Do Kwon's Extradition Approved, But Destination Is Unclear

Leader Of Killnet Crew Unmasked By Russian State Media

ownCloud Flaws Lead To Sensitive Info Disclosure, Auth Bypass

Hackers Hijack Industrial Control System At US Water Utility

You Don’t Need to Turn Off Apple’s NameDrop Feature in iOS 17

Yes, your iPhone automatically turns on NameDrop with the latest software update. But you shouldn’t really be worried about it—regardless of what the police are saying.

EvilSlackbot: A Slack Attack Framework

submitted by /u/Dr_Mantis_Tobbogon
[link] [comments]

Experts Uncover Passive Method to Extract Private RSA Keys from SSH Connections

A new study has demonstrated that it's possible for passive network attackers to obtain private RSA host keys from a vulnerable SSH server by observing when naturally occurring computational faults that occur while the connection is being established. The Secure Shell (SSH) protocol is a method for securely transmitting commands and logging in to a computer over an unsecured network. Based on a

Leader of pro-Russia DDoS crew Killnet 'unmasked' by Russian state media

Also: NXP China attack, Australia can't deliver on ransom payment ban (yet), and Justin Sun's very bad month

Infosec in Brief Cybercriminals working out of Russia go to great lengths to conceal their real identities, and you won't ever find the state trying to unmask them either – as long as they keep supplying the attacks on Axis nations. It's the reason why we found it so amusing that of all the ways the identity of an organized cybercrime gang leader could be revealed, it was Russian state media that may have recently outed someone of note.…

Education is the foundation of modern cyber defence

How to enhance employee career development and retain skilled staff with SANS cyber training

Sponsored Post Every organisation needs to make cyber security training a high priority. Effective education is an essential part of improving security practices and fostering a sound security posture.…

Ransomware-hit British Library: Too open for business, or not open enough?

Unique institutions need unique security. Instead, they're fobbed off with the same old, same old

Opinion The British Library’s showpiece site, in a listed red brick building in St Pancras, is presided over by a large bronze sculpture depicting Isaac Newton poring over a document he’s working with, measuring it with dividers.…

U.S., U.K., and Global Partners Release Secure AI System Development Guidelines

The U.K. and U.S., along with international partners from 16 other countries, have released new guidelines for the development of secure artificial intelligence (AI) systems. "The approach prioritizes ownership of security outcomes for customers, embraces radical transparency and accountability, and establishes organizational structures where secure design is a top priority," the U.S.

Crypto crasher Do Kwon's extradition approved, but destination is unclear

Hey Google, are the jails nicer in South Korea or the US?

Terraform Labs founder Do Kwon – a wanted man in both South Korea and the United States – will soon face extradition from Montenegro after a court gave approval for his removal.…

Beijing fosters foreign influencers to spread its propaganda

They get access to both China's internet and global platforms, and cash in on both

China is offering foreign influencers access to its vast market in return for content that sings its praises and helps to spreads Beijing's desired narratives more widely around the world, according to think tank the Australian Strategic Policy Institute (ASPI).…

Weekly Update 375

For a weekly update with no real agenda, we sure did spend a lot of time talking about the ridiculous approach Harvey Norman took to dealing with heavy traffic on Black Friday. It was just... unfathomable. A bunch of people chimed into the tweet thread and suggested it may have been by design, but they certainly wouldn't have set out to achieve the sorts of headlines that adorned the news afterwards. Who knows, but it made for entertaining content this week 🙂

References

1. Sponsored by: Kolide ensures that if a device isn't secure, it can't access your apps. It's Device Trust for Okta. Watch the demo today!
2. The Harvey Norman website outage was just, dumb (some people suggested it was a deliberate strategy to create demand)
3. Unifi has launched a search feature for license plate recognition in their Protect app (I'd really like to see this data surfaced into Home Assistant so I can trigger events off specific vehicles)
4. I mentioned Ubiquiti's funny ads about subscription services for video being reminiscent of the old "Mac versus PC ads" (there's a whole series of these, check out their YouTube channel for more)
5. Australia Post's approach to verifying identities using digital driver's license appears to be "she'll be right mate" (let's see if that's just a teething problem and they start using the proper verifier soon)

Defending Azure Active Directory (Entra ID): Unveiling Threats Through Hunting Techniques

submitted by /u/Or1rez
[link] [comments]

Private and Secure Web Search Engines: DuckDuckGo, Brave, Kagi, Startpage

What you look for online is up to you—just make sure no one else is taking a peek.

Open Source Security Assessment Collaboration Platform

submitted by /u/ascetik
[link] [comments]

North Korean Software Supply Chain Attack Hits North America, Asia

Novel Mirai-Based DDoS Botnet Exploits 0-Days To Infect Routers And Security Cameras

Gulf Air Exposed To Data Breach, Vital Operations Not Affected

Sensitive Kubernetes Secrets Discovered Exposed

OpenCart Owner Turns Air Blue After Researcher Discloses Serious Vuln

Google’s Ad Blocker Crackdown Is Growing

Plus: North Korean supply chain attacks, a Russian USB worm spreads internationally, and more.

Telekopye's tricks of the trade – Week in security with Tony Anscombe

ESET's research team reveals details about the onboarding process of the Telekopye scam operation and the various methods that the fraudsters use to defraud people online

New 'HrServ.dll' Web Shell Detected in APT Attack Targeting Afghan Government

An unspecified government entity in Afghanistan was targeted by a previously undocumented web shell called HrServ in what’s suspected to be an advanced persistent threat (APT) attack. The web shell, a dynamic-link library (DLL) named “hrserv.dll,” exhibits “sophisticated features such as custom encoding methods for client communication and in-memory execution,” Kaspersky security researcher Mert

Warning: 3 Critical Vulnerabilities Expose ownCloud Users to Data Breaches

The maintainers of the open-source file-sharing software ownCloud have warned of three critical security flaws that could be exploited to disclose sensitive information and modify files. A brief description of the vulnerabilities is as follows - CVE-2023-49103 (CVSS score: 10.0) - Disclosure of sensitive credentials and configuration in containerized deployments impacting graphapi versions from

OpenCart owner turns air blue after researcher discloses serious vuln

Web storefront maker fixed the flaw, but not before blasting infoseccer

The owner of the e-commerce store management system OpenCart has responded with hostility to a security researcher disclosing a vulnerability in the product.…

Cybercriminals Using Telekopye Telegram Bot to Craft Phishing Scams on a Grand Scale

More details have emerged about a malicious Telegram bot called Telekopye that's used by threat actors to pull off large-scale phishing scams. "Telekopye can craft phishing websites, emails, SMS messages, and more," ESET security researcher Radek Jizba said in a new analysis. The threat actors behind the operation – codenamed Neanderthals – are known to run the criminal enterprise as a

Go on a Psychedelic Journey of the Internet's Growth and Evolution

Security researcher Barrett Lyon, who makes visualizations of the internet's network infrastructure, is back with a new piece chronicling the rise of the IPv6 protocol.

Tell Me Your Secrets Without Telling Me Your Secrets

The title of this article probably sounds like the caption to a meme. Instead, this is an actual problem GitGuardian's engineers had to solve in implementing the mechanisms for their new HasMySecretLeaked service. They wanted to help developers find out if their secrets (passwords, API keys, private keys, cryptographic certificates, etc.) had found their way into public GitHub repositories. How

Hamas-Linked Cyberattacks Using Rust-Powered SysJoker Backdoor Against Israel

Cybersecurity researchers have shed light on a Rust version of a cross-platform backdoor called SysJoker, which is assessed to have been used by a Hamas-affiliated threat actor to target Israel amid the ongoing war in the region. “Among the most prominent changes is the shift to Rust language, which indicates the malware code was entirely rewritten, while still maintaining similar

Comprehensive guide on writing your first metasploit remote code execution module

submitted by /u/security_aaudit
[link] [comments]

Telekopye: Chamber of Neanderthals’ secrets

Insight into groups operating Telekopye bots that scam people in online marketplaces

Kubernetes Secrets of Fortune 500 Companies Exposed in Public Repositories

Cybersecurity researchers are warning of publicly exposed Kubernetes configuration secrets that could put organizations at risk of supply chain attacks. “These encoded Kubernetes configuration secrets were uploaded to public repositories,” Aqua security researchers Yakir Kadkoda and Assaf Morag said in a new research published earlier this week. Some of those impacted include two top blockchain

BlackCat claims it is behind Fidelity National Financial ransomware shakedown

One of US's largest underwriters forced to shut down a number of key systems

Fortune 500 insurance biz Fidelity National Financial (FNF) has confirmed that it has fallen victim to a "cybersecurity incident."…

Hide files inside images

submitted by /u/JizosKasa
[link] [comments]

Konni Group Using Russian-Language Malicious Word Docs in Latest Attacks

A new phishing attack has been observed leveraging a Russian-language Microsoft Word document to deliver malware capable of harvesting sensitive information from compromised Windows hosts. The activity has been attributed to a threat actor called Konni, which is assessed to share overlaps with a North Korean cluster tracked as Kimsuky (aka APT43). "This campaign relies on a remote access trojan

It's Time to Log Off

There’s a devastating amount of heavy news these days. Psychology experts say you need to know your limits—and when to put down the phone.

CVE-2023-46604: Attacking & Defending ActiveMQ

submitted by /u/gfekkas
[link] [comments]

Industry piles in on North Korea for sustained rampage on software supply chains

Kim’s cyber cronies becoming more active, sophisticated in attempts to pwn global orgs

The national cybersecurity organizations of the UK and the Republic of Korea (ROK) have issued a joint advisory warning of an increased volume and sophistication of North Korean software supply chain attacks. …

Alert: New WailingCrab Malware Loader Spreading via Shipping-Themed Emails

Delivery- and shipping-themed email messages are being used to deliver a sophisticated malware loader known as WailingCrab. "The malware itself is split into multiple components, including a loader, injector, downloader and backdoor, and successful requests to C2-controlled servers are often necessary to retrieve the next stage," IBM X-Force researchers Charlotte Hammond, Ole Villadsen, and Kat

Attack on direct debit provider London & Zurich leaves customers with 6-figure backlogs

Customers complain of poor comms during huge outage that’s sparked payroll fears

A ransomware attack and resulting outages at direct debit collection company London & Zurich has forced at least one customer to take out a short-term loan as six-figure backlogs continue to cause cash flow mayhem.…

6 Steps to Accelerate Cybersecurity Incident Response

Modern security tools continue to improve in their ability to defend organizations’ networks and endpoints against cybercriminals. But the bad actors still occasionally find a way in. Security teams must be able to stop threats and restore normal operations as quickly as possible. That’s why it’s essential that these teams not only have the right tools but also understand how to effectively

Mirai-based Botnet Exploiting Zero-Day Bugs in Routers and NVRs for Massive DDoS Attacks

An active malware campaign is leveraging two zero-day vulnerabilities with remote code execution (RCE) functionality to rope routers and video recorders into a Mirai-based distributed denial-of-service (DDoS) botnet. “The payload targets routers and network video recorder (NVR) devices with default admin credentials and installs Mirai variants when successful,” Akamai said in an advisory

Stop social engineering at the IT help desk

How Secure Service Desk thwarts social engineering attacks and secures user verification

Sponsored Post Ransomware can hit any organization at any time, and hackers are proving adept at social engineering techniques to gain access to sensitive data in any way they can.…

Mirai malware infects routers and cameras for new botnet

Akamai sounds the alarm – won't name the manufacturers yet

Akamai has uncovered two zero-day bugs capable of remote code execution, both being exploited to distribute the Mirai malware and built a botnet army for distributed denial of service (DDoS) attacks.…

N. Korean Hackers Distribute Trojanized CyberLink Software in Supply Chain Attack

A North Korean state-sponsored threat actor tracked as Diamond Sleet is distributing a trojanized version of a legitimate application developed by a Taiwanese multimedia software developer called CyberLink to target downstream customers via a supply chain attack. "This malicious file is a legitimate CyberLink application installer that has been modified to include malicious code that downloads,

New Relic warns customers it's experienced a cyber … something

Users told to hold tight and await instructions as investigation continues

Web tracking and analytics outfit New Relic has issued a scanty security advisory warning customers it has experienced a scary cyber something.…

North Korea makes finding a gig even harder by attacking candidates and employers

That GitHub repo an interviewer wants you to work on could be malware

Palo Alto Networks' Unit 42 has detailed a pair of job market hacking schemes linked to state-sponsored actors in North Korea: one in which the threat actors pose as job seekers, the other as would-be employers.…

How to give Windows Hello the finger and login as someone on their stolen laptop

Not that we're encouraging anyone to defeat this fingerprint authentication

Hardware security hackers have detailed how it's possible to bypass Windows Hello's fingerprint authentication and login as someone else – if you can steal or be left alone with their vulnerable device.…

US nuke reactor lab hit by 'gay furry hackers' demanding cat-human mutants

Staff records swiped, leaked by gang who probably read one too many comics, sorry, graphic novels

The self-described "gay furry hackers" of SiegedSec are back: this time boasting they've broken into America's biggest nuclear power lab's computer systems and stolen records on thousands of employees. Some of that data has already been leaked, it appears.…

4 of the top 10 password strength tools are giving people bad password advice, and they don't care.

submitted by /u/ezzzzz
[link] [comments]

Diamond Sleet supply chain compromise distributes a modified CyberLink installer

submitted by /u/SCI_Rusher
[link] [comments]

New Flaws in Fingerprint Sensors Let Attackers Bypass Windows Hello Login

A new research has uncovered multiple vulnerabilities that could be exploited to bypass Windows Hello authentication on Dell Inspiron 15, Lenovo ThinkPad T14, and Microsoft Surface Pro X laptops. The flaws were discovered by researchers at hardware and software product security and offensive research firm Blackwing Intelligence, who found the weaknesses in the fingerprint sensors from Goodix,

IPSec Analysis (X-Post from /r/malware)

submitted by /u/tohitsugu
[link] [comments]

185,000 Individuals Impacted By MOVEit Hack At AutoZone

Sam Altman Is Back As OpenAI CEO Just Days After Being Removed, Along With A New Board

Kinsing Malware Exploits Critical Apache ActiveMQ Flaw To Mine Crypto

Windows Hello Fingerprint Authentication Bypassed On Popular Laptops

USB Worm Unleashed By Russian State Hackers Spreads Worldwide