Menu

Category Archives: Security

Articles about security

Fujitsu SaaS Hack Sends Govt. of Japan Scrambling
Cryptocurrency scam attack on Twitter reminds users to check their app connections
Fujitsu pulls ProjectWEB tool offline after apparent supply chain attack sees Japanese infosec agency data stolen
Biden’s Cybersecurity Executive Order Puts Emphasis on the Wrong Issues
Security automation for digital transformation
I hacked my friend’s website after a SIM swap attack

Here’s how easily your phone number could be stolen, why a successful SIM swap scam is only the beginning of your problems, and how you can avoid becoming a victim of the attack The post I hacked my friend’s website after a SIM swap attack appeared first on WeLiveSecurity

Unfixable Apple M1 chip bug enables cross-process chatter, breaking OS security model
Smashing Security podcast #229: Dating leaks, right to repair, and a stinky bishop

Patch for CVE-2020-24119.

CVE-2021-3480: invalid BIND DN crash

Patch for CVE-2020-24119.

CVE-2021-3480: invalid BIND DN crash

An update that fixes one vulnerability is now available.

PDF Feature ‘Certified’ Widely Vulnerable to Attack
VMware Sounds Ransomware Alarm Over Critical Severity Bug
Bluetooth bugs could allow attackers to impersonate devices

Patches to remedy the vulnerabilities should be released over the coming weeks The post Bluetooth bugs could allow attackers to impersonate devices appeared first on WeLiveSecurity

Multiple vulnerabilities have been found in Ceph, the worst of which could result in privilege escalation.

BazaLoader Masquerades as Movie-Streaming Service
‘Privateer’ Threat Actors Emerge from Cybercrime Swamp
A Peek Inside the Underground Ransomware Economy
What to do about open source vulnerabilities? Move fast, says Linux Foundation expert

nginx could be made to crash or run programs if it received specially crafted network traffic.

A vulnerability in Nextcloud Desktop Client could allow a remote attacker to execute arbitrary commands.

Actionable threat intelligence for publicly known exploits for RHEL

Multiple vulnerabilities have been found in cURL, the worst of which could result in the arbitrary execution of code.

Computer Misuse Act: Tell the Home Office infosec needs a public interest defence in law, says CyberUp campaign

Multiple vulnerabilities have been found in OpenSSH, the worst of which could allow a remote attacker to execute arbitrary code.

The package thunderbird before version 78.10.2-1 is vulnerable to multiple issues including content spoofing and information disclosure.

The package hivex before version 1.3.20-1 is vulnerable to denial of service.

In-person cybersec training? Yes, it’s back on the agenda this year
Contract killer: Certified PDFs can be secretly tampered with during the signing process, boffins find
VMware reveals critical vCenter hole it says ‘needs to be considered at once’

If you’re an admin, service provider, security executive, or are otherwise affiliated with the world of IT solutions, then you know that one of the biggest challenges to overcome is efficacy. Especially in terms of cybersecurity, efficacy is something of an amorphous term; everyone wants it to be better, but what exactly does that mean? […]

Threat Actor ‘Agrius’ Emerges to Launch Wiper Attacks Against Israeli Targets

An update that fixes one vulnerability is now available.

Red Hat OpenShift Container Platform release 4.7.12 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.7.

Red Hat OpenShift Container Platform release 4.7.12 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.7.12.

Red Hat OpenShift Container Platform release 4.7.12 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.7.12.

Release of OpenShift Serverless Client kn 1.14.1 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from

Snowden was right, rules human rights court as it declares UK spy laws broke ECHR
Apple fixes macOS zero‑day bug that let malware take secret screenshots

You would do well to update to macOS Big Sur 11.4 post-haste The post Apple fixes macOS zero‑day bug that let malware take secret screenshots appeared first on WeLiveSecurity

Trend Micro Bugs Threaten Home Network Security
Brit watchdog shows some teeth over McAfee antivirus auto-renewals
Combatting Insider Threats with Keyboard Security
Bose Admits Ransomware Hit: Employee Data Accessed
Pulse Secure VPNs Get Quick Fix for Critical RCE
Apple Patches Zero-Day Flaw in MacOS that Allows for Sneaky Screenshots
DevSecOps compliance: Make your auditor’s job easier!
What ‘cross-cloud’ architects need to know
South Korea plans large scale quantum cryptography adoption, thanks in part to tech partnership with USA
Hard cheese: Stilton snap shared via EncroChat leads to drug dealer’s downfall
China’s Digital Yuan not aimed at challenging US dollar, says former People’s Bank governor
Apple patches macOS flaw exploited by malware to secretly snap screenshots
American Express Fined for Sending Millions of Spam Messages
Restaurant Reservation System Patches Easy-to-Exploit XSS Bug
Legacy data protection and modern ransomware? The odds are not in your favor
Icarus moment: Mozilla Thunderbird was saving OpenPGP keys in plaintext after encryption snafu
FBI Analyst Indicted for Theft of Osama bin Laden Threat Intel
ProxyJump is safer than SSH agent forwarding
Rom‑con: How romance fraud targets older people and how to avoid it

Online dating scams often follow the same script – here’s what senior citizens should watch out for and how their younger relatives can help them avoid falling victim The post Rom‑con: How romance fraud targets older people and how to avoid it appeared first on WeLiveSecurity

An update for openshift-serverless-1-kn-cli-artifacts-rhel8-container, openshift-serverless-1-knative-rhel8-operator-container, and openshift-serverless-1-serverless-operator-bundle-container is now available for Openshift Serveless 1.14.

Apple is happy to diss the desktop – it knows who’s got the most to lose
Air India admits to data breach impacting 4.5m customers, sat on the news for five weeks

An update that fixes one vulnerability is now available.

Roman Fiedler found that libX11, the X11 protocol client library, was vulnerable to protocol command injection due to insufficient validation of arguments to some functions.

Roman Fiedler reported that missing length validation in various functions provided by libx11, the X11 client-side library, allow to inject X11 protocol commands on X clients, leading to authentication bypass, denial of service or potentially the

Indonesia’s national health insurance scheme leaks at least a million citizens’ records

security update

– Update to 20.11.7 – Closes security issue CVE-2021-31215

– Security fix for CVE-2021-28363. – Security fix for *pip incorrectly handled unicode separators in git references*.

LinuxSecurity is in Beta: A Customized User Profile is Just the Beginning! >
American insurance giant CNA reportedly pays $40m to ransomware crooks
DarkSide Getting Taken to ‘Hackers’ Court’ For Not Paying Affiliates
Building SIEM for Today’s Threat Landscape
WP Statistics Bug Allows Attackers to Lift Data from WordPress Sites
UK Computer Misuse Act convictions declined last year despite pandemic explosion in online criminal activity
Email Campaign Spreads StrRAT Fake-Ransomware RAT
Here’s how we got persistent shell access on a Boeing 747 – Pen Test Partners
Google’s ‘Ask me anything’ on Privacy Sandbox was more about questions than answers
In search of good cybersecurity
Doncaster insurance firm One Call hit by not-dead-at-all Darkside ransomware gang
Toyota rear-ended by twin cyber attacks that left ransomware-shaped dents

security update

Cyber insurance giant CNA paid out $40 million to its ransomware attackers
100M Android Users Hit By Rampant Cloud Leaks
The Gig Economy Creates Novel Data-Security Risks
Android 12 will give you more control over how much data you share with apps

An all-new privacy dashboard and better location, microphone and camera controls are all aimed at curbing apps’ data-slurping habits The post Android 12 will give you more control over how much data you share with apps appeared first on WeLiveSecurity

Four Android Bugs Being Exploited in the Wild
2021 Attacker Dwell Time Trends and Best Defenses
Qlocker ransomware gang shuts shop after extorting owners of QNAP NAS drives
UK data regulator fines American Express up to 0.021p per email after opted-out folk spammed 4.1 million times
Apple Exec Calls Level of Mac Malware ‘Unacceptable’
Smashing Security podcast #228: Pipeline pickle, Blockchain bollocks, and Eufy SNAFU

security update

Can Nanotech Secure IoT Devices From the Inside-Out?
Microsoft, Google Clouds Hijacked for Gobs of Phishing
Scams target families of missing persons, FBI warns

Con artists use social media to find and target victims for various nefarious ends, including to extort relatives of missing persons The post Scams target families of missing persons, FBI warns appeared first on WeLiveSecurity

Keksec Cybergang Debuts Simps Botnet for Gaming DDoS
Fake Microsoft Authenticator extension discovered in Chrome Store
Windows PoC Exploit Released for Wormable RCE