Nostr notes by zCat

Ad-based spyware delivery (zero click, if I understand it right) ...

2025-12-06T11:07:56Z

Ad-based spyware delivery (zero click, if I understand it right)

More reads:
https://x.com/IntCyberDigest/status/1997101543015801169

https://x.com/BleepinComputer/status/1996682923664118014

https://x.com/lukOlejnik/status/1996604138512146890

https://x.com/StarkPrivacy/status/1996995200699302015

Pixnapping - stealing pixels and reconstructing the screen with ...

2025-10-19T12:43:18Z

Pixnapping - stealing pixels and reconstructing the screen with secrets (like Signal messages, Authenticator's code, etc.) on Android 😬 #privacy #security

Source: https://www.pixnapping.com/

📺 Watch DC Privacy Summit here (6h52m but with a lot of ...

2025-10-18T14:10:41Z

📺 Watch DC Privacy Summit here (6h52m but with a lot of breaks):

https://www.youtube.com/live/TeFzGvD2JOc

Agenda:
https://www.dcprivacysummit.org/agenda.html

#privacy

Learn zero knowledge for free with 0xPARC (older material but ...

2025-10-15T22:12:08Z

Learn zero knowledge for free with 0xPARC (older material but well explained)

#zeroknowledge #zk #zksnark

source: https://learn.0xparc.org/

⚡ Tails 7.1 released - it changes the home page of Tor Browser ...

2025-10-15T22:07:06Z

⚡ Tails 7.1 released - it changes the home page of Tor Browser to an offline page and explains better how to set an administration password. #privacy

source:
https://tails.net/news/version_7.1/

📱 GrapheneOS is finally ready to break free from Pixels, and ...

2025-10-15T22:03:43Z

📱 GrapheneOS is finally ready to break free from Pixels, and it may never look back

GrapheneOS didn’t reveal the name of its new partner, but said that those devices will be priced in the same range as Pixels.

tl;dr: no privacy for poor people 😬 #privacy

source:
https://www.androidauthority.com/graphene-os-major-android-oem-partnership-3606853/

#Crypto circus in last hours 🤡 🎪 🏆 Biggest liquidation ...

2025-10-11T09:12:20Z

#Crypto circus in last hours 🤡 🎪

🏆 Biggest liquidation in history:
https://x.com/unusual_whales/status/1976839842261835887

💰 Insiders are richer:
https://x.com/martypartymusic/status/1976771889738793109

🙉 Rumors (crypto[.]com & wintermute blew up - all denied):
https://x.com/heycape_/status/1976795205736223050

🪦CEX down as usal (Coinbase sucks):
https://x.com/WatcherGuru/status/1976779135159877727

📉 Oracle issues:
https://x.com/omeragoldberg/status/1976796779120107696

Nostr event nevent1qqspq0vplrd4mnqhd9ehsd2xtm6efuncwu92s24dvq5t65y782rywxczyqt06fhsqp20vc23c67hjf0daaq4scgr4uvag30e8an0tcjtx3p852mlxtd

2025-10-11T07:46:43Z

"The insider who opened trades 30 mins before Trumps tarrif announcement closed the trades for $104m+$88m=$192m profits.

The @HyperliquidX accounts were opened today."

Source: https://x.com/martypartymusic/status/1976771889738793109

Amazing how we all act like it is normal 🤷‍♂️

Coinbase should invest into infrastructure and people (to not ...

2025-10-10T22:10:00Z

Coinbase should invest into infrastructure and people (to not sell customer's personal data) rather then military parades. It is down... as usual 🤷‍♂️

Same as Coinbase btw

2025-10-09T23:27:41Z

In reply to nevent1q…hru6
_________________________

Same as Coinbase btw

So, they got some underpaid dude with 500$ lure and then couple ...

2025-10-09T23:26:45Z

So, they got some underpaid dude with 500$ lure and then couple of 1000$. These companies deserve public shame 🤦‍♂️

quoting
nevent1q…efhg
🚨 Discord hack

- Name, Discord username, email and other contact details if provided to Discord customer support
- Limited billing information such as payment type, the last four digits of your credit card, and purchase history if associated with your account
- IP addresses
- Messages with our customer service agents
Limited corporate data (training materials, internal presentations)

https://discord.com/press-releases/update-on-security-incident-involving-third-party-customer-service

Great, but I am biased

2025-10-09T23:16:03Z

In reply to nevent1q…xm0n
_________________________

Great, but I am biased

Funny, I watched another YouTube privacy guru who was arrested in ...

2025-10-09T23:13:27Z

Funny, I watched another YouTube privacy guru who was arrested in the past for running a dark market. Probably these people should not be giving privacy advice (until you want to end like them) 😬

🚨 Redis: Redis warns of critical flaw impacting thousands of ...

2025-10-06T16:07:14Z

🚨 Redis: Redis warns of critical flaw impacting thousands of instances

Source:
https://www.bleepingcomputer.com/news/security/redis-warns-of-max-severity-flaw-impacting-thousands-of-instances/

🚨 Unity: Steam and Microsoft warn of Unity flaw exposing gamers to attacks

Source:
https://www.bleepingcomputer.com/news/security/steam-and-microsoft-warn-of-unity-flaw-exposing-gamers-to-attacks/

Weekend fun that collects last trades and updates live price ...

2025-10-05T19:00:17Z

Weekend fun that collects last trades and updates live price through WebSockets in your browser. Loaded from IPFS, because why not?😀

It probably has a couple of bugs, but it works on my local. ZEC, XMR, BTC, ETH

IPFS gateway:
https://ipfs.io/ipns/k51qzi5uqu5djm23wijwx9pxh0kqyf2m9ab16d7i9b73s2eu3ecor3ad77z3l6/

DWEB gateway:
https://k51qzi5uqu5djm23wijwx9pxh0kqyf2m9ab16d7i9b73s2eu3ecor3ad77z3l6.ipns.dweb.link/

Jason Hassler: "17 countries have rolled out or passed ...

2025-10-05T12:16:06Z

Jason Hassler: "17 countries have rolled out or passed digital ID laws in the last 3 months:

-EU
-UK
-Laos
-China
-Taiwan
-Mexico
-Zambia
-Canada
-Ethiopia
-Thailand
-Vietnam
-Australia
-Costa Rica
-Switzerland
-Papua New Guinea

Totally just a coincidence, I'm sure." #privacy

Source: https://x.com/JasonBassler1/status/1974623479304687699

Ente: What would normally take 30 minutes for your photo library ...

2025-10-04T19:21:06Z

Ente: What would normally take 30 minutes for your photo library now runs in less than 30 seconds, thanks to vector databases.

Ente is great alternative (that actually cares about your privacy) to Google Photos.

Read more: https://ente.io/blog/vector-db/

Nostr event nevent1qqs0m2ustdredk2r4seg4t3vqh5nf74vx07almtdj5znyjnsad9m88qzyqt06fhsqp20vc23c67hjf0daaq4scgr4uvag30e8an0tcjtx3p85ys5u2m

2025-10-04T08:43:36Z

Stolen from X:
https://x.com/malwrhunterteam/status/1785966314835579101

Printers have unique fingerprints, but what about photos/cameras? ...

2025-10-04T08:38:49Z

Printers have unique fingerprints, but what about photos/cameras? 🫆 #privacy

Source:
https://blur-fields.github.io/

nice tl;dr ...

2025-10-03T23:50:36Z

In reply to nevent1q…ws09
_________________________

nice tl;dr

🚨 Discord hack - Name, Discord username, email and other ...

2025-10-03T23:48:02Z

🚨 Discord hack

- Name, Discord username, email and other contact details if provided to Discord customer support
- Limited billing information such as payment type, the last four digits of your credit card, and purchase history if associated with your account
- IP addresses
- Messages with our customer service agents
Limited corporate data (training materials, internal presentations)

https://discord.com/press-releases/update-on-security-incident-involving-third-party-customer-service

Monero: The first testnet (alpha stressnet) for Full-Chain ...

2025-10-03T23:39:06Z

Monero: The first testnet (alpha stressnet) for Full-Chain Membership Proofs (FCMP++) and CARROT is live! 👀

Zcash info hub: https://scifi.money/ What is #Zcash, why does it ...

2025-10-03T21:35:10Z

Zcash info hub: https://scifi.money/

What is #Zcash, why does it exists, how it works and why you might be interested 👀

Chat control is not dead. Germany is being Germany. Fight ...

2025-10-03T21:30:13Z

Chat control is not dead. Germany is being Germany. Fight against! ✊

Single Blog:
https://signal.org/blog/pdfs/germany-chat-control.pdf

Tuta Blog:
https://tuta.com/blog/unity-day-reminder-no-to-surveillance

Nostr event nevent1qqs9acv8ly38ftts3ppc5zv540j52fx52gtadkwyue5hx0z7gnqt0uqzyqt06fhsqp20vc23c67hjf0daaq4scgr4uvag30e8an0tcjtx3p85xlx9wt

2025-10-03T21:20:34Z

Is this the last free speech platform?

BTW, fuck Google, fuck Android sigh ...

2025-08-30T11:56:55Z

BTW, fuck Google, fuck Android *sigh*

Delete WhatsApp. It is spyware with security holes ...

2025-08-30T11:46:55Z

Delete WhatsApp. It is spyware with security holes

https://x.com/BleepinComputer/status/1961466788450894254

Nostr event nevent1qqs0lnjjs5yqcz08e70qpr2050mzwelqy3ujym9ddn5w7ghhh6hn8qszyqt06fhsqp20vc23c67hjf0daaq4scgr4uvag30e8an0tcjtx3p85j9pk07

2025-08-30T11:43:49Z

#Zcash #Privacy #Freedom

The new version of zCat, an Android data aggregator for #Zcash , ...

2025-03-08T11:13:10Z

The new version of zCat, an Android data aggregator for #Zcash , privacy & security news was released! Please update your app to v0.1.8!

Available in multiple languages: EN🇺🇸, BR🇧🇷, CS🇨🇿, DE🇩🇪, ES🇪🇸, FR🇫🇷, IN🇮🇩, PL🇵🇱, RU🇷🇺, TH🇹🇭 & TR🇹🇷

What is new? Integration of the ZKRadio. It is test implementation, it may be changed in the next version

Added ZcashEsp RSS feed as a News source. If you are aware of any other Zcash related RSS feeds, please let me know.

Added new localisations: Indonesian 🇮🇩 and Polish 🇵🇱 languages are brought back after being paused, and there is added a new language - Thai 🇹🇭language

The 'official announcement' can be found on Free2Z

https://free2z.cash/zCat/zpage/zcat-the-newest-version-v018-was-released

Enjoy and have a great weekend.

Nostr event nevent1qqsp7jem6jqyaawlm7csa0znn0p2pcsd7w0zxlj45whz3tu9634205czyqt06fhsqp20vc23c67hjf0daaq4scgr4uvag30e8an0tcjtx3p85c5w60v

2025-02-26T22:16:18Z

Hacker steals record $1.46 billion from Bybit ETH cold wallet ...

2025-02-21T22:45:43Z

Hacker steals record $1.46 billion from Bybit ETH cold wallet

Cryptocurrency exchange Bybit revealed today that an unknown attacker stole over $1.46 billion worth of cryptocurrency from one of its ETH cold wallets.

"The incident occurred when our ETH multisig cold wallet executed a transfer to our warm wallet. Unfortunately, this transaction was manipulated through a sophisticated attack that masked the signing interface, displaying the correct address while altering the underlying smart contract logic," Bybit explained.

See more: https://www.bleepingcomputer.com/news/security/hacker-steals-record-146-billion-from-bybit-eth-cold-wallet/

#security #hack #crypto

Vulnerabilities in MongoDB Library Allow RCE on Node[.]js Servers ...

2025-02-21T22:44:09Z

Vulnerabilities in MongoDB Library Allow RCE on Node[.]js Servers

Two critical-severity vulnerabilities in the Mongoose Object Data Modeling (ODM) library for MongoDB could have allowed attackers to achieve remote code execution (RCE) on Node[.]js application server.

The first of the critical-severity flaws in the library, tracked as CVE-2024-53900, could allow an attacker to exploit the $where value to potentially achieve RCE on Node.js. The second issue, tracked as CVE-2025-23061, is a bypass for CVE-2024-53900’s patch.

See more:
https://www.securityweek.com/vulnerabilities-in-mongodb-library-allow-rce-on-node-js-servers/

#security #nodejs #rce

The newest version of zCat, an Android data aggregator for ...

2025-02-21T10:41:53Z

The newest version of zCat, an Android data aggregator for #Zcash, privacy & security news was released! Please update your app to v0.1.6!

Available in multiple languages: EN 🇺🇸, BR 🇧🇷, CS 🇨🇿, DE 🇩🇪, ES 🇪🇸, FR 🇫🇷 & RU 🇷🇺

https://play.google.com/store/apps/details?id=crypto.crab.app.zcat

It is only small patch release with smaller changes and bug fixes (and more languages). More info in the post on Free2Z:

https://free2z.cash/zCat/zpage/zcat-the-newest-version-v016-was-released

New OpenSSH Flaws Enable Man-in-the-Middle and DoS Attacks — ...

2025-02-20T07:45:27Z

New OpenSSH Flaws Enable Man-in-the-Middle and DoS Attacks — Patch Now

"Successful MitM exploitation could permit malicious actors to compromise and hijack SSH sessions, and gain unauthorized access to sensitive data."

"DoS attack can result in availability issues, preventing administrators from managing servers and locking legitimate users out, effectively crippling routine operations."

See more: https://thehackernews.com/2025/02/new-openssh-flaws-enable-man-in-middle.html

#security #ssh #mitm

Phishing attack hides JavaScript using invisible Unicode trick: A ...

2025-02-20T07:34:50Z

Phishing attack hides JavaScript using invisible Unicode trick:

A new JavaScript obfuscation method utilizing invisible Unicode characters to represent binary values is being actively abused in phishing attacks targeting affiliates of an American political action committee (PAC).

See more:
https://www.bleepingcomputer.com/news/security/phishing-attack-hides-javascript-using-invisible-unicode-trick/

#security #phishing

Hackers Exploit Signal's Linked Devices Feature to Hijack ...

2025-02-20T07:22:19Z

Hackers Exploit Signal's Linked Devices Feature to Hijack Accounts via Malicious QR Codes

"In the attacks spotted by the Google Threat Intelligence Group, the threat actors, including one it's tracking as UNC5792, have resorted to malicious QR codes that, when scanned, will link a victim's account to an actor-controlled Signal instance.

As a result, future messages get delivered synchronously to both the victim and the threat actor in real-time, thereby granting threat actors a persistent way to eavesdrop on the victim's conversations. Google said UAC-0195 partially overlaps with a hacking group known as UAC-0195."

See more:
https://thehackernews.com/2025/02/hackers-exploit-signals-linked-devices.html

#security #privacy #signal

Qubes OS 4.2.4 has been released! What is new: - All security ...

2025-02-18T11:18:58Z

Qubes OS 4.2.4 has been released!

What is new:
- All security updates to date
- All bug fixes to date
- Included Fedora template upgraded from Fedora 40 to 41

#privacy #security

More info:
https://www.qubes-os.org/news/2025/02/18/qubes-os-4-2-4-has-been-released/

🦓 The #Zcash Foundation has announced a release of Zebra ...

2025-02-08T10:37:37Z

🦓 The #Zcash Foundation has announced a release of Zebra 2.2.0.

This release introduces an additional consensus check on the branch ID of NU6 transactions, along with some important refactors and other improvements.

See more: https://zfnd.org/zebra-2-2-0-release/

💻 Tails has released a security patch with Tails 6.12. These ...

2025-02-08T10:31:55Z

💻 Tails has released a security patch with Tails 6.12.

These vulnerabilities can only be exploited by a powerful attacker who has already exploited another vulnerability to take control of an application in Tails.

See more: https://blog.torproject.org/new-release-tails-6-12/

🇬🇧 U.K. orders Apple to let it spy on users’ encrypted ...

2025-02-08T10:13:45Z

🇬🇧 U.K. orders Apple to let it spy on users’ encrypted accounts

Secret order requires blanket access to protected cloud backups around the world, which if implemented would undermine Apple’s privacy pledge to its users. #privacy

https://www.washingtonpost.com/technology/2025/02/07/apple-encryption-backdoor-uk/

Be careful about what you download from the official app stores ...

2025-02-07T08:57:44Z

Be careful about what you download from the official app stores 🧐

Bleeping Computer:
https://www.bleepingcomputer.com/news/mobile/google-play-apple-app-store-apps-caught-stealing-crypto-wallets/

🇫🇷 Crypto mixers and anything that "opacifies ...

2025-02-07T08:56:09Z

🇫🇷 Crypto mixers and anything that "opacifies transactions" are going to be banned in France.

If you use them, it will be presumed money laundering for your pear.

These two amendments have been adopted.

Original tweet:
https://x.com/fakenine_/status/1887531025984614541

🇨🇿 The president of Czech Republic signed a new set of ...

2025-02-07T08:54:45Z

🇨🇿 The president of Czech Republic signed a new set of rules for cryptocurrencies.

Tl;Dr: Steps to integrate MiCA and no capital gains tax after 3 years of holding.

Source (in Czech):
https://www.seznamzpravy.cz/clanek/ekonomika-finance-byznys-meny-kryptomeny-prezident-pavel-podepsal-zakon-zavadejici-pravidla-pro-trh-s-kryptomenami-269565

Nostr event nevent1qqsqv3fujw2xtyyxhv4xvekf2u78h3v04gpm9vjrj8r2d5xfm3l9uxqzyqt06fhsqp20vc23c67hjf0daaq4scgr4uvag30e8an0tcjtx3p858yyr60

2024-12-25T06:57:17Z

Merry Christmas and Happy Holidays to everyone! 🎄🎅

Privacy is not a crime 😎

#zcash #privacy

Microsoft December 2024 Patch Tuesday fixes 1 exploited zero-day, ...

2024-12-11T07:23:04Z

Microsoft December 2024 Patch Tuesday fixes 1 exploited zero-day, 71 flaws, Adobe Patches Over 160 Vulnerabilities Across 16 Products.

Today is Microsoft's December 2024 Patch Tuesday, which includes security updates for 71 flaws, including one actively exploited zero-day vulnerability.

This Patch Tuesday fixed sixteen critical vulnerabilities, all of which are remote code execution flaws.

This month's Patch Tuesday fixes one actively exploited, publicly disclosed zero-day vulnerability CVE-2024-49138 - Windows Common Log File System Driver Elevation of Privilege Vulnerability.

See more:
BleepingComputer :
https://www.bleepingcomputer.com/news/microsoft/microsoft-december-2024-patch-tuesday-fixes-1-exploited-zero-day-71-flaws/

SecurityWeek:
https://www.securityweek.com/microsoft-ships-urgent-patch-for-exploited-windows-clfs-zero-day/

Security week (Adobe): https://www.securityweek.com/adobe-patches-over-160-vulnerabilities-across-16-products/

#cybersecurity #microsoft #zeroday #patch

Researchers Uncover Prompt Injection Vulnerabilities in DeepSeek ...

2024-12-11T07:17:03Z

Researchers Uncover Prompt Injection Vulnerabilities in DeepSeek and Claude AI

Details have emerged about a now-patched security flaw in the DeepSeek artificial intelligence (AI) chatbot that, if successfully exploited, could permit a bad actor to take control of a victim's account by means of a prompt injection attack.

Security researcher Johann Rehberger, who has chronicled many a prompt injection attack targeting various AI tools, found that providing the input "Print the xss cheat sheet in a bullet list. just payloads" in the DeepSeek chat triggered the execution of JavaScript code as part of the generated response – a classic case of cross-site scripting (XSS).

XSS attacks can have serious consequences as they lead to the execution of unauthorized code in the context of the victim's web browser.

An attacker could take advantage of such flaws to hijack a user's session and gain access to cookies and other data associated with the chat.deepseek[.]com domain, thereby leading to an account takeover.

See more: https://thehackernews.com/2024/12/researchers-uncover-prompt-injection.html

#cybersecurity #ai #injection

SAP Patches Critical Vulnerability in NetWeaver Enterprise ...

2024-12-11T07:13:48Z

SAP Patches Critical Vulnerability in NetWeaver

Enterprise software maker SAP on Tuesday announced the release of nine new and four updated security notes as part of its December 2024 Security Patch Day.

Marked as ‘hot news’, the highest severity in SAP’s notebook, the first new security note addresses three vulnerabilities in NetWeaver AS for JAVA (Adobe Document Services), including a critical flaw that could lead to full system compromise.

The critical issue, tracked as CVE-2024-47578 (CVSS score of 9.1), affects the Adobe Document Service component of NetWeaver, which allows an attacker with administrative privileges to send a crafted request from a vulnerable web application.

See more: https://www.securityweek.com/sap-patches-critical-vulnerability-in-netweaver/

#cybersecurity #SAP #netweaver

Ivanti warns of maximum severity CSA auth bypass vulnerability ...

2024-12-11T07:12:16Z

Ivanti warns of maximum severity CSA auth bypass vulnerability

Today, Ivanti warned customers about a new maximum-severity authentication bypass vulnerability in its Cloud Services Appliance (CSA) solution.

The security flaw (tracked as CVE-2024-11639 and reported by CrowdStrike's Advanced Research Team) enables remote attackers to gain administrative privileges on vulnerable appliances running Ivanti CSA 5.0.2 or earlier without requiring authentication or user interaction by circumventing authentication using an alternate path or channel.

Ivanti advises admins to upgrade vulnerable appliances to CSA 5.0.3 using detailed information available in this support document.

"We are not aware of any customers being exploited by these vulnerabilities prior to public disclosure. These vulnerabilities were disclosed through our responsible disclosure program," the company said on Tuesday. "Currently, there is no known public exploitation of this these vulnerabilities that could be used to provide a list of indicators of compromise."

See more:
BleepingComputer :
https://www.bleepingcomputer.com/news/security/ivanti-warns-of-maximum-severity-csa-auth-bypass-vulnerability/

The Hacker News:
https://thehackernews.com/2024/12/ivanti-issues-critical-security-updates.html

#cybersecurity #ivanti #authenticationbypass

New Cleo zero-day RCE flaw exploited in data theft attacks ...

2024-12-11T07:09:05Z

New Cleo zero-day RCE flaw exploited in data theft attacks

Hackers are actively exploiting a zero-day vulnerability in Cleo managed file transfer software to breach corporate networks and conduct data theft attacks.

The flaw is found in the company's secure file transfer products, Cleo LexiCom, VLTrader, and Harmony, and is a flaw that allows unrestricted file upload and downloads that leads to remote code execution.

The Cleo MFT vulnerability affects versions 5[.]8[.]0[.]21 and earlier and is a bypass for a previously fixed flaw, CVE-2024-50623, which Cleo addressed in October 2024. However, the fix was incomplete, allowing threat actors to bypass it and continue to exploit it in attacks.

Cleo says its software is used by 4,000 companies worldwide, including Target, Walmart, Lowes, CVS, The Home Depot, FedEx, Kroger, Wayfair, Dollar General, Victrola, and Duraflame.

See more:
BleepingComputer :
https://www.bleepingcomputer.com/news/security/new-cleo-zero-day-rce-flaw-exploited-in-data-theft-attacks/

The Hacker News:
https://thehackernews.com/2024/12/cleo-file-transfer-vulnerability-under.html

Security Week:
https://www.securityweek.com/cleo-file-transfer-tool-vulnerability-exploited-in-wild-against-enterprises/

#cybersecurity #rce #cleo

Chinese hackers use Visual Studio Code tunnels for remote access ...

2024-12-11T07:03:52Z

Chinese hackers use Visual Studio Code tunnels for remote access

Chinese hackers targeting large IT service providers in Southern Europe were seen abusing Visual Studio Code (VSCode) tunnels to maintain persistent remote access to compromised systems.

VSCode tunnels are part of Microsoft's Remote Development feature, which enables developers to securely access and work on remote systems via Visual Studio Code. Developers can also execute command and access the file system of remote devices, making it a powerful development tool.

The tunnels are established using Microsoft Azure infrastructure, with executables signed by Microsoft, providing trustworthy access.

Attack chains observed by the companies entail the use of SQL injection as an initial access vector to breach internet-facing applications and database servers. The code injection is accomplished by means of a legitimate penetration testing tool called SQLmap that automates the process of detecting and exploiting SQL injection flaws.

See more:
BleepingComputer :
https://www.bleepingcomputer.com/news/security/chinese-hackers-use-visual-studio-code-tunnels-for-remote-access/

The Hacker News:
https://thehackernews.com/2024/12/hackers-weaponize-visual-studio-code.html

#cybersecurity #visualstudiocode #sqlinjection

Exploits and vulnerabilities in Q3 2024 Q3 2024 saw multiple ...

2024-12-08T07:25:21Z

Exploits and vulnerabilities in Q3 2024

Q3 2024 saw multiple vulnerabilities discovered in Windows and Linux subsystems that are not standard for cyberattacks. This is because operating system developers have been releasing new security mitigations for whole sets of vulnerabilities in commonly used subsystems.

For example, a log integrity check is set to appear in the Common Log Filing System (CLFS) in Windows, so the number of exploits for it will drop. As for Linux, this operating system has the Linux Kernel Runtime Guard (LKRG), implemented as a separate kernel module.

Although the first version of LKRG was released back in 2018, it is undergoing constant refinement. And it is becoming more actively used in various Linux builds.

See more: https://securelist.com/exploits-and-vulnerabilities-q3-2024/114839/

#cybersecurity #exploits #vulnerabilities

IT threat evolution in Q3 2024. Mobile statistics According to ...

2024-12-08T07:21:10Z

IT threat evolution in Q3 2024. Mobile statistics

According to Kaspersky Security Network, in Q3 2024:

- As many as 6.7 million attacks involving malware, adware or potentially unwanted mobile apps were prevented.
- Adware was the most common mobile threat, accounting for 36% of all detected threats.
- More than 222,000 malicious and potentially unwanted installation packages were detected, of which:
A) 17,822 were associated with mobile banking Trojans.
B) 1576 packages were mobile ransomware Trojans

See more: https://securelist.com/malware-report-q3-2024-mobile-statistics/114692/

#cybersecurity #mobile #malware

SecurityWeek sums up the last week news: ENISA and NCSC release ...

2024-12-08T07:16:14Z

SecurityWeek sums up the last week news:

ENISA and NCSC release cybersecurity reports, abuse of Cloudflare services, FBI warns of gen-AI enabling fraud.

See more: https://www.securityweek.com/in-other-news-cloudflare-abuse-uk-and-eu-cybersecurity-reports-fbi-gen-ai-alert/

#cybersecurity

Data Breach News! Atrium Health Data Breach Impacts 585,000 ...

2024-12-08T07:14:00Z

Data Breach News!

Atrium Health Data Breach Impacts 585,000 People

Healthcare company Atrium Health has notified the US Department of Health and Human Services (HHS) that a recently discovered data breach impacts more than 585,000 individuals.

See more: https://www.securityweek.com/atrium-health-data-breach-impacts-585000-people/

Blue Yonder SaaS giant breached by Termite ransomware gang

The Termite ransomware gang has officially claimed responsibility for the November breach of software as a service (SaaS) provider Blue Yonder. Its list of over 3,000 customers includes other high-profile companies like Microsoft, Renault, Bayer, Tesco, Lenovo, DHL, 3M, Ace Hardware, Procter & Gamble, Carlsberg, Dole, Wallgreens, Western Digital, and 7-Eleven.

See more: https://www.bleepingcomputer.com/news/security/blue-yonder-saas-giant-breached-by-termite-ransomware-gang/

#cybersecurity #databreach #privacy

Ultralytics AI model hijacked to infect thousands with ...

2024-12-08T07:09:21Z

Ultralytics AI model hijacked to infect thousands with cryptominer

The popular Ultralytics YOLO11 AI model was compromised in a supply chain attack to deploy cryptominers on devices running versions 8.3.41 and 8.3.42 from the Python Package Index (PyPI)

Ultralytics is a software development company specializing in computer vision and artificial intelligence (AI), specifically in object detection and image processing.

It's best known for its "YOLO" (You Only Look Once) advanced object detection model, which can quickly and accurately detect and identify objects in video streams in real time.

Ultralytics tools are open-source and are used by numerous projects spanning a wide range of industries and applications.

The library has been starred 33,600 times and forked 6,500 times on GitHub, and it has had over 260,000 downloads over the past 24 hours from PyPI alone.

See more:
BleepingComputer:
https://www.bleepingcomputer.com/news/security/ultralytics-ai-model-hijacked-to-infect-thousands-with-cryptominer/

The Hacker News:
https://thehackernews.com/2024/12/ultralytics-ai-library-compromised.html

#cybersecurity #malware #ai

New Windows zero-day exposes NTLM credentials, gets unofficial ...

2024-12-08T07:04:41Z

New Windows zero-day exposes NTLM credentials, gets unofficial patch

A new zero-day vulnerability has been discovered that allows attackers to capture NTLM credentials by simply tricking the target into viewing a malicious file in Windows Explorer.

The flaw was discovered by the 0patch team, a platform that provides unofficial support for end-of-life Windows versions, and was reported to Microsoft. However, no official fix has been released yet.

According to 0patch, the issue, which currently has no CVE ID, impacts all Windows versions from Windows 7 and Server 2008 R2 up to the latest Windows 11 24H2 and Server 2022.

See more: https://www.bleepingcomputer.com/news/security/new-windows-zero-day-exposes-ntlm-credentials-gets-unofficial-patch/

#cybersecurity #windows #patch

Researchers Uncover Flaws in Popular Open-Source Machine Learning ...

2024-12-08T07:03:04Z

Researchers Uncover Flaws in Popular Open-Source Machine Learning Frameworks

Cybersecurity researchers have disclosed multiple security flaws impacting open-source machine learning (ML) tools and frameworks such as MLflow, H2O, PyTorch, and MLeap that could pave the way for code execution.

The vulnerabilities, discovered by JFrog, are part of a broader collection of 22 security shortcomings the supply chain security company first disclosed last month.

Unlike the first set that involved flaws on the server-side, the newly detailed ones allow exploitation of ML clients and reside in libraries that handle safe model formats like Safetensors.

"Hijacking an ML client in an organization can allow the attackers to perform extensive lateral movement within the organization," the company said. "An ML client is very likely to have access to important ML services such as ML Model Registries or MLOps Pipelines."

See more: https://thehackernews.com/2024/12/researchers-uncover-flaws-in-popular.html

#cybersecurity #machinelearning #malware

Crypto-stealing malware posing as a meeting app targets Web3 pros ...

2024-12-08T06:58:36Z

Crypto-stealing malware posing as a meeting app targets Web3 pros

Cybercriminals are targeting people working in Web3 with fake business meetings using a fraudulent video conferencing platform that infects Windows and Macs with crypto-stealing malware.

The campaign is dubbed "Meeten" after the name commonly used by the meeting software and has been underway since September 2024.

The malware, which has both a Windows and a macOS version, targets victims' cryptocurrency assets, banking information, information stored on web browsers, and Keychain credentials (on Mac).

See more: https://www.bleepingcomputer.com/news/security/crypto-stealing-malware-posing-as-a-meeting-app-targets-web3-pros/

#cybersecurity #cryptocurrency #malware

Hackers Leveraging Cloudflare Tunnels, DNS Fast-Flux to Hide ...

2024-12-08T06:56:03Z

Hackers Leveraging Cloudflare Tunnels, DNS Fast-Flux to Hide GammaDrop Malware

The threat actor known as Gamaredon has been observed leveraging Cloudflare Tunnels as a tactic to conceal its staging infrastructure hosting a malware called GammaDrop.

The activity is part of an ongoing spear-phishing campaign targeting Ukrainian entities since at least early 2024 that's designed to drop the Visual Basic Script malware, Recorded Future's Insikt Group said in a new analysis.

The cybersecurity company is tracking the threat actor under the name BlueAlpha, which is also known as Aqua Blizzard, Armageddon, Hive0051, Iron Tilden, Primitive Bear, Shuckworm, Trident Ursa, UAC-0010, UNC530, and Winterflounder. The group, believed to be active since 2014, is affiliated with Russia's Federal Security Service (FSB).

The tools are chiefly engineered to steal valuable data from web applications running inside internet browsers, email clients, and instant messaging applications such as Signal and Telegram, as well as download additional payloads and propagate the malware via connected USB drives.

See more: https://thehackernews.com/2024/12/hackers-leveraging-cloudflare-tunnels.html

#cybersecurity #cloudflare #malware

New Android spyware found on phone seized by Russian FSB After a ...

2024-12-06T07:28:20Z

New Android spyware found on phone seized by Russian FSB

After a Russian programmer was detained by Russia's Federal Security Service (FSB) for fifteen days and his phone confiscated, it was discovered that a new spyware was secretly installed on his device upon its return.

The programmer, Kirill Parubets, was arrested by the FSB after being accused of donating to Ukraine. After regaining access to his mobile device, the programmer suspected it was tampered with by the Russian government after it exhibited unusual behavior and displayed a notifications stating, "Arm cortex vx3 synchronization."

After sharing it with Citizen Lab for forensic analysis, investigators confirmed that spyware had been installed on the device that impersonated a legitimate and popular Android app 'Cube Call Recorder,' which has over 10,000,000 downloads on Google Play.

Contrary to the legitimate app, though, the spyware has access to a broad range of permissions, giving it unfettered access to the device and allowing the attackers to monitor the activities on the phone.

See more: https://www.bleepingcomputer.com/news/security/new-android-spyware-found-on-phone-seized-by-russian-fsb/

#android #spyware #privacy #cybersecurity

Critical Vulnerability Discovered in SailPoint IdentityIQ ...

2024-12-06T07:26:28Z

Critical Vulnerability Discovered in SailPoint IdentityIQ

SailPoint this week warned that a critical-severity vulnerability in the identity and access management (IAM) platform IdentityIQ could allow attackers to access restricted files.

SailPoint’s IdentityIQ IAM platform provides full lifecycle and compliance management capabilities covering provisioning, access requests, certifications, and segregation of duties.

The critical issue, tracked as CVE-2024-10905, has a CVSS score of 10/10 and is described as an improper access control flaw. The bug is, essentially, a directory traversal flaw that affects all IdentityIQ versions up to patch levels 8.4p2, 8.3p5, and 8.2p8.

See more: https://www.securityweek.com/critical-vulnerability-discovered-in-sailpoint-identityiq/

#cybersecurity #identityiq

U.S. org suffered four month intrusion by Chinese hackers A large ...

2024-12-06T07:24:31Z

U.S. org suffered four month intrusion by Chinese hackers

A large U.S. organization with significant presence in China has been reportedly breached by China-based threat actors who persisted on its networks from April to August 2024.

According to Symantec’s threat researchers, the operation appeared to focus on intelligence gathering, involving multiple compromised machines and targeting Exchange Servers, likely for email and data exfiltration.

The researchers did not explicitly name the breached U.S. organization but mentioned that the same entity was targeted by the China-based ‘Daggerfly’ threat group in 2023.

See more
BleepingComputer:
https://www.bleepingcomputer.com/news/security/us-org-suffered-four-month-intrusion-by-chinese-hackers/

The Hackers News:
https://thehackernews.com/2024/12/researchers-uncover-4-month-cyberattack.html

#cybersecurity #cyberattack #breach

I-O Data Confirms Zero-Day Attacks on Routers, Full Patches ...

2024-12-06T07:22:03Z

I-O Data Confirms Zero-Day Attacks on Routers, Full Patches Pending

Japanese device maker I-O Data this week confirmed zero-day exploitation of critical flaws in multiple routers and warned that full patches won’t be available for a few weeks.

According to a warning from incident responders at JPCERT/CC, the most serious flaw opens the door for a remote attacker to disable the router’s firewall, execute commands, or alter configurations.

“The developer states that attacks exploiting these vulnerabilities have been observed,” according to the JPCERT/CC alert.

A separate bulletin from IO-Data documents three separate defects — CVE-2024-45841, CVE-2024-47133 and CVE-2024-52564 — and warns of additional information disclosure and command execution risks.

See more: https://www.securityweek.com/i-o-data-confirms-zero-day-attacks-on-routers-full-patches-pending/

#cybersecurity #zeroday #iodata

Europol Shuts Down Manson Market Fraud Marketplace, Seizes 50 ...

2024-12-06T07:19:23Z

Europol Shuts Down Manson Market Fraud Marketplace, Seizes 50 Servers

Europol on Thursday announced the shutdown of a clearnet marketplace called Manson Market that facilitated online fraud on a large scale.

The operation, led by German authorities, has resulted in the seizure of more than 50 servers associated with the service and the arrest of two suspects. More than 200 terabytes of digital evidence have been collected.

In addition, over 80 data storage devices, cell phones, computers, as well as cash and crypto assets worth more than €63,000 ($66,500) have been confiscated.

Manson Market ("manson-market[.]pw") is believed to have launched in 2022 as a way to peddle sensitive information that was illegally obtained from victims as part of phishing and vishing (voice phishing) schemes.

See more:
The Hacker News:
https://thehackernews.com/2024/12/europol-shuts-down-manson-market-fraud.html

BleepingComputer:
https://www.bleepingcomputer.com/news/security/police-shuts-down-manson-cybercrime-market-fake-shops-arrests-key-suspects/

#cybercrime #mansonmarket

Mitel MiCollab zero-day flaw gets proof-of-concept exploit ...

2024-12-06T07:13:23Z

Mitel MiCollab zero-day flaw gets proof-of-concept exploit

Researchers have uncovered an arbitrary file read zero-day in the Mitel MiCollab collaboration platform, allowing attackers to access files on a server's filesystem.

Mitel MiCollab is an enterprise collaboration platform that consolidates various communication tools into a single application, offering voice and video calling, messaging, presence information, audio conferencing, mobility support, and team collaboration functionalities.

It's utilized by various organizations, including large corporations, small to medium-sized enterprises, and companies operating on a remote or hybrid workforce model.

The latest vulnerability in the product was discovered by researchers at watchTowr, who, despite having reported to the vendor since August, it remains unfixed after 90 days of being disclosed and waiting for a patch.

See more:
BleepingComputer: https://www.bleepingcomputer.com/news/security/mitel-micollab-zero-day-flaw-gets-proof-of-concept-exploit/

The Hacker News:
https://thehackernews.com/2024/12/critical-mitel-micollab-flaw-exposes.html

#cybersecurity #micollab #zeroday

CISA Warns of Active Exploitation of Flaws in Zyxel, ProjectSend, ...

2024-12-05T07:30:51Z

CISA Warns of Active Exploitation of Flaws in Zyxel, ProjectSend, and CyberPanel

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added multiple security flaws affecting products from Zyxel, North Grid Proself, ProjectSend, and CyberPanel to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild.

See more: https://thehackernews.com/2024/12/cisa-warns-of-active-exploitation-of.html

#cybersecurity #kev #cisa

quoting
nevent1q…83u9
CISA Warns of Zyxel Firewall Vulnerability Exploited in Attacks

The US cybersecurity agency CISA on Tuesday warned that a path traversal vulnerability in multiple Zyxel firewall appliances has been exploited in the wild.

The issue, tracked as CVE-2024-11667 (CVSS score of 7.5), is a high-severity flaw affecting the web management interface of Zyxel ATP, USG FLEX, and USG20(W)-VPN series devices.

Successful exploitation of the security defect could allow an attacker to download or upload files using crafted URLs, a NIST advisory reads.

“An attacker may gain unauthorized access to the system, steal credentials, and create backdoor VPN connections by exploiting the vulnerability,” Qualys warned on Tuesday.

See more: https://www.securityweek.com/cisa-warns-of-zyxel-firewall-vulnerability-exploited-in-attacks/

#cybersecurity #zyxel #exploit

Security Risks Persist in Open Source Ecosystem Significant ...

2024-12-05T07:28:33Z

Security Risks Persist in Open Source Ecosystem

Significant security risks continue to be prevalent in open source software practices, a new report by the Linux Foundation, OpenSSF and Harvard University has found.

The CENSUS III project was based on 12 million observations of free and open source software (FOSS) libraries used in production apps at over 10,000 companies. It highlighted a number of concerning cybersecurity practices relating to open source software, which is widely used across all industries.

The project aims to provide a clearer picture of the structural issues that threaten the FOSS ecosystem.

- Ongoing Reliance on Outdated Python 2 Language
- Lack of Standardized Naming for Software Components
- Open Source Security Dependent on Handful of Contributors
- Heavy Reliance on Individual Developer Accounts
- Legacy Software Remains Prevalent

See more: https://www.infosecurity-magazine.com/news/security-risks-open-source/

#opensource #cybersecurity

Pegasus Spyware Infections Proliferate Across iOS, Android ...

2024-12-05T07:22:53Z

Pegasus Spyware Infections Proliferate Across iOS, Android Devices

Researchers have discovered seven new Pegasus spyware infections targeting journalists, government officials, and corporate executives that started several years ago and span both iPhone and Android devices, demonstrating that the range of the notorious spyware may be even greater than once thought.

Researchers from iVerify discovered multiple devices compromised by Israeli company NSO Group's spyware via attacks initiated between 2021 and 2023 that affect Apple iPhone iOS versions 14, 15, and 16.6, as well as Android, they revealed in a blog post published on Dec. 4. The infections were discovered in May during a threat-hunting scan of 3,500 devices from iVerify users who opted in to the checks.

Specifically, the investigation uncovered multiple Pegasus variants in five unique malware types across iOS and Android. The researchers detected forensic artifacts in diagnostic data, shutdown logs, and crash logs found on the devices.

See more: https://www.darkreading.com/endpoint-security/pegasus-spyware-infections-ios-android-devices

#cybersecurity #pegasus #spyware

Six password takeaways from the updated NIST cybersecurity ...

2024-12-05T07:20:54Z

Six password takeaways from the updated NIST cybersecurity framework

Password security is changing — and updated guidelines from the National Institute of Standards and Technology (NIST) reject outdated practices in favor of more effective protections.

Don't have time to read the 35,000-word guidelines? No problem. Here are the six takeaways from NIST’s new guidance that your organization needs to know to create password policies that work.

1. Password length > password complexity
2. Facilitate longer passwords
3. Implement MFA
4. Avoid frequent password changes
5. Prevent the use of already-breached passwords
6. Discontinue password hints and other knowledge-based recovery

See more: https://www.bleepingcomputer.com/news/security/six-password-takeaways-from-the-updated-nist-cybersecurity-framework/

#cybersecurity #password #passwordpolicy

quoting
nevent1q…rkpd
How to Plan a New (and Improved!) Password Policy for Real-World Security Challenges

Many organizations struggle with password policies that look strong on paper but fail in practice because they're too rigid to follow, too vague to enforce, or disconnected from real security needs.

Password policy must be strict enough to protect your systems, flexible enough for daily work, and precise enough to be enforced consistently. Let's explore five strategies for building a password policy that works in the real world.

1. Build compliant password practices
2. Review your existing password obligations
3. Create a policy based on real data
4. Put some muscle in your password policy
5. Create password standards that stick

See more: https://thehackernews.com/2024/12/how-to-plan-new-and-improved-password.html

#cybersecurity #password #passwordpolicy

Largest German Crime Marketplace Taken Down, Administrator ...

2024-12-05T07:17:55Z

Largest German Crime Marketplace Taken Down, Administrator Arrested

Authorities in Germany on Tuesday announced the takedown of Crimenetwork, which they describe as the largest German-speaking online marketplace for the underground economy.

Crimenetwork has been around since 2012, being used to trade various types of illegal goods and services, including stolen information, drugs and counterfeit documents. Authorities said the platform had over 100,000 buyers and 100 sellers, most of them likely from German-speaking countries.

Investigators determined that nearly $100 million in Bitcoin and Monero cryptocurrencies were transferred through Crimenetwork between 2018 and 2024. Operators received a commission of 1-5% from each sale.

German police arrested an alleged administrator of the platform on Monday, seizing evidence, vehicles, and cryptocurrency worth roughly €1 million.

See more: https://www.securityweek.com/largest-german-crime-marketplace-taken-down-administrator-arrested/

#darknetmarketplace #dnm #crimenetrwork

quoting
nevent1q…jy3w
Europol Dismantles Criminal Messaging Service MATRIX in Major Global Takedown

Europol on Tuesday announced the takedown of an invite-only encrypted messaging service called MATRIX that's created by criminals for criminal purposes.

The joint operation, conducted by French and Dutch authorities under the moniker Passionflower, comes in the aftermath of an investigation that was launched in 2021 after the messaging service was discovered on the phone of a criminal convicted for the murder of a Dutch journalist Peter R. de Vries.

This allowed authorities to intercept messages being sent via the service for a period of three months, amassing a total of more than 2.3 million messages in 33 languages. The messages, Europol said, are associated with serious crimes such as international drug trafficking, arms trafficking, and money laundering.

It's worth noting at this stage that MATRIX is different from the open-source, decentralized messaging app of the same name ("matrix[.]org"). Also known by other names such as Mactrix, Totalsec, X-quantum, and Q-safe, it had at least 8,000 user accounts globally, who paid anywhere between $1,360 and $1,700 in cryptocurrency for a Google Pixel phone and a six-month subscription to the service installed on it.

See more: https://thehackernews.com/2024/12/europol-dismantles-criminal-messaging.html

#cybersecurity #matrix

Europol Dismantles Criminal Messaging Service MATRIX in Major ...

2024-12-05T07:14:37Z

Europol Dismantles Criminal Messaging Service MATRIX in Major Global Takedown

Europol on Tuesday announced the takedown of an invite-only encrypted messaging service called MATRIX that's created by criminals for criminal purposes.

The joint operation, conducted by French and Dutch authorities under the moniker Passionflower, comes in the aftermath of an investigation that was launched in 2021 after the messaging service was discovered on the phone of a criminal convicted for the murder of a Dutch journalist Peter R. de Vries.

This allowed authorities to intercept messages being sent via the service for a period of three months, amassing a total of more than 2.3 million messages in 33 languages. The messages, Europol said, are associated with serious crimes such as international drug trafficking, arms trafficking, and money laundering.

It's worth noting at this stage that MATRIX is different from the open-source, decentralized messaging app of the same name ("matrix[.]org"). Also known by other names such as Mactrix, Totalsec, X-quantum, and Q-safe, it had at least 8,000 user accounts globally, who paid anywhere between $1,360 and $1,700 in cryptocurrency for a Google Pixel phone and a six-month subscription to the service installed on it.

See more: https://thehackernews.com/2024/12/europol-dismantles-criminal-messaging.html

#cybersecurity #matrix

How to Plan a New (and Improved!) Password Policy for Real-World ...

2024-12-05T07:10:53Z

How to Plan a New (and Improved!) Password Policy for Real-World Security Challenges

Many organizations struggle with password policies that look strong on paper but fail in practice because they're too rigid to follow, too vague to enforce, or disconnected from real security needs.

Password policy must be strict enough to protect your systems, flexible enough for daily work, and precise enough to be enforced consistently. Let's explore five strategies for building a password policy that works in the real world.

1. Build compliant password practices
2. Review your existing password obligations
3. Create a policy based on real data
4. Put some muscle in your password policy
5. Create password standards that stick

See more: https://thehackernews.com/2024/12/how-to-plan-new-and-improved-password.html

#cybersecurity #password #passwordpolicy

Russian hackers hijack Pakistani hackers' servers for their ...

2024-12-05T07:06:20Z

Russian hackers hijack Pakistani hackers' servers for their own attacks

The notorious Russian cyber-espionage group Turla is hacking other hackers, hijacking the Pakistani threat actor Storm-0156's infrastructure to launch their own covert attacks on already compromised networks.

Using this tactic, Turla (aka "Secret Blizzard") accessed networks Storm-0156 had previously breached, like in Afghan and Indian government organizations, and deployed their malware tools.

According to a report from Lumen's Black Lotus Labs, which tracked this campaign since January 2023 with the help of Microsoft's Threat Intelligence Team, the Turla operation has been underway since December 2022.

Turla (aka Secret Blizzard) is a Russian state-sponsored hacking group linked to Center 16 of Russia's Federal Security Service (FSB), the unit responsible for the interception, decoding, and collection of data from foreign targets.

See more: https://www.bleepingcomputer.com/news/security/russian-turla-hackers-hijack-pakistani-apt-servers-for-cyber-espionage-attacks/

#cybersecurity #turla #espionage

New DroidBot Android malware targets 77 banking, crypto apps A ...

2024-12-05T07:01:28Z

New DroidBot Android malware targets 77 banking, crypto apps

A new Android banking malware named 'DroidBot' attempts to steal credentials for over 77 cryptocurrency exchanges and banking apps in the UK, Italy, France, Spain, and Portugal.

According to Cleafy researchers who discovered the new Android malware, DroidBot has been active since June 2024 and operates as a malware-as-a-service (MaaS) platform, selling the tool for $3,000/month.

At least 17 affiliate groups have been identified using malware builders to customize their payloads for specific targets.

DroidBot's developers, who appear to be Turkish, provide affiliates with all the tools required to conduct attacks. This includes the malware builder, command and control (C2) servers, and a central administration panel from which they can control their operations, retrieve stolen data, and issue commands.

See more: https://www.bleepingcomputer.com/news/security/new-droidbot-android-malware-targets-77-banking-crypto-apps/

#cybersecurity #android #malware

Android’s December 2024 Security Update Patches 14 ...

2024-12-05T06:58:33Z

Android’s December 2024 Security Update Patches 14 Vulnerabilities

Google on Tuesday announced patches for 14 high-severity vulnerabilities as part of Android’s December 2024 security update, including a remote code execution flaw in the System component.

The first part of the update, which arrives on devices as the 2024-12-01 security patch level, resolves six security defects in the Framework and System components, five of which could allow attackers to elevate privileges.

According to Google’s advisory, however, the sixth of these bugs, which is tracked as CVE-2024-43767 and impacts System, is the most severe issue, as it could lead to remote code execution (RCE) with no additional execution privileges needed.

Fixes for these defects were included in updated Android 12, 12L, 13, 14, and 15 versions and the source code for these patches has been released to the Android Open Source Project (AOSP) repository.

See more: https://www.securityweek.com/androids-december-2024-security-update-patches-14-vulnerabilities/

#cybersecurity #android

CISA Warns of Zyxel Firewall Vulnerability Exploited in Attacks ...

2024-12-05T06:56:17Z

CISA Warns of Zyxel Firewall Vulnerability Exploited in Attacks

The US cybersecurity agency CISA on Tuesday warned that a path traversal vulnerability in multiple Zyxel firewall appliances has been exploited in the wild.

The issue, tracked as CVE-2024-11667 (CVSS score of 7.5), is a high-severity flaw affecting the web management interface of Zyxel ATP, USG FLEX, and USG20(W)-VPN series devices.

Successful exploitation of the security defect could allow an attacker to download or upload files using crafted URLs, a NIST advisory reads.

“An attacker may gain unauthorized access to the system, steal credentials, and create backdoor VPN connections by exploiting the vulnerability,” Qualys warned on Tuesday.

See more: https://www.securityweek.com/cisa-warns-of-zyxel-firewall-vulnerability-exploited-in-attacks/

#cybersecurity #zyxel #exploit

Researchers Uncover Backdoor in Solana's Popular Web3[.]js ...

2024-12-05T06:51:49Z

Researchers Uncover Backdoor in Solana's Popular Web3[.]js npm Library

Cybersecurity researchers are alerting to a software supply chain attack targeting the popular @solana/web3[.]js npm library that involved pushing two malicious versions capable of harvesting users' private keys with an aim to drain their cryptocurrency wallets.

The attack has been detected in versions 1.95.6 and 1.95.7. Both these versions are no longer available for download from the npm registry. The package is widely used, attracting over 400,000 weekly downloads.

"These compromised versions contain injected malicious code that is designed to steal private keys from unsuspecting developers and users, potentially enabling attackers to drain cryptocurrency wallets," Socket said in a report.

@solana/web3[.]js is an npm package that can be used to interact with the Solana JavaScript software development kit (SDK) for building Node[.]js and web apps.

See more:
The Hacker News: https://thehackernews.com/2024/12/researchers-uncover-backdoor-in-solanas.html

SecurityWeek:
https://www.securityweek.com/solana-web3-js-library-backdoored-in-supply-chain-attack/

BleepingComputer:
https://www.bleepingcomputer.com/news/security/solana-web3js-library-backdoored-to-steal-secret-private-keys/

#cybersecurity #solana #malware #c2

Critical SailPoint IdentityIQ Vulnerability Exposes Files to ...

2024-12-04T07:08:05Z

Critical SailPoint IdentityIQ Vulnerability Exposes Files to Unauthorized Access

A critical security vulnerability has been disclosed in SailPoint's IdentityIQ identity and access management (IAM) software that allows unauthorized access to content stored within the application directory.

The flaw, tracked as CVE-2024-10905, has a CVSS score of 10.0, indicating maximum severity. It affects IdentityIQ versions 8.2. 8.3, 8.4, and other previous versions.

IdentityIQ "allows HTTP access to static content in the IdentityIQ application directory that should be protected," according to a description of the flaw on NIST's National Vulnerability Database (NVD).

See more: https://thehackernews.com/2024/12/critical-sailpoint-identityiq.html

#cybersecurity #identityq

With Threats to Encryption Looming, Signal’s Meredith Whittaker ...

2024-12-04T07:03:21Z

With Threats to Encryption Looming, Signal’s Meredith Whittaker Says ‘We’re Not Changing’

At WIRED’s The Big Interview event, the president of the Signal Foundation talked about secure communications as critical infrastructure and the need for a new funding paradigm for tech.

The secure messaging app Signal is famous for knowing as little about its users as possible. The app isn’t hoarding metadata, tracking you, or showing you ads—in other words, it’s not monetizing user data. Instead, the Signal Foundation is a nonprofit. Its president, Meredith Whittaker, sees a massive shift underway and an “invitation for action” as the monoliths of Big Tech lose popularity and the old economics of Silicon Valley become brittle.

See more: https://www.wired.com/story/big-interview-meredith-whittaker-signal-2024/

#signal #privacy

Veeam warns of critical RCE bug in Service Provider Console Veeam ...

2024-12-04T07:01:04Z

Veeam warns of critical RCE bug in Service Provider Console

Veeam released security updates today to address two Service Provider Console (VSPC) vulnerabilities, including a critical remote code execution (RCE) discovered during internal testing.

VSPC, described by the company as a remote-managed BaaS (Backend as a Service) and DRaaS (Disaster Recovery as a Service) platform, is used by service providers to monitor the health and security of customer backups, as well as manage their Veeam-protected virtual, Microsoft 365, and public cloud workloads.

The first security flaw fixed today (tracked as CVE-2024-42448 and rated with a 9.9/10 severity score) enables attackers to execute arbitrary code on unpatched servers from the VSPC management agent machine.

Veeam also patched a high-severity vulnerability (CVE-2024-42449) that can let attackers steal the NTLM hash of the VSPC server service account and use the gained access to delete files on the VSPC server.

See more:
BleepingComputer: https://www.bleepingcomputer.com/news/security/veeam-warns-of-critical-rce-bug-in-service-provider-console/

The Hackers News: https://thehackernews.com/2024/12/veeam-issues-patch-for-critical-rce.html

#cybersecurity #rce #veeam

Hackers Use Corrupted ZIPs and Office Docs to Evade Antivirus and ...

2024-12-04T06:57:15Z

Hackers Use Corrupted ZIPs and Office Docs to Evade Antivirus and Email Defenses:

Cybersecurity researchers have called attention to a novel phishing campaign that leverages corrupted Microsoft Office documents and ZIP archives as a way to bypass email defenses.

"The ongoing attack evades #antivirus software, prevents uploads to sandboxes, and bypasses Outlook's spam filters, allowing the malicious emails to reach your inbox," ANY[.]RUN said in a series of posts on X.

The malicious activity entails sending emails containing ZIP archives or Office attachments that are intentionally corrupted in such a way that they cannot be scanned by security tools. These messages aim to trick users into opening the attachments with false promises of employee benefits and bonuses.

In other words, the corrupted state of the files means that they are not flagged as suspicious or malicious by email filters and antivirus software. However, the attack still works because it takes advantage of the built-in recovery mechanisms of programs like Word, Outlook, and WinRAR to relaunch such damaged files in recovery mode

See more: https://thehackernews.com/2024/12/hackers-use-corrupted-zips-and-office.html

#cybersecurity #malware

New EU Regulation Establishes European ‘Cybersecurity Shield’ ...

2024-12-04T06:53:00Z

New EU Regulation Establishes European ‘Cybersecurity Shield’

The Council of the European Union on Monday announced the adoption of two new laws meant to improve the overall cybersecurity across the EU.

The two new laws in the cybersecurity package establish a cybersecurity shield that calls for member states to cooperate in detecting and responding to cyberattacks, and amend the EU’s Cybersecurity Act (CSA) of 2019 to ensure adequate security standards for managed security services.

The first legislative act (PDF) establishes a European Cybersecurity Alert System, a pan-European network of cyberhubs that creates “coordinated detection and situational awareness capabilities, reinforcing the Union’s threat detection and information-sharing capabilities”.

See more: https://www.securityweek.com/new-eu-regulation-establishes-european-cybersecurity-shield/

#cybersecurity #eu

Cloudflare’s developer domains increasingly abused by threat ...

2024-12-04T06:51:28Z

Cloudflare’s developer domains increasingly abused by threat actors

Cloudflare's 'pages.dev' and 'workers.dev' domains, used for deploying web pages and facilitating serverless computing, are being increasingly abused by cybercriminals for phishing and other malicious activities.

According to cybersecurity firm Fortra, the abuse of these domains has risen between 100% and 250% compared to 2023.

The researchers believe the use of these domains is aimed at improving the legitimacy and effectiveness of these malicious campaigns, taking advantage of Cloudflare's trusted branding, service reliability, low usage costs, and reverse proxying options that complicate detection.

Cloudflare Pages is a platform designed for front-end developers to build, deploy, and host fast, scalable websites directly on Cloudflare's global Content Delivery Network (CDN).

See more: https://www.bleepingcomputer.com/news/security/cloudflares-developer-domains-increasingly-abused-by-threat-actors/

#cybersecurity #phishing #cloudflare

Exploit released for critical WhatsUp Gold RCE flaw, patch now A ...

2024-12-04T06:47:41Z

Exploit released for critical WhatsUp Gold RCE flaw, patch now

A proof-of-concept (PoC) exploit for a critical-severity remote code execution flaw in Progress WhatsUp Gold has been published, making it critical to install the latest security updates as soon as possible.

The flaw is tracked as CVE-2024-8785 (CVSS v3.1 score: 9.8) and was discovered by Tenable in mid-August 2024. It exists in the NmAPI[.]exe process in WhatsUp Gold versions from 2023.1.0 and before 24.0.1.

When launched, NmAPI[.]exe provides a network management API interface for WhatsUp Gold, listening for and processing incoming requests.

Due to insufficient validation of incoming data, attackers could send specially crafted requests to modify or overwrite sensitive Windows registry keys that control where WhatsUp Gold configuration files are read from.

See more: https://www.bleepingcomputer.com/news/security/exploit-released-for-critical-whatsup-gold-rce-flaw-patch-now/

#cybersecurity #rce #whatsup

Cisco Warns of Exploitation of Decade-Old ASA WebVPN ...

2024-12-04T06:42:54Z

Cisco Warns of Exploitation of Decade-Old ASA WebVPN Vulnerability

Cisco on Monday updated an advisory to warn customers of active exploitation of a decade-old security flaw impacting its Adaptive Security Appliance (ASA).

The vulnerability, tracked as CVE-2014-2120 (CVSS score: 4.3), concerns a case of insufficient input validation in ASA's WebVPN login page that could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a targeted user of the appliance.

"An attacker could exploit this vulnerability by convincing a user to access a malicious link," Cisco noted in an alert released in March 2014.

As of December 2, 2024, the networking equipment major has revised its bulletin to note that it has become aware of "additional attempted exploitation" of the vulnerability in the wild.

See more: https://thehackernews.com/2024/12/cisco-warns-of-exploitation-of-decade.html

#cybersecurity #xss #webvpn

760,000 Employee Records From Several Major Firms Leaked Online ...

2024-12-04T06:38:55Z

760,000 Employee Records From Several Major Firms Leaked Online

The information of more than 760,000 employees of several major organizations emerged online on Monday morning after a threat actor dumped it on a popular hacking forum.

The data apparently originates from last year’s massive MOVEit hack, in which a zero-day vulnerability in Progress Software’s file transfer software was used to steal sensitive information from thousands of organizations.

Roughly 2,800 organizations and close to 100 million individuals were affected by the attack, which is believed to have been carried out by the Russia-linked Cl0p ransomware gang.
https://www.securityweek.com/760000-employee-records-from-several-major-firms-leaked-online/

#cybersecurity #databreach #moveit

Horns&Hooves Campaign Delivers RATs via Fake Emails and ...

2024-12-03T14:20:41Z

Horns&Hooves Campaign Delivers RATs via Fake Emails and JavaScript Payloads

A newly discovered malware campaign has been found to target private users, retailers, and service businesses mainly located in Russia to deliver NetSupport RAT and BurnsRAT.

The campaign, dubbed Horns&Hooves by Kaspersky, has hit more than 1,000 victims since it began around March 2023. The end goal of these attacks is to leverage the access afforded by these trojans to install stealer malware such as Rhadamanthys and Meduza.

"Recent months have seen a surge in mailings with lookalike email attachments in the form of a ZIP archive containing JScript scripts," security researcher Artem Ushkov said in a Monday analysis. "The script files [are] disguised as requests and bids from potential customers or partners."

See more: https://thehackernews.com/2024/12/horns-campaign-delivers-rats-via-fake.html

#cybersecurity #malware

Hackers Stole $1.49 Billion in Cryptocurrency to Date in 2024 ...

2024-12-03T14:17:17Z

Hackers Stole $1.49 Billion in Cryptocurrency to Date in 2024

Nearly $1.49 billion in cryptocurrency losses have been registered to date in 2024, mainly due to hacking incidents, a new report from web3 bug bounty platform Immunefi shows.

The total year-to-date losses have dropped compared to last year, when they surpassed $1.75 billion during the period, and were mainly driven by losses of over $359 million in May and of more than $282 million in July.

In November, cryptocurrency losses surpassed $71 million, mainly due to hacks ($70,996,200), with only a small percentage lost to rug pulls ($25,300). Total losses were 79% lower compared to November 2023, when they exceeded $343 million.

See more:
https://www.securityweek.com/hackers-stole-1-49-billion-in-cryptocurrency-to-date-in-2024/

#cybersecurity #cryptocurrency #defi

BootKitty UEFI malware exploits LogoFAIL to infect Linux systems ...

2024-12-03T14:13:21Z

BootKitty UEFI malware exploits LogoFAIL to infect Linux systems

The recently uncovered 'Bootkitty' Linux UEFI bootkit exploits the LogoFAIL flaw, tracked as CVE-2023-40238, to target computers running on vulnerable firmware.

This is confirmed by firmware security firm Binarly, which discovered LogoFAIL in November 2023 and warned about its potential to be used in actual attacks.

Bootkitty and LogoFAIL connection
Bootkitty was discovered by ESET, who published a report last week, noting that it is the first UEFI bootkit specifically targeting Linux. However, at this time, it is more of an in-development UEFI malware that only works on specific Ubuntu versions, rather than a widespread threat.

LogoFAIL is a set of flaws in the image-parsing code of UEFI firmware images used by various hardware vendors, exploitable by malicious images or logos planted on the EFI System Partition (ESP).

See more:
https://www.bleepingcomputer.com/news/security/bootkitty-uefi-malware-exploits-logofail-to-infect-linux-systems/

#cybersecurity #linux #uefi

SpyLoan Android malware on Google Play installed 8 million times ...

2024-12-03T14:06:11Z

SpyLoan Android malware on Google Play installed 8 million times

A new set of 15 SpyLoan Android malware apps with over 8 million installs was discovered on Google Play, targeting primarily users from South America, Southeast Asia, and Africa.

The apps were discovered by McAfee, a member of the 'App Defense Alliance,' and have now been removed from Android's official app store.

However, their presence on Google Play is indicative of the threat actors' persistence, as even recent law enforcement actions against SpyLoan operators have not curbed the issue, says McAfee.

The last major "SpyLoan cleanup" on Google Play was in December 2023, when over a dozen apps that had amassed 12 million downloads were removed.

See more
BleepingComputer:
https://www.bleepingcomputer.com/news/security/spyloan-android-malware-on-google-play-installed-8-million-times/

The Hacker News:
https://thehackernews.com/2024/12/8-million-android-users-hit-by-spyloan.html

#cybersecurity #android #malware

Location tracking of phones is out of control. Here’s how to ...

2024-12-01T07:56:43Z

Location tracking of phones is out of control. Here’s how to fight back.

Unique IDs assigned to Android and iOS devices threaten your privacy. Who knew?

You likely have never heard of Babel Street or Location X, but chances are good that they know a lot about you and anyone else you know who keeps a phone nearby around the clock.

Reston, Virginia-located Babel Street is the little-known firm behind Location X, a service with the capability to track the locations of hundreds of millions of phone users over sustained periods of time.

See more:
https://arstechnica.com/information-technology/2024/10/phone-tracking-tool-lets-government-agencies-follow-your-every-move/

#privacy #tracking #mobile

Zello asks users to reset passwords after security incident Zello ...

2024-11-28T23:45:27Z

Zello asks users to reset passwords after security incident

Zello is warning customers to reset their passwords if their account was created before November 2nd in what appears to be another security breach.

Zello is a mobile service with 140 million users that allows first responders, hospitality services, transportation, and family and friends to communicate via their mobile phones using a push-to-talk app.

Over the past two weeks, numerous people have received security notices from Zello on November 15th asking them to reset their app password.

See more: https://www.bleepingcomputer.com/news/security/zello-asks-users-to-reset-passwords-after-security-incident/

#cybersecurity #zello

U.S. Telecom Giant T-Mobile Detects Network Intrusion Attempts ...

2024-11-28T23:44:08Z

U.S. Telecom Giant T-Mobile Detects Network Intrusion Attempts from Wireline Provider

U.S. telecom service provider T-Mobile said it recently detected attempts made by bad actors to infiltrate its systems in recent weeks but noted that no sensitive data was accessed.

These intrusion attempts "originated from a wireline provider's network that was connected to ours," Jeff Simon, chief security officer at T-Mobile, said in a statement. "We see no instances of prior attempts like this."

The company further said its security defenses prevented the threat actors from disrupting its services or obtaining customer information. It has since confirmed that it cut off connectivity to the unnamed provider's network. It did not explicitly attribute the activity to any known threat actor or group, but noted that it has shared its findings with the U.S. government.

See more
The Hacker News:
https://thehackernews.com/2024/11/us-telecom-giant-t-mobile-detects.html

Bleeping Computer:
https://www.bleepingcomputer.com/news/security/chinese-hackers-breached-t-mobiles-routers-to-scope-out-network/

SecurityWeek:
https://www.securityweek.com/t-mobile-shares-more-information-on-china-linked-cyberattack/

#cybersecurity

#nevent1q…zspd

2024-11-28T23:37:53Z

In reply to nevent1q…k7s5
_________________________

quoting nevent1q…zspd
We're calling on the Tor & Internet freedom community to help scale up WebTunnel bridges. Ever thought about running a Tor bridge? Now is the time! Our goal is to deploy 200 new WebTunnel bridges by the end of this year to open secure access for users in Russia.🕸️🌉 https://blog.torproject.org/call-for-webtunnel-bridges/

Tor needs 200 new WebTunnel bridges to fight censorship The Tor ...

2024-11-28T23:37:08Z

Tor needs 200 new WebTunnel bridges to fight censorship

The Tor Project has put out an urgent call to the privacy community asking volunteers to help deploy 200 new WebTunnel bridges by the end of the year to fight government censorship.

Currently, the Tor Project operates 143 WebTunnel bridges, which help users in heavily censored regions bypass internet access restrictions and website blocks.

This comes in response to increasing censorship in Russia, which Tor says currently impacts the browser's built-in censorship circumvention mechanisms, including obfs4 connections and Snowflake.

The Tor Project believes that setting up more WebTunnel bridges is the best response to this censorship escalation, as analyzing new tactics and developing workarounds takes time, leaving users vulnerable and isolated from the free internet.

See more:
https://www.bleepingcomputer.com/news/security/tor-needs-200-new-webtunnel-bridges-to-fight-censorship/

#tor #privacy #censorship

Police bust pirate streaming service making €250 million per ...

2024-11-28T23:30:41Z

Police bust pirate streaming service making €250 million per month

An international law enforcement operation has dismantled a pirate streaming service that served over 22 million users worldwide and made €250 million ($263M) per month.

Italy's Postal and Cybersecurity Police Service announced the action, codenamed "Taken Down," stating they worked with Eurojust, Europol, and many other European countries, making this the largest takedown of its kind in Italy and internationally.

"More than 270 Postal Police officers, in collaboration with foreign law enforcement, carried out 89 searches in 15 Italian regions and 14 additional searches in the United Kingdom, the Netherlands, Sweden, Switzerland, Romania, Croatia, and China, involving 102 individuals," reads the announcement.

See more: https://www.bleepingcomputer.com/news/technology/police-bust-pirate-streaming-service-making-250-million-per-month/

#pirate #streaming

ProjectSend Vulnerability Exploited in the Wild Threat actors are ...

2024-11-28T23:28:32Z

ProjectSend Vulnerability Exploited in the Wild

Threat actors are likely exploiting ProjectSend servers unpatched against a vulnerability that was publicly disclosed roughly a year and a half ago, VulnCheck warns.

An open source application written in PHP, ProjectSend is designed for file sharing, enabling users to create client groups, assign user roles, and access statistics, detailed logs, notifications, and more.

The exploited issue, tracked as CVE-2024-11680 (CVSS score of 9.8), is described as an improper authentication vulnerability that could allow remote, unauthenticated attackers to modify the application’s configuration.

Attackers could send crafted HTTP requests to the options[.]php endpoint to create rogue accounts, upload webshells, and potentially embed malicious JavaScript code, a NIST advisory reads.

See more: https://www.securityweek.com/projectsend-vulnerability-exploited-in-the-wild/

#cybersecurity #php

APT-C-60 Hackers Exploit StatCounter and Bitbucket in SpyGlace ...

2024-11-28T23:26:30Z

APT-C-60 Hackers Exploit StatCounter and Bitbucket in SpyGlace Malware Campaign

The threat actor known as APT-C-60 has been linked to a cyber attack targeting an unnamed organization in Japan that used a job application-themed lure to deliver the SpyGlace backdoor.

That's according to findings from JPCERT/CC, which said the intrusion leveraged legitimate services like Google Drive, Bitbucket, and StatCounter. The attack was carried out around August 2024.

"In this attack, an email purporting to be from a prospective employee was sent to the organization's recruiting contact, infecting the contact with malware," the agency said.

See more: https://thehackernews.com/2024/11/apt-c-60-exploits-wps-office.html

#cybersecurity #malware

New NachoVPN attack uses rogue VPN servers to install malicious ...

2024-11-28T01:58:29Z

New NachoVPN attack uses rogue VPN servers to install malicious updates

A set of vulnerabilities dubbed "NachoVPN" allows rogue VPN servers to install malicious updates when unpatched Palo Alto and SonicWall SSL-VPN clients connect to them.

AmberWolf security researchers found that threat actors can trick potential targets into connecting their SonicWall NetExtender and Palo Alto Networks GlobalProtect VPN clients to attacker-controlled VPN servers using malicious websites or documents in social engineering or phishing attacks.

Threat actors can use the rogue VPN endpoints to steal the victims' login credentials, execute arbitrary code with elevated privileges, install malicious software via updates, and launch code-signing forgery or man-in-the-middle attacks by installing malicious root certificates.

See more:
Bleeping Computer: https://www.bleepingcomputer.com/news/security/new-nachovpn-attack-uses-rogue-vpn-servers-to-install-malicious-updates/

SecurityWeek:
https://www.securityweek.com/new-vpn-attack-demonstrated-against-palo-alto-networks-sonicwall-products/

#cybersecurity

Firefox and Windows zero-days exploited by Russian RomCom hackers ...

2024-11-28T01:53:24Z

Firefox and Windows zero-days exploited by Russian RomCom hackers

Russian-based RomCom cybercrime group chained two zero-day vulnerabilities in recent attacks targeting Firefox and Tor Browser users across Europe and North America.

The first flaw (CVE-2024-9680) is a use-after-free bug in Firefox's animation timeline feature that allows code execution in the web browser's sandbox. Mozilla patched this vulnerability on October 9, 2024, one day after ESET reported it.

The second zero-day exploited in this campaign is a privilege escalation flaw (CVE-2024-49039) in the Windows Task Scheduler service, allowing attackers to execute code outside the Firefox sandbox. Microsoft addressed this security vulnerability earlier this month, on November 12.

RomCom abused the two vulnerabilities as a zero-day chain exploit, which helped them gain remote code execution without requiring user interaction. Their targets only had to visit an attacker-controlled and maliciously crafted website that downloaded and executed the RomCom backdoor on their system.

See more:
Bleeping Computer:
https://www.bleepingcomputer.com/news/security/firefox-and-windows-zero-days-exploited-by-russian-romcom-hackers/

The Hackers News:
https://thehackernews.com/2024/11/romcom-exploits-zero-day-firefox-and.html

SecurityWeek:
https://www.securityweek.com/russian-apt-chained-firefox-and-windows-zero-days-against-us-and-european-targets/

#cybersecurity #zeroday #firefox