Security
Black Hat USA 2024: researcher strips all Windows security using updates to downgrade
A fully patched and secure system is just an illusion. SafeBreach Labs researcher Alon Leviev has bypassed the deepest layer of Windows security without a screwdriver and made a fully patched Windows machine vulnerable to hordes of past vulnerabilities.
Read more about Black Hat USA 2024: researcher strips all Windows security using updates to downgrade
Black Hat USA 2024: fifth of the world’s solar output exposed to disruption
A series of now-patched bugs in a leading photovoltaic (PV) plant management platform exposed a fifth of the world’s solar power output to blackout-inducing attacks, researchers claim.
Read more about Black Hat USA 2024: fifth of the world’s solar output exposed to disruption
Black Hat USA 2024: vehicle head unit can spy on you, researchers reveal
Android-based infotainment systems used in Ford, GM, Honda, and other major vehicle brands can be turned into data-stealing devices, Cisco Talos researchers have uncovered.
Read more about Black Hat USA 2024: vehicle head unit can spy on you, researchers reveal
Paris Olympics ransomware attack hits famed Grand Palais venue
The historic Grand Palais museum complex, one of the sporting venues for the Paris Olympic Games, has been targeted by ransomware crooks, French cyber police revealed on Tuesday.
Read more about Paris Olympics ransomware attack hits famed Grand Palais venue
Polish quiz website fails cybersecurity test, leaving 60K users exposed
Quizme, a Polish entertainment platform popular among educational institutions for creating and sharing quizzes, has inadvertently exposed the sensitive data of over 60,000 users, including easily crackable passwords. Users may be at risk of account takeovers and phishing attacks.
Read more about Polish quiz website fails cybersecurity test, leaving 60K users exposed
Chrome update leaves uBlock Origin users behind, with development to continue on Firefox
Users of uBlock Origin, one of the most popular content-blocking solutions on Chrome, have been warned that the extension should be removed or replaced. As Google moves to a new extensions platform, only a “pared-down” version will prevail.
Read more about Chrome update leaves uBlock Origin users behind, with development to continue on Firefox
Users are getting malware instead of software updates in ISP breach
A sophisticated Chinese cyber-espionage group, known as Evasive Panda or StormBamboo, successfully compromised an undisclosed internet service provider (ISP) to poison software updates to its users.
Read more about Users are getting malware instead of software updates in ISP breach
Scammers now impersonating crypto exchanges to get access to your accounts, FBI warns
Scammers are increasingly impersonating cryptocurrency exchanges, feigning concern about clients’ funds. They urge victims to “safeguard” accounts from attackers by providing credentials or access, The Federal Bureau of Investigation (FBI) warns.
Read more about Scammers now impersonating crypto exchanges to get access to your accounts, FBI warns
Thousands of Ubiquiti cameras and routers vulnerable, despite patches available
More than 20,000 internet-exposed Ubiquiti devices are open to attackers, revealing sensitive data about the owners, Check Point Research warns.
Read more about Thousands of Ubiquiti cameras and routers vulnerable, despite patches available
Cloudflare’s free tunnels plagued by RATs and other malware, researchers warn
Cybercriminals have found a no-cost professional infrastructure to perform their attacks and deliver malware. It’s Cloudflare’s free tier tunnel service, which is supposed to protect legitimate web services.
Read more about Cloudflare’s free tunnels plagued by RATs and other malware, researchers warn
Employees at Dell, AT&T, Verizon, Capital One, and other companies exposed via popular office app
A massive data leak has exposed employees' credentials, affecting around 900 companies and organizations, including Dell, Verizon, AT&T, the Department of Energy, Comcast, and Chase.
Read more about Employees at Dell, AT&T, Verizon, Capital One, and other companies exposed via popular office app
Google being impersonated on Google Ads by scammers peddling fake Authenticator
Hackers are abusing Google Ads to masquerade as Google, tricking users into downloading a Google Authenticator that’s actually malware on GitHub.
Read more about Google being impersonated on Google Ads by scammers peddling fake Authenticator
Millions of websites are sitting ducks for hijackers using unresolved method
More than a dozen threat actors connected to Russia are exploiting a powerful attack vector in the domain name system (DNS). Hackers can claim existing domain names without the real owners noticing and use them for malicious purposes, warns the IT automation and security company Infoblox.
Read more about Millions of websites are sitting ducks for hijackers using unresolved method
BangBros unzipped: 12 million records laid bare, users exposed
Miami-based BangBros, a well-known adult film studio and platform, has exposed private user information that includes IPs, usernames, locations, feedback messages, and model performance statistics. Cybernews researchers found a large unsecured online database containing 12 million records.
Read more about BangBros unzipped: 12 million records laid bare, users exposed
Virtual machines at risk as ransomware gangs exploit dangerous VMware vulnerability
VMware’s enterprise-class software for hosting virtual machines (ESXi) contains a bug that hackers are actively exploiting. They gain full administrative permissions by creating a group called “ESX Admins” and adding themselves to it.
Read more about Virtual machines at risk as ransomware gangs exploit dangerous VMware vulnerability
Researchers find new way to steal tokens using cross-site scripting and OAuth
Although cross-site scripting (XSS) attacks might have fallen out of prominence in recent years, researchers have demonstrated a new method that enables bad actors to steal user session tokens.
Read more about Researchers find new way to steal tokens using cross-site scripting and OAuth
Gold rush for data: Paris 2024 Olympic apps are eavesdropping on users
Apps for the Paris Olympic Games 2024 are tracking users, extracting private data, and peddling it to advertisers and big tech. Moreover, their overreaching capabilities exceed what’s being declared.
Read more about Gold rush for data: Paris 2024 Olympic apps are eavesdropping on users
Hundreds of PC models vulnerable to boot-level attacks after vendors copypaste “secret” keys
Attackers could gain the highest possible privilege – boot-level access – to hundreds of PC system models from Gigabyte, Dell, Lenovo, Supermicro, Acer, and others. The vendors did not bother to change the test master keys provided by the UEFI developer, labeled “DO NOT TRUST,” according to a report by security firm Binarly.
Read more about Hundreds of PC models vulnerable to boot-level attacks after vendors copypaste “secret” keys
Chrome now asking for ZIP archive passwords to help detect malicious files
Cybercriminals are increasingly using encrypted and password-protected files to deliver infostealers and other malware while slipping through security defenses. Google Chrome has introduced a solution, which, while not elegant, should still be effective.
Read more about Chrome now asking for ZIP archive passwords to help detect malicious files
European banks gain insight from first-ever cyber stress test
The European Central Bank on Friday released the results from its first-ever cyber resilience stress test on over 100 European banks – declaring there was “room for improvement.”
Read more about European banks gain insight from first-ever cyber stress test
