FreshRSS

πŸ”’
☐ β˜† βœ‡ The Hacker News

Lazarus Group Using Log4j Exploits to Deploy Remote Access Trojans

By Newsroom β€” December 11th 2023 at 13:00
The notorious North Korea-linked threat actor known as the Lazarus Group has been attributed to a new global campaign that involves the opportunistic exploitation of security flaws in Log4j to deploy previously undocumented remote access trojans (RATs) on compromised hosts. Cisco Talos is tracking the activity under the name Operation Blacksmith, noting the use of three DLang-based
☐ β˜† βœ‡ The Hacker News

Randstorm Exploit: Bitcoin Wallets Created b/w 2011-2015 Vulnerable to Hacking

By Newsroom β€” November 20th 2023 at 09:16
Bitcoin wallets created between 2011 and 2015 are susceptible to a new kind of exploit calledΒ RandstormΒ that makes it possible to recover passwords and gain unauthorized access to a multitude of wallets spanning several blockchain platforms. "Randstorm() is a term we coined to describe a collection of bugs, design decisions, and API changes that, when brought in contact with each other, combine
☐ β˜† βœ‡ The Hacker News

Do You Really Trust Your Web Application Supply Chain?

By The Hacker News β€” September 20th 2023 at 10:34
Well, you shouldn’t. It may already be hiding vulnerabilities. It's the modular nature of modern web applications that has made them so effective. They can call on dozens of third-party web components, JS frameworks, and open-source tools to deliver all the different functionalities that keep their customers happy, but this chain of dependencies is also what makes them so vulnerable. Many of
☐ β˜† βœ‡ Naked Security

Dangerous hole in Apache Commons Text – like Log4Shell all over again

By Paul Ducklin β€” October 18th 2022 at 17:26
Third time unlucky. Time to put your patching boots on again...

act-1200

☐ β˜† βœ‡ Naked Security

8 months on, US says Log4Shell will be around for β€œa decade or longer”

By Paul Ducklin β€” July 18th 2022 at 16:57
When it comes to cybersecurity, ask not what everyone else can do for you...

☐ β˜† βœ‡ Naked Security

Log4Shell-like security hole found in popular Java SQL database engine H2

By Paul Ducklin β€” January 7th 2022 at 19:32
"It's Log4Shell, Jim, but not as we know it." How to find and fix a JNDI-based vuln in the H2 Database Engine.

☐ β˜† βœ‡ Naked Security

S3 Ep64: Log4Shell again, scammers keeping busy, and Apple Home bug [Podcast + Transcript]

By Paul Ducklin β€” January 6th 2022 at 19:44
We're back for 2022 - listen now!

☐ β˜† βœ‡ Naked Security

FTC threatens β€œlegal action” over unpatched Log4j and other vulns

By Paul Ducklin β€” January 5th 2022 at 19:37
Remember the Equifax breach? Remember the $700m penalty? In case you'd forgotten, here's the FTC to refresh your memory!

☐ β˜† βœ‡ Naked Security

Log4Shell vulnerability Number Four: β€œMuch ado about something”

By Paul Ducklin β€” December 29th 2021 at 19:12
It's a Log4j bug, and you ought to patch it. But we don't think it's a critical crisis like the last one.

☐ β˜† βœ‡ Naked Security

Log4Shell explained – how it works, why you need to know, and how to fix it

By Paul Ducklin β€” December 13th 2021 at 19:41
Find out how to deal with the Log4Shell vulnerability right across your estate. Yes, you need to patch, but that helps everyone else along with you!

❌