> TODAY'S SUMMARY (18 articles)
Today's cybersecurity landscape highlights several critical threats and vulnerabilities. A new WordPress vulnerability, Click2Shell, allows remote code execution via a single click, emphasizing the need for immediate updates to version 7.1.1. Additionally, a fake job interview campaign linked to North Korea has infected over 30,000 devices, showcasing the ongoing risks of social engineering attacks. The TryCloudflare service misconfiguration has led to unintended Google indexing, exposing sensitive user services. On the infrastructure side, flaws in Zyxel switches and Veeam software are actively exploited, prompting CISA to add them to its Known Exploited Vulnerabilities catalog. Lastly, security researchers have identified potential backdoor access through Meta's AI assistant, underlining the importance of scrutinizing AI integrations for security flaws.
|
// AI-powered summary generated at 08:01
In the final part of our three-part series, we investigate the how the toolkit user gained control of program flow and what their strategy means for the reliability of their exploit. Elderwood and the Department of Labor Hack Writing Exploits with the Elderwood Kit (Part 1) Writing Exploits with the...
Password strength meters that offer web surfers a visual gauge of how weak or strong a chosen lock may be are increasingly present on websites – but how effective are they at getting folks to choose stronger options? When it comes to locking down sensitive data, meters had an impact, suggesting that...
First it was shown that Snapchat photos and videos on Android are not deleted, merely hidden; then a YouTube video shows how to locate Snapchat videos on iOS; and now a complaint alleging deceptive business practices has been filed with the FTC.
In the second part of our three-part series, we investigate the tools provided by the Elderwood kit for developing exploits from discovered vulnerabilities. Elderwood and the Department of Labor Hack Writing Exploits with the Elderwood Kit (Part 1) Writing Exploits with the Elderwood Kit (Part 2) Se...
Marks and Spencer, Pret a Manger and Transport for London customers have all reported automatic payment deductions from contactless payment cards while they were making payment by other means, renewing long-standing concerns over the security of contactless payment cards.
Yahoo Japan, 35.5% owned by Japan’s mobile phone operator SoftBank and 34.7% owned by Yahoo Inc, announced Friday that it may have lost 22 million user IDs from its total of around 200 million.
Recently, the Department of Labor (DoL) and several other websites were compromised to host a new zero-day exploit in Internet Explorer 8 (CVE-2013-1347). Researchers noted similarities between this attack and earlier ones attributed to Elderwood, a distinct set of tools used to develop several past...
Rep. Hank Johnson, D-Ga, has introduced the bipartisan Application Privacy, Protection and Security (APPS) Act of 2013 (H.R. 1913). Its purpose is to require app developers to maintain privacy policies, obtain consent from consumers before collecting data, and securely maintain the data they collect...
A leading anti-malware company has uncovered a wide-ranging malware campaign that appears to originate in India and seems primarily to target Pakistan with data-stealing malware.
Plusieurs rendez-vous français habituels sont consacrés cette année à la cybersécurité industrielle.
Comme pour faire écho à mon précédent article concernant la publication en 2013 de plusieurs normes par l’ISA (International Society of Automation), l’antenne française de [...] Lire la suite
Proving that not all demonstrations are staged, a previously unknown Mac backdoor was discovered during a live presentation at the Oslo Freedom Forum earlier this week.
Critical infrastructure threats are up significantly according to US officials – a worrying state of affairs that spans a wide range of threat vectors and potential participants.
Stuxnet is often cited as history’s first true cyber weapon. By common consensus it was developed and used by the US and Israel to successfully disrupt Iran’s nuclear program – but a new report questions its success.
CISOs are often the first victim following a major security breach. Given the prevalence of such breaches, the average tenure of a CISO is now just 18 months; and this is likely to worsen if corporate security doesn’t improve.
Pushdo, one of the more enduring and resilient botnets, has already survived four takedowns in five years. Now a new variant with new evasion techniques has been detected.
The Twitter product security team are improving the security of their code by adopting more security automation.
Four LulzSec members who claim to be "latter-day pirates" have plead guilty to hacking charges and compromising millions of people's information.
Android malware authors have officially turned the complexity corner, according to an analysis of mobile malware for the first quarter of 2013. The size and scope of the Android threatscape is evolving, adding new tactics and advanced approaches that extend beyond malicious applications.
Heise Security published a suggestion that Microsoft is reading users’ Skype messages, but Microsoft maintains automated scanning is used to identify suspected spam and phishing links.
Infosecurity Europe has released basic figures on last month’s eighteenth annual exhibition and conference: pre-ABC audit figures show a 6% increase in visitors over 2012 to 13,200, with more than 70 new exhibitors.