released its second major version that drops its payload directly from email attachments. Specifically Word docs. Obviously this smash and grab type of attack is looking for quick payouts and not trying for persistence or lateral movement. Full write up in the article.
And last today, from PortSwigger.net
A recently-patched security hole in Chromium browsers allowed attackers to bypass safeguards against dangling markup injection, and extract sensitive information from webpages. While dangling markup injection is well-known and -addressed in Chrome, the new attack took advantage of an unaddressed case in how the browser upgrades unsafe HTTP connections. You know where to find the details.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight - 29 June, 2022
Episode 254 - 29 June 2022
Android Photo Overshare- https://www.bleepingcomputer.com/news/security/amazon-fixes-high-severity-vulnerability-in-android-photos-app/
Linux PWNkit -
https://www.securityweek.com/cisa-says-pwnkit-linux-vulnerability-exploited-attacks
Service Fabric Fix- https://www.bleepingcomputer.com/news/security/microsoft-fixes-bug-that-let-hackers-hijack-azure-linux-clusters/
Firefox 102 -
https://www.securityweek.com/firefox-102-patches-19-vulnerabilities-improves-privacy
UnRAR Vuln -
https://thehackernews.com/2022/06/new-unrar-vulnerability-could-let.html
Hi, I’m Paul Torgersen. It’s Wednesday June 29th, 2022, and this is a look at the information security news from overnight.
From BleepingComputer.com
Amazon has fixed a vulnerability in its Photos app for Android, which has over 50 million downloads on the Google Play Store. The image and video storage app enables users to share files with up to five family members. Unfortunately, if the flaw is exploited, it also shares access tokens for Amazon API authentication with the bad guys.
From SecurityWeek.com:
The CISA says a Linux vulnerability known as PwnKit has been exploited in the wild. The flaw is a memory corruption issue that affects Polkit, a component designed for controlling system-wide privileges in Unix-like operating systems. Proof-of-concepts are available and exploitation is easy, which is why the CISA has added the vulnerability to its must patch list. Government orgs have until July 18 to install patches, but you private orgs should really get your patch on too.
From BleepingComputer.com:
Microsoft has fixed a container escape vulnerability in the Service Fabric application hosting platform. Exploitation could allow threat actors to escalate privileges to root, gain control of the host node, and compromise the entire SF Linux cluster. According to Microsoft, Service Fabric hosts over a million apps and powers many of their Azure products, as well as others. Not only should you get your patch on, but Microsoft recommends that customers continue to review all containerized workloads (both Linux and Windows) which are permitted access to their host clusters.
From SecurityWeek.com:
Mozilla has launched Firefox 102 that includes patches for 19 vulnerabilities, including four high-severity bugs. The new version also improves user privacy by mitigating query parameter tracking when navigating the internet with Enhanced Tracking Protection in strict mode. This confines cookies to the sites that created them, preventing cross-site tracking
And last today, from TheHackerNews.com
A new security vulnerability has been disclosed in RARlab's UnRAR utility that could permit a remote attacker to execute arbitrary code on a system that relies on the binary. The flaw relates to a path traversal vulnerability in the Unix versions of UnRAR that can be triggered upon extracting a maliciously crafted RAR archive. Other versions of the software, including those for Windows and Android, are not impacted. Any software that utilizes an unpatched version of UnRAR to extract untrusted archives is affected by the flaw.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight - 27 June, 2022
Episode 253 - 27 June 2022
BBVA 2FA Clone- https://thehackernews.com/2022/06/new-android-banking-trojan-revive.html
ICS ShadowPad -
https://www.bleepingcomputer.com/news/security/microsoft-exchange-bug-abused-to-hack-building-automation-systems/
LockBit Bounty- https://www.pcmag.com/news/ransomware-gang-offers-bug-bounty-promises-payouts-up-to-1-million
Raccoon 2.0 -
https://www.bleepingcomputer.com/news/security/raccoon-stealer-is-back-with-a-new-version-to-steal-your-passwords/
OpenSSL Bad Memory -
https://www.theregister.com/2022/06/27/openssl_304_memory_corruption_bug/?td=rt-3a
Hi, I’m Paul Torgersen. It’s Tuesday June 28th, 2022, and I want to say a quick thank you as I have just passed 100 subscribers on YouTube. Which is great, but let’s not stop there. If you find this valuable, please share with your networks and colleagues. Let’s see if we can’t add a zero or two to that number. And now, this is a look at the information security news from overnight.
From TheHackerNews.com
A new Android banking trojan called Revive has been discovered specifically targeting users of the Spanish financial services company BBVA. Phishing campaigns push a look alike website where victims download an app which impersonates the bank's two factor authentication app. Italian cybersecurity firm Cleafy first spotted the malware in mid June, and says it appears to be in its early stages of development.
From BleepingComputer.com:
A new Chinese-speaking threat actor is hacking into the building automation systems of several Asian organizations and loading the ShadowPad backdoor. The group focused on devices that have not yet patched the Microsoft Exchange vulnerability collectively known as ProxyLogon. According to Dutch research, there are about 46,000 such machines. Kaspersky believes the group is ultimately hunting for sensitive information.
From PCMag.com:
In what seems to be a first, the LockBit ransomware group has launched a bug bounty program. Evidently they have been successful enough to be able to afford to buy new zero-days. Their current rates run from $1,000 to $1 million, although the million bucks for is you can dox the LockBit leader. If this is compelling to any of you, keep in mind that the main targets for this group are healthcare and education, two of the most vulnerable populations out there. Do you really want to help somebody like that?
From BleepingComputer.com:
I mentioned last week that the Raccoon Stealer group had temporarily shuttered operations after one of their leaders was killed in the Russian invasion of Ukraine. Well, they’re back in action with 2.0, a new and completely re-coded version of their malware offering elevated password-stealing functionality and upgraded operational capacity. Details in the article.
And last today, from TheRegister.com
OpenSSL 3.0.4 was released on June 21 to address a command-injection vulnerability that they hadn’t quite completely patched earlier. Unfortunately, the new release contains a memory corruption which can be triggered trivially by an attacker. This targets the Intel Advanced Vector Extensions 512, or AVX512. The researcher said that if this bug can be exploited remotely, and they are not certain yet that it can, it could be more severe than Heartbleed, at least from a purely technical point of view. Details in the link.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight - 27 June, 2022
Episode 253 - 27 June 2022
Auto Supplier Attacked- https://www.bleepingcomputer.com/news/security/automotive-fabric-supplier-tb-kawashima-announces-cyberattack/
Iranian Factory Lucky Break -
https://www.securityweek.com/cyberattack-forces-iran-steel-company-halt-production
Oracle Miracle Fix- https://portswigger.net/daily-swig/oracle-patches-miracle-exploit-impacting-middleware-fusion-cloud-services
Mega Vuln -
https://www.securityweek.com/top-cryptographers-flag-devastating-flaws-mega-cloud-storage
CODESYS ICS Flaws -
https://thehackernews.com/2022/06/critical-security-flaws-identified-in.html
Hi, I’m Paul Torgersen. It’s Monday June 27th, 2022, and this is a look at the information security news from overnight.
From BleepingComputer.com
TB Kawashima, part of the Toyota Group of companies, announced that one of its subsidiaries has been hit by a cyberattack. The company responded by turning off all systems and devices in the network and says that production has not been impacted, but their website was down. No confirmation from the company, but the LockBit ransomware group has claimed responsibility and started leaking data supposedly acquired in the attack.
From SecurityWeek.com:
Iranian state owned Khuzestan Steel Company, one of three in the country, had to stop work until further notice following a cyberattack. The company’s CEO claimed they were able to thwart the attack and prevent structural damage to production lines. In a bit of a lucky break, it appears the attack at least partially failed because the factory happened to be non-operational at the time due to an electricity outage.
From PortSwigger.net:
Oracle has finally patched a remote code execution vulnerability impacting Oracle Fusion Middleware and other Oracle systems. The vulnerability, dubbed Miracle Exploit, carries a 9.8 severity and is said to be easily exploitable. The bug was found on accident while researchers were building a proof of concept for a different zero-day. Oracle was first notified of the flaw back in October of last year and has now issued a fix. Get your patch on kids.
From SecurityWeek.com:
Cryptographers at a Swiss university have found at least five exploitable security flaws in the privacy-themed MEGA cloud storage service that could lead to devastating attacks on the confidentiality and integrity of user data in the MEGA cloud. The company released an advisory and patches, but said the vulnerabilities would be exceedingly difficult to exploit, basically requiring Mega to become a bad actor against itself.
And last today, from TheHackerNews.com
CODESYS has released patches to address 11 security flaws in its ICS automation software, two of which were rated critical, that could result in information disclosure and denial-of-service. These vulnerabilities are considered simple to exploit, and impacted at least seven of their Programmable Logic Controller applications. More details in the article.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight - 24 June, 2022
Episode 252 - 24 June 2022
Ransomware Decoy- https://www.theregister.com/2022/06/24/ransomware_as_espionage_distraction/
Quantum .LNK Builder -
https://www.bleepingcomputer.com/news/security/malicious-windows-lnk-attacks-made-easy-with-new-quantum-builder/
Python Backdoor- https://thehackernews.com/2022/06/multiple-backdoored-python-libraries.html
Hermit Spies Android and iOS -
https://www.securityweek.com/sma-technologies-patches-critical-security-issue-workload-automation-solution
Mitel VoIP Zero-Day -
https://thehackernews.com/2022/06/hackers-exploit-mitel-voip-zero-day-bug.html
Hi, I’m Paul Torgersen. It’s Friday June 24th, 2022, and this is a look at the information security news from overnight.
From TheRegister.com
A state-sponsored Chinese threat group that Secureworks has named Bronze Starlight, has a ransomware campaign that is targeting pharmaceutical companies, electronic component designers and manufacturers, US law firms, and aerospace and defense companies. The thing is, the ransomware is just a decoy. Researchers believe the true aim is cyber espionage, which explains why these specific types of companies are being targeted. Link to that research in the article.
From BleepingComputer.com:
Researchers have noticed a new tool they call Quantum that helps cybercriminals build malicious .LNK files to deliver payloads. These are especially popular in phishing campaigns, currently being used by Emotet, Bumblebee, Qbot, and IcedID. Quantum features a graphical interface and hundreds of icon and extension spoofing options, and you can rent it starting at less than 200 Euros a month. A link to the Cyble research in the article.
From The HackerNews.com:
Researchers have discovered a number of malicious Python packages in the official third-party software repository that are engineered to exfiltrate AWS credentials and environment variables to a publicly exposed endpoint. What’s not for certain is if this is the result of an attack, or some sort of pen-test situation. This would be at least the third such example of a pen tester making a point in the last month or so.
From ThreatPost.com:
Google is warning that the Hermit spyware by RCS Labs out of Italy, is being deployed against Android and iOS users. The campaign is targeting victims in Kazakhstan and Italy. Last week it was learned that the Kazak government was using this same spyware against its own citizens. Google says the fake apps containing the spyware are not in the Google Play or Apple stores and are only downloaded from third party websites.
And last today, from TheHackerNews.com
A suspected ransomware intrusion against an unnamed target is leveraging a Linux based Mitel VoIP appliance as an entry point. CrowdStrike says the threat actor is exploiting a 9.8 severity bug that Mitel had patched back in April and are utilizing a couple of anti-forensic measures to erase traces of their actions. Details and links in the article.
That’s all for me today. Have a great weekend. Like and subscribe, and until next week, be safe out there.
A daily look at the relevant information security news from overnight - 23 June, 2022
Episode 251 - 23 June 2022
Russian Bears- https://threatpost.com/fancy-bear-nuke-threat-lure/180056/
Auto Supplier Hosed -
https://www.reuters.com/technology/japanese-automotive-hose-maker-nichirin-hit-by-ransomware-attack-2022-06-22/
NIMble Trooper- https://thehackernews.com/2022/06/chinese-hackers-distributing-sms-bomber.html
SMA UNIX Root -
https://www.securityweek.com/sma-technologies-patches-critical-security-issue-workload-automation-solution
Parse Bug No Game -
https://portswigger.net/daily-swig/severe-parse-server-bug-impacts-apple-game-center
Hi, I’m Paul Torgersen. It’s Thursday June 23rd, 2022, and from Chicago‘s O’Hare airport, this is a look at the information security news from overnight.
From ThreatPost.com
Russian APT group Fancy Bear is targeting Ukranians with a phishing campaign that uses the threat of nuclear war to exploit the Microsoft Follina vulnerability. The goal is to deliver a .Net stealer that can nab credentials from the Chrome, Firefox and Edge browsers. The group is strongly believed to be working at the behest of Russian Intelligence.
From Reuters.com:
Japanese automotive hose maker Nichirin said that a U.S. subsidiary had been hit by a ransomware attack that has forced it to entirely shut down its computerized production controls. The company has switched to manual production and shipping in order to keep parts flowing to customers. No word on the threat actor or malware strain.
From The HackerNews.com:
A threat cluster out of China with ties to a hacking group called Tropic Trooper has been spotted using a previously undocumented malware coded in Nim language. The novel loader, dubbed Nimbda, is bundled with a Chinese language 'SMS Bomber' tool that is most likely illegally distributed in the Chinese-speaking web. The Nim loader has the same executable icon as the SMS Bomber, so the entire bundle works as a trojanized binary. More details in the article.
From SecurityWeek.com:
A critical vulnerability in the SMA Technologies OpCon UNIX agent results in the same SSH key being deployed with all installations. The installation files also include a corresponding, unencrypted private key named “sma_id_rsa.” An attacker with access to that key can gain SSH access as root on affected systems. The key even remains on the system after the OpCon software has been removed. Details and a link to the advisory in the article.
And last today, from PortSwigger.net
A vulnerability in Parse Server software has led to the discovery of an authentication bypass impacting Apple Game Center. Exploitation of this 8.6 severity bug could result in authentication being bypassed by making a fake certificate accessible via certain Apple domains and providing the URL to that certificate in an authData object. Attack complexity is considered low and no privileges are required. A fix has been issued, so get your patch on kids.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight - 22 June, 2022
Episode 250 - 22 June 2022
Yodel Sings the Blues- https://www.bleepingcomputer.com/news/security/yodel-parcel-company-confirms-cyberattack-is-disrupting-delivery/
Chrome Release -
https://www.securityweek.com/google-patches-14-vulnerabilities-release-chrome-103
Acrobat Blocks PFD Checks- https://www.bleepingcomputer.com/news/security/adobe-acrobat-may-block-antivirus-tools-from-monitoring-pdf-files/
Apple Removes the Stop Signs -
https://www.zdnet.com/article/apples-ios-16-will-give-you-an-alternative-to-irritating-captcha-tests/
Racoon Out - Dridex In -
https://thehackernews.com/2022/06/rig-exploit-kit-now-infects-victims-pcs.html
Hi, I’m Paul Torgersen. It’s Wednesday June 22nd, 2022, and once again from Chicago this is a look at the information security news from overnight.
From BleepingComputer.com
Yodel delivery service company out of the UK says they have been disrupted due to a cyberattack. Deliveries were delayed and package tracking was down, but the company says that customer payment information has not been compromised. No word on the threat actor or specific malware used, but it is assumed to be a ransomware attack.
From SecurityWeek.com:
Google announced the release of Chrome 103 with patches for a total of 14 vulnerabilities, including nine reported by external researchers. The most severe of these bugs is a critical-severity use-after-free issue in Base. The company paid out $44,000 in bug bounties for this batch of fixes and said they have seen no indication that any of them have been exploited in the wild.
From BleepingComputer.com:
Adobe Acrobat is blocking security software from having visibility into the PDF files it opens, creating a security risk for users. These security tools work by injecting DLLs into software products being launched on a machine. Acrobat is actively checking if components from 30 security products are loaded into its processes and blocks them, essentially denying them from doing their job. Adobe says they are currently working with these vendors to address the issue. Details on the article.
From ZDNet.com:
In a move that will break absolutely nobody’s heart, when Apple rolls out iOS 16 and MacOS Ventura, it will be the first to utilize Private Access Tokens instead of CAPTCHA challenges. Cloudflare estimates that up to 500 man-years are wasted each day looking for those grainy stop signs. No word from Google on when they will introduce this for Android, but they have been in the working group with Apple shaping the authentication standard.
And last today, from TheHackerNews.com
The group behind the Raccoon Stealer malware have temporarily shuttered operations after the death of one of their team members. So the operators behind the Rig Exploit Kit have swapped the Raccoon out for the Dridex financial trojan. This little nasty has the capability to download additional payloads, steal customer login information from banking websites, capture screenshots, log keystrokes, and more. You can find additional details in the article.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight - 21 June, 2022
Episode 249 - 21 June 2022
ToddyCat Tracked- https://www.bleepingcomputer.com/news/security/new-toddycat-apt-group-targets-exchange-servers-in-asia-europe/
NTLM Relay Attack -
https://thehackernews.com/2022/06/new-ntlm-relay-attack-lets-attackers.html
OT Insecure by Design- https://www.securityweek.com/basecamp-icefall-secure-design-ot-makes-little-headway
Microsoft Re-Arms Windows -
https://www.zdnet.com/article/microsoft-this-out-of-band-windows-security-update-fixes-microsoft-365-sign-in-issues-for-arm-devices/
Beware Zombie Bugs -
https://www.theregister.com/2022/06/21/apple-safari-zombie-exploit/
Hi, I’m Paul Torgersen. It’s Tuesday June 21st, 2022, and from Chicago this is a look at the information security news from overnight.
From BleepingComputer.com
A new APT group dubbed ToddyCat has been targeting Microsoft Exchange servers throughout Asia and Europe. According to the Kaspersky researchers, it looks like they have been in action since at least December of 2020. Kaspersky has also found a previously unknown passive backdoor they named Samurai and new trojan malware dubbed Ninja Trojan. Both malware strains allow the attackers to take control of infected systems and move laterally within the victims' networks.
From TheHackerNews.com:
A new Windows NTLM relay attack dubbed DFSCoerce has been uncovered that leverages the Distributed File System: Namespace Management Protocol to seize control of a domain. This follows a similar method called PetitPotam that abuses Microsoft's Encrypting File System Remote Protocol to coerce Windows servers into authenticating with a relay under an attacker's control. To mitigate NTLM relay attacks, Microsoft recommends enabling Extended Protection for Authentication, SMB signing, and turning off HTTP on AD CS servers.
From SecurityWeek.com:
Ten years after project Basecamp, Forescout has conducted an updated project, dubbed OT:Icefall, to gauge the current state of Security By Design in OT products. They found 56 insecure by design problems stemming from ten manufacturers. Forescout says the flaws are not programming error vulnerabilities, but rather flaws in the protocols, authorizations, and certifications built into the designs. Seems not enough has changed in the last 10 years.
From ZDNet.com:
Microsoft has issued an out-of-band update for Windows 11 and Windows 10 to fix an issue that emerged with Arm devices after their latest Patch Tuesday update. It seems some users were prevented from signing into applications including VPN connections, Microsoft Teams, and Microsoft Outlook. The issue only affects Windows devices that use Arm processors; machines using other processors are not affected. If that is you and you have not yet applied the June 14 updates, you should use this out of band update instead.
And last today, from TheRegister.com
Beware of zombie vulnerabilities. The Safari browser had a vulnerability that was completely patched by Apple back in 2013 when it was discovered. Unfortunately that fix was regressed in 2016 during some code refactoring. That same bug was found being exploited earlier this year. It is unsure for how many of those five years the de-patched bug was being exploited in the wild. See the details and a link to the Google Project Zero research in the article.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight - 20 June, 2022
Episode 248 - 20 June 2022
Bank Breach Flagged- https://www.bleepingcomputer.com/news/security/flagstar-bank-discloses-data-breach-impacting-15-million-customers/
BRATA Bulks Up -
https://www.zdnet.com/article/this-phone-wiping-android-banking-trojan-is-getting-nastier/
No End of Life Support- https://cybersecuritynews.com/cisco-says-zero-day-flaws/
ICS Vulns -
https://www.securityweek.com/automationdirect-patches-vulnerabilities-plc-hmi-products
Online Extension Tracking -
https://www.bleepingcomputer.com/news/security/google-chrome-extensions-can-be-fingerprinted-to-track-you-online/
Hi, I’m Paul Torgersen. It’s Monday June 20th, 2022, a day to recognize Juneteenth, and this is a look at the information security news from overnight.
From BleepingComputer.com
Flagstar Bank is notifying 1.5 million customers of a data breach where hackers accessed personal data including full names and social security numbers. The breach actually took place back in December, but the bank did not realize this until the beginning of June. No word of why the breach remained hidden for so long, or what other information was compromised. If you are one of the 1.5 million, you are the lucky recipient of 2 years of free credit monitoring.
From ZDNet.com:
With the nasty Android banking trojan known as BRATA, which is Brazilian Remote Access Tool, Android, used to be you only had to worry about it wiping your smartphone with a factory reset to cover its tracks. Recently it has added new features to improve its ability at phishing online-banking credentials and intercepting SMS two-factor authentication codes. See all the details from the Cleafy research in the article.
From CyberSecurityNews.com:
We talked last week about the 9.8 severity flaw in Cisco routers, for which the company has released an update. However, if Cisco has previously noted that your router was reaching end of life, they will NOT be releasing a patch nor a workaround for this vulnerability. These include the Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers. Time to upgrade kids.
From SecutiyWeek.com:
AutomationDirect has patched several high-severity vulnerabilities in some of its programmable logic controller (PLC) and human-machine interface (HMI) products. Exploitation of these ICS vulnerabilities could allow an attacker to make unauthorized changes to the targeted devices. See details from the Dragos report in the article.
And last today, from BleepingComputer.com
A researcher has found a way to use your installed Google Chrome extensions to generate a fingerprint of your device that can be used to track you online. He built a website to create fingerprints, or tracking hashes, based on various characteristics of a device, including GPU performance, installed Windows applications, screen resolution, hardware configuration, and even the installed fonts. See all the creepy details in the article.
That’s all for me today from Chicago. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight - 17 June, 2022
Episode 247 - 17 June 2022
Office 365 Attack- https://thehackernews.com/2022/06/a-microsoft-office-365-feature-could.html
Wallet Recovery Flaw -
https://www.bleepingcomputer.com/news/security/metamask-phantom-warn-of-flaw-that-could-steal-your-crypto-wallets/
Naked Phishing- https://www.infosecurity-magazine.com/news/nakedpages-phishing-toolkit/
QNAP DeadBolted -
https://www.bleepingcomputer.com/news/security/qnap-thoroughly-investigating-new-deadbolt-ransomware-attacks/
WordPress Ninja vuln -
https://www.securityweek.com/exploited-vulnerability-patched-wordpress-plugin-over-1-million-installations
Hi, I’m Paul Torgersen. It’s Friday June 17th, 2022, and this is a look at the information security news from overnight.
From HackerNews.com
A potentially dangerous piece of functionality has been discovered in the Microsoft 365 suite that could help threat actors encrypt files stored on SharePoint and OneDrive. The attack hinges on the AutoSave feature, which allows a number of older file versions after users make edits. As the number is reached, the oldest file version gets deleted as the newest is saved. So attackers can either encrypt that available number plus 1, or reduce the number available to something smaller, like 1. Details and a link to the Proofpoint research in the article.
From BleepingComputer.com:
MetaMask and Phantom are warning of a new vulnerability called Demonic, that could expose a crypto wallet's seed phrase and allow attackers to steal any NFTs and crypto stored there. It is caused by how web browsers save contents of non-password fields as part of a standard “restore session”. Browser wallet extensions, such as Metamask, Phantom, and Brave, use an input field that is not designated as a password field, so the recovery phrase is saved in plain text form. MetaMask and Phantom have both patched the flaw, however, no word yet from Brave.
From Infosecurity-Magazine.com:
Researchers at CloudSEK have spotted a new phishing toolkit for sale across the various cybercrime forums. The “NakedPages,” toolkit is designed to run on Linux machines, runs JavaScript, is fully automated, and comes preloaded with more than 50 phishing templates and site projects. A link to the CloudSEK advisory in the article.
From BleepingComputer.com:
QNAP is warning customers to secure their devices against a new campaign of attacks pushing the DeadBolt ransomware. The company is urging users to update their Network Attached Storage devices to the latest firmware version and ensure they're not exposed to remote access over the Internet. The campaign appears to target QNAP NAS devices running QTS 4.x.
And last today, from SecurityWeek.com
The WordPress Ninja Forms plugin, which helps administrators add customizable forms to their WordPress sites, has a vulnerability that appears to have been exploited in the wild. The flaw was identified in the Merge Tag functionality of the plugin, and carries a severity rating of 9.8. The Ninja Forms plugin has over a million installations. WordPress performed a forced update to fix the issue, but administrators are urged to confirm they are using the fixed version.
That’s all for me this week. Have a great weekend. Like and subscribe, and until Monday, be safe out there.
A daily look at the relevant information security news from overnight - 16 June, 2022
Episode 246 - 16 June 2022
Cisco Email Patch- https://www.bleepingcomputer.com/news/security/cisco-secure-email-bug-can-let-attackers-bypass-authentication/
Android Malibot -
https://www.zdnet.com/article/this-new-android-malware-bypasses-multi-factor-authentication-to-steal-your-passwords/
PrintNightmare Still Exposed- https://www.infosecurity-magazine.com/news/new-printnightmare-patch-bypassed/
Shoprite Compromised -
https://www.bleepingcomputer.com/news/security/extortion-gang-ransoms-shoprite-largest-supermarket-chain-in-africa/
Zimbra Zinger -
https://portswigger.net/daily-swig/business-email-platform-zimbra-patches-memcached-injection-flaw-that-imperils-user-credentials
Hi, I’m Paul Torgersen. It’s Thursday June 16th, 2022, and this is a look at the information security news from overnight.
From BleepingComputer.com
Cisco is warning customers to patch a critical vulnerability that could allow attackers to login into the web management interface of Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager appliances. The flaw is due to improper authentication checks on affected devices using Lightweight Directory Access Protocol (LDAP) for external authentication.
From ZDNet.com:
A new Android malware called Malibot steals passwords, bank details and crypto wallets, and bypasses multi-factor authentication. Oh, it can also access text messages, steal browser cookies and take screenshots. It is distributed through smishing and fake websites, one of which spoofs a legit crypto tracker that has more than a million downloads on the Play Store. Current targets are customers of Spanish and Italian banks.
From Infosecurity-Magazine.com:
On Tuesday, Microsoft released a partial patch for the PrintNightmare zero-day. On Wednesday they pushed an out of band patch for the remaining affected products. Later Wednesday, researchers found a way around the new patch to still exploit the original vulnerability. The ongoing flaw relates to the Point and Print function, which microsoft says is not directly related to the flaw, but has a weak security posture which makes exploitation possible.
From BleepingComputer.com:
Africa's largest supermarket chain, Shoprite, has been hit by a ransomware attack. The company, which operates almost three thousand stores across twelve countries in the continent, warned customers Eswatini, Namibia and Zambia that their personal information may have been compromised. A threat group called RansomHouse has claimed responsibility for the attack. There has been no mention of any business disruptions or operational issues, so this may be a straight data theft with no files encrypted.
And last today, from ZPortSwigger.net
Business webmail platform Zimbra has patched a memcached injection vulnerability that could allow attackers to steal login credentials without user interaction. It would steal cleartext credentials from the Zimbra instance, when the mail client connects to the server to check their mail. Details and a link to the Sonar research in the article.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.
Follina’s Tuesday Patch, Hertzbleed Attack, Mighty Bot, and more.
A daily look at the relevant information security news from overnight - 15 June, 2022
Episode 245 - 15 June 2022
Follina’s Tuesday PAtch- https://www.zdnet.com/article/microsoft-june-2022-patch-tuesday-55-fixes-remote-code-execution-in-abundance/
Hertzbleed Attack -
https://www.securityweek.com/new-hertzbleed-remote-side-channel-attack-affects-intel-amd-processors
Travis Exposed Tokens- https://www.bleepingcomputer.com/news/security/thousands-of-github-aws-docker-tokens-exposed-in-travis-ci-logs/
Citrix ADM Error -
https://www.securityweek.com/attackers-can-exploit-critical-citrix-adm-vulnerability-reset-admin-passwords
Linux Panchan Bot -
https://www.bleepingcomputer.com/news/security/new-go-botnet-panchan-spreading-rapidly-in-education-networks/
Mighty Bot -
https://www.zdnet.com/article/a-tiny-botnet-launched-the-largest-ddos-attack-on-record/
Hi, I’m Paul Torgersen. It’s Wednesday June 15th, 2022, and this is a look at the information security news from overnight.
From ZDNet.com
June Patch Tuesday is a popular one with everyone from Siemens to Schneider to Adobe to SAP rolling out updates. In fact, 141 updates just from those four. The one I am going to call out is Microsoft. Redmond rolled out 55 fixes, That’s down from 74 last month, and only three of which are critical, but one of those is a fix for the Follina zero-day. At long last. Get your patch on kids.
From SecurityWeek.com:
Researchers have identified a new side-channel attack that can allow hackers to remotely extract sensitive information from a targeted system through a CPU timing attack they are calling Hertzbleed. This impacts devices powered by Intel and AMD and possibly others. Details on the article.
From BleepingComputer.com:
The Travis CI platform, which is used for software development and testing, has exposed user data containing tens of thousands of authentication tokens for GitHub, AWS, and Docker Hub. Aqua Security, who discovered the flaw, shared their findings with Travis hoping for a fix, but they were told that the issue was “by design” and left the data exposed.
From SecurityWeek.com:
Citrix has warned of a critical vulnerability in their Citrix Application Delivery Management that could essentially allow an attacker to trigger an administrator password reset at the next reboot. The vulnerabilities impact all supported versions of Citrix ADM server and Citrix ADM agent. Customers will need to update the server as well as all associated agents. The company says it has already taken care of the ADM cloud service and no additional action is required there.
From BleepingComputer.com
A new peer-to-peer botnet named Panchan has popped up targeting Linux servers in the education sector to mine crypto. It is empowered with SSH worm functions to move laterally within the compromised network, and has powerful detection avoidance capabilities, such as using memory-mapped miners and dynamically detecting process monitoring to pause the mining module.
And last today, from ZDNet.com
Speaking of botnets, Cloudflare says it mitigated a DDoS attack that peaked at 26 million requests per second, and was caused by a botnet of only just over 5,000 devices. Rather than being based in IoT devices, this botnet was hiding in cloud service providers. For this particular attack, each device was averaging 5,200 requests per second, which is about 4,000 times more than a typical IoT botnet can generate. Details on the article.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight - 14 June, 2022
Episode 244 - 14 June 2022
Linux Root Malware- https://www.bleepingcomputer.com/news/security/new-syslogk-linux-rootkit-uses-magic-packets-to-trigger-backdoor/
Gallium’s PingPull RAT -
https://www.theregister.com/2022/06/14/gallium-pingpull-rat/
Metasploit Upgrades- https://www.bleepingcomputer.com/news/security/metasploit-620-improves-credential-theft-smb-support-features-more/
Reach Out and GhostTouch Someone -
https://portswigger.net/daily-swig/ghosttouch-hackers-can-reach-your-phones-touchscreen-without-even-touching-it
Guzzle Drupal Patch -
https://threatpost.com/bluetooth-signals-track-smartphones/179937/
Hi, I’m Paul Torgersen. It’s Tuesday June 14th, 2022, and this is a look at the information security news from overnight.
From BleepingComputer.com
A new Linux rootkit malware named ‘Syslogk’ can force-load its modules into the Linux kernel, and hide directories and network traffic. It also loads a backdoor called Rekoobe, which lays dormant until specially crafted "magic packets" are used to wake it up. The malware is currently under heavy development.
From TheRegister.com:
The Gallium group, believed to be a Chinese state-sponsored team, has begun using an upgraded remote access trojan called PingPull, that is very difficult to detect. The group is also broadening its scope, adding financial service firms and government agencies to the telecoms companies it usually targets. Their geographic focus continues to be Asia, Southeast Asia, Europe and Africa,
From BleepingComputer.com:
Metasploit 6.2.0 has been released with 138 new modules, 148 new improvements or features, and 156 bug fixes since version 6.1.0 was released almost a year ago. Great for the pen teasters. Unfortunately, also great for the threat actors that use it as well. Details in the article.
From PortSwigger.net:
Attacks on smartphones require physical access to the device and interactions with the touchscreen. Or at least they used to. According to new research an attack can execute taps and swipes on the phone’s screen from a distance of up to 40 millimeters. The attack, called GhostTouch, uses electromagnetic interference to manipulate the touchscreen and can initiate calls or even download malware.
And last today, from SecurityWeek.com
The Drupal team has released a moderately critical advisory for serious vulnerabilities in the third-party library Guzzle that handles HTTP requests and responses to external services, and can be exploited to remotely hijack Drupal-powered websites. The vulnerabilities do not affect Drupal core, but may affect some contributed projects or custom code on Drupal sites. Details and a link to the advisory in the article.
That’s all for me today. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight - 13 June, 2022
Episode 243 - 13 June 2022
Hello XD upgrades- https://www.bleepingcomputer.com/news/security/hello-xd-ransomware-now-drops-a-backdoor-while-encrypting/
Conti targets Intel -
https://www.cpomagazine.com/cyber-security/conti-ransomware-develops-proof-of-concept-code-for-firmware-attacks/
WannaFriendMe out of the Blox- https://www.techradar.com/news/this-ransomware-can-only-be-decrypted-by-going-to-the-roblox-store
Web3 Wallet seed stealer -
https://www.securityweek.com/chinese-hackers-adding-backdoor-ios-android-web3-wallets-seaflower-campaign
Bluetooth fingerprint -
https://threatpost.com/bluetooth-signals-track-smartphones/179937/
Sentient AI? -
https://www.theregister.com/2022/06/13/google_lamda_sentient_claims/
Hi, I’m Paul Torgersen. It’s Monday June 13th, 2022, and this is a look at the information security news from overnight.
From BleepingComputer.com
Researchers report increased activity of the Hello XD ransomware, which is based on the leaked source code of Babuk, with two significant notes. One is that the operators are now deploying an upgraded sample featuring stronger encryption that includes custom packing for detection avoidance and encryption algorithm changes. And two, they are now including an open-source backdoor named MicroBackdoor. Lots of details in the article.
From CPOMagazine.comm:
An analysis of leaked chats from the Conti ransomware group have found two items of note. Evidently the cybercrime group was planning firmware attacks targeting the Intel Management Engine. Such a compromise would allow threat actors to introduce a backdoor on Intel devices and execute commands without detection by OS-based security tools. The other interesting piece is that the chat logs seem to confirm a link between the Conti group and the Russian Foreign Services Bureau. Color me not surprised.
From TechRadar.com:
A new ransomware group called WannaFriendMe, is targeting gamers with the Chaos ransomware, which tries to pass itself off as Ryuk. The strange thing is, the decryptor is so easy, my kid can get it. I only say that because to get the decryptor, you need to log into a Roblox account and buy a specific game pass. Costs about $20.
From SecurityWeek.com:
Cybercriminals likely operating out of China are distributing backdoored versions of iOS and Android Web3 wallets in an effort to steal users’ seed phrase. This previously unreported campaign, dubbed SeaFlower, has been described as one of the most technically sophisticated threats targeting users of Web3 wallets ever seen. Details in the article.
From ThreatPost.com
Researchers warn Bluetooth signals can be used to track device owners via a unique fingerprinting of the radio signal. Their paper suggests that minor manufacturing imperfections in hardware are unique to each device, and cause measurable distortions which can be used as a basically a fingerprint to track a specific device. Details and a link to the research in the article.
And last today, from The Register.com
You ever see the movie Her? Well, since 2021, Google’s Responsible AI team, has been tasked with talking to LaMDA, or Language Model for Dialogue Applications. This project was built by fine-tuning a family of Transformer-based neural language models specialized for dialog, with up to 137 billion model parameters. Someone on that team has recently been placed on paid administrative leave for violating Google’s confidentiality policies. This person has gone on record stating that they believe the application has exhibited self-awareness and is now a sentient being.
That is quite enough from me today. Have a great rest of your day. Like and subscribe, and until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight - 10 June, 2022
Episode 242 - 10 June 2022
Massive Messenger Mess- https://www.bleepingcomputer.com/news/security/massive-facebook-messenger-phishing-operation-generates-millions/
Fujitsu Flaws -
https://portswigger.net/daily-swig/separate-fujitsu-cloud-storage-vulnerabilities-could-enable-attackers-to-destroy-virtual-backups
Palermo popped- https://www.bleepingcomputer.com/news/security/vice-society-ransomware-claims-attack-on-italian-city-of-palermo/
HID Switched Can’t Hide -
https://www.securityweek.com/vulnerabilities-hid-mercury-access-controllers-allow-hackers-unlock-doors
Aoqin Dragon Rears -
https://www.bleepingcomputer.com/news/security/chinese-hacking-group-aoqin-dragon-quietly-spied-orgs-for-a-decade/
Hi, I’m Paul Torgersen. It’s Friday June 10th, 2022, and once again from Chicago, this is a look at the information security news from overnight.
From BleepingComputer.com
A massive phishing operation is abusing Facebook and Messenger to lure millions of users and tricking them into entering their account credentials and seeing advertisements. The campaign operators then use these stolen accounts to send further phishing messages to their friends, generating a significant revenue via online advertising commissions. The activity peaked in April and May of this year, but has been going on since at least September of last year.
From PortSwigger.net:
Two flaws in the web interface of a Fujitsu cloud storage system could allow remote code execution, and ultimately be exploited to read, write, and destroy backed up files. The vulnerabilities impact the enterprise-grade Fujitsu Eternus CS8000 Control Center version 8.1. Details in the article.
From BleepingComputer.com:
The city of Palermo, Italy, has taken all systems offline in response to a ransomware attack, impacting 1.3 million residents and tens of thousands of tourists visiting the city. The Vice Society ransomware group has claimed responsibility for the attack via an entry on their dark web data leak site.
From SecurityWeek.com:
Access control products using HID Mercury controllers are affected by critical vulnerabilities that can be exploited to remotely unlock doors. The issues were found in products from LenelS2, a subsidiary of Carrier, but HID Global said that all OEM partners that use these hardware controllers are affected. A total of eight vulnerabilities were found, seven of which were rated high or critical severity. Either upgrade to the latest firmware, or make sure those babies are behind a firewall.
And last today, from BleepingComputer.com
A previously unknown Chinese-speaking threat actor has been discovered and named Aoqin Dragon. Researchers were able to link it to malicious activity going as far back as 2013. This hacking group is focused on cyber-espionage, targeting government, education, and telecommunication organizations based in Singapore, Hong Kong, Vietnam, Cambodia, and Australia. Details, including a link to the research, in the article.
That’s all for me this week. Have a great weekend. And until next week, be safe out there.
A daily look at the relevant information security news from overnight - 09 June, 2022
Episode 241 - 09 June 2022
Linux Symbiote- https://www.zdnet.com/article/this-new-linux-malware-is-almost-impossible-to-detect/
Black Basta hearts Qbot -
https://threatpost.com/black-basta-ransomware-qbot/179909/
Emotet gets Chromed- https://www.bleepingcomputer.com/news/security/emotet-malware-now-steals-credit-cards-from-google-chrome-users/
Cuba upgrade -
https://www.bleepingcomputer.com/news/security/cuba-ransomware-returns-to-extorting-victims-with-updated-encryptor/
China hacking telecoms -
https://www.securityweek.com/us-details-chinese-attacks-against-telecoms-providers
Hi, I’m Paul Torgersen. It’s Thursday June 9th, 2022, and from Chicago, this is a look at the information security news from overnight.
From ZDNet.com
A joint research effort has discovered a new form of Linux malware they’ve called Symbiote that is almost impossible to detect. Instead of attempting to compromise running processes, Symbiote instead acts as a shared object library that is loaded on all running processes via LD_PRELOAD. It appears to have been developed to target financial institutions in Latin America, although that is not definitive. Details and a link to the research blog post in the article.
From ThreatPost.com:
Here’s a mashup I never wanted to hear: Black Basta is now leveraging the Qbot network to spread its ransomware and move laterally through the infected networks. You can link to the NCC Group research for all the nasty details in the article.
From BleepingComputer.com:
The Emotet botnet is now attempting to infect potential victims with a credit card stealer module designed to harvest credit card information stored in Google Chrome user profiles. In an odd twist, once card details are collected they were exfiltrated to a different C2 server than the module loader. Details in the article.
Also from BleepingComputer.com:
The Cuba ransomware group has returned to regular operations with a new and improved version of its malware. Cuba ransomware's activity reached a peak last year when it partnered with the Hancitor malware gang for initial access, breaching 49 US organizations. This year has seen much lower activity from them, but that appears to be changing with the upgrade to the malware.
And last today, from SecurityWeek.com
The NSA, CISA and FBI have issued a joint cybersecurity advisory warning of China-linked threat actors compromising telecom companies and network services providers. The advisory details some of the techniques and tactics the APTs use, as well as specify many of the vulnerabilities they have been targeting. See the article for details and a link to that advisory.
That’s all for me today. Have a great rest of your day. Like and subscribe. Tell a friend. And until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight - 08 June, 2022
Episode 240 - 08 June 2022
Properties loader- https://www.bleepingcomputer.com/news/security/new-svcready-malware-loads-from-word-doc-properties/
Shields down -
https://www.securityweek.com/data-breach-shields-health-care-group-impacts-2-million-patients
Who let the Dogs out- https://www.bleepingcomputer.com/news/security/new-dogwalk-windows-zero-day-bug-gets-free-unofficial-patches/
Owl be watching you -
https://www.securityweek.com/owl-labs-patches-severe-vulnerability-video-conferencing-devices
Bad Pirates -
https://www.bleepingcomputer.com/news/security/pirated-ccleaner-search-results-spread-information-stealing-malware/
Hi, I’m Paul Torgersen. It’s Wednesday June 8th, 2022, and this is a look at the information security news from overnight.
From BleepingComputer.com
A previously unknown malware loader named SVCReady has been discovered in phishing attacks, featuring an unusual way of loading the malware from Word documents. Specifically, it uses VBA macro code to execute shellcode stored in the properties of the document. HP reports that the malware has been under deployment since April of this year, and received several updates in May. This indicates it is currently under heavy development, and is likely still at an early stage.
From SecurityWeek.com:
Shields Health Care Group of Massachusetts has informed roughly two million individuals of a cybersecurity incident that potentially impacted a robust set of their PII and PHI. No word on the threat actor or attack vector in this breach that happened between March 7 and March 21 of this year. No free monitoring was offered, but they do guide you on how to lock down your three credit reports. Gee, thanks.
From BleepingComputer.com:
Yet another Windows zero-day vulnerability in the Microsoft Support Diagnostic Tool has come to light. The security flaw dubbed DogWalk, is a path traversal flaw attackers can exploit to copy an executable to the Windows Startup folder from a .diagcab file. This flaw has actually been known for over two years, but Microsoft said that Outlook users are not at risk because .diagcab files are automatically blocked. Opatch says yea, but here’s a free patch anyway, you know, just in case.
From SecurityWeek.com:
Video conferencing company Owl Labs has released patches for a severe vulnerability affecting its Meeting Owl Pro and Whiteboard Owl devices. These flaws can be exploited to find registered devices worldwide and access sensitive data, or even gain access to the owners’ networks. The company says updating to firmware version 5.4.1.4 should eliminate the threat of unauthorized access.
And last today, from BleepingComputer.com
A new malware distribution campaign dubbed “FakeCrack,” is being promoted through search results for a pirated copy of the CCleaner Pro Windows optimization program. What you really get is a nasty that steals your passwords, credit cards and crypto wallets. On the other hand, if you are pirating software anyway, maybe you get what you deserve.
That’s all for me today . Have a great rest of your day. Like and subscribe. And until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight - 07 June, 2022
Episode 239 - 07 June 2022
Mandiant not locked- https://www.bleepingcomputer.com/news/security/mandiant-no-evidence-we-were-hacked-by-lockbit-ransomware/
Google patches -
https://www.securityweek.com/google-patches-critical-android-vulnerabilities-june-2022-updates
Karakut phones it in- https://www.zdnet.com/article/fbi-warning-this-gang-steals-data-for-ransom-then-makes-harassing-phone-calls-to-pile-on-the-pressure/
Not so smart scale baddie -
https://portswigger.net/daily-swig/unpatched-bug-chain-poses-mass-account-takeover-threat-to-yunmai-weight-monitoring-app
Follina phishing -
https://www.bleepingcomputer.com/news/security/wi
ndows-zero-day-exploited-in-us-local-govt-phishing-attacks/
Hi, I’m Paul Torgersen. It’s Tuesday June 7th, 2022, which means a good chunk of you are probably at RSA, and this is a look at the information security news from overnight.
From BleepingComputer.com
The LockBit ransomware group published a new page on its data leak website, saying that they have 356,000 files they allegedly stole from Mandiant, and will be leaked online. Mandiant says, no way dude. They can find no evidence of any sort of breach. Mandiant, if you recall, is being acquired by Google in an all cash deal valued at $5.4 billion.
From SecurityWeek.com:
Google’s Patch Tuesday resolves a total of 40 Android vulnerabilities, including at least four rated critical. The company also announced it addressed roughly 80 vulnerabilities in its Pixel devices. Get your patch on kids.
From ZDNet.com:
A cyber-criminal gang, Karakut, is stealing sensitive data from businesses and demanding a ransom payment in exchange for deleting the stolen information. Pretty standard stuff, right? Well, these guys don’t stop there. According to an advisory from the FBI and CISA, next comes an extensive harassment campaign, with emails and even phone calls to employees, business partners, and clients with warnings that the company needs to pay the ransom.
From PortSwigger.net:
Several zero-day vulnerabilities in the Yunmai Smart Scale app could be chained together and exploited for full account takeover and access to all user details. The company, Zhuhai Yunmai Technologies, had tried to patch one of the flaws, but it was unsuccessful. The app currently has about a half a million downloads.
And last today, from BleepingComputer.com
Phishing campaigns against European governments and US local governments have ramped up recently using malicious Rich Text Format documents to exploit the unpatched critical Windows zero-day vulnerability known as Follina. The threat actor is suspected to be a State sponsored group, but no attribution has been confirmed as of yet. Details in the article.
That’s all for me today . Have a great rest of your day. Like and subscribe. And until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight - 06 June, 2022
Episode 238 - 06 June 2022
Patched Atlassian- https://www.securityweek.com/atlassian-patches-confluence-zero-day-exploitation-attempts-surge
Yuga Labs phished -
https://www.bleepingcomputer.com/news/security/bored-ape-yacht-club-otherside-nfts-stolen-in-discord-server-hack/
Novartis data sale - https://www.bleepingcomputer.com/news/security/novartis-says-no-sensitive-data-was-compromised-in-cyberattack/
U-Boot baddie -
https://www.securityweek.com/critical-u-boot-vulnerability-allows-rooting-embedded-systems
Reverse Tunnel phishing -
https://www.bleepingcomputer.com/news/security/evasive-phishing-mixes-reverse-tunnels-and-url-shortening-services/
Hi, I’m Paul Torgersen. It’s Monday June 6th, 2022, and this is a look at the information security news from overnight.
From SecurityWeek.com
We talked Friday about the zero-day affecting Atlassian Confluence Server and Data Center. Well, two things have happened since then; Atlassian has issued a patch, and attempts to exploit the vulnerability have gone through the roof. According to a Cloudflare report, they say they have seen evidence suggesting that potentially malicious payloads have been delivered since at least May 26. We may not have seen the full impact of this vulnerability quite yet. And in the meantime, get your patch on kids.
From BleepingComputer.com:
Hackers reportedly stole over $257,000 in Ethereum and thirty-two NFTs after the Yuga Lab's Bored Ape Yacht Club and Otherside Metaverse Discord servers were compromised in a phishing scam. The scam pretended to be an exclusive, limited giveaway for existing NFT holders, which included a link to a webpage that allowed a visitor to mint a free NFT. You can imagine where the link really went. Details in the article.
Also from BleepingComputer.com:
Data extortion group Industrial Spy began selling data allegedly stolen from Novartis on their Tor extortion marketplace for $500,000 in bitcoin. The data is supposed to be related to RNA and DNA-based drug technology, although Novartis says that no sensitive data was compromised. There are 7.7 MB of PDF files for sale, but it is unclear if that is the extent of the data that was taken. Novartis has no comment yet about how and when the data was accessed.
From SecurityWeek.com:
A critical vulnerability in the U-Boot, boot loader could be exploited to write arbitrary data, and ultimately allow an attacker to gain root on Linux-based embedded systems. The open-source boot loader is used in various types of embedded systems, including ChromeOS and Android, and supports multiple architectures. NCC Group says a patch is in the works.
And last today, from BleepingComputer.com
Researchers are seeing an uptick in phishing campaigns utilizing reverse tunnel services along with URL shorteners, which makes them a bear to get shut down. With reverse tunnels, threat actors can host the phishing pages locally on their own computers and then route connections through external services. Often, they refresh those phishing links in less than 24 hours, making it nearly impossible to shut down the sites before they get moved. Details in the article.
That’s all for me today . Have a great rest of your day. Like and subscribe. And until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight - 03 June, 2022
Episode 237 - 03 June 2022
Windows opatch- https://www.bleepingcomputer.com/news/security/windows-msdt-zero-day-vulnerability-gets-free-unofficial-patch/
UNISOC DoS -
https://www.securityweek.com/millions-budget-smartphones-unisoc-chips-vulnerable-remote-dos-attacks
Asian app attack - https://www.bleepingcomputer.com/news/security/chinese-luoyu-hackers-deploy-cyber-espionage-malware-via-app-updates/
Atlassian critical -
https://www.securityweek.com/atlassian-confluence-servers-hacked-zero-day-vulnerability
GitLb patch -
https://www.bleepingcomputer.com/news/security/gitlab-security-update-fixes-critical-account-take-over-flaw/
Hi, I’m Paul Torgersen. It’s Friday, June 3rd, 2022, and this is a look at the information security news from overnight.
From BleepingComputer.com
While Microsoft has still not released a patch for the Windows critical vulnerability known as Follina, our friends at opatch have. Instead of just disabling the MSDT URL protocol handler which is the Microsoft suggested mitigation for the issue, opatch has added sanitization of the user-provided path to avoid rendering the Windows diagnostic wizardry inoperable across the Operating System for all applications. Details in the article.
From SecurityWeek.com:
Millions of budget smartphones that use UNISOC chipsets could have a critical vulnerability that leads to a denial of service attack. UNISOC has about 11% of the smartphone chip market, with the majority of these chips sold in Asia and Africa. The company has already issued the appropriate patch. Google will also address this flaw in an upcoming Android patch.
From BleepingComputer.com:
Chinese hacking group LuoYu is infecting victims with the WinDealer information stealer by switching legitimate app updates with a man-on-the-side attack. They are currently targeting popular Asian apps such as QQ, WeChat, and WangWang. Details in the article.
From SecurityWeek.com:
Atlassian Confluence Servers and Data Centers are affected by a critical vulnerability that can be leveraged for remote code execution and is being actively exploited in the wild. All supported versions of Confluence Server and Data Center are affected. Until a patch becomes available, users have been advised to prevent access to their Confluence servers from the internet, or simply disable these instances. The company hopes to have a patch ready by the end of today.
And last today, from BleepingComputer.com
GitLab has released a critical security update for multiple versions of its Community and Enterprise Edition products to address eight vulnerabilities, one of which that could lead to account takeover. That 9.9 severity vulnerability affects all GitLab versions 11.10 through 14.9.4, 14.10 through 14.10.3, and version 15.0. Get your patch on kids.
That’s all for me today . Have a great rest of your day. Like and subscribe. And until next time, be safe out there.
A daily look at the relevant information security news from overnight - 02 June, 2022
Episode 236 - 02 June 2022
WhatsApp hack- https://www.bleepingcomputer.com/news/security/hackers-steal-whatsapp-accounts-using-call-forwarding-trick/
Sowing Discord -
https://threatpost.com/scammers-target-nft-discord-channel/179827/
New Windows zero-day - https://www.bleepingcomputer.com/news/security/new-windows-search-zero-day-added-to-microsoft-protocol-nightmare/
Elasticsearch snatched -
https://www.securityweek.com/cybercriminals-hold-1200-unsecured-elasticsearch-databases-ransom
Horde zero-day -
https://portswigger.net/daily-swig/horde-webmail-contains-zero-day-rce-bug-with-no-patch-on-the-horizon
Hi, I’m Paul Torgersen. It’s Thursday June 2nd, 2022, I think I said yesterday was Tuesday, and Tuesday was Monday. Obviously my brain is not comprehending the holiday very well. Anyway, this is a look at the information security news from overnight.
From BleepingComputer.com
Hackers are going after WhatsApp accounts to gain access to personal messages and contact lists. The method relies on the mobile carriers’ automated service to forward calls to a different phone number, and WhatsApp’s option to send a one-time password verification code via voice call. You can pursue all the details in the article.
From ThreatPost.com:
Hackers are escalating phishing and scamming attacks targeting NFT servers to exploit a popular Discord bot and persuade users to click on the malicious links. The discord bot mee6, which is used to automate welcome messages and inform visitors about the server rules, etc., seems to be compromised across several high profile servers. As always, when in doubt, don’t click the link.
From BleepingComputer.com:
A new Windows Search zero-day vulnerability can be used to automatically open a search window containing malware executables simply by launching a Word document. This error stems from Windows support of a URI protocol handler called 'search-ms' that allows applications and HTML links to launch customized searches on a device. Details in the article.
From SecurityWeek.com:
Over 1,200 Elasticsearch databases that could be accessed without authentication have fallen victim to a ransomware attacker, which replaced their indexes with a note demanding a payment of 0.012 Bitcoin in exchange for their data. In each case, data held in the databases was replaced with a ransom note stored in the 'message' field of an index called 'read_me_to_recover_database'. Inside the 'email' field is a contact email address. THe article has a link to the full Secureworks write up.
And last today, from PortSwigger.net
A zero-day vulnerability in Horde Webmail enables attackers to execute arbitrary code on the underlying server. Going from bad to worse, Horde has already flagged this version of their webmail to be their final release, so it is likely that a patch will not be forthcoming.
That’s all for me today . Have a great rest of your day. Like and subscribe, And until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight - 01 June, 2022
Episode 235 - 01 June 2022
Costa Rica Hive- https://www.bleepingcomputer.com/news/security/costa-rica-s-public-health-agency-hit-by-hive-ransomware/
Foxconn Locked -
https://www.securityweek.com/ransomware-group-claims-have-breached-foxconn-factory
Wait ‘till I get my Hanes on you - https://www.marketwatch.com/story/hanesbrands-says-it-suffered-a-ransomware-attack-on-may-24-and-has-informed-law-enforcement-2022-05-31
Sidewinder VPN -
https://www.bleepingcomputer.com/news/security/sidewinder-hackers-plant-fake-android-vpn-app-in-google-play-store/
JetPort backdoor -
https://www.securityweek.com/vendor-refuses-remove-backdoor-account-can-facilitate-attacks-industrial-firms
Hi, I’m Paul Torgersen. It’s Tuesday June 1st, 2022, and this is a look at the information security news from overnight.
From BleepingComputer.com
Costa Rica, after declaring a national emergency because of ransomware attacks from the Conti group, has now been hit with a Hive ransomware attack. All computer systems of Costa Rica's public health service are now offline after every printer in the system started printing early this morning. It is thought that the threat actors behind this Hive attack may come from Conti as that organization continues being disbanded and moved to smaller entities.
From SecurityWeek.com:
Cybercriminals say they have breached the systems of the Foxconn factory in Mexico, using the LockBit 2.0 ransomware. They are threatening to leak stolen files if the company doesn’t pay up. It is unclear if the attack has impacted the company’s OT systems. You may recall, the US systems of Foxconn were hit about a year and a half ago with the DopplePaymer ransomware.
From MarketWatch.com:
Speaking of ransomware, Hanesbrands said it was the subject of a ransomware attack on May 24 and activated business continuity and incident response plans to contain it. The company says they are in the early stages of their investigation and have not determined the full impact of the attack.
From BleepingComputer.com:
Phishing campaigns attributed to an APT called SideWinder involved a fake VPN app for Android devices published on Google Play Store. They even have a custom tool that filters victims for better targeting. SideWinder has been active since at least 2012, and is believed to be of Indian origin with a relatively high level of sophistication. They have been attributed with close to 1,000 attacks in the past two years. Details in the article.
And last today, from SecurityWeek.com
Korenix JetPort industrial serial device servers have a backdoor account that can take full control of the device. This was found back in 2020, but it was only made public now, after a lengthy disclosure process that ended with the vendor saying that the account will not be removed. They say it is needed for customer support. The password for the account is in the firmware, so is the same for every device and cannot be changed by the customer. But don’t worry, the manufacturer says the password can't be cracked in a reasonable amount of time. Buyer beware. Or at least be aware.
That’s all for me today . Have a great rest of your day. And until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight.
Episode 234 - 27 May 2022
Word backdoor- https://www.zdnet.com/article/this-zero-day-windows-flaw-opens-a-backdoor-to-hackers-via-microsoft-word-heres-how-to-fix-it/
WSL attack surface -
https://www.bleepingcomputer.com/news/security/new-windows-subsystem-for-linux-malware-steals-browser-auth-cookies/
Killnet warns Italy - https://www.thesundaily.my/world/italy-on-alert-over-killnet-cyber-attack-threat-DA9266005
Spirit Super suckered -
https://portswigger.net/daily-swig/data-breach-at-australian-pension-provider-spirit-super-impacts-50k-victims-following-phishing-attack
EnemyBot adapting -
https://threatpost.com/enemybot-malware-targets-web-servers-cms-tools-and-android-os/179765/
Hi, I’m Paul Torgersen. It’s Monday May 31st, 2022, and this is a look at the information security news from overnight.
From ZDNet.com
Security researchers discovered a zero-day flaw called Follina that enables a malicious Word document to execute code via the Microsoft Support Diagnostic Tool, even when macros are disabled. There is no patch yet. For mitigation, Microsoft recommends disabling a protocol used for troubleshooting Windows bugs. Details and links in the article.
From BleepingComputer.com:
Hackers are showing an increased interest in the Windows Subsystem for Linux, or WSL, as an attack surface for new malware. Some of the more advanced samples are suitable for espionage and downloading additional modules. After the first malicious Linux binary for WSL was discovered just over a year ago, Black Lotus Labs says that since last fall, they have tracked more than 100 samples of WSL-based malware.
From TheSunDaily.my:
Italy is on high alert after the pro-Russian ‘Killnet’ hacker group said it would launch a cyber attack that would inflict “irreparable” damage on the country. Killnet has staged several attacks on Italian public institutions in recent weeks, including on the websites of the Senate and the defense ministry. All this in response to Italy backing Western sanctions on Russia following its invasion of Ukraine.
From PortSwigger.net:
A phishing attack on Australian pension provider Spirit Super has resulted in PII being leaked on some 50,000 customers. The personal data includes names and other sensitive information, but according to the company, does not include birthday, tax ID or driver’s license numbers, or bank account details.
And last today, from ThreatPost.com
A rapidly evolving IoT malware dubbed EnemyBot is targeting content management systems, web servers and Android devices, taking advantage of recently disclosed vulnerabilities in VMWare, Adobe, WordPress and others. The threat actor group Keksec is believed to be behind the distribution of the malware, which borrows code heavily from other botnets, such as Mirai, Qbot and Zbot. Details in the article.
That’s all for me today . Have a great rest of your day. And until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight.
Episode 234 - 27 May 2022
Buggy Android apps- https://www.bleepingcomputer.com/news/security/microsoft-finds-severe-bugs-in-android-apps-from-large-mobile-providers/
Guzzle cookies crumble -
https://portswigger.net/daily-swig/patch-released-for-cross-domain-cookie-leakage-flaw-in-guzzle
Ransome besets Somerset - https://www.cnn.com/2022/05/26/politics/new-jersey-somerset-county-ransomware-attack/index.html
BlackCat slashes Austria -
https://www.bleepingcomputer.com/news/security/blackcat-alphv-ransomware-asks-5-million-to-unlock-austrian-state/
Crital OAS flaws- https://threatpost.com/critical-flaws-in-popular-ics-platform-can-trigger-rce/179750/
New Windows update not Trend-y -
https://www.bleepingcomputer.com/news/security/windows-11-kb5014019-breaks-trend-micro-ransomware-protection/
Hi, I’m Paul Torgersen. It’s Friday May 27th, 2022, and this is a look at the information security news from overnight.
From BleepingComputer.com:
Microsoft security researchers have found high severity vulnerabilities in a framework owned by MCE Systems that is used by Android apps. The vulnerabilities expose users to command injection and privilege escalation attacks. The apps have millions of downloads on Google's Play Store and come pre-installed as system applications on devices bought from operators including AT&T, TELUS, Rogers Communications, Bell Canada, and Freedom Mobile. Patches have been issued.
From PortSwigger.net:
Guzzle, the popular HTTP client for PHP applications, has addressed a high severity vulnerability leading to cross-domain cookie leakage. The flaw resides in Guzzle’s cookie middleware, which is fortunately disabled by default, so most library consumers will not be affected. Drupel is one of the applications that use the third-party library and has released updates to address the issue.
From CNN.com:
A ransomware attack has forced officials in Somerset County New Jersey to switch off their computers and set up temporary Gmail accounts so the public can communicate with key agencies like health, emergency and sheriff's departments. The county says the attack has only affected email and IT systems and that phone lines and emergency service systems are all working properly. No word on the threat actor or specific malware involved.
From BleepingComputer.com:
The Austrian state of Carinthia has been hit by the BlackCat ransomware gang, who demanded $5 million to unlock their encrypted computer systems. Evidently thousands of workstations have been locked by the attack. The government says there is no evidence that BlackCat actually managed to exfiltrate any data, and that the plan is to restore the machines from backups.
From ThreatPost.com:
Multiple flaws have been found in Open Automation Software, a popular platform used by industrial control systems. The two critical and five high severity vulnerabilities could allow unauthorized device access, remote code execution, or denial of service that could ultimately threaten the stability of critical infrastructure. The flaws affect OAS Platform version 16.00.0112. See the full Cisco Talos report in the article.
And last today, from BleepingComputer.com
Windows previewed its upcoming cumulative update, which unfortunately has some compatibility issues with some of Trend Micro's security products, including the ransomware protection feature. The issue affects the User Mode Hooking component used by several Trend Micro endpoint solutions. The company is working on a fix to address this issue before the updates are pushed to all Windows customers as part of their June Patch Tuesday.
That’s all for me this week . Have a great holiday weekend. Take a moment to remember those that gave their last full measure to secure the freedoms of the rest of us. And until next time, be safe out there.
A daily look at the relevant information security news from overnight.
Episode 233 - 26 May 2022
Curb Kerberos- https://www.zdnet.com/article/microsoft-heres-how-to-defend-windows-against-these-new-privilege-escalation-attacks/
Tales from the Cheerscrypt -
https://www.bleepingcomputer.com/news/security/new-cheers-linux-ransomware-targets-vmware-esxi-servers/
Broadcom buy - https://www.securityweek.com/vmware-absorb-broadcom-security-solutions-following-61-billion-deal
Chromeloader rises -
https://www.bleepingcomputer.com/news/security/new-chromeloader-malware-surge-threatens-browsers-worldwide/
DuckDuck no- https://www.techradar.com/news/duckduckgo-in-hot-water-over-hidden-tracking-agreement-with-microsoft
Hi, I’m Paul Torgersen. It’s Wednesday May 26th, 2022, and again from Las Vegas, this is a look at the information security news from overnight.
From ZDNet.com:
Microsoft has detailed mitigation techniques to help Windows users defend themselves from automated 'Kerberos Relay' attacks. The KrbRelayUp tool flaw can give an attacker System privileges on Windows machines. See the details in the article.
From BleepingComputer.com:
A new Cheers ransomware called Cheerscrypt has appeared and is starting its operations by targeting VMware ESXi servers. I guess they learned that from the LockBit and Hive ransomware crowd. There is the full Trend Micro writeup in the article.
From SecurityWeek.com:
Speaking of VMWare, Broadcom announced they are acquiring the company for about $61 billion in cash and stock. Man, just a small sliver of that and I can keep this podcast running forever. I need to find out who to talk to. If you recall, Broadcom acquired Symantec’s enterprise unit back in 2019. Not sure how those technologies and services will migrate to VMWare.
From BleepingComputer.com:
The ChromeLoader malware is seeing a significant uptick this month, after being relatively stable through the beginning of the year. ChromeLoader is a browser hijacker that can modify web browser settings to show search results that promote unwanted software, fake giveaways and surveys, and adult games and dating sites. You know where to find the details.
And last today, from TechRadar.com
I’m sure many of you are DuckDuckGo users, wanting the privacy the search engine offers. Unfortunately, while Google and Facebook trackers are being blocked, Microsoft trackers are allowed to continue running, as are trackers related to the bing.com and linkedin.com domains. Apparently, DuckDuckGo has a search syndication agreement with Microsoft. For a company known for its transparency, strange how this agreement remained a secret for so long. DuckDuck, no.
That’s all for me today. Have a great rest of your day. And until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight.
Episode 232 - 25 May 2022
Mozilla un-pwned- https://www.bleepingcomputer.com/news/security/mozilla-fixes-firefox-thunderbird-zero-days-exploited-at-pwn2own/
Chrome hardened -
https://www.securityweek.com/chrome-102-patches-32-vulnerabilities
Moshen Dragon Trend-ing - https://www.bleepingcomputer.com/news/security/trend-micro-fixes-bug-chinese-hackers-exploited-for-espionage/
No TOR for Tails -
https://portswigger.net/daily-swig/tails-users-warned-not-to-launch-bundled-tor-browser-until-security-fix-is-released
BPFDoor goes deep- https://www.bleepingcomputer.com/news/security/bpfdoor-malware-uses-solaris-vulnerability-to-get-root-privileges/
Hi, I’m Paul Torgersen. It’s Wednesday May 25th, 2022, and again from Las Vegas, this is a look at the information security news from overnight.
From BleepingComputer.com:
Mozilla has released security updates to address zero-day vulnerabilities exploited during the Pwn2Own Vancouver 2022 hacking contest. The two critical flaws can let attackers gain JavaScript code execution on mobile and desktop devices running Firefox, Firefox ESR, Firefox for Android, and Thunderbird. On a side note: the total amount of bug bounties earned at Pwn2Own this year? $1.2 million. Well done.
From SecurityWeek.com:
Google announced the release of Chrome 102, which patches 32 vulnerabilities, including one critical and eight high-severity flaws. The critical security hole has been described as a use-after-free bug affecting Indexed DB. Somebody has a bug bounty coming to them for that one too.
From BleepingComputer.com:
Trend Micro has patched a flaw in Trend Micro Security that has been used by Chinese threat group Moshen Dragon to side-load malicious DLLs. The fix was deployed via ActiveUpdate, so if you have an active internet connection, you should have already received it. More details in the article.
From PortSwigger.net:
Tails is warning users to stop using Tor Browser that comes bundled with the privacy-focused operating system. They found a bug that could enable an attacker to corrupt the methods of an Array object in JavaScript via prototype pollution. This could end in the execution of attacker-controlled JavaScript code in a privileged context.
And last this today, from BleepingComputer.com
During a recent incident response, PwC has been able to dig into the inner workings of the BPFdoor malware for Linux and Solaris. BPFDoor is a custom backdoor that can't be stopped by firewalls, it can function without opening any ports and does not need a command and control server because it can receive commands from any IP address on the web. This nasty has been attributed to a China-based threat actor PwC tracks as Red Menshen. All the details in the article.
That’s all for me today. Have a great rest of your day. And as always, until tomorrow, be safe out there.
A daily look at the relevant information security news from overnight.
Episode 231 - 24 May 2022
Yik Yak fixed that - https://portswigger.net/daily-swig/yik-yak-fixes-information-disclosure-bug-that-leaked-users-gps-location
Abusing the abused -
https://www.bleepingcomputer.com/news/security/photos-of-abused-victims-used-in-new-id-verification-scam/
Argo CD max severity - https://portswigger.net/daily-swig/critical-argo-cd-vulnerability-could-allow-attackers-admin-privileges
Fake PoCs -
https://www.bleepingcomputer.com/news/security/fake-windows-exploits-target-infosec-community-with-cobalt-strike/
Hi, I’m Paul Torgersen. It’s Tuesday May 24th, 2022, and from Las Vegas, this is a look at the information security news from overnight.
From PortSwigger.net:
Anonymous social network Yik Yak took more than three months, but finally fixed vulnerabilities that were submitted by two different security researchers. The flaw enabled threat actors to access users’ precise locations, within like 10ft or 15ft. Not so hot for an anonymous site.
From BleepingComputer.com:
In a new low, scammers are leveraging dating apps like Tinder and Grindr to pose as former abuse victims to gain your trust and sell you bogus ID verification services. These catphishers show their target pictures of physical abuse and get them to register on a scam site to prove they are not a former sex offender. All the sketchy details in the article.
From PortSwigger.net:
The maintainers of Argo CD, the continuous delivery tool for Kubernetes, have patched a critical vulnerability that enabled attackers to forge JSON Web Tokens and become administrators. The bad news is, this bug has a severity rating of 10 out of 10. The good news is, anonymous access is deactivated by default, so if you haven’t played with any settings, you were probably ok. But, you know, patch it.
From BleepingComputer.com:
A threat actor is targeting security researchers with fake Windows proof-of-concepts for recently patched vulnerabilities CVE-2022-24500 and -26809. When you go in to check out the PoCs, it loads the Cobalt Strike backdoor instead. Details in the article.
And last this today, from Infosecurity-magazine.com
Here’s one to cheer about. Our friends Anonymous have announced on social media that they’re launching a cyber-war against the pro-Russian group Killnet. Couldn’t happen to a more deserving group. You know who my money’s on.
That’s all for me today. Have a great rest of your day. Remember to LIKE, SUBSCRIBE, and share with your network. And as always, until next time, be safe out there.
A daily look at the relevant information security news from overnight.
Episode 230 - 23 May 2022
Chicago students breach - https://chicago.suntimes.com/education/2022/5/20/23132983/cps-public-schools-data-breach-students-employees-records-battelle-kids
PyPI infection -
https://www.bleepingcomputer.com/news/security/malicious-pypi-package-opens-backdoors-on-windows-linux-and-macs/
Record Etherium bounty - https://portswigger.net/daily-swig/blockchain-bridge-wormhole-pays-record-10m-bug-bounty-reward
PDF snake -
https://threatpost.com/snake-keylogger-pdfs/179703/
WordPress backdoor- https://www.bleepingcomputer.com/news/security/backdoor-baked-into-premium-school-management-plugin-for-wordpress/
Hi, I’m Paul Torgersen. It’s Monday May 23rd, 2022, and this is a look at the information security news from overnight.
From the Chicago.SunTimes.com:
A massive data breach has exposed four years’ worth of records of about a half million Chicago Public Schools students and nearly 60,000 employees. The attack targeted a company that provides teacher evaluations and should not contain financial records or Social Security numbers. And in a dose of real world teaching, those students now get a free year of credit and identity theft monitoring.
From BleepingComputer.com:
Another malicious Python package has been spotted in the PyPI registry performing supply chain attacks to drop Cobalt Strike malware on Windows, Linux, and macOS systems. The malicious package is named 'pymafka’, very similar to PyKafka, a widely used Apache Kafka client that counts over four million downloads. All the details in the article.
From PortSwigger.net:
An ethical hacker has earned a record $10 million bug bounty after discovering a critical security vulnerability in the Wormhole core bridge contract on Ethereum. The vulnerability would have allowed the wormhole to be bricked, forever losing the $736 million of assets that were in the contract at the time.
From ThreatPost.com:
A malicious email campaign using a weaponized PDF file and a 22-year-old Office bug is propagating the Snake keylogger. It also employs several evasion techniques, such as embedding malicious files, loading remotely-hosted exploits and shellcode encryption. You know where to find the details.
And last this week, from BleepingComputer.com
A backdoor has been discovered in a premium WordPress plugin designed as a complete management solution for schools. The name of the plugin is “School Management,” published by Weblizar, and multiple versions before 9.9.7 have the backdoor baked into its code. Although the latest version is clean, the developer did not disclose the source of the compromise.
That’s all for me today. Remember to LIKE, SUBSCRIBE, and share with your networks. And as always, until next time, be safe out there.
A daily look at the relevant information security news from overnight.
Episode 239 - 20 May 2022
Log4J exploit - https://www.bleepingcomputer.com/news/security/lazarus-hackers-target-vmware-servers-with-log4shell-exploits/
SQL brute -
https://www.securityweek.com/new-brute-force-attacks-against-sql-servers-use-powershell-wrapper
Phishing with Chat - https://www.bleepingcomputer.com/news/security/phishing-websites-now-use-chatbots-to-steal-your-credentials/
Jupiter flawed - https://threatpost.com/vulnerability-wordpress-themes-site-takeover/179672/
Flux flaw -
https://portswigger.net/daily-swig/rogue-cloud-users-could-sabotage-fellow-off-prem-tenants-via-critical-flux-flaw
Vidar delivery- https://www.zdnet.com/article/fake-domains-offer-windows-11-installers-but-deliver-malware-instead/
Hi, I’m Paul Torgersen. It’s Friday May 20th, 2022, and after a couple days under the weather, this is a look at the information security news from overnight.
From BleepingComputer.com:
The North Korean hacking group Lazarus is exploiting the Log4J remote code execution vulnerability on VMware Horizon servers. They use the weakness to execute a PowerShell command and ultimately install the NukeSped backdoor. Details in the article.
From SecurityWeek.com:
Microsoft has warned organizations of a new wave of brute force cyberattacks that target SQL servers and use a living-off-the-land binary. Specifically, the attackers rely on a legitimate utility called sqlps.exe to achieve fileless persistence on SQL servers that use weak or default passwords.
From BleepingComputer.com:
Phishing attacks are now using automated chatbots to guide visitors through the process of handing over their login credentials to the threat actors. How nice of them. Actually, the presence of a chatbot lends a sense of legitimacy to the malicious sites. See the full Trustwave report in the article.
From ThreatPost.com:
A critical privilege escalation flaw found in two WordPress site themes, can allow the threat actors to take over the sites completely. The Jupiter and JupiterX Core Plugin affect more than 90,000 sites. The vulnerability affects Jupiter Theme 6.10.1 or earlier, and JupiterX Core Plugin 2.0.7 or earlier. Updated versions have patched the flaws.
From PortSwigger.net:
A critical vulnerability in Flux2, the continuous delivery tool for Kubernetes, can enable rogue tenants in multi-tenancy deployments to sabotage their neighbors that are using the same off-premise infrastructure. The remote code execution flaw arises through improper validation of kubeconfig files, which “can define commands to be executed to generate on-demand authentication tokens”. In a single tenant deployment, this flaw is only a 6.8 severity. In multi tenant deployments, that rating jumps to a 9.9
And last this week, from ZDNet.com
Newly registered domains that just appeared in April, mimic a legitimate Microsoft Windows 11 OS download portal. Unfortunately, what you actually get is a nasty little information stealer called Vidar. Link to the full Zscaler report in the article.
That’s all for me this week. Remember to LIKE and SUBSCRIBE. And as always, until next time, be safe out there.
A daily look at the relevant information security news from overnight.
Episode 238 - 17 May 2022
Apple attack - https://www.bleepingcomputer.com/news/security/apple-emergency-update-fixes-zero-day-used-to-hack-macs-watches/
Conti hits Parker -
https://www.infosecurity-magazine.com/news/parker-conti-ransomware/
Tesla BLE - https://www.bleepingcomputer.com/news/security/hackers-can-steal-your-tesla-model-3-y-using-new-bluetooth-attack/
Card skimming - https://www.zdnet.com/article/fbi-hackers-used-malicious-php-code-to-grab-credit-card-data/
iPhone vulv- https://threatpost.com/iphones-attack-turned-off/179641/
Hi, I’m Paul Torgersen. It’s Tuesday May 17th, 2022, and this is a look at the information security news from overnight.
From BleepingComputer.com:
Apple has released security updates to address a zero-day vulnerability that threat actors can exploit in attacks targeting Macs and Apple Watches. The flaw is an out-of-bounds write issue in the AppleAVD, the kernel extension for audio and video decoding. Apple says it is likely this has already been exploited in the wild.
From Infosecurity-magazine.com:
US manufacturer Parker-Hannifin has announced a data breach exposing employees’ PII after being the target of a Conti ransomware attack. The company said that an unauthorized third party gained access to its IT systems between 11 and 14 of March this year. On the plus side, if you‘re information was involved, you just got two free years of identity theft monitoring.
From BleepingComputer.com:
Security researchers at the NCC Group have developed a tool to carry out a Bluetooth Low Energy relay attack that bypasses all existing protections to authenticate on target devices. What target devices, you ask? Teslas. Details in the article.
From ZDNet.com:
The FBI put out a warning that someone is scraping credit card data from the checkout pages of US businesses' websites. The bad actor is injecting malicious PHP Hypertext Preprocessor code into the business' online checkout page and sending the scraped data to a server that spoofed a legitimate card processing server. They also left a backdoor into the victims system.
And last today, from ThreatPost.com
Because of how Apple implements standalone wireless features such as Bluetooth, Near Field Communication and Ultra-wideband technologies, researchers have found that iPhones are vulnerable to malware loading attacks even when the device is turned off. The root cause of the issue is how iPhones implement low power mode for wireless chips. No comment yet from Apple, but there is a link to the research report in the article.
That’s all for me today. Remember to LIKE and SUBSCRIBE. And as always, until next time, be safe out there.
A daily look at the relevant information security news from overnight.
Episode 237 - 12 May 2022
Eurovision saved - https://www.reuters.com/world/europe/italian-police-prevents-pro-russian-hacker-attacks-during-eurovision-contest-2022-05-15/
SonicWall crack -
https://www.bleepingcomputer.com/news/security/sonicwall-strongly-urges-admins-to-patch-sslvpn-sma1000-bugs/
Multi phish - https://www.zdnet.com/article/this-phishing-attack-delivers-three-forms-of-malware-and-they-all-want-to-steal-your-data/
Pixelmon phony - https://www.bleepingcomputer.com/news/security/fake-pixelmon-nft-site-infects-you-with-password-stealing-malware
sysrv botnet- https://www.zdnet.com/article/microsoft-warns-this-botnet-has-new-tricks-to-target-linux-and-windows-systems/
Hi, I’m Paul Torgersen. It’s Monday May 16th, 2022, and this is a look at the information security news from overnight.
From Reuters.com:
Italian police thwarted hacker attacks by pro-Russian groups that were trying to change the results in the Eurovision Song Contest. Ukraine's Kalush Orchestra won the contest with their entry "Stefania". Evidently Vladimer didn’t think too highly of that.
From BleepingComputer.com:
SonicWall is strongly urging customers to patch several high-risk security flaws impacting its Secure Mobile Access 1000 Series line of products. The vulnerability can let attackers bypass authorization and compromise unpatched appliances. The company says there is no evidence of this yet being exploited in the wild, and that there are no temporary mitigations. Get your patch on kids.
From ZDNet.com:
A new phishing campaign has been spotted targeting Microsoft Windows users. This little over-achiever delivers three different forms of malware, AveMariaRAT, BitRAT and the PandoraHVNC trojan malware. BitRAT is particularly nasty, as it can take full control of infected Windows systems, including the ability to view through the webcam and listen through the microphone
From BleepingComputer.com:
A fake Pixelmon NFT site entices fans with free tokens and collectibles, but what they really get is a chunk of malware that steals their crypto wallets. They’ve done a credible job of replicating the actual website, but use a .pw url instead of the actual .club. Details in the article.
And last today, from ZDNet.com
Microsoft has warned that a new variant of the Sysrv botnet is targeting a critical flaw in the Spring Framework to install crypto miners on Linux and Windows systems. The flaw being exploited affects VMware's Spring Cloud Gateway and Oracle's Communications Cloud Native Core Network Exposure Function. It was given a critical rating by both firms.
That’s all for me today. Remember to LIKE and SUBSCRIBE. And as always, until next time, be safe out there.
A daily look at the relevant information security news from overnight.
Episode 238 - 13 May 2022
REvil killer - https://portswigger.net/daily-swig/researcher-stops-revil-ransomware-in-its-tracks-with-dll-hijacking-exploit
Tricky phish -
https://www.bleepingcomputer.com/news/security/iranian-hackers-exposed-in-a-highly-targeted-espionage-campaign/
Zyxel flaw - https://www.securityweek.com/critical-vulnerability-allows-remote-hacking-zyxel-firewalls
InHand out of hand - https://www.securityweek.com/critical-vulnerabilities-provide-root-access-inhand-industrial-routers
Top Aces locked- https://therecord.media/top-aces-ransomware-attack-lockbit/
Hi, I’m Paul Torgersen. It’s Friday the 13th of May, 2022, and this is a look at the information security news from overnight.
From PortSwigger.net:
John Page at Malvuln.com has discovered a vulnerability in the REvil ransomware that can be exploited to deactivate the malware before it encrypts any files. REvil searches for and executes DLLs in the directory where it is located. By hijacking a vulnerable DLL and executing specially crafted code, he was able to stop and terminate REvil before it started encrypting. Details, including a proof of concept, in the article.
From BleepingComputer.com:
Threat analysts have spotted a novel attack attributed to the Iranian hacking group APT34 or Oilrig, targeting Jordanian diplomats with custom-crafted tools. The spear-phishing email has an Excel attachment that contains VBA macro code to load a malicious executable, a configuration file, and a signed and clean DLL. It also checks for the existence of a mouse, which if you are playing in a sandbox, may not be there.
From SecurityWeek.com:
Thousands of Zyxel firewalls could be vulnerable to remote attacks which affect ATP, VPN and USG FLEX series firewalls. The vulnerability can be exploited by a remote, unauthenticated attacker for arbitrary code execution as the “nobody” user. The company has already released a fix. Details in the article.
Also from SecurityWeek.com:
A total of 17 vulnerabilities have been found in the InHand Networks wireless industrial routers which could be exploited to gain root access. The weaknesses affect IR302 version 3.5.37 and prior. If that is you, make sure to update to version 3.5.45. Get your patch on kids.
And last today, from TheRecord.media:
Top Aces, a Canadian company that supplies fighter jets for airborne training exercises has been hit with a ransomware attack. The company works extensively with the armed forces of Canada, Germany, United States, Israel and others. The LockBit ransomware group gave Top Aces a deadline of May 15 before it leaks the 44GB of data it allegedly stole.
That’s all for me today. Remember to LIKE and SUBSCRIBE. And as always, until next time, be safe out there.
A daily look at the relevant information security news from overnight.
Episode 237 - 12 May 2022
HP broken BIOS - https://www.bleepingcomputer.com/news/security/hp-fixes-bug-letting-attackers-overwrite-firmware-in-over-200-models/
New Nerbian -
https://threatpost.com/nerbian-rat-advanced-trick/179600/
Bitter at Bangladesh - https://www.bleepingcomputer.com/news/security/bitter-cyberspies-target-south-asian-govts-with-new-malware/
Fake Vanity - https://portswigger.net/daily-swig/box-zoom-google-docs-offer-phishing-boost-with-vanity-url-flaws
Konica cure- https://www.securityweek.com/konica-minolta-printers-vulnerable-hacking-physical-access
Hi, I’m Paul Torgersen. It’s Thursday May 12th, 2022, and this is a look at the information security news from overnight.
From BleepingComputer.com:
HP has released BIOS updates to fix two 8.8 severity vulnerabilities that would allow code to run with Kernel privileges, and affects over 200 PC and notebook products. The problem appears to be that an SMI handler can be triggered from the OS environment. You can see the details and a couple important links in the article.
From ThreatPost.com:
A newly discovered and complex remote access trojan dubbed Nerbian RAT, is spreading via malicious email campaigns using COVID-19 as a lure. This multi-feature baddie, including the ability to evade analysis or detection by researchers. The majority of the attacks have been centered in Spain and the United Kingdom.
From BleepingComputer.com:
APT cyberespionage group Bitter has been found targeting the government of Bangladesh with a new malware with remote file execution capabilities. These messages are sent via spoofed email addresses that appear to come from Pakistani government organizations. This was likely possible by exploiting a flaw in the Zimbra mail server that allows attackers to send messages from a non-existent mail domain. Full details from the Talos research in the article.
From PortSwigger.net:
Threat actors are enhancing their phishing campaigns by exploiting a failure to validate subdomains within so-called ‘vanity URLs’ used in SaaS applications. Apps such as Box, Zoom, and Google Docs validate vanity URLs’ URI (the unique sequence of characters at the end of the link), but not its descriptive subdomain, which is the portion preceding the URI.
And last today, from SecurityWeek.com:
Hundreds of thousands of Konica printers are vulnerable to hacking via physical access. The vendor produced firmware and operating system patches in early 2020, but details are only being disclosed now because in many cases the patches need to be manually installed by a service technician. That was a bit tough in the midst of the Covid shutdowns.
That’s all for me today. Remember to LIKE and SUBSCRIBE. And as always, until next time, be safe out there.
A daily look at the relevant information security news from overnight.
Episode 236 - 11 May 2022
Windows zero-days patched - https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-new-ntlm-relay-zero-day-in-all-windows-versions/
Intel bad memory -
https://threatpost.com/intel-memory-bug-poses-risk-for-hundreds-of-products/179595/
Siemens and Schneider patches - https://www.securityweek.com/ics-patch-tuesday-siemens-schneider-electric-address-43-vulnerabilities
IceApple bites - https://www.bleepingcomputer.com/news/security/new-iceapple-exploit-toolset-deployed-on-microsoft-exchange-servers/
Adobe patches -
https://www.securityweek.com/adobe-warns-critical-security-flaws-enterprise-products
@ phishing- https://threatpost.com/novel-phishing-trick-uses-weird-links-to-bypass-spam-filters/179587/
Hi, I’m Paul Torgersen. It’s Wednesday May 11th, 2022, and this is a look at the information security news from overnight.
From BleepingComputer.com:
Microsoft has patched 75 flaws on Mays’ Patch Tuesday including an actively exploited Windows LSA spoofing zero-day that attackers can exploit remotely to force domain controllers to authenticate them via the Windows NT LAN Manager. This particular bug affects all Windows versions from Windows 7 and Windows Server 2008 through Windows 11 and Windows 2022. Two other zero-days were also addressed in the update.
From ThreatPost.com:
Intel is reporting a memory bug impacting microprocessor firmware used in hundreds of products. The vulnerability resides inside some of the Intel Optane SSD and Intel Optane Data Center products, which allows privilege escalation, denial of service, or information disclosure. Details in the article.
From SecurityWeek.com:
Schneider Electric has released three advisories to inform customers about eight vulnerabilities, and Siemens has released 12 advisories covering 35 vulnerabilities, including one with a critical severity rating. Details and links to the advisory statements in the article.
From BleepingComputer.com:
CrowdStrike researchers have found a new post-exploitation framework that they dubbed IceApple, deployed mainly on Microsoft Exchange servers across a wide geography. This stealthy little framework is .NET-based and comes with at least 18 modules, each for a specific task, that help the attacker discover relevant machines on the network, steal credentials, delete files and directories, or exfiltrate data. Details and a link to download the CrowdStrike report in the article.
From SecurityWeek.com:
Adobe used this Patch Tuesday to cover at least 18 serious security defects in multiple enterprise-facing products and warned that unpatched systems are at risk of remote code execution attacks. Link to the advisory in the article, and in what has become a bit of a theme today, get your patch on kids.
And last today, from ThreatPost.com:
Researchers have identified a never-before-seen method for sneaking malicious links into phishing emails. The trick takes advantage of a key difference in how email inboxes and browsers read URLs. Specifically, using an “@” symbol in the middle of the string. Most browsers will either interpret this as authentication information, or simply ignore it and execute whatever follows the symbol. Read about all the dirty tricks in the article.
That’s all for me today. Remember to LIKE and SUBSCRIBE. And as always, until next time, be safe out there.
A daily look at the relevant information security news from overnight.
Episode 235 - 07 May 2022
Putin pwned - https://www.bleepingcomputer.com/news/security/hackers-display-blood-is-on-your-hands-on-russian-tv-take-down-rutube/
EU Points finger -
https://www.securityweek.com/eu-blames-russia-satellite-hack-ahead-ukraine-invasion
Chemical phish - https://www.bleepingcomputer.com/news/security/ukraine-warns-of-chemical-attack-phishing-pushing-stealer-malware/
Azure RCE - https://www.bleepingcomputer.com/news/security/microsoft-releases-fixes-for-azure-flaw-allowing-rce-attacks/
NCF counter attack- https://www.zdnet.com/article/government-hackers-made-hundreds-of-thousands-of-stolen-credit-cards-worthless-to-crooks/
Hi, I’m Paul Torgersen. It’s Tuesday May 10th, 2022, and this is a look at the information security news from overnight.
From BleepingComputer.com:
While Russian President Vladimir Putin was giving his "Victory Day" speech, pro-Ukrainian hacking groups defaced the online Russian TV schedule page to display anti-war messages. The name of every programme was changed to "On your hands is the blood of thousands of Ukrainians and their hundreds of murdered children. TV and the authorities are lying. No to war” At the same time, a cyberattack took down the Russian video sharing site RuTube. More details in the link.
From SecurityWeek.com:
The European Union this week accused Russian authorities of carrying out a cyberattack against a satellite network an hour before they invaded Ukraine. The target was the KA-SAT network operated by Viasat. This is significant as it marks the first time the EU has ever formally accused Russia of carrying out a cyber attack.
From BleepingComputer.com:
Ukraine's Computer Emergency Response Team is warning of the mass phishing campaign distributing the Jester Stealer malware. The emails warn of impending chemical attacks to scare recipients into opening the XLS attachments, which are of course laced with malicious macros. Additional details in the article.
Also from BleepingComputer.com:
Microsoft has released updates to address a security flaw affecting Azure Synapse and Azure Data Factory pipelines that could allow remote code execution across the Integration Runtime infrastructure. The vulnerability was found in the third-party ODBC data connector used to connect to Amazon Redshift, in Integration Runtime, in Azure Synapse Pipelines, and Azure Data Factory. Details and a link to the security advisory in the article.
And last today, from ZDNet.com:
From the One for the Good Guys file. Britain's National Cyber Force, which is a joint effort using the combined resources of the GCHQ and the Ministry of Defence, took direct action against computer networks used by cyber criminals, and made hundreds of thousands of stolen credit cards, worthless to the crooks that stole them. Well done you.
That’s all for me today. Remember to LIKE and SUBSCRIBE. And as always, until next time, be safe out there.
Episode 235 - 07 May 2022
IKEA breach - https://www.infosecurity-magazine.com/news/data-breach-ikea-canada/
Agco attack -
https://www.securityweek.com/ransomware-attack-hits-production-facilities-agricultural-equipment-giant-agco
DCRat upgrade - https://www.zdnet.com/article/beware-this-cheap-and-homemade-malware-is-surprisingly-effective/
Trend Micro miss - https://www.bleepingcomputer.com/news/security/trend-micro-antivirus-modified-windows-registry-by-mistake-how-to-fix/
BIG-IP PoC- https://portswigger.net/daily-swig/big-ip-proof-of-concept-released-for-rce-vulnerability-in-f5-network-management-tool
Hi, I’m Paul Torgersen. It’s Monday May 9th, 2022, and this is a look at the information security news from overnight.
From Infosecurity-Magazine.com:
IKEA has notified the Canadian government about a data breach involving the personal information of about 95,000 customers. The company said that no financial or banking information was involved. How and why the data got out is not known. IKEA says there is no action required by their customers at this time.
From SecurityWeek.com:
Agco announced that it has been the victim of a ransomware attack that impacted some of its production facilities. The company has launched an investigation but says it will be at least several days before they can repair their systems and return operations to normal. No word yet on the threat actor or the malware strain involved.
From ZDNet.com:
The DCRat backdoor malware has been redesigned and relaunched, and it is quite the little Swiss Army knife. It can steal a variety of information, take screenshots, clipboard contents, even has a keylogger. But the two really amazing things? This baby was developed and maintained by one person, not a big syndicate. And you can buy it on the dark web for about $5 bucks.
From BleepingComputer.com:
Trend Micro antivirus has fixed a false positive affecting its Apex One endpoint security solution that caused Microsoft Edge updates to be tagged as malware and the Windows registry to be incorrectly modified. Trend Micro says they have updated the pattern to alleviate the problem, and also published a work around in case the pattern fix didn’t. Details in the article.
And last today, from PortSwigger.net:
We talked last week about the critical vulnerability in F5’s BIG-IP networking software. Well, now a proof-of-concept has been released. If you are one of the more than 35,000 companies using this network management software, get your updates taken care of. And App developers using BIG-IP services should immediately take steps to mitigate the vulnerability until the patch is installed.
That’s all for me today. Remember to LIKE and SUBSCRIBE. And as always, until next time, be safe out there.
A daily look at the relevant information security news from overnight.
Episode 234 - 06 May 2022
Thumbs suck - https://threatpost.com/usb-malware-targets-windows-installer/179521/
New NetDooka -
https://www.bleepingcomputer.com/news/security/new-netdooka-malware-spreads-via-poisoned-search-results/
CT swipe - https://portswigger.net/daily-swig/wordpress-sites-getting-hacked-within-seconds-of-tls-certificates-being-issued
Android updates - https://www.bleepingcomputer.com/news/security/google-fixes-actively-exploited-android-kernel-vulnerability/
And. And. It’s gone- https://www.zdnet.com/article/weird-bug-made-google-docs-crash-if-you-typed-one-word-five-times/
Hi, I’m Paul Torgersen. It’s Friday May 6th, 2022, and this is a look at the information security news from overnight.
From ThreatPost.com:
A new wormable malware called Raspberry Robin has been active since this past September and is delivered onto Windows machines through USB drives. Do people still do that? Remember when you used to go to a conference, and vendors would hand out thumb drives? Then people would go home and actually stick them into their computer? Don’t do that. There is more information in the article, but the answer is: don’t do that.
From BleepingComputer.com:
A new malware framework known as NetDooka has been discovered being distributed through the PrivateLoader pay-per-install malware distribution service. The framework features a loader, a dropper, a protection driver, and a powerful RAT component that relies on a custom network communication protocol. Researchers at TrendMicro warn that, while the tool is still in an early development phase, it is already very capable. Link to the research in the article.
From PortSwigger.com:
Attackers are abusing the Certificate Transparency system to compromise new WordPress sites in the brief window after web admins upload the WordPress files, but before they manage to secure the website with a password. Hackers are evidently monitoring the CT logs because sites are being hacked within minutes, sometimes seconds, of TLS certificates being requested. You know where to find the details.
From BleepingComputer.com:
Google has released the second part of their May security patch for Android, including a fix for an actively exploited Linux kernel vulnerability. Do note that if you are using Android 9 or older, this patch does not apply to you and you really should upgrade to a more recent Android OS. Also, if you have a Google Pixel, you have some additional patching to do. Get your patch on kids.
And last today, from ZDNet.com:
An obscure bug is making Google Docs crash after users typed in a simple, repeated word pattern. If you type the word and, with a capital A, and a period and space after it, five times in a row, it would crash your doc. And any attempts to reopen the doc would retrigger the crash. And “and” isn’t the only word that triggers this, but not ALL words trigger it. It appears that Google has now fixed the bug, but, but, but but, but beware.
That’s all for me today. Remember to LIKE and SUBSCRIBE. And as always, until next time, be safe out there.
A daily look at the relevant information security news from overnight.
Episode 233 - 055 May 2022
Cyberpunk Ape caper - https://www.bleepingcomputer.com/news/security/pixiv-deviantart-artists-hit-by-nft-job-offers-pushing-malware/
Windows log trojan -
https://www.securityweek.com/kaspersky-warns-fileless-malware-hidden-windows-event-logs
F5 RCE bug - https://threatpost.com/f5-critical-bugbig-ip-systems/179514/
More Cisco bugs - https://www.zdnet.com/article/vm-escape-and-root-access-bugs-fixed-in-cisco-nfv-infrastructure-software/
NHS phish- https://www.bleepingcomputer.com/news/security/attackers-hijack-uk-nhs-email-accounts-to-steal-microsoft-logins/
A daily look at the relevant information security news from overnight.
Episode 232 - 04 May 2022
Sixt sacked - https://www.securityweek.com/cyberattack-causes-disruptions-car-rental-giant-sixt
Twitter phish -
https://www.bleepingcomputer.com/news/security/new-phishing-warns-your-verified-twitter-account-may-be-at-risk/
ERP Spyder - https://www.zdnet.com/article/chinese-hackers-use-rarely-seen-windows-mechanism-abuse-in-campaign-undetected-for-years/
Chrome zero two - https://www.bollyinside.com/news/problems-with-google-a-chrome-update-has-been-released-to-address-a-rare-zero-day-vulnerability
Avaya Aruba a warning- https://www.theregister.com/2022/05/03/aruba_avaya_critical_vulns/?td=rt-3a
A daily look at the relevant information security news from overnight.
Episode 231 - 03 May 2022
Exchange exfil - https://www.bleepingcomputer.com/news/security/cyberspies-use-ip-cameras-to-deploy-backdoors-steal-exchange-emails/
uClibc needs uHelp -
https://www.securityweek.com/many-iot-devices-exposed-attacks-due-unpatched-flaw-uclibc-library
STMP sidestep - https://www.bleepingcomputer.com/news/security/google-smtp-relay-service-abused-for-sending-phishing-emails/
Kellogg Community Closed - https://www.battlecreekenquirer.com/story/news/2022/05/02/ransomware-attack-forces-kcc-cancel-classes-indefinitely/9612941002/
Moshen Dragon rears up- https://www.bleepingcomputer.com/news/security/chinese-cyber-espionage-group-moshen-dragon-targets-asian-telcos/
A daily look at the relevant information security news from overnight.
Episode 230 - 02 May 2022
Windows fake - https://www.bleepingcomputer.com/news/security/fake-windows-10-updates-infect-you-with-magniber-ransomware/
Massy miss -
https://www.guardian.co.tt/news/massy-stores-stalled-nationwide-by-cyber-attack-6.2.1486196.cb45ff1644
Mental Un-health - https://www.zdnet.com/article/mozilla-finds-mental-health-apps-fail-spectacularly-at-user-data-security/
Azure flex - https://www.scmagazine.com/news/cloud-security/microsoft-fixes-vulnerability-in-azure-database-for-postgresql-flexible-server
ARcare snare- https://portswigger.net/daily-swig/data-breach-at-us-healthcare-provider-arcare-impacts-345-000-individuals
A daily look at the relevant information security news from overnight.
Episode 229 - 29 April 2022
REvil revived - https://www.techtarget.com/searchsecurity/news/252516434/REvil-ransomware-attacks-resume-but-operators-are-unknown
Synology warning -
https://www.bleepingcomputer.com/news/security/synology-warns-of-critical-netatalk-bugs-in-multiple-products/
Phishing RedLine - https://www.zdnet.com/article/this-phishing-campaign-delivers-malware-that-steals-your-passwords-and-chat-logs/
Dos Ukraine - https://www.bleepingcomputer.com/news/security/ukraine-targeted-by-ddos-attacks-from-compromised-wordpress-sites/
Three Frogs- https://threatpost.com/apt-id-3-separate-actors/179435/
A daily look at the relevant information security news from overnight.
Episode 228 - 28 April 2022
Bumblebee sting - https://www.bleepingcomputer.com/news/security/new-bumblebee-malware-takes-over-bazarloaders-ransomware-delivery/
Russian attacks -
https://www.zdnet.com/article/microsoft-russia-has-launched-hundreds-of-cyberattacks-against-ukraine/
QNAP snap - https://www.bleepingcomputer.com/news/security/qnap-warns-users-to-disable-afp-until-it-fixes-critical-bugs/
GitHUb flub - https://threatpost.com/github-repos-stolen-oauth-tokens/179427/
Journalists phished -
https://threatpost.com/hackers-target-journalists-goldbackdoor/179389/
Black Basta rises- https://www.bleepingcomputer.com/news/security/new-black-basta-ransomware-springs-into-action-with-a-dozen-breaches/
A daily look at the relevant information security news from overnight.
Episode 227 - 27 April 2022
ADA drilled - https://www.bleepingcomputer.com/news/security/american-dental-association-hit-by-new-black-basta-ransomware/
Hotel hit -
https://yle.fi/news/3-12417602
Yuma hack - https://kyma.com/news/2022/04/25/yrmc-faces-potential-cyber-attack/
North Dakota news - https://www.kvrr.com/2022/04/25/north-dakota-company-hit-by-cyber-attack-more-than-500000-affected/
Journalists phished -
https://threatpost.com/hackers-target-journalists-goldbackdoor/179389/
Coke Storm - https://www.securityweek.com/coca-cola-investigating-hack-claims-made-pro-russia-group
Emotet again, Hospital hit, Bad Cat, and more.
A daily look at the relevant information security news from overnight.
Episode 226 - 26 April 2022
Emotet, again - https://www.zdnet.com/article/the-emotet-botnet-is-back-and-it-has-some-new-tricks-to-spread-malware/
Hospital hit - https://www.bleepingcomputer.com/news/security/french-hospital-group-disconnects-internet-after-hackers-steal-data/
Big patch batch - https://www.inferse.com/62708/microsoft-april-2022-update-patches-two-zero-day-flaws-117-hacks-forbes/
VM-be-ware - https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-vmware-rce-flaw-to-install-backdoors/
Bad Cat - https://www.scmagazine.com/analysis/ransomware/error-in-alphv-blackcat-ransomware-code-may-offer-some-linux-users-a-shiel
A daily look at the relevant information security news from overnight.
Episode 225 - 31 December 2019
Not so Special - https://www.bleepingcomputer.com/news/security/special-olympics-new-york-hacked-to-send-phishing-emails/
Heritage ransomed - https://www.scmagazine.com/home/security-news/ransomware/ransomware-shuts-down-the-heritage-company/
Chrome SQL patch - https://threatpost.com/google-chrome-affected-by-magellan-2-0-flaws/151446/
Blue Bear breach - https://www.scmagazine.com/home/security-news/data-breach/school-software-vendor-active-network-suffers-data-breach/
Microsoft hits Thallium - https://www.zdnet.com/article/microsoft-takes-down-50-domains-operated-by-north-korean-hackers/
A daily look at the relevant information security news from overnight.
Episode 224 - 30 December 2019
FIN7 BIOLOAD - https://www.bleepingcomputer.com/news/security/fin7-hackers-bioload-malware-drops-fresher-carbanak-backdoor/
Not so Wyze - https://www.zdnet.com/article/iot-vendor-wyze-confirms-server-leak/
Moss Adams mess - https://www.scmagazine.com/home/security-news/data-breach/names-social-security-numbers-exposed-in-moss-adams-breach/
Ryuk hits port - https://www.bleepingcomputer.com/news/security/us-coast-guard-says-ryuk-ransomware-took-down-maritime-facility/
Making a Ruckus - https://techcrunch.com/2019/12/28/ruckus-wireless-routers-flaws/
A daily look at the relevant information security news from overnight.
Episode 222 - 23 December 2019
Huge citrix risk - https://www.technadu.com/citrix-vulnerability-80000-companies-around-the-world-at-risk/88242/
Greta gangsters - https://threatpost.com/greta-thunberg-emotet-person-of-the-year/151351/
Mozi on in - https://www.bleepingcomputer.com/news/security/new-mozi-p2p-botnet-takes-over-netgear-d-link-huawei-routers/
Twitter tweak - https://www.zdnet.com/article/twitter-to-android-users-weve-just-patched-this-nasty-bug-so-update-your-app-asap/
ToTok is terrible - https://www.technadu.com/apple-google-remove-totok-spying-allegations/88179/
A daily look at the relevant information security news from overnight.
Episode 222 - 23 December 2019
Wawa whacked - https://www.scmagazine.com/home/security-news/data-breach/wawa-pos-system-compromised-for-10-months-cybersecurity-pros-weigh-in/
Facebook user cache - https://threatpost.com/267m-facebook-phone-numbers-exposed-online/151327/
Android malvertisers - https://www.cyberscoop.com/play-store-adware-white-ops/
Olympic phishing - https://www.bleepingcomputer.com/news/security/tokyo-2020-staff-warns-of-phishing-disguised-as-official-emails/
Ring roster - https://www.zdnet.com/article/hackers-keep-dumping-ring-credentials-online-for-the-giggles/
A daily look at the relevant information security news from overnight.
Episode 221 - 20 December 2019
Hornet’s nest stings - https://www.zdnet.com/article/this-grab-bag-hacking-attack-drops-six-different-types-of-malware-in-one-go/
Connect(un)Wise - https://www.bleepingcomputer.com/news/security/screenconnect-msp-software-used-to-install-zeppelin-ransomware/
Honda exposure - https://www.technadu.com/honda-exposes-976-million-records-containing-pii-vehicle-owners/87906/
DLL hijack fixed - https://www.bleepingcomputer.com/news/software/adwcleaner-801-fixes-dll-hijacking-vulnerability/
Emotet hits Germany - https://www.zdnet.com/article/frankfurt-shuts-down-it-network-following-emotet-infection/
A daily look at the relevant information security news from overnight.
Episode 220 - 19 December 2019
Another blackmail ransom - https://www.zdnet.com/article/another-ransomware-strain-is-now-stealing-data-before-encrypting-it/
Data lost and found - https://www.androidpolice.com/2019/12/17/google-fixes-chrome-bug-that-broke-local-storage-for-some-web-and-android-apps-no-data-is-lost/
Dumb smart tracker - https://techcrunch.com/2019/12/18/cloud-flaws-millions-child-watch-trackers/
More cities ransomed - https://www.scmagazine.com/home/security-news/ransomware/galt-st-lucie-police-hit-with-ransomware/
Beware free wifi - https://www.zdnet.com/article/fbi-warns-against-using-free-wifi-networks-while-traveling/
A daily look at the relevant information security news from overnight.
Episode 219 - 18 December 2019
Botnet gains Momentum - https://www.scmagazine.com/home/security-news/malware/momentum-botnet-spotted-in-the-wild/
Lazarus Dacls trojan - https://www.zdnet.com/article/lazarus-pivots-to-linux-attacks-through-dacls-trojan/
Intel RST patch - https://www.bleepingcomputer.com/news/security/update-intels-rapid-storage-app-to-fix-bug-letting-malware-evade-av/
ACER, ASUS oops - https://www.securityweek.com/privilege-escalation-flaws-found-preinstalled-acer-asus-software
Dudell Asian attack - https://www.bleepingcomputer.com/news/security/chinese-rancor-apt-refreshes-malware-kit-for-espionage-attacks/
A daily look at the relevant information security news from overnight.
Episode 218 - 17 December 2019
TP-Link Archer flaw - https://www.bleepingcomputer.com/news/security/tp-link-router-bug-lets-attackers-login-without-passwords/
Firefox forces 2FA - https://www.zdnet.com/article/mozilla-to-force-all-add-on-devs-to-use-2fa-to-prevent-supply-chain-attacks/
Conor leaks - https://www.zdnet.com/article/south-african-it-firm-conor-behind-the-leak-of-1-million-web-browsing-records/
LightInTheBox loses data - https://www.scmagazine.com/home/security-news/data-breach/1-6-billion-lightinthebox-customer-records-left-exposed/
Ugly sweater Emotet - https://www.bleepingcomputer.com/news/security/emotet-trojan-is-inviting-you-to-a-malicious-christmas-party/
A daily look at the relevant information security news from overnight.
Episode 217 - 16 December 2019
WordPress vulnerability - https://threatpost.com/critical-bug-in-wordpress-plugins-open-sites-to-hacker-takeovers/151123/
Visa warning - https://www.scmagazine.com/home/retail/visa-warns-against-new-pos-attacks-fin8-fingered-as-the-culprit/
Rooster Teeth breached - https://www.bleepingcomputer.com/news/security/attackers-steal-credit-cards-in-rooster-teeth-data-breach/
Facebook leak - https://www.theregister.co.uk/2019/12/13/facebook_data_loss/
New Orleans ransom - https://www.zdnet.com/article/new-orleans-hit-by-ransomware-city-employees-told-to-turn-off-computers/
A daily look at the relevant information security news from overnight.
Episode 216 - 13 December 2019
EchoBot widens attack - https://www.bleepingcomputer.com/news/security/new-echobot-variant-exploits-77-remote-code-execution-flaws/
Process hollowing trick - https://www.zdnet.com/article/monero-miners-can-lurk-undetected-through-new-process-hollowing-technique/
Siemens power plant bugs - https://threatpost.com/critical-remote-code-execution-global-power-plants/151087/
Smishing smasher - https://www.zdnet.com/article/google-rolls-out-verified-sms-and-spam-protection-in-android/
Ransom / blackmail - https://www.bleepingcomputer.com/news/security/another-ransomware-will-now-publish-victims-data-if-not-paid/
A daily look at the relevant information security news from overnight.
Episode 215 - 12 December 2019
Zeppelin attack - https://www.zdnet.com/article/this-new-ransomware-is-targeting-health-and-tech-companies-across-europe-and-north-america/
iKrampus - https://threatpost.com/krampus-3pc-malware-iphone-users/151043/
Lazarus rents TrickBot - https://www.zdnet.com/article/trickbot-gang-is-now-a-malware-supplier-for-north-korean-hackers/
Turkey card sale - https://www.bleepingcomputer.com/news/security/batch-of-460-000-payment-cards-sold-on-black-market-forum/
KeyWe (un)smart lock - https://www.theregister.co.uk/2019/12/11/f_secure_keywe/
A daily look at the relevant information security news from overnight.
Episode 214 - 11 December 2019
OAuth phishing - https://www.bleepingcomputer.com/news/security/phishing-attack-hijacks-office-365-accounts-using-oauth-apps/
SGX vs PlunderVolt - https://www.zdnet.com/article/new-plundervolt-attack-impacts-intel-cpus/
Don’t Blink - https://threatpost.com/amazon-blink-smart-camera-flaws/150962/
AirDoS patch - https://techcrunch.com/2019/12/10/ios-airdrop-lock-up-iphones/
WIndows zero-day patch - https://www.zdnet.com/article/microsoft-december-2019-patch-tuesday-plugs-windows-zero-day/
Adobe critical patches - https://threatpost.com/adobe-fixes-critical-acrobat-photoshop-brackets-flaws/150970/
A daily look at the relevant information security news from overnight.
Episode 213 - 10 December 2019
Ryuk flaw - https://www.zdnet.com/article/ryuk-ransomware-contains-a-bug-causing-data-loss-for-some-victims/
Snatch trick - https://www.bleepingcomputer.com/news/security/snatch-ransomware-reboots-to-windows-safe-mode-to-bypass-av-tools/
iPR nightmare - https://threatpost.com/ge-dunkin-forever21-internal-doc-leak/150920/
Birth to death exposed - https://techcrunch.com/2019/12/09/birth-certificate-applications-exposed/
Pensacola attack - https://www.scmagazine.com/home/security-news/pensacola-hit-with-cyberattack-hours-after-shooting-at-naval-base/
A daily look at the relevant information security news from overnight.
Episode 212 - 09 December 2019
Car makers targeted - https://www.zdnet.com/article/bmw-and-hyundai-hacked-by-vietnamese-hackers-report-claims/
Info stealing VPN - https://www.bleepingcomputer.com/news/security/fake-vpn-site-pushes-cryptbot-and-vidar-info-stealing-trojans/
Facebook sues - https://www.scmagazine.com/home/security-news/legal-security-news/company-sued-for-allegedly-hijacking-facebook-accounts-to-serve-ads/
NVIDIA patches - https://www.bleepingcomputer.com/news/security/nvidia-patches-severe-flaws-in-mercedes-infotainment-system-chips/
MacOS trojan - https://threatpost.com/stealthy-macos-malware-lazarus-apt/150881/
A daily look at the relevant information security news from overnight.
Episode 211 - 06 December 2019
VPN hijack - https://www.bleepingcomputer.com/news/security/new-linux-vulnerability-lets-attackers-hijack-vpn-connections/
CyrusOne ransomed - https://www.zdnet.com/article/ransomware-attack-hits-major-us-data-center-provider/
HackerOne pays bounty - https://www.scmagazine.com/home/security-news/vulnerabilities/cookie-leak-allows-white-hat-researcher-to-access-hackerone-vulnerability-reports/
OpenBSD quick patch - https://www.zdnet.com/article/openbsd-patches-severe-authentication-bypass-privilege-escalation-vulnerabilities/
VC BEC SOL - https://www.theregister.co.uk/2019/12/05/vcs_tricked_mitm/
A daily look at the relevant information security news from overnight.
Episode 210 - 05 December 2019
Buer a best buy - https://threatpost.com/buer-loader-underground-markets/150807/
Sprint slip - https://techcrunch.com/2019/12/04/sprint-contractor-cell-phone-bills-exposed/
Salesforce skimmers - https://www.bleepingcomputer.com/news/security/salesforce-s-heroku-used-to-host-magecart-skimmers-stolen-cards/
Python pirates - https://www.zdnet.com/article/two-malicious-python-libraries-removed-from-pypi/
Sweaty Betty sweatin’ - https://www.bleepingcomputer.com/news/security/uk-retailer-sweaty-betty-hacked-to-steal-customer-payment-info/
A daily look at the relevant information security news from overnight.
Episode 209 - 04 December 2019
MageCart shoots - https://www.scmagazine.com/web-services-security-e-commerce-security/magecart-skimmer-group-guns-for-smith-wessons-black-friday-sales/
No ‘Droid perma-DoS - https://threatpost.com/google-critical-android-permanent-dos-flaw/150764/
Extensions snipped - https://www.bleepingcomputer.com/news/software/avast-and-avg-firefox-extensions-pulled-from-mozilla-addons-site/
Bad chat - https://www.zdnet.com/article/this-new-android-malware-comes-disguised-as-a-chat-app/
FTC fake - https://www.bleepingcomputer.com/news/security/ftc-warns-of-ongoing-scam-spreading-scary-terrorism-allegations/
A daily look at the relevant information security news from overnight.
Episode 208 - 03 December 2019
PyXie dusted - https://www.zdnet.com/article/this-trojan-malware-is-being-used-to-steal-passwords-and-spread-ransomware/
Azure (N)OAuth - https://threatpost.com/microsoft-oauth-flaw-azure-takeover/150737/
Cookie monster - https://www.bleepingcomputer.com/news/security/facebook-ads-manager-targeted-by-new-info-stealing-trojan/
TrueDialog insecure - https://threatpost.com/insecure-database-exposes-millions-of-private-sms-messages/150706/
StrandHogg gone wild - https://www.zdnet.com/article/android-new-strandhogg-vulnerability-is-being-exploited-in-the-wild/
A daily look at the relevant information security news from overnight.
Episode 207 - 02 December 2019
All Steamed up - https://www.bleepingcomputer.com/news/security/fake-steam-skin-giveaway-site-steals-your-login-credentials/
Mixcloud mess - https://techcrunch.com/2019/11/29/mixcloud-data-breach/
Datrix fast phish - https://www.theregister.co.uk/2019/11/28/datrix_phishing_attack/
Oyster shucked - https://www.zdnet.com/article/got-an-oyster-card-tfl-just-locked-your-account-to-make-you-reset-your-password/
Mongo CStealer - https://www.bleepingcomputer.com/news/security/new-chrome-password-stealer-sends-stolen-data-to-a-mongodb-database/
A daily look at the relevant information security news from overnight.
Episode 206 - 29 November 2019
Prosegur crippled - https://www.zdnet.com/article/security-firm-prosegur-weve-shut-our-it-network-after-ryuk-ransomware-attack/
Magento exposed - https://www.infosecurity-magazine.com/news/magento-marketplace-breach-exposes/
imminent Monitor crushed - https://www.bleepingcomputer.com/news/security/law-enforcement-shuts-down-imminent-monitor-malware-makes-arrests/
Dexphot spreads - https://threatpost.com/dexphot-malware-cryptocurrency/150634/
Phishing season - https://www.bleepingcomputer.com/news/security/beware-of-thanksgiving-ecard-emails-distributing-malware/
A daily look at the relevant information security news from overnight.
Episode 205 - 27 November 2019
DeathRansom emerges - https://www.bleepingcomputer.com/news/security/new-deathransom-ransomware-begins-to-make-a-name-for-itself/
New MageCart moves - https://threatpost.com/magecart-variant-tactics-mitm-phishing/150628/
Media too social - https://www.theregister.co.uk/2019/11/26/facebook_twitter_data_loss/
French jobs site open - https://www.technadu.com/french-job-seeking-platform-exposes-14-million-records-online/85861/
Y2K? Why not - https://www.bleepingcomputer.com/news/security/splunk-faces-y2k-bug-like-problem-unless-patched/
A daily look at the relevant information security news from overnight.
Episode 204 - 26 November 2019
Bots new Tricks - https://threatpost.com/trickbot-evolves-ssh-keys/150617/
Fortinet finally fixed - https://www.zdnet.com/article/some-fortinet-products-shipped-with-hardcoded-encryption-keys/
Database an open vista - https://techcrunch.com/2019/11/25/vistaprint-security-lapse/
Crooks caught Catch - https://threatpost.com/pos-malware-customer-data-catch-restaurants/150581/
Ginp grows up - https://www.bleepingcomputer.com/news/security/ginp-android-banker-sets-as-default-sms-app-steals-all-text/
A daily look at the relevant information security news from overnight.
Episode 203 - 25 November 2019
Raccoon info stealer - https://threatpost.com/raccoon-stealer-malware-scurries-past-microsoft-messaging-gateways/150545/
Clop CryptoMix trick - https://www.bleepingcomputer.com/news/security/clop-ransomware-tries-to-disable-windows-defender-malwarebytes/
VNC Project flaws - https://threatpost.com/critical-flaws-vnc-industrial/150568/
Ryuk cripples nursing homes - https://securityboulevard.com/2019/11/110-nursing-homes-cut-off-from-health-records-in-ransomware-attack/
Allied in a Maze - https://www.bleepingcomputer.com/news/security/allied-universal-breached-by-maze-ransomware-stolen-data-leaked/
A daily look at the relevant information security news from overnight.
Episode 202 - 22 November 2019
Port (monitor) Lambert - https://www.zdnet.com/article/deprimon-downloader-uses-novel-ways-to-infect-your-pc-with-coloredlambert-malware/
Payment page perp - https://www.bleepingcomputer.com/news/security/card-skimmer-group-replaces-checkout-page-to-steal-payment-info/
Hakbit decryptor - https://www.zdnet.com/article/ransomware-a-free-tool-can-decrypt-this-malware-variant-that-puts-a-ransom-note-on-you-desktop-wallpaper/
Gekko Group goof - https://www.scmagazine.com/home/security-news/data-breach/leaky-gekko-group-database-exposes-info-on-hotel-brands-travelers/
SecTopRAT - https://www.zdnet.com/article/new-sectoprat-malware-creates-hidden-second-desktop-to-control-browser-sessions/
A daily look at the relevant information security news from overnight.
Episode 201 - 21 November 2019
Jetpack urgent update - https://www.bleepingcomputer.com/news/security/millions-of-sites-exposed-by-flaw-in-jetpack-wordpress-plugin/
Phoenix rising - https://www.zdnet.com/article/new-phoenix-keylogger-tries-to-stop-over-80-security-products-to-avoid-detection/
Gaming and crypto dump - https://threatpost.com/hackers-dump-2-2m-gaming-cryptocurrency-passwords-online/150451/
Video-no - https://www.theregister.co.uk/2019/11/20/veed_io_unsecured_aws_bucket_user_videos_exposed/
Jigsaw decrypted - https://www.zdnet.com/article/ransomware-this-free-tool-decrypts-85-variants-of-the-horror-tinged-jigsaw-malware/
A daily look at the relevant information security news from overnight.
Episode 200 - 20 November 2019
D-Link duds - https://threatpost.com/d-link-wont-fix-router-bugs/150438/
Android I see you - https://www.zdnet.com/article/android-vulnerability-lets-rogue-apps-take-photos-record-video-even-if-your-phone-is-locked/
Vets bit - https://threatpost.com/400-vet-locations-ryuk-ransomware/150443/
Ransom fail - https://www.bleepingcomputer.com/news/security/critical-windows-update-spam-fails-at-delivering-ransomware/
McTrojan - https://threatpost.com/mcdonalds-facebook-ads-banking-trojans/150425/
A daily look at the relevant information security news from overnight.
Episode 199 - 19 November 2019
Backdoor two fer - https://www.bleepingcomputer.com/news/security/linux-windows-users-targeted-with-new-acbackdoor-malware/
Macy’s MageCart - https://www.scmagazine.com/home/security-news/macys-com-magecart-attack-yields-payment-personal-info/
Mouse house hack - https://threatpost.com/disney-accounts-hacked-hijacked/150366/
ProtonMail bombed out - https://www.zdnet.com/article/protonmail-blocked-in-belarus-following-wave-of-bomb-threats-across-the-country/
Magic: The Gathering your data - https://techcrunch.com/2019/11/16/magic-the-gathering-wizards-data-exposure/
A daily look at the relevant information security news from overnight.
Episode 198 - 18 November 2019
NextCry undetectable - https://www.bleepingcomputer.com/news/security/new-nextcry-ransomware-encrypts-data-on-nextcloud-linux-servers/
Sacm sites explode - https://threatpost.com/holiday-shoppers-malicious-sites-posing-retailers/150326/
RAT two-fer - https://www.zdnet.com/article/when-one-isnt-enough-this-shady-malware-will-infect-your-pc-with-two-trojans/
End-around the endpoint - https://threatpost.com/malware-steals-info-with-advanced-obfuscation/150280/
Ad non blocker - https://www.zdnet.com/article/android-malware-disguises-as-ad-blocker-but-then-pesters-users-with-ads/
A daily look at the relevant information security news from overnight.
Episode 197 - 15 November 2019
Government phish - https://www.bleepingcomputer.com/news/security/new-threat-actor-impersonates-govt-agencies-to-deliver-malware/
Zombieload workaround - https://www.zdnet.com/article/windows-linux-get-options-to-disable-intel-tsx-to-prevent-zombieload-v2-attacks/
Patient data breach - https://www.scmagazine.com/home/health-care/open-database-exposes-93m-files-on-patients-of-substance-abuse-facilities/
Pranks exposed - https://www.technadu.com/prankdial-com-exposes-138-million-records/84939/
Healthcare breaches - https://www.bleepingcomputer.com/news/security/us-health-network-supplier-expose-pii-phi-data-in-breaches/
A daily look at the relevant information security news from overnight.
Episode 196 - 14 November 2019
Multi purpose ransomware - https://www.bleepingcomputer.com/news/security/purelocker-ransomware-can-lock-files-on-windows-linux-and-macos/
FLawed 5G - https://techcrunch.com/2019/11/12/5g-flaws-locations-spoof-alerts/
VMWare patches - https://www.scmagazine.com/home/security-news/vulnerabilities/vmware-patches-five-security-vulnerabilities/
Securing iOS - https://www.technadu.com/ios-13-3-enable-safari-hardware-security-keys/84840/
AnteFrigus odd ransomware - https://www.bleepingcomputer.com/news/security/strange-antefrigus-ransomware-only-targets-specific-drives/
A daily look at the relevant information security news from overnight.
Episode 195 - 13 November 2019
Intel Zombieload - https://techcrunch.com/2019/11/12/intel-cascade-lake-zombieload/
IE zero-day patch - https://threatpost.com/microsoft-patches-rce-bug/150136/
Orvis.com oops oops - https://www.technadu.com/orvis-com-exposed-hundreds-internal-passwords-pastebin/84732/
Adobe critical patches - https://threatpost.com/adobe-critical-bugs-illustrator-media-encoder/150114/
Pemex huge ransom - https://www.bleepingcomputer.com/news/security/mexicos-pemex-oil-suffers-ransomware-attack-49-million-demanded/
A daily look at the relevant information security news from overnight.
Episode 194 - 12 November 2019
SmarterASP downed - https://threatpost.com/ransomware-attack-downs-hosting-service-smarterasp-net/150072/
VegaLocker RaaS - https://www.zdnet.com/article/vegalocker-evolves-into-buran-ransomware-as-a-service/
ZoneAlarm leak - https://www.securityweek.com/data-zonealarm-forum-users-leaked-following-breach
TrickBot harassment scam - https://www.bleepingcomputer.com/news/security/trickbot-malware-uses-fake-sexual-harassment-complaints-as-bait/
Dharma decrypt scam - https://www.theregister.co.uk/2019/11/11/dharma_decryption_promises_data_recovery/
A daily look at the relevant information security news from overnight.
Episode 193 - 11 November 2019
Titanium backdoor - https://threatpost.com/platinum-apt-titanium-backdoor/150062/
ConnectWise warning - https://www.zdnet.com/article/connectwise-warns-of-ongoing-ransomware-attacks-targeting-its-customers/
Cisco spam RAT - https://www.bleepingcomputer.com/news/security/clever-webex-spam-use-cisco-redirect-to-deliver-rat-malware/
Ring up wifi codes - https://threatpost.com/amazon-fixes-ring-video-doorbell-flaw-that-leaked-wi-fi-credentials/150029/
Boardriders wipeout - https://www.bleepingcomputer.com/news/security/quiksilver-and-billabong-affected-by-ransomware-attack/
A daily look at the relevant information security news from overnight.
Episode 192 - 08 November 2019
ZIP right by - https://www.bleepingcomputer.com/news/security/specially-crafted-zip-files-used-to-bypass-secure-email-gateways/
InterMed PHI breach - https://www.scmagazine.com/home/security-news/data-breach/maines-intermed-suffers-data-breach-30000-affected/
Nvidia patches - https://www.zdnet.com/article/nvidia-patches-severe-geforce-gpu-vulnerabilities/
TDS tweak - https://www.bleepingcomputer.com/news/security/legitimate-tds-platform-abused-to-push-malware-via-exploit-kits/
Cisco slip-up - https://www.zdnet.com/article/cisco-all-these-routers-have-the-same-embedded-crypto-keys-so-update-firmware/
A daily look at the relevant information security news from overnight.
Episode 191 - 07 November 2019
Your Asus is exposed - https://www.technadu.com/asuswrt-exposes-user-information-via-unprotected-database/84291/
Magento EOL - https://www.zdnet.com/article/between-200000-and-240000-magento-online-stores-will-reach-eol-next-year/
Facebook privacy breach - https://threatpost.com/facebook-privacy-breach-developers-group-data/149930/
Phishy subpoena - https://www.bleepingcomputer.com/news/security/subpoena-phishing-emails-serve-nasty-predator-thief-infection/
Malicious Micro insider - https://www.theregister.co.uk/2019/11/06/trend_micro_leak/
A daily look at the relevant information security news from overnight.
Episode 190 - 06 November 2019
You’re a wizard spidey - https://threatpost.com/wizard-spider-upgrades-ryuk-ransomware/149853/
MegaCortex expands - https://www.bleepingcomputer.com/news/security/new-megacortex-ransomware-changes-windows-passwords-threatens-to-publish-data/
Nunavut ransomed - https://www.zdnet.com/article/canadian-nunavut-government-systems-crippled-by-ransomware/
Capesand shifting - https://www.scmagazine.com/home/security-news/vulnerabilities/capesand-ek-attacking-ie-flash-vulnerabilities/
Beware WordPress pirates - https://www.technadu.com/wp-vcd-malware-plaguing-pirated-wordpress-plugins-themes/84203/
A daily look at the relevant information security news from overnight.
Episode 189 - 05 November 2019
rConfig unpatched - https://threatpost.com/critical-rce-flaw-in-rconfig/149847/
Nemty’s new ride - https://www.technadu.com/nemty-ransomware-delivered-through-trik-botnet/84155/
BitPaymer hits Spain - https://www.zdnet.com/article/ransomware-hits-spanish-companies-sparking-wannacry-panic/
Android bad beam - https://www.zdnet.com/article/android-bug-lets-hackers-plant-malware-via-nfc-beaming/
Alexa, Siri, beam me up! - https://threatpost.com/alexa-siri-google-smart-speakers-hacked-via-laser-beam/149860/
A daily look at the relevant information security news from overnight.
Episode 188 - 04 November 2019
Calypso beat - https://threatpost.com/calypso-apt-target-governments/149773/
Nikkei BEC - https://www.bleepingcomputer.com/news/security/media-giant-nikkei-loses-29-million-to-bec-scammers/
Chrome patches xero-day - https://www.zdnet.com/article/halloween-scare-google-discloses-chrome-zero-day-exploited-in-the-wild/
Ai.type costly - https://threatpost.com/android-keyboard-app-swindle-40m/149731/
Marriott exposure - https://www.bleepingcomputer.com/news/security/marriott-reports-exposure-of-associates-social-security-numbers/
A daily look at the relevant information security news from overnight.
Episode 187 - 01 November 2019
Gafgyt bot-maker - https://www.zdnet.com/article/this-aggressive-iot-malware-is-forcing-wi-fi-routers-to-join-its-botnet-army/
Horde helper - https://techcrunch.com/2019/10/31/horde-webmail-inbox-one-click/
China taps SMS - https://threatpost.com/china-hackers-spy-texts-messagetap-malware/149761/
Web.oops - https://www.scmagazine.com/home/security-news/data-breach/web-com-discloses-breach-affecting-customer-account-info/
QNAP snatched - https://www.zdnet.com/article/thousands-of-qnap-nas-devices-have-been-infected-with-the-qsnatch-malware/
A daily look at the relevant information security news from overnight.
Episode 186 - 31 October 2019
Bed Bath & Breached - https://www.scmagazine.com/home/security-news/cybercrime/bed-bath-beyond-declares-data-incident/
Joker cards - https://www.technadu.com/jokers-stash-1-3-million-credit-debit-card-dump/83433/
NK hits India nuke plant - https://www.zdnet.com/article/confirmed-north-korean-malware-found-on-indian-nuclear-plants-network/
NHS pager leak - https://techcrunch.com/2019/10/30/nhs-pagers-medical-health-data/
Paradise found - https://www.bleepingcomputer.com/news/security/paradise-ransomware-decryptor-gets-your-files-back-for-free/
A daily look at the relevant information security news from overnight.
Episode 185 - 30 October 2019
Adwind RAT back - https://www.zdnet.com/article/this-old-trojan-malware-is-back-with-a-new-trick-to-help-it-hide-in-plain-sight/
Leaky PayPad - https://www.technadu.com/paypad-leak-exposes-credit-card-information-2-million-nigerian-transactions/83198/
Sextortion hack - https://www.bleepingcomputer.com/news/security/blogger-and-wordpress-sites-hacked-to-show-sextortion-scams/
Need help with xHelper - https://www.zdnet.com/article/new-unremovable-xhelper-malware-has-infected-45000-android-devices/
Italy Maze attack - https://www.bleepingcomputer.com/news/security/maze-ransomware-attacks-italy-in-new-email-campaign/
A daily look at the relevant information security news from overnight.
Episode 184 - 29 October 2019
Russia targets Olympics - https://www.zdnet.com/article/microsoft-russian-hackers-are-targeting-sporting-organizations-ahead-of-tokyo-olympics/
Sixth June skimmed - https://www.bleepingcomputer.com/news/security/sixth-june-fashion-site-hacked-to-steal-credit-cards/
Georgia suffers huge attack - https://threatpost.com/country-of-georgia-suffers-widespread-cyberattack/149625/
Krystal discloses breach - https://www.bleepingcomputer.com/news/security/us-food-chain-alerts-customers-of-payment-card-incident/
UniCredit breah (again) - https://threatpost.com/unicredit-suffers-third-breach/149617/
A daily look at the relevant information security news from overnight.
Episode 183 - 28 October 2019
Creative (OPEN) Cloud - https://www.theregister.co.uk/2019/10/25/adobe_user_data_exposed/
FuxSocy ransomware - https://www.bleepingcomputer.com/news/security/new-fuxsocy-ransomware-impersonates-the-notorious-cerber/
Clover Sites exposed - https://threatpost.com/religious-website-data-exposed-months/149535/
Johannesburg extorted - https://www.zdnet.com/article/city-of-johannesburg-held-for-ransom-by-hacker-gang/
P&G slimmed - https://www.bleepingcomputer.com/news/security/pandg-online-beauty-store-hacked-to-steal-payment-info/
A daily look at the relevant information security news from overnight.
Episode 182 - 25 October 2019
Raccoon Stealer - https://www.zdnet.com/article/this-easy-to-use-information-stealing-trojan-malware-is-quickly-gaining-popularity-among-cyber-criminals/
DDoS ransom - https://www.zdnet.com/article/a-ddos-gang-is-extorting-businesses-posing-as-russian-government-hackers/
AWS DDoS - https://www.itproportal.com/news/aws-hit-by-ddos-attack/
More D-Link vulns - https://www.technadu.com/10-d-link-routers-vulnerable-remote-command-execution/83028/
Fujitsu keyboard fail - https://threatpost.com/fujitsu-wireless-keyboard-unpatched-flaws/149477/
A daily look at the relevant information security news from overnight.
Episode 181 - 24 October 2019
Maxthon major vuln - https://www.zdnet.com/article/bug-that-grants-admin-rights-to-malware-found-in-maxthon-chinas-favorite-browser/
Discord curruption - https://www.bleepingcomputer.com/news/security/discord-turned-into-an-info-stealing-backdoor-by-new-malware/
Not in front of the robots honey - https://threatpost.com/bedside-hotel-robot-hacked-video/149491/
Phishing good in Kalispell - https://www.scmagazine.com/home/health-care/phishing-scam-behind-kalispell-regional-healthcare-data-breach/
CPDoS proof - https://www.zdnet.com/article/cpdos-attack-can-poison-cdns-to-deliver-error-pages-instead-of-legitimate-sites/
A daily look at the relevant information security news from overnight.
Episode 180 - 23 October 2019
MedusaLocker rears head - https://www.bleepingcomputer.com/news/security/medusalocker-ransomware-wants-its-share-of-your-money/
Home Group breach - https://www.infosecurity-magazine.com/news/home-group-data-breach/
Active Directory help - https://www.securityweek.com/new-azure-ad-feature-detects-unauthorized-access-attempts
Billtrust back up after attack - https://www.bleepingcomputer.com/news/security/billing-provider-billtrust-suffers-outage-after-malware-attack/
Remcos trojan upgrade - https://docs.google.com/document/d/1MNpTyoZ4Ka0cRMkofHpBIzCpuAniXD9XuRa7Xomf-3U/edit#
A daily look at the relevant information security news from overnight.
Episode 179 - 22 October 2019
Best Western leak - https://www.zdnet.com/article/autoclerk-database-leaked-customer-government-and-military-personal-records/
Trend Micro rund malware - https://www.theregister.co.uk/2019/10/21/flaw_trend_micro/
Gustuff new look - https://threatpost.com/gustuff-android-banker-switches-technical-approach/149403/
Winnti skip-2.0 - https://www.scmagazine.com/home/security-news/gaming/skip-2-0-backdoor-malware-provides-magic-password-to-access-mssql-accounts/
Alexa, what’s my password? - https://threatpost.com/new-way-found-to-use-alexa-google-to-voice-phish-and-eavesdrop-on-users/149352/
A daily look at the relevant information security news from overnight.
Episode 178 - 21 October 2019
Long term skim - https://www.zdnet.com/article/mission-health-store-hijack-went-undetected-for-years/
WordPress backdoor - https://www.bleepingcomputer.com/news/security/hackers-backdoor-sites-by-hiding-fake-wordpress-plugins/
STOP decryptor - https://www.zdnet.com/article/free-decrypter-released-for-stop-ransomware-todays-most-popular-ransomware-strain/
Spelevo delivers Maze - https://www.bleepingcomputer.com/news/security/maze-ransomware-now-delivered-by-spelevo-exploit-kit/
Rockin’ ransomware - https://www.infosecurity-magazine.com/news/italians-rocked-by-ransomware/
A daily look at the relevant information security news from overnight.
Episode 177 - 18 October 2019
The Dukes are back - https://www.bleepingcomputer.com/news/security/cozy-bear-russian-hackers-spotted-after-staying-undetected-for-years/
Samsung sucky bios - https://www.zdnet.com/article/samsung-admits-fingerprint-reader-flaw-promises-software-fix/
Cisco patches - https://threatpost.com/cisco-aironet-access-points-critical-flaws/149266/
UC Browser flaw - https://www.bleepingcomputer.com/news/security/500-million-uc-browser-android-users-exposed-to-mitm-attacks-again/
Stripe phishing - https://www.darkreading.com/endpoint/phishing-campaign-targets-stripe-credentials-financial-data/d/d-id/1336117
A daily look at the relevant information security news from overnight.
Episode 176 - 17 October 2019
Malware WAV - https://www.bleepingcomputer.com/news/security/attackers-hide-backdoors-and-cryptominers-in-wav-audio-files/
Android PoC - https://www.zdnet.com/article/security-researcher-publishes-proof-of-concept-code-for-recent-android-zero-day/
Big Oracle patch - https://www.scmagazine.com/home/security-news/vulnerabilities/oracle-patches-218-security-vulnerabilities/
WordPress patches - https://www.scmagazine.com/home/security-news/vulnerabilities/wordpress-patches-6-bugs/
Scum of the earth arrested - https://www.zdnet.com/article/us-south-korea-officials-trace-bitcoin-transactions-to-take-down-massive-child-porn-site/
A daily look at the relevant information security news from overnight.
Episode 175 - 16 October 2019
Stolen cards stolen - https://arstechnica.com/information-technology/2019/10/data-for-a-whopping-26-million-stolen-payment-cards-leaked-in-hack-of-fraud-bazaar/
Checkm8 scam - https://www.bleepingcomputer.com/news/security/scammers-use-fake-checkra1n-ios-jailbreak-in-click-fraud-campaign/
New TA505 campaign - https://www.bleepingcomputer.com/news/security/new-sdbot-remote-access-trojan-used-in-ta505-malspam-campaigns/
Docker spreads miner - https://thenextweb.com/security/2019/10/16/cryptojacking-worm-uses-docker-to-infect-over-2000-systems-to-secretly-mine-monero/
Rocke evolves - https://www.bleepingcomputer.com/news/security/chinese-hackers-use-new-cryptojacking-tactics-to-evade-detection/
A daily look at the relevant information security news from overnight.
Episode 174 - 15 October 2019
Pitney Bowes encrypted - https://www.zdnet.com/article/pitney-bowes-claims-customer-data-safe-following-malware-attack/
Alphabroder down - https://www.asicentral.com/news/newsletters/promogram/october-2019/alphabroder-suffers-ransomware-attack/
Ransomware hits M6 - https://www.zdnet.com/article/m6-one-of-frances-biggest-tv-channels-hit-by-ransomware/
Sudo no-no - https://thehackernews.com/2019/10/linux-sudo-run-as-root-flaw.html
Winnti updates attack - https://www.bleepingcomputer.com/news/security/winnti-group-uses-new-portreuse-malware-against-asian-manufacturer/
A daily look at the relevant information security news from overnight.
Episode 173 - 14 October 2019
Nitro PDF flaw - https://www.bleepingcomputer.com/news/security/nitro-pdf-pro-to-get-micropatches-for-7-potential-rce-bugs/
Fin7 active - https://threatpost.com/fin7-retools/149117/
Hookers hacked - https://www.technadu.com/hookers-nl-forum-hacked-250000-users-exposed/82246/
Leafy data smoked - https://www.technadu.com/cannabis-news-website-leafly-exposes-customer-information/82326/
Faux Crypto platform - https://www.bleepingcomputer.com/news/security/attackers-create-elaborate-crypto-trading-scheme-to-install-malware/
A daily look at the relevant information security news from overnight.
Episode 172 - 11 October 2019
Nemty decryptor - https://www.bleepingcomputer.com/news/security/nemty-ransomware-decryptor-released-recover-files-for-free/
Apple zero-day - https://www.scmagazine.com/home/security-news/ransomware/bitpaymer-ransomware-attackers-exploit-apple-flaw-to-bypass-detection/
iTerm2 critical - https://www.zdnet.com/article/patch-now-mac-users-critical-7-year-old-flaw-in-open-source-macos-app-iterm2/
Attor attack - https://threatpost.com/sophisticated-spy-kit-russians-gsm-plugin/149095/
Cyberoam vulnerability - https://techcrunch.com/2019/10/10/cyberoam-firewall-network-hackers/
A daily look at the relevant information security news from overnight.
Episode 171 - 10 October 2019
Microsoft NTLM vuln - https://www.bleepingcomputer.com/news/security/new-microsoft-ntlm-flaws-may-allow-full-domain-compromise/
Gamer patches - https://threatpost.com/gamers-high-severity-intel-nvidia-flaws/149034/
Border Gateway Protocol work - https://www.zdnet.com/article/mit-weve-created-ai-to-detect-serial-internet-address-hijackers/
AWS phish - https://www.bleepingcomputer.com/news/security/beware-of-fake-amazon-aws-suspension-emails-for-unpaid-bills/
Security awareness fail - https://www.zdnet.com/article/most-americans-cant-recognize-2fa-https-or-private-browsing/
A daily look at the relevant information security news from overnight.
Episode 170 - 09 October 2019
Volusion breached - https://www.zdnet.com/article/hackers-breach-volusion-and-start-collecting-card-details-from-thousands-of-sites/
LokiBot spear phish - https://www.bleepingcomputer.com/news/security/microsoft-blocks-credential-theft-attack-targeting-dozens-of-orgs/
Quiet Patch Tuesday - https://www.scmagazine.com/home/security-news/vulnerabilities/microsoft-repairs-59-software-bugs-on-a-quiet-patch-tuesday/
Catalina patches - https://threatpost.com/apple-tackles-a-dozen-bugs-in-catalina/148988/
Joomla zero-day - https://www.zdnet.com/article/zero-day-published-for-old-joomla-cms-versions/
A daily look at the relevant information security news from overnight.
Million exposed - https://www.bleepingcomputer.com/news/security/1-million-people-had-their-medical-data-exposed-in-t-ora-breach/
TwitterKit - https://threatpost.com/vulnerable-twitter-api-leaves-millions-open-to-attack/148945/
Mushtik hacked - https://www.zdnet.com/article/white-hat-hacks-muhstik-ransomware-gang-and-releases-decryption-keys/
HildaCrypt keys - https://www.bleepingcomputer.com/news/security/hildacrypt-ransomware-developer-releases-decryption-keys/
DCH Pays ransom - https://www.scmagazine.com/home/security-news/ransomware/dch-health-system-pays-ransomware-attackers-in-bid-to-restore-operations/
VPNs vulnerable - https://www.technadu.com/british-spy-agency-vulnerabilities-three-vpns/81976/
A daily look at the relevant information security news from overnight.
Episode 168 - 07 October 2019
HTTPS vuln - https://threatpost.com/new-reductor-malware-hijacks-https-traffic/148904/
Brazilian info auction - https://www.bleepingcomputer.com/news/security/details-of-92-million-brazilians-auctioned-on-underground-forums/
VoIP targeted -https://threatpost.com/voip-espionage-campaign-utilities-supplier/148916/
UAB phished - https://www.bleepingcomputer.com/news/security/uab-medicine-data-breach-exposes-patient-info-in-phishing-attack/
Iran picking targets - https://www.scmagazine.com/home/security-news/iran-hackers-targeted-presidential-campaign-journalists/
A daily look at the relevant information security news from overnight.
Episode 167 - 04 October 2019
MacOS DDoS - https://www.zdnet.com/article/macos-systems-abused-in-ddos-attacks/
Ransomware wiper - https://www.bleepingcomputer.com/news/security/lost-files-data-wiper-poses-as-a-windows-security-scanner/
WhatsApp GIF - https://www.scmagazine.com/home/security-news/vulnerabilities/whatsapp-bug-allows-access-to-content-users-should-update/
Foxit flaws - https://threatpost.com/foxit-pdf-reader-vulnerable-to-8-high-severity-flaws/148897/
Android zero-day - https://www.zdnet.com/article/google-finds-android-zero-day-impacting-pixel-samsung-huawei-xiaomi-devices/
A daily look at the relevant information security news from overnight.
Episode 166 - 03 October 2019
Vendor email compromise - https://www.bleepingcomputer.com/news/security/new-silent-starling-gang-targets-500-vendors-in-bec-scam-twist/
Ghostcat - https://www.scmagazine.com/website-web-server-security/browser-hijacking-ghostcat-malware-haunts-online-publishers/
Zendesk alerted to breach - https://www.zdnet.com/article/zendesk-discloses-2016-data-breach/
Geost banking bot - https://threatpost.com/virus-bulletin-geost-android-botnet/148864/
GandCrab to Sodinokibi - https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-builds-an-all-star-team-of-affiliates/
A daily look at the relevant information security news from overnight.
Episode 165 - 02 October 2019
Adwind rat updated - https://www.bleepingcomputer.com/news/security/new-adwind-rat-variant-used-against-the-us-petroleum-sector/
Ukraine exposes Russians - https://www.technadu.com/20-million-russians-tax-records-exposed/81520/
Emotet the wizard - https://www.bleepingcomputer.com/news/security/fake-office-activation-wizard-docs-used-to-spread-emotet-trojan/
VoIP vulns - https://www.zdnet.com/article/academics-find-eight-vulnerabilities-in-androids-voip-components/
Hospitals ransomed - https://threatpost.com/ransomware-attacks-leave-u-s-hospitals-turning-away-patients/148823/
A daily look at the relevant information security news from overnight.
Episode 164 - 01 October 2019
Ba-Zynga - https://www.scmagazine.com/home/security-news/data-breach/the-word-is-out-zynga-was-breached/
ODT piggyback - https://www.bleepingcomputer.com/news/security/under-detected-odt-files-deliver-common-remote-access-trojans/
Locking Linux - https://www.zdnet.com/article/linux-to-get-kernel-lockdown-feature/
One biiiillion ads - https://www.bleepingcomputer.com/news/security/egobbler-malvertiser-uses-webkit-exploit-to-infect-over-1-billion-ads/
PDF’ed up - https://www.zdnet.com/article/new-pdfex-attack-can-exfiltrate-data-from-encrypted-pdf-files/
A daily look at the relevant information security news from overnight.
Episode 163 - 30 September 2019
Rheinmetall hit - https://www.zdnet.com/article/malware-infection-disrupts-production-at-defence-contractor-plants-in-three-countries/
Masad spyware - https://threatpost.com/masad-spyware-telegram-bots/148759/
SMells like MageCart - https://www.theregister.co.uk/2019/09/27/online_perfume_merchant_hacked/
Spyware on the cheap - https://threatpost.com/arcane-stealer-low-end-dark-web/148741/
New SMS attack - https://www.zdnet.com/article/new-sim-card-attack-disclosed-similar-to-simjacker/
A daily look at the relevant information security news from overnight.
Episode 162 - 27 September 2019
The WhiteShadow knows - https://www.bleepingcomputer.com/news/security/new-whiteshadow-downloader-uses-mssql-servers-for-malware-delivery/
DoorDash breach - https://threatpost.com/doordash-data-breach-impacts-personal-data-of-almost-5m-users/148724/
New fileless zombie maker - https://www.bleepingcomputer.com/news/security/microsoft-spots-nodersok-malware-campaign-that-zombifies-pcs/
Banned extensions - https://www.zdnet.com/article/microsoft-bans-38-file-extensions-in-outlook-for-the-web/
Rich Review poor - https://www.scmagazine.com/home/security-news/vulnerabilities/wordpress-rich-review-plugin-vulnerable-to-malvertising/
A daily look at the relevant information security news from overnight.
Episode 161 - 26 September 2019
Magecart hits routers - https://threatpost.com/magecart-group-targets-routers-behind-public-wi-fi-networks/148662/
vBulletin zero-day - https://www.scmagazine.com/web-services-security-e-commerce-security/reports-actively-exploited-zero-day-found-in-vbulletin-forum-software/
Chinese attacking Windows - https://threatpost.com/narrator-windows-utility-trojanized-to-gain-full-system-control/148654/
Liberia Porrua exposed - https://www.technadu.com/mexican-bookstore-libreria-porrua-exposes-data-million-customers/80932/
Heyyo exposed - https://www.zdnet.com/article/heyyo-dating-app-leaked-users-personal-data-photos-location-data-more/
Adobe patches ColdFusion - https://www.bleepingcomputer.com/news/security/adobe-fixes-critical-security-vulnerabilities-in-coldfusion/
A daily look at the relevant information security news from overnight.
Episode 160 - 25 September 2019
APT10 after utilities - https://www.zdnet.com/article/17-us-utility-firms-targeted-by-mysterious-state-sponsored-group/
New Fancy Bear attack - https://threatpost.com/zebrocy-retools-political-attacks/148593/
U.S. vets sammed - https://www.bleepingcomputer.com/news/security/fake-employment-site-created-to-target-veterans-with-malware/
Wyoming hospital ransomware - https://www.darkreading.com/attacks-breaches/wyoming-hospital-the-latest-to-be-hit-with-ransomware-attack/d/d-id/1335895
Apple open access - https://techcrunch.com/2019/09/24/apple-bug-full-access-keyboards/
A daily look at the relevant information security news from overnight.
Episode 159 - 24 September 2019
YouTube hack - https://www.forbes.com/sites/daveywinder/2019/09/23/youtube-security-warning-issued-for-23-million-creators-as-massive-hack-attack-confirmed/#635c899b6b4f
Kuwait shipping attacks - https://www.zdnet.com/article/hackers-target-transportation-and-shipping-industries-in-new-trojan-malware-campaign/
Microsoft urgent patches - https://threatpost.com/microsoft-internet-explorer-zero-day-flaw-addressed-in-out-of-band-security-update/148584/
Indian banks hit - https://www.zdnet.com/article/new-north-korean-malware-targeting-atms-spotted-in-india/
Apps nasty adverts - https://www.bleepingcomputer.com/news/security/malicious-android-apps-evade-google-play-protect-via-remote-commands/
A daily look at the relevant information security news from overnight.
Episode 158 - 23 September 2019
Magecart hits hotels - https://www.zdnet.com/article/magecart-strikes-again-hotel-booking-websites-come-under-fire/
Verlo Mattress soft - https://threatpost.com/mattress-company-leaks-data-records-of-387k-customers/148530/
Forcepoint VPN fix - https://www.bleepingcomputer.com/news/security/forcepoint-fixes-privilege-escalation-bug-in-windows-vpn-client/
Mac stock malware - https://www.scmagazine.com/home/security-news/cybercrime/tricks-of-the-trade-mac-malware-impersonates-trading-app/
Facebook slaps apps - https://techcrunch.com/2019/09/20/facebook-suspends-apps-hoarding-data/
A daily look at the relevant information security news from overnight.
Episode 157 - 20 September 2019
Open Harbor - https://www.zdnet.com/article/patch-now-1300-harbor-cloud-registries-open-to-attack/
Click2Gov breach - https://www.bankinfosecurity.com/eight-us-cities-see-payment-data-card-stolen-a-13127
Celeb Insta-hack - https://www.bleepingcomputer.com/news/security/celebrity-instagram-accounts-being-hacked-to-push-scams/
Thinkful oops - https://techcrunch.com/2019/09/19/thinkful-data-breach-chegg-acquisition/
WeWork WiFi wide open - https://gizmodo.com/wework-is-exposing-an-astronomical-amount-of-data-on-po-1838254217
A daily look at the relevant information security news from overnight.
Episode 156 - 19 September 2019
IT supply chain hack - https://www.bleepingcomputer.com/news/security/new-tortoiseshell-group-hacks-11-it-providers-to-reach-their-customers/
Scotiabank leaks - https://www.theregister.co.uk/2019/09/18/scotiabank_code_github_leak/
Phishing page emails - https://www.bleepingcomputer.com/news/security/microsoft-phishing-page-sends-stolen-logins-using-javascript/
IRS Amadey botnet - https://threatpost.com/irs-emails-botnet-recruitment/148473/
Windows Defender failing - https://www.zdnet.com/article/windows-defender-malware-scans-are-failing-after-a-few-seconds/
A daily look at the relevant information security news from overnight.
Episode 155 - 18 September 2019
Lion Air exposed - https://www.bleepingcomputer.com/news/security/millions-of-lion-air-passenger-records-exposed-and-exchanged-on-forums/
Gootkit exposed - https://www.zdnet.com/article/gootkit-malware-crew-left-their-database-exposed-online-without-a-password/
Radeon VM flaw - https://threatpost.com/amd-radeon-cards-vmware-workstations/148406/
Linux kernel miner - https://www.zdnet.com/article/skidmap-malware-buries-into-the-kernel-to-hide-cryptocurrency-mining/
Legit certs for sale - https://threatpost.com/threat-actor-buys-digital-certs-spreads-malware/148345/
TFlower ransomware - https://www.bleepingcomputer.com/news/security/tflower-ransomware-the-latest-attack-targeting-businesses/
A daily look at the relevant information security news from overnight.
Episode 154 - 17 September 2019
Emotet awakes - https://www.zdnet.com/article/emotet-todays-most-dangerous-botnet-comes-back-to-life/
Ordinypt wiper - https://www.bleepingcomputer.com/news/security/destructive-ordinypt-malware-hitting-germany-in-new-spam-campaign/
Lumin PDF users exposed - https://www.zdnet.com/article/data-of-24-3-million-lumin-pdf-users-shared-on-hacking-forum/
Insecure home routers - https://threatpost.com/asus-lenovo-routers-remotely-exploitable-bugs/148361/
Nemty get an upgrade - https://www.technadu.com/nemty-ransomware-evolving-kill-processes-services/80180/
A daily look at the relevant information security news from overnight.
Episode 153 - 16 September 2019
Entercom issues - https://www.bleepingcomputer.com/news/security/giant-entercom-radio-network-deals-with-ransomware-like-incident/
Phishing with Asteroth - https://threatpost.com/astaroth-spy-trojan-facebook-youtube/148327/
LastPass leaky - https://www.zdnet.com/article/lastpass-bug-leaks-credentials-from-previous-site/
North Korean spear phishing - https://threatpost.com/north-korean-spear-phishing-attack-us/148299/
Insta user access - https://www.darkreading.com/risk-management/instagram-bug-put-user-account-details-phone-numbers-at-risk/d/d-id/1335797
A daily look at the relevant information security news from overnight.
Episode 152 - 13 September 2019
SMS tracker - https://www.zdnet.com/article/new-simjacker-attack-exploited-in-the-wild-to-track-users-for-at-least-two-years/
RAT sandwich - https://www.bleepingcomputer.com/news/security/new-wiryjmper-dropper-hides-netwire-rat-payloads-in-plain-sight/
Dealer Leads exposed - https://threatpost.com/198m-car-buyer-records-exposed-online/148231/
UNICEF oops - https://www.infosecurity-magazine.com/news/unicef-leaks-data-of-online/
Garmin skimmed - https://www.bleepingcomputer.com/news/security/garmin-sa-shopping-portal-breach-leads-to-theft-of-payment-data/
A daily look at the relevant information security news from overnight.
Episode 151 - 12 September 2019
Fraudsters leak - https://threatpost.com/major-groupon-ticketmaster-fraud-scheme-exposed-by-insecure-database/148246/
Ryuk stealer - https://www.bleepingcomputer.com/news/security/ryuk-related-malware-steals-confidential-military-financial-files/
Chrome crypto update - https://www.zdnet.com/article/google-discloses-vulnerability-in-chrome-os-built-in-security-key-feature/
Cobalt Dickens strikes again - https://www.bleepingcomputer.com/news/security/iranian-hackers-hit-over-60-universities-to-get-library-access/
Apps see the light - https://www.zdnet.com/article/most-android-flashlight-apps-request-an-absurd-number-of-permissions/
A daily look at the relevant information security news from overnight.
Episode 150 - 11 September 2019
Microsoft Teams vuln - https://www.bleepingcomputer.com/news/security/microsoft-teams-can-be-used-to-execute-arbitrary-payloads/
D-Link and Comba flaws - https://threatpost.com/vulnerabilities-in-d-link-comba-routers-can-leak-credentials/148150/
Microsoft patches 80 - https://www.zdnet.com/article/microsoft-patches-two-zero-days-in-massive-september-2019-patch-tuesday/
Adobe patches Flash - https://threatpost.com/adobe-critical-flash-player-code-execution-flaws/148169/
Captcha hides phish - https://www.bleepingcomputer.com/news/security/microsoft-phishing-page-uses-captcha-to-bypass-automated-detection/
A daily look at the relevant information security news from overnight.
Episode 149 - 10 September 2019
Critical IoT vulns - https://www.zdnet.com/article/critical-vulnerabilities-impact-over-a-million-iot-radio-devices/
Stealth Raven evolves - https://threatpost.com/stealth-falcon-middle-east-windows-bits/148136/
Trove of exploit kits - https://www.bleepingcomputer.com/news/security/exploit-kits-target-windows-users-with-ransomware-and-trojans/
DDoS hits big sites - https://threatpost.com/wikipedia-world-of-warcraft-ddos-attacks/148121/
Telegram unsend fix - https://techcrunch.com/2019/09/09/telegram-bug-delete-unsent-photos/
A daily look at the relevant information security news from overnight.
Episode 148 - 09 September 2019
BlueKeep weaponized - https://www.zdnet.com/article/metasploit-team-releases-bluekeep-exploit/
GootKit evades - https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/
Lilocked intensifies - https://www.zdnet.com/article/thousands-of-servers-infected-with-new-lilocked-lilu-ransomware/
Exim patched - https://www.theregister.co.uk/2019/09/06/exim_vulnerability_patch/
Huge BEC takes Toyota - https://www.bleepingcomputer.com/news/security/over-37-million-lost-by-toyota-boshoku-subsidiary-in-bec-scam/
A daily look at the relevant information security news from overnight.
Episode 147 - 06 September 2019
DK-Lok exposed - https://www.zdnet.com/article/dklok-data-breach-leaked-global-enterprise-client-internal-emails/
Danfoss crit vuln - https://www.helpnetsecurity.com/2019/09/05/danfoss-scada-vulnerabilities/
GPS defaults to 123456 - https://www.zdnet.com/article/600000-gps-trackers-left-exposed-online-with-a-default-password-of-123456/
Monster data exposed - https://techcrunch.com/2019/09/05/monster-exposed-user-data-years/
WordPress fixes - https://www.bleepingcomputer.com/news/security/wordpress-523-released-with-security-and-bug-fixes/
A daily look at the relevant information security news from overnight.
Episode 146 - 05 September 2019
Android zero day - https://threatpost.com/android-zero-day-bug-opens-door-to-privilege-escalation-attack-researchers-warn/148014/
Deepfake scam - https://www.zdnet.com/article/forget-email-scammers-use-ceo-voice-deepfakes-to-con-workers-into-wiring-cash/
Joker trojan - https://www.bleepingcomputer.com/news/security/stealthy-android-trojan-spy-signs-you-up-for-premium-subscriptions/
Samba root access - https://www.bleepingcomputer.com/news/security/year-old-samba-bug-allows-access-to-forbidden-root-share-paths/
Facebook data leak - https://techcrunch.com/2019/09/04/facebook-phone-numbers-exposed/
A daily look at the relevant information security news from overnight.
Episode 145 - 04 September 2019
BMC ports exposed - https://www.zdnet.com/article/over-47000-supermicro-servers-are-exposing-bmc-ports-on-the-internet/
Multilingual toolkit - https://www.bleepingcomputer.com/news/security/new-toolkit-pushes-malware-via-fake-program-update-alerts-in-30-languages/
Chip and PIN cloned - https://www.zdnet.com/article/german-bank-loses-eur1-5-million-in-mysterious-cashout-of-emv-cards/
Bit by BleachBit - https://www.bleepingcomputer.com/news/security/fake-bleachbit-website-built-to-distribute-azorult-info-stealer/
Yves Rocher exposure - https://threatpost.com/data-leak-impacts-millions/147908/
A daily look at the relevant information security news from overnight.
Episode 144 - 03 September 2019
Foxit PDF breached - https://www.zdnet.com/article/company-behind-foxit-pdf-reader-announces-security-breach/
Astaroth by Cloudflare - https://www.bleepingcomputer.com/news/security/astaroth-trojan-uses-cloudflare-workers-to-bypass-av-software/
Brazil selling off data - https://www.zdnet.com/article/brazilian-citizen-data-under-threat-with-sale-of-national-tech-firms/
WordPress hackers create admins - https://www.zdnet.com/article/wordpress-sites-under-attack-as-hacker-group-tries-to-create-rogue-admin-accounts/
Sodinokibi via WordPress - https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-spreads-via-fake-forums-on-hacked-sites/
A daily look at the relevant information security news from overnight.
Episode 143 - 30 August 2019
Dental ransom - https://www.zdnet.com/article/ransomware-hits-hundreds-of-dentist-offices-in-the-us/
BRATA spreading - https://www.bleepingcomputer.com/news/security/brata-android-rat-used-to-infect-and-spy-on-brazilian-users/
Cisco critical patch - https://www.zdnet.com/article/patch-now-cisco-ios-xe-routers-exposed-to-rare-1010-severity-security-flaw/
TGI Fridays oops - https://threatpost.com/tgi-fridays-data-exposure/147849/
iPhone hack - https://techcrunch.com/2019/08/29/google-iphone-secretly-hacked/
A daily look at the relevant information security news from overnight.
Episode 142 - 29 August 2019
Magecart hits big - https://threatpost.com/magecart-ecommerce-card-skimming-bonanza/147765/
Revenge and Orcus RATs - https://www.bleepingcomputer.com/news/security/attackers-target-govt-and-financial-orgs-with-orcus-revenge-rats/
TrickBot SIM swap - https://www.zdnet.com/article/trickbot-todays-top-trojan-adds-feature-to-aid-sim-swapping-attacks/
xHelper dropper hits Android - https://www.bleepingcomputer.com/news/security/android-trojan-infects-tens-of-thousands-of-devices-in-4-months/
Set-top IoT attack - https://www.theregister.co.uk/2019/08/28/android_set_boxes_ares_malware/
A daily look at the relevant information security news from overnight.
Episode 141 - 28 August 2019
WS-DD can launch DDoS - https://www.zdnet.com/article/protocol-used-by-630000-devices-can-be-abused-for-devastating-ddos-attacks/
New APT LYCEUM - https://threatpost.com/oil-and-gas-firms-targeted-by-new-lyceum-threat-group/147705/
Trojan dropper app - https://www.bleepingcomputer.com/news/security/trojan-dropper-malware-found-in-android-app-with-100m-downloads/
Retadup taken down - https://www.zdnet.com/article/avast-and-french-police-take-over-malware-botnet-and-disinfect-850000-computers/
Gartner exposes 1TB - https://www.technadu.com/gartner-exposes-1tb-data-belonging-to-subsidiary/77903/
A daily look at the relevant information security news from overnight.
Episode 140 - 27 August 2019
Enterprise network attacks - https://www.zdnet.com/article/hackers-mount-attacks-on-webmin-servers-pulse-secure-and-fortinet-vpns/
Nemty arrives - https://www.bleepingcomputer.com/news/security/new-nemty-ransomware-may-spread-via-compromised-rdp-connections/
Hostinger breached - https://techcrunch.com/2019/08/25/web-host-hostinger-data-breach/
Quasar phishing - https://www.bleepingcomputer.com/news/security/phishing-campaign-delivers-quasar-rat-payloads-via-fake-resumes/
Clickjacking plagues advertisers - https://www.zdnet.com/article/clickjacking-scripts-found-on-613-popular-sites-academics-say/
A daily look at the relevant information security news from overnight.
Episode 139 - 26 August 2019
Emotet back in operation - https://www.bleepingcomputer.com/news/security/emotet-botnet-is-back-servers-active-across-the-world/
Lenovo bug - https://threatpost.com/bug-found-in-pre-installed-software/147657/
New Asruex strain - https://www.zdnet.com/article/asruex-trojan-exploits-old-office-adobe-bugs-to-backdoor-your-system/
MasterCard breach - https://www.bleepingcomputer.com/news/security/mastercard-reports-data-breach-to-german-and-belgian-dpas/
Hy-Vee records sale - https://www.zdnet.com/article/data-stolen-from-hy-vee-customers-offered-for-sale-on-jokers-stash-dark-web-trading-post/
A daily look at the relevant information security news from overnight.
Episode 138 - 23 August 2019
Squid buggy buffer - https://www.bleepingcomputer.com/news/security/unpatched-squid-servers-exposed-to-dos-code-execution-attacks/
Google Play spyware - https://www.zdnet.com/article/open-source-spyware-makes-it-on-the-google-play-store/
Portland schools BEC - https://www.bleepingcomputer.com/news/security/portland-public-schools-recovers-29-million-lost-in-bec-scam/
Neutrino trojan back - https://fossbytes.com/nasty-botnet-neutrino-caught-hacking-other-hackers-web-shells/
Free antivirus vuln - https://www.technadu.com/bitdefender-antivirus-free-2020-vulnerable-privilege-escalation-attacks/77440/
A daily look at the relevant information security news from overnight.
Episode 137 - 22 August 2019
CIsco critical flaws - https://threatpost.com/cisco-patches-six-critical-bugs/147585/
China targets research - https://www.zdnet.com/article/cancer-research-organizations-become-the-new-focus-of-chinese-hacking-groups/
Phishing with Microsoft - https://www.bleepingcomputer.com/news/security/phishing-attacks-scrape-branded-microsoft-365-login-pages/
Another Steam zero day - https://threatpost.com/researcher-discloses-second-steam-zero-day-after-valve-bug-bounty-ban/147593/
Free RAT - https://www.zdnet.com/article/cybersecurity-this-trojan-malware-being-offered-for-free-could-cause-hacking-spike/
A daily look at the relevant information security news from overnight.
Episode 136 - 21 August 2019
Remote desktop bug expands - https://www.bleepingcomputer.com/news/security/microsoft-patches-vulnerable-android-remote-desktop-app/
Buggy Nest - https://threatpost.com/google-nest-security-cam-takeover/147477/
MoviePass leaks - https://techcrunch.com/2019/08/20/moviepass-thousands-data-exposed-leak/
Apple un-fixes iOS - https://threatpost.com/apple-ios-patch-blunder-iphones-jailbreaks/147519/
Kubernetes flaw - https://www.bleepingcomputer.com/news/security/severe-flaws-in-kubernetes-expose-all-servers-to-dos-attacks/
A daily look at the relevant information security news from overnight.
Episode 135 - 20 August 2019
NordVPN trojan - https://www.bleepingcomputer.com/news/security/hackers-use-fake-nordvpn-website-to-deliver-banking-trojan/
Webmin backdoor - https://www.zdnet.com/article/backdoor-found-in-webmin-a-popular-web-based-utility-for-managing-unix-servers/
Adwind hitting utilities - https://www.bleepingcomputer.com/news/security/adwind-remote-access-trojan-hits-utilities-sector/
Segmented routers leak - https://www.bleepingcomputer.com/news/security/router-network-isolation-broken-by-covert-data-exfiltration/
Ransomware hits Texas - https://threatpost.com/coordinated-ransomware-attack-hits-23-texas-government-agencies/147457/
A daily look at the relevant information security news from overnight.
Episode 134 - 19 August 2019
Phishing 404 - https://www.bleepingcomputer.com/news/security/microsoft-warns-of-phishing-attacks-using-custom-404-pages/
8 million adware downloads - https://techcrunch.com/2019/08/16/android-users-tricked-adware-apps/
BIRD breach - https://www.forbes.com/sites/daveywinder/2019/08/16/european-central-bank-breach-ecb-confirms-hack-and-shuts-down-website/#74b7720594bd
Mozilla free password - https://www.bleepingcomputer.com/news/security/mozilla-firefox-bug-let-third-parties-access-saved-passwords/
Hy-Vee PoS breach - https://www.zdnet.com/article/hy-vee-issues-warning-to-customers-after-discovering-point-of-sale-breach/
A daily look at the relevant information security news from overnight.
Episode 133 - 16 August 2019
DanaBot on the move - https://www.zdnet.com/article/danabot-banking-trojan-jumps-from-australia-to-german-targets/
Choice Hotel breach - https://www.infosecurity-magazine.com/news/choice-hotels-breach-hackers/
Voicemail phish - https://www.bleepingcomputer.com/news/security/microsoft-voicemail-notifications-used-as-bait-in-phishing-campaign/
Trend Micro password flaw - https://www.zdnet.com/article/trend-micro-fixes-hijack-security-flaw-in-password-manager/
Apache versions oops - https://threatpost.com/apache-security-advisories-red-flags-wrong-versions-in-patching-gaffe/147388/
A daily look at the relevant information security news from overnight.
Episode 132 - 15 August 2019
All Windows vuln - https://threatpost.com/20-year-old-bug-legacy-microsoft-windows-users/147336/
Miner on Task - https://www.zdnet.com/article/this-new-cryptojacking-malware-uses-a-sneaky-trick-to-remain-hidden/
Intel patches - https://www.bleepingcomputer.com/news/security/intel-updates-nuc-firmware-to-patch-high-severity-bug/
Biometrics leak - https://www.zdnet.com/article/major-biometrics-data-leak-impacts-police-banks-enterprise-companies/
Phishing with Google - https://www.bleepingcomputer.com/news/security/phishing-campaign-uses-google-drive-to-bypass-email-gateways/
A daily look at the relevant information security news from overnight.
Episode 131 - 14 August 2019
HTTP/2s - https://www.bleepingcomputer.com/news/security/new-http-2-flaws-expose-unpatched-web-servers-to-dos-attacks/
Facebook eavesdropping - https://www.bloomberg.com/news/articles/2019-08-13/facebook-paid-hundreds-of-contractors-to-transcribe-users-audio
Troldesh rising - https://www.technadu.com/troldesh-ransomware-infecting-victims-compromised-websites/76628/
HVACking - https://www.bleepingcomputer.com/news/security/hvacking-remotely-exploiting-bugs-in-building-control-systems/
Dating apps exposing - https://www.zdnet.com/article/four-major-dating-apps-expose-precise-locations-of-10-million-users/
A daily look at the relevant information security news from overnight.
Episode 130 - 13 August 2019
Cloud Atlas morphing - https://www.zdnet.com/article/cloud-atlas-threat-group-updates-weaponry-with-polymorphic-malware/
Multiple drivers flawed - https://www.securityweek.com/vulnerabilities-device-drivers-20-vendors-expose-pcs-persistent-malware
SQLite vuln - https://www.zdnet.com/article/clever-attack-uses-sqlite-databases-to-hack-other-apps-malware-servers/
4G full of flaws - https://www.bleepingcomputer.com/news/security/4g-router-vulnerabilities-let-attackers-take-full-control/
Phone charger hack - https://techcrunch.com/2019/08/12/iphone-charging-cable-hack-computer-def-con/
A daily look at the relevant information security news from overnight.
Episode 129 - 12 August 2019
BIG-IP load imbalance - https://www.helpnetsecurity.com/2019/08/09/vulnerable-load-balancers/
Clicker with 100M downloads - https://www.bleepingcomputer.com/news/security/android-apps-with-over-100m-installs-contain-a-clicker-trojan/
“Smart lock” NOT - https://threatpost.com/hack-of-high-end-hotel-smart-locks-shows-iot-security-fail/147178/
KDE vuln resolved - https://www.bleepingcomputer.com/news/security/kde-vulnerability-fixed-by-removing-shell-command-support/
Saefco trojan - https://www.zdnet.com/article/new-saefko-trojan-focuses-on-stealing-your-credit-card-details/
A daily look at the relevant information security news from overnight.
Episode 128 - 09 August 2019
WhatsApp exploit - https://www.zdnet.com/article/whatsapp-vulnerabilities-puts-words-in-your-mouth-lets-hackers-tamper-with-text/
Avaya VoIP bug - https://threatpost.com/critical-rce-bug-avaya-voip-phones/147122/
Ursnif macro - https://www.zdnet.com/article/phishing-watch-out-for-this-new-version-of-trojan-malware-that-spreads-through-malicious-word-documents/
LEE leaves the door open - https://www.technadu.com/leadership-for-educational-equity-leaks-data-3-7-million-members/76286/
Baseball Hall of Shame - https://www.bleepingcomputer.com/news/security/national-baseball-hall-of-fame-hit-by-payment-card-stealing-attack/
A daily look at the relevant information security news from overnight.
Episode 127 - 08 August 2019
Smominru expands - https://threatpost.com/smominru-cryptominer-scrapes-credentials-half-million-machines/147038/
Clipsa the brute - https://www.zdnet.com/article/new-windows-malware-can-also-brute-force-wordpress-websites/
LokiBot adds steganography - https://www.bleepingcomputer.com/news/security/lokibot-uses-image-files-to-hide-code-for-unpacking-routine/
State Farm brute = https://www.zdnet.com/article/state-farm-says-hackers-confirmed-valid-usernames-and-passwords-in-credentials-stuffing-attack/
Leapfrog too chatty - https://www.digitaltrends.com/news/leapfrog-flaw-could-have-exposed-childrens-info-and-location/
A daily look at the relevant information security news from overnight.
Episode 126 - 07 August 2019
Cisco switch bugs - https://www.zdnet.com/article/security-bugs-in-popular-cisco-switch-brand-allow-hackers-to-take-over-devices/
EchoBot gettin busy - https://www.bleepingcomputer.com/news/security/new-echobot-botnet-variant-uses-over-50-exploits-to-propagate/
KDE vuln disclosed - https://www.zdnet.com/article/unpatched-kde-vulnerability-disclosed-on-twitter/
Mass spoofing threat - https://threatpost.com/mass-spoofing-campaign-walmart/146994/
CafePress pwned - https://www.theregister.co.uk/2019/08/05/cafebreach_breach_23m_user_records/
A daily look at the relevant information security news from overnight.
Episode 125 - 06 August 2019
MegaCortex v2 - https://www.zdnet.com/article/megacortex-ransomware-slams-eu-firms-with-demands-of-up-to-5-8-million/
Snapdragon vulns - https://www.bleepingcomputer.com/news/security/qualpwn-bugs-in-snapdragon-soc-can-attack-android-over-the-air/
Dragonblood expands - https://www.technadu.com/two-dragonblood-vulnerabilities-wpa3-wi-fi-standard/75933/
StockX covered breach - https://techcrunch.com/2019/08/03/stockx-hacked-millions-records/
Strontium hits IoT - https://www.bleepingcomputer.com/news/security/russian-apt-abuses-iot-devices-to-infiltrate-corporate-targets/
A daily look at the relevant information security news from overnight.
Episode 124 - 05 August 2019
GermanWiper - https://www.zdnet.com/article/germanwiper-ransomware-hits-germany-hard-destroys-files-asks-for-ransom/
SystemBC stealthy - https://threatpost.com/systembc-proxy-malware-socks5-stealth/146879/
LookBack RAT - https://www.bleepingcomputer.com/news/security/phishing-attacks-target-us-utilities-with-remote-access-trojan/
NVIDIA patches - https://www.bleepingcomputer.com/news/security/nvidia-patches-high-severity-flaws-in-windows-gpu-display-driver/
Beware free antivirus - https://threatpost.com/critical-bug-android-antivirus/146927/
A daily look at the relevant information security news from overnight.
Episode 123 - 02 August 2019
Mirai goes Tor - https://www.zdnet.com/article/new-mirai-botnet-lurks-in-the-tor-network-to-stay-under-the-radar/
Amavaldo campaigns - https://www.scmagazine.com/home/security-news/cybercrime/fiendish-amavaldo-banking-trojan-strikes-in-mexico-after-targeting-brazilians/
Rocke miner - https://www.theregister.co.uk/2019/08/01/palo_alto_networks_rocke_malware/
Adware abuses reputation - https://www.bleepingcomputer.com/news/security/dealply-adware-abuses-microsoft-smartscreen-to-boost-av-evasion/
Korean card sale - https://www.zdnet.com/article/breach-alert-in-south-korea-after-1m-card-details-were-put-up-for-sale-online/
A daily look at the relevant information security news from overnight.
Episode 122 - 01 August 2019
Pearson data breach - https://www.wsj.com/articles/pearson-hack-exposed-details-on-thousands-of-u-s-students-11564619001?mod=rsswn
New Malvertising - https://threatpost.com/malvertising-ad-blockers-mac-malware/146861/
Limit bypassed - https://www.helpnetsecurity.com/2019/07/31/visa-contactless-cards-flaws/
DHS small aircraft warning - https://www.zdnet.com/article/dhs-warns-about-can-bus-vulnerabilities-in-small-aircraft/
Honda endpoints exposed - https://techcrunch.com/2019/07/31/security-lapse-exposed-weak-points-on-hondas-internal-network/
A daily look at the relevant information security news from overnight.
Episode 121 - 31 July 2019
Apple Air issues - https://www.zdnet.com/article/apples-awdl-protocol-plagued-by-flaws-that-enable-tracking-and-mitm-attacks/
Akamai discovers RFI - https://www.securityweek.com/campaign-leverages-rfi-attacks-deploy-phishing-kits
OXID fixes - https://www.bleepingcomputer.com/news/security/oxid-eshop-used-by-mercedes-fixes-remote-takeover-security-bug/
LAPD hacked - https://www.scmagazine.com/home/security-news/data-breach/personal-info-on-2500-lapd-members-17-5k-applicants-stolen/
NC county BEC - https://www.bleepingcomputer.com/news/security/north-carolina-county-lost-17-million-in-bec-scam/
A daily look at the relevant information security news from overnight.
Episode 119 - 30 July 2019
Capital One breached - https://arstechnica.com/information-technology/2019/07/feds-former-cloud-worker-hacks-into-capital-one-and-takes-data-for-106-million-people/
Urgent11 - https://www.zdnet.com/article/urgent11-security-flaws-impact-routers-printers-scada-and-many-iot-devices/
Android ransomware - https://www.scmagazine.com/home/security-news/mobile-security/flawed-but-promising-android-ransomware-uncovered/
Comodo exposed - https://techcrunch.com/2019/07/27/comodo-password-access-data/
Sephora online oops - https://z6mag.com/2019/07/29/sephora-online-hit-by-data-breach-company-offers-monitoring-services/
A daily look at the relevant information security news from overnight.
Episode 93 - 27 February 2019
Blacklist miss costs big - https://www.btcnn.com/cryptojacking/hacker-steals-2-9-million-eos-cryptocurrency-following-failure-to-update-blacklist/
Phishing for Federal bids - https://www.zdnet.com/article/federal-bidding-scam-targets-us-contractors/
Bronze Union active again - https://threatpost.com/bronze-union-apt-updates-remote-access-trojans-in-fresh-wave-of-attacks/142219/
Embassy website embarrassing - https://www.bleepingcomputer.com/news/security/web-site-for-a-bangladesh-embassy-compromised-with-malicious-docs/
SHAREit over sharing - https://threatpost.com/shareit-flaws-files/142200/
A daily look at the relevant information security news from overnight.
Episode 52 - 31 December, 2018
Ryuk takes down newspapers - https://www.forbes.com/sites/daveywinder/2018/12/30/north-korea-implicated-in-attack-that-stops-wall-street-journal-and-new-york-times-presses/#7361e78820a2
Multi-tasking bot family - https://www.scmagazine.com/home/security-news/zscaler-threatlabz-researchers-identified-a-new-dos-bot-family-named-siren-that-uses-10-dos-methods-to-carry-out-attacks/
Another Windows zero day - https://www.bleepingcomputer.com/news/security/windows-zero-day-bug-allows-overwriting-files-with-arbitrary-data/
Video monitors share videos - https://threatpost.com/guardzilla-cameras-flaw/140415/
How Facebook tracks non users - https://threatpost.com/how-facebooks-tracks-non-users-via-android-apps/140436/
Our TOPPODCAST Picks 
