FreshRSS

🔒
△ 🔃
☐ ☆ ✇ The Hacker News

New ShellBot DDoS Malware Variants Targeting Poorly Managed Linux Servers

By Ravie Lakshmanan — March 21st 2023 at 11:41
Poorly managed Linux SSH servers are being targeted as part of a new campaign that deploys different variants of a malware called ShellBot. "ShellBot, also known as PerlBot, is a DDoS Bot malware developed in Perl and characteristically uses IRC protocol to communicate with the C&C server," AhnLab Security Emergency response Center (ASEC) said in a report. ShellBot is installed on servers that
☐ ☆ ✇ Naked Security

Linux gets double-quick double-update to fix kernel Oops!

By Paul Ducklin — March 13th 2023 at 17:59
Linux doesn't BSoD. It has oopses and panics instead. (We show you how to make a kernel module to explore further.)

☐ ☆ ✇ The Hacker News

IceFire Ransomware Exploits IBM Aspera Faspex to Attack Linux-Powered Enterprise Networks

By Ravie Lakshmanan — March 9th 2023 at 14:01
A previously known Windows-based ransomware strain known as IceFire has expanded its focus to target Linux enterprise networks belonging to several media and entertainment sector organizations across the world. The intrusions entail the exploitation of a recently disclosed deserialization vulnerability in IBM Aspera Faspex file-sharing software (CVE-2022-47986, CVSS score: 9.8), according to
☐ ☆ ✇ The Hacker News

New Mirai Botnet Variant 'V3G4' Exploiting 13 Flaws to Target Linux and IoT Devices

By Ravie Lakshmanan — February 17th 2023 at 09:25
A new variant of the notorious Mirai botnet has been found leveraging several security vulnerabilities to propagate itself to Linux and IoT devices. Observed during the second half of 2022, the new version has been dubbed V3G4 by Palo Alto Networks Unit 42, which identified three different campaigns likely conducted by the same threat actor. "Once the vulnerable devices are compromised, they
☐ ☆ ✇ The Hacker News

Critical RCE Vulnerability Discovered in ClamAV Open Source Antivirus Software

By Ravie Lakshmanan — February 17th 2023 at 05:46
Cisco has rolled out security updates to address a critical flaw reported in the ClamAV open source antivirus engine that could lead to remote code execution on susceptible devices. Tracked as CVE-2023-20032 (CVSS score: 9.8), the issue relates to a case of remote code execution residing in the HFS+ file parser component. The flaw affects versions 1.0.0 and earlier, 0.105.1 and earlier, and
☐ ☆ ✇ The Hacker News

Linux Variant of Clop Ransomware Spotted, But Uses Faulty Encryption Algorithm

By Ravie Lakshmanan — February 7th 2023 at 11:02
The first-ever Linux variant of the Clop ransomware has been detected in the wild, but with a faulty encryption algorithm that has made it possible to reverse engineer the process. "The ELF executable contains a flawed encryption algorithm making it possible to decrypt locked files without paying the ransom," SentinelOne researcher Antonis Terefos said in a report shared with The Hacker News.
☐ ☆ ✇ The Hacker News

Alert: Hackers Actively Exploiting Critical "Control Web Panel" RCE Vulnerability

By Ravie Lakshmanan — January 12th 2023 at 06:48
Malicious actors are actively attempting to exploit a recently patched critical vulnerability in Control Web Panel (CWP) that enables elevated privileges and unauthenticated remote code execution (RCE) on susceptible servers. Tracked as CVE-2022-44877 (CVSS score: 9.8), the bug impacts all versions of the software before 0.9.8.1147 and was patched by its maintainers on October 25, 2022. Control
☐ ☆ ✇ Naked Security

Serious Security: How to improve cryptography, resist supply chain attacks, and handle data breaches

By Paul Ducklin — January 4th 2023 at 19:50
Lessons for us all: improve cryptography, fight cybercrime, own your supply chain... and don't steal my data and then pretend you're sorry.

☐ ☆ ✇ The Hacker News

New shc-based Linux Malware Targeting Systems with Cryptocurrency Miner

By Ravie Lakshmanan — January 4th 2023 at 08:32
A new Linux malware developed using the shell script compiler (shc) has been observed deploying a cryptocurrency miner on compromised systems. "It is presumed that after successful authentication through a dictionary attack on inadequately managed Linux SSH servers, various malware were installed on the target system," AhnLab Security Emergency Response Center (ASEC) said in a report published
☐ ☆ ✇ Naked Security

PyTorch: Machine Learning toolkit pwned from Christmas to New Year

By Paul Ducklin — January 1st 2023 at 21:36
The bad news: the crooks have your SSH private keys. The good news: only users of the "nightly" build were affected.

☐ ☆ ✇ The Hacker News

WordPress Security Alert: New Linux Malware Exploiting Over Two Dozen CMS Flaws

By Ravie Lakshmanan — January 2nd 2023 at 07:50
WordPress sites are being targeted by a previously unknown strain of Linux malware that exploits flaws in over two dozen plugins and themes to compromise vulnerable systems. "If sites use outdated versions of such add-ons, lacking crucial fixes, the targeted web pages are injected with malicious JavaScripts," Russian security vendor Doctor Web said in a report published last week. "As a result,
☐ ☆ ✇ The Hacker News

Cyber Security Is Not a Losing Game – If You Start Right Now

By The Hacker News — December 16th 2022 at 12:46
Reality has a way of asserting itself, irrespective of any personal or commercial choices we make, good or bad. For example, just recently, the city services of Antwerp in Belgium were the victim of a highly disruptive cyberattack.  As usual, everyone cried "foul play" and suggested that proper cybersecurity measures should have been in place. And again, as usual, it all happens a bit too late.
☐ ☆ ✇ The Hacker News

New GoTrim Botnet Attempting to Break into WordPress Sites' Admin Accounts

By Ravie Lakshmanan — December 14th 2022 at 14:12
A new Go-based botnet has been spotted scanning and brute-forcing self-hosted websites using the WordPress content management system (CMS) to seize control of targeted systems. "This new brute forcer is part of a new campaign we have named GoTrim because it was written in Go and uses ':::trim:::' to split data communicated to and from the C2 server," Fortinet FortiGuard Labs researchers Eduardo
☐ ☆ ✇ The Hacker News

Google Launches OSV-Scanner Tool to Identify Open Source Vulnerabilities

By Ravie Lakshmanan — December 13th 2022 at 18:22
Google on Tuesday announced the open source availability of OSV-Scanner, a scanner that aims to offer easy access to vulnerability information about various projects. The Go-based tool, powered by the Open Source Vulnerabilities (OSV) database, is designed to connect "a project's list of dependencies with the vulnerabilities that affect them," Google software engineer Rex Pan in a post shared
☐ ☆ ✇ The Hacker News

Cryptocurrency Mining Campaign Hits Linux Users with Go-based CHAOS Malware

By Ravie Lakshmanan — December 12th 2022 at 13:51
A cryptocurrency mining attack targeting the Linux operating system also involved the use of an open source remote access trojan (RAT) dubbed CHAOS. The threat, which was spotted by Trend Micro in November 2022, remains virtually unchanged in all other aspects, including when it comes to terminating competing malware, security software, and deploying the Monero (XMR) cryptocurrency miner. "The
☐ ☆ ✇ The Hacker News

The Value of Old Systems

By The Hacker News — December 2nd 2022 at 13:00
Old technology solutions – every organization has a few of them tucked away somewhere.  It could be an old and unsupported storage system or a tape library holding the still-functional backups from over 10 years ago.  This is a common scenario with software too. For example, consider an accounting software suite that was extremely expensive when it was purchased. If the vendor eventually went
☐ ☆ ✇ The Hacker News

New Chinese Malware Attack Framework Targets Windows, macOS, and Linux Systems

By Ravie Lakshmanan — October 13th 2022 at 12:17
A previously undocumented command-and-control (C2) framework dubbed Alchimist is likely being used in the wild to target Windows, macOS, and Linux systems. "Alchimist C2 has a web interface written in Simplified Chinese and can generate a configured payload, establish remote sessions, deploy payload to the remote machines, capture screenshots, perform remote shellcode execution, and run
☐ ☆ ✇ The Hacker News

Researchers Link Cheerscrypt Linux-Based Ransomware to Chinese Hackers

By Ravie Lakshmanan — October 3rd 2022 at 12:56
The recently discovered Linux-Based ransomware strain known as Cheerscrypt has been outed as a handiwork of a Chinese cyber espionage group known for operating short-lived ransomware schemes. Cybersecurity firm Sygnia attributed the attacks to a threat actor it tracks under the name Emperor Dragonfly, which is also known as Bronze Starlight (Secureworks) and DEV-0401 (Microsoft). "Emperor
☐ ☆ ✇ The Hacker News

New Malware Families Found Targeting VMware ESXi Hypervisors

By Ravie Lakshmanan — September 30th 2022 at 14:42
Threat actors have been found deploying never-before-seen post-compromise implants in VMware's virtualization software to seize control of infected systems and evade detection. Google's Mandiant threat intelligence division referred to it as a "novel malware ecosystem" that impacts VMware ESXi, Linux vCenter servers, and Windows virtual machines, allowing attackers to maintain persistent access
☐ ☆ ✇ The Hacker News

Firing Your Entire Cybersecurity Team? Are You Sure?

By The Hacker News — September 23rd 2022 at 10:20
What on earth were they thinking? That's what we – and other security experts – were wondering when content giant Patreon recently dismissed its entire internal cybersecurity team in exchange for outsourced services. Of course, we don't know the true motivations for this move. But, as outsiders looking in, we can guess the cybersecurity implications of the decision would be inescapable for any
☐ ☆ ✇ The Hacker News

SparklingGoblin APT Hackers Using New Linux Variant of SideWalk Backdoor

By Ravie Lakshmanan — September 14th 2022 at 10:20
A Linux variant of a backdoor known as SideWalk was used to target a Hong Kong university in February 2021, underscoring the cross-platform abilities of the implant.  Slovak cybersecurity firm ESET, which detected the malware in the university's network, attributed the backdoor to a nation-state actor dubbed SparklingGoblin. The unnamed university is said to have been already targeted by the
☐ ☆ ✇ The Hacker News

New Stealthy Shikitega Malware Targeting Linux Systems and IoT Devices

By Ravie Lakshmanan — September 7th 2022 at 12:38
A new piece of stealthy Linux malware called Shikitega has been uncovered adopting a multi-stage infection chain to compromise endpoints and IoT devices and deposit additional payloads. "An attacker can gain full control of the system, in addition to the cryptocurrency miner that will be executed and set to persist," AT&T Alien Labs said in a new report published Tuesday. The findings add to a
☐ ☆ ✇ The Hacker News

Google Launches New Open Source Bug Bounty to Tackle Supply Chain Attacks

By Ravie Lakshmanan — August 31st 2022 at 05:42
Google on Monday introduced a new bug bounty program for its open source projects, offering payouts anywhere from $100 to $31,337 (a reference to eleet or leet) to secure the ecosystem from supply chain attacks. Called the Open Source Software Vulnerability Rewards Program (OSS VRP), the offering is one of the first open source-specific vulnerability programs. With the tech giant the maintainer
☐ ☆ ✇ The Hacker News

"As Nasty as Dirty Pipe" — 8 Year Old Linux Kernel Vulnerability Uncovered

By Ravie Lakshmanan — August 22nd 2022 at 13:05
Details of an eight-year-old security vulnerability in the Linux kernel have emerged that the researchers say is "as nasty as Dirty Pipe." Dubbed DirtyCred by a group of academics from Northwestern University, the security weakness exploits a previously unknown flaw (CVE-2022-2588) to escalate privileges to the maximum level. "DirtyCred is a kernel exploitation concept that swaps unprivileged 
☐ ☆ ✇ The Hacker News

CISA Issues Warning on Active Exploitation of UnRAR Software for Linux Systems

By Ravie Lakshmanan — August 10th 2022 at 06:59
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a recently disclosed security flaw in the UnRAR utility to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. Tracked as CVE-2022-30333 (CVSS score: 7.5), the issue concerns a path traversal vulnerability in the Unix versions of UnRAR that can be triggered upon extracting a
☐ ☆ ✇ The Hacker News

Resolving Availability vs. Security, a Constant Conflict in IT

By The Hacker News — August 5th 2022 at 10:20
Conflicting business requirements is a common problem – and you find it in every corner of an organization, including in information technology. Resolving these conflicts is a must, but it isn’t always easy – though sometimes there is a novel solution that helps. In IT management there is a constant struggle between security and operations teams. Yes, both teams ultimately want to have secure
☐ ☆ ✇ The Hacker News

New Linux Malware Framework Lets Attackers Install Rootkit on Targeted Systems

By Ravie Lakshmanan — July 21st 2022 at 13:22
A never-before-seen Linux malware has been dubbed a "Swiss Army Knife" for its modular architecture and its capability to install rootkits. This previously undetected Linux threat, called Lightning Framework by Intezer, is equipped with a plethora of features, making it one of the most intricate frameworks developed for targeting Linux systems. "The framework has both passive and active
☐ ☆ ✇ The Hacker News

New 'FabricScape' Bug in Microsoft Azure Service Fabric Impacts Linux Workloads

By Ravie Lakshmanan — June 29th 2022 at 08:26
Cybersecurity researchers from Palo Alto Networks Unit 42 disclosed details of a new security flaw affecting Microsoft's Service Fabric that could be exploited to obtain elevated permissions and seize control of all nodes in a cluster. The issue, which has been dubbed FabricScape (CVE-2022-30137), could only be weaponized on containers that are configured to have runtime access. It has been 
☐ ☆ ✇ The Hacker News

CISA Warns of Active Exploitation of 'PwnKit' Linux Vulnerability in the Wild

By Ravie Lakshmanan — June 29th 2022 at 04:01
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) this week moved to add a Linux vulnerability dubbed PwnKit to its Known Exploited Vulnerabilities Catalog, citing evidence of active exploitation. The issue, tracked as CVE-2021-4034 (CVSS score: 7.8), came to light in January 2022 and concerns a case of local privilege escalation in polkit's pkexec utility, which allows an
☐ ☆ ✇ The Hacker News

Panchan: A New Golang-based Peer-To-Peer Botnet Targeting Linux Servers

By Ravie Lakshmanan — June 15th 2022 at 13:05
A new Golang-based peer-to-peer (P2P) botnet has been spotted actively targeting Linux servers in the education sector since its emergence in March 2022. Dubbed Panchan by Akamai Security Research, the malware "utilizes its built-in concurrency features to maximize spreadability and execute malware modules" and "harvests SSH keys to perform lateral movement." <!--adsense--> The feature-packed
☐ ☆ ✇ The Hacker News

New Syslogk Linux Rootkit Lets Attackers Remotely Command It Using "Magic Packets"

By Ravie Lakshmanan — June 14th 2022 at 08:54
A new covert Linux kernel rootkit named Syslogk has been spotted under development in the wild and cloaking a malicious payload that can be remotely commandeered by an adversary using a magic network traffic packet. "The Syslogk rootkit is heavily based on Adore-Ng but incorporates new functionalities making the user-mode application and the kernel rootkit hard to detect," Avast security
☐ ☆ ✇ The Hacker News

HelloXD Ransomware Installing Backdoor on Targeted Windows and Linux Systems

By Ravie Lakshmanan — June 13th 2022 at 08:55
Windows and Linux systems are being targeted by a ransomware variant called HelloXD, with the infections also involving the deployment of a backdoor to facilitate persistent remote access to infected hosts. "Unlike other ransomware groups, this ransomware family doesn't have an active leak site; instead it prefers to direct the impacted victim to negotiations through Tox chat and onion-based
☐ ☆ ✇ The Hacker News

Symbiote: A Stealthy Linux Malware Targeting Latin American Financial Sector

By Ravie Lakshmanan — June 9th 2022 at 12:08
Cybersecurity researchers have taken the wraps off what they call a "nearly-impossible-to-detect" Linux malware that could be weaponized to backdoor infected systems. Dubbed Symbiote by threat intelligence firms BlackBerry and Intezer, the stealthy malware is so named for its ability to conceal itself within running processes and network traffic and drain a victim's resources like a parasite.
☐ ☆ ✇ The Hacker News

Even the Most Advanced Threats Rely on Unpatched Systems

By The Hacker News — June 9th 2022 at 11:54
Common cybercriminals are a menace, there's no doubt about it – from bedroom hackers through to ransomware groups, cybercriminals are causing a lot of damage. But both the tools used and the threat posed by common cybercriminals pale in comparison to the tools used by more professional groups such as the famous hacking groups and state-sponsored groups. In fact, these tools can prove almost
☐ ☆ ✇ The Hacker News

EnemyBot Linux Botnet Now Exploits Web Server, Android and CMS Vulnerabilities

By Ravie Lakshmanan — May 30th 2022 at 10:30
A nascent Linux-based botnet named Enemybot has expanded its capabilities to include recently disclosed security vulnerabilities in its arsenal to target web servers, Android devices, and content management systems (CMS). "The malware is rapidly adopting one-day vulnerabilities as part of its exploitation capabilities," AT&T Alien Labs said in a technical write-up published last week. "Services
☐ ☆ ✇ Naked Security

“Dirty Pipe” Linux kernel bug lets anyone write to any file

By Paul Ducklin — March 8th 2022 at 19:37
Even read-only files can be written to, leading to a dangerously general purpose elevation-of-privilege attack.

pipe-1200

☐ ☆ ✇ Naked Security

Linux kernel patches “performance can be harmful” bug in video driver

By Paul Ducklin — February 1st 2022 at 19:59
This bug is fiendishly hard to exploit - but if you patch, it won't be there to exploit at all.

☐ ☆ ✇ Naked Security

“PwnKit” security bug gets you root on most Linux distros – what to do

By Paul Ducklin — January 26th 2022 at 19:58
An elevation of privilege bug that could let a "mostly harmless" user give themselves a instant root shell

☐ ☆ ✇ Naked Security

Serious Security: Linux full-disk encryption bug fixed – patch now!

By Paul Ducklin — January 14th 2022 at 21:58
Imagine if someone who didn't have your password could sneakily modify data that was encrypted with it.

☐ ☆ ✇ Naked Security

Microsoft Edge finally arrives on Linux – “Official” build lands in repos

By Paul Ducklin — October 28th 2021 at 23:03
Microsoft Edge for Linux makes an Official landing.

❌