Menu

Monthly Archives: June 2021

Microsoft hooks up with MITRE to map Azure’s ATT&CK surface for ‘proactive security’
PrintNightmare, the zero-day hole in Windows – here’s what to do
Indexsinas SMB Worm Campaign Infests Whole Enterprises
Global police shut down VPN service favored by cybercriminals

A global operation takes down the infrastructure of DoubleVPN and seizes data about its customers The post Global police shut down VPN service favored by cybercriminals appeared first on WeLiveSecurity

International law enforcement op nukes Russian-language DoubleVPN service allegedly favoured by cybercriminals
Microsoft faces up to an old foe with out-of-band patch for PDF weirdness
Data for 700 million LinkedIn users up for grabs on hacker forum

Information scraped from LinkedIn user profiles includes full names, gender, email addresses and phone numbers The post Data for 700 million LinkedIn users up for grabs on hacker forum appeared first on WeLiveSecurity

Why MTTR is Bad for SecOps
Received a WhatsApp verification code without requesting it? Beware – you might be about to have your account stolen
Zero-Day Used to Wipe My Book Live Devices
PoC Exploit Circulating for Critical Windows Print Spooler Bug
Leaked print spooler exploit lets Windows users remotely execute code as system on your domain controller
Colombian police arrest Gozi malware suspect after 8 years at large
8-month suspended sentence for script kiddie who DDoS’d Labour candidate in runup to 2019 UK general election

X.Org X Server could be made to crash or run programs if it received specially crafted input.

Feds Told to Better Manage Facial Recognition, Amid Privacy Concerns

An update that fixes three vulnerabilities is now available.

An update that solves four vulnerabilities and has 98 fixes is now available.

Police warn of WhatsApp scams in time for Social Media Day

An update is now available for Red Hat OpenShift Container Platform 3.11. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability

An update that fixes three vulnerabilities is now available.

An update that solves three vulnerabilities and has three fixes is now available.

UK arm of international charity the Salvation Army hit by ransomware attack
Common Facebook scams and how to avoid them

Are you on Facebook? So are scammers. Here are some of the most common con jobs on Facebook you should watch out for and how you can tell if you’re being scammed. The post Common Facebook scams and how to avoid them appeared first on WeLiveSecurity

America tops ITU’s Global Cyber Security Index, UK in tie for second with Saudi Arabia
Subdomain security is substandard, say security researchers
You can hijack Google Cloud VMs using DHCP floods, says this guy, once the stars are aligned and…
Samsung commits to 5 years of Android updates… for its enterprise smartphone users at least
Users Clueless About Cybersecurity Risks: Study
Intel sticks another nail in the coffin of TSX with feature-disabling microcode update
In Memoriam: John McAfee

What was it like to work for, and be friends with, the larger-than-life technology entrepreneur back when he helped shape the computer security industry? The post In Memoriam: John McAfee appeared first on WeLiveSecurity

Microsoft Translation Bugs Open Edge Browser to Trivial UXSS Attacks
UK Cabinet Office’s spending on cybersecurity training rises by 500% in a year

An update for lz4 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from

An update for fwupd is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from

An update for libxml2 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from

An update for rpm is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from

Open Source Utilization in Email Security Demystified>

An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability

An update for the 389-ds:1.4 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which

Details of RCE Bug in Adobe Experience Manager Revealed
Watchdog bans crypto super-exchange Binance from ‘regulated activities’ in the UK
Cobalt Strike Usage Explodes Among Cybercrooks
America world’s sole cyber superpower, ten years ahead of China, says Brit think tank
Data for 700M LinkedIn Users Posted for Sale in Cyber-Underground
5G Security Vulnerabilities Fluster Mobile Operators
NVIDIA Patches High-Severity GeForce Spoof-Attack Bug
Microsoft approved a Windows driver booby-trapped with rootkit malware
Attackers Breach Microsoft Customer Service Accounts
Microsoft Signs Malware That Spreads Through Gaming
Critical CISO Initiatives for the Second Half of 2021
One billion dollars lost by over-60s through online fraud in 2020, says FBI

The XML parsers used by XMLBeans did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include the possibility for XML Entity Expansion attacks which could lead to a denial-of-service. This update implements sensible defaults for the XML parsers to prevent these kind

An update that fixes two vulnerabilities is now available.

security update

An update that fixes one vulnerability is now available.

An update that fixes one vulnerability is now available.

Two vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service or the execution of arbitrary code if malformed image files are processed.

An update that fixes three vulnerabilities is now available.

An update that contains security fixes can now be installed.

Two issues have been found in bluez, a package with Bluetooth tools and daemons. One issue is about a man-in-the-middle attack during secure pairing, the other is about information disclosure due to improper access

An update that fixes two vulnerabilities is now available.

This update ships updated CPU microcode for some types of Intel CPUs and provides mitigations for security vulnerabilities which could result in privilege escalation in combination with VT-d and various side channel attacks.

SolarWinds backdoor gang pwned Microsoft support agent to turn sights on customers
Jailed for seven years: Cyber-crook who broke into Big Biz to steal bank card info for FIN7 super-gang

For many U.S. workers the switch to remote work is a permanent one. That means more high-stakes work is being conducted on self-configured home networks. For others, home networks are simply hosting more devices as smart doorbells, thermostats and refrigerators now connect to the internet. Security experts warn that while the internet of things (IoT) […]

AWS launches BugBust contest: Help fix a $100m problem for a $12 tshirt
Mercedes-Benz Customer Data Flies Out the Window

Add fix to CVE-2021-28041

**Version 6.5.0** (June 16th, 2021) * **SECURITY** Fixes **CVE-2021-34551**, a complex RCE affecting Windows hosts. See SECURITY.md for details. * The fix for this issue changes the way that language files are loaded. While they remain in the same PHP-like format, they are processed as plain text, and any code in them will not be […]

PS3 Players Ban: Latest Victims of Surging Attacks on Gaming Industry  

**Version 6.5.0** (June 16th, 2021) * **SECURITY** Fixes **CVE-2021-34551**, a complex RCE affecting Windows hosts. See SECURITY.md for details. * The fix for this issue changes the way that language files are loaded. While they remain in the same PHP-like format, they are processed as plain text, and any code in them will not be […]

An update that solves three vulnerabilities and has three fixes is now available.

Password predictability is one of the most significant challenges to overall online security. Well aware of this trend, hackers often seek to exploit what they assume are the weak passwords of the average computer user. With a little bit of background information, “brute forcing” a simple password is a straightforward undertaking. How are passwords cracked? […]

FIN7 ‘Pen Tester’ Headed to Jail Amid $1B in Payment-Card Losses
Dell SecureAssist contained RCE flaw allowing miscreants to remotely reflash your BIOS with code of their creation
Gaming industry under siege from cyberattacks during pandemic

Cyberattacks targeting the gaming industry skyrocket, with web attacks more than tripling year-on-year in 2020 The post Gaming industry under siege from cyberattacks during pandemic appeared first on WeLiveSecurity

Cisco ASA Bug Now Actively Exploited as PoC Drops
My Book Live Users Wake Up to Wiped Devices, Active RCE Attacks
Pull your Western Digital My Book Live NAS off the internet now if you value your files
Ever wondered what makes hackers tick? Find out from Kevin Mitnick at this virtual event
Hackers Crack Pirated Games with Cryptojacking Malware
FIN7 hacking gang’s “pen tester” jailed for seven years by US court
Disconnect your WD My Book Live from the internet or face data deletion, says Western Digital

A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory, resulting in a crash. The highest threat from this vulnerability is to system availability (CVE-2020-27840).

Updated graphicsmagick packages fix security vulnerabilities: The graphicsmagick package has been updated to version 1.3.36, fixing several security issues and other bugs. See the upstream NEWS file for details.

A memory leak was discovered in Mat_VarCalloc in mat.c in matio 1.5.17 because SafeMulDims does not consider the rank==0 case (CVE-2019-20052). References: – https://bugs.mageia.org/show_bug.cgi?id=27969

Several security issues were fixed in Thunderbird.

British tourists charged £1000s for pier visits in billing blunder
Application analysis in the DevSecOps life cycle
‘What are the odds someone will find and exploit this?’ Nice one — you just released an insecure app
Cloud security is still a work in progress
Who would cross the Bridge of Death? Answer me these questions three! Oh and you’ll need two-factor authentication

An update that fixes one vulnerability is now available.

An update that fixes two vulnerabilities is now available.

Spam Downpour Drips New IcedID Banking Trojan Variant
You won’t want that Linux bling if it comes from Pling: Marketplace platform has critical vulnerabilities
Would-be password-killer FIDO Alliance aims to boost uptake with new UX guidelines
Oh FCUK! Fashion Label, Medical Diagnostics Firm Latest REvil Victims
Romance in 2021: Using creepware to keep tabs on your partner or ex. Aww