Daft name, serious risk: Kit from ActionTec and Sagemcom remotely ruined and required replacement.
The post ‘Pumpkin Eclipse’ — 600,000+ Rural ISP Routers Bricked Beyond Repair appeared first on Security Boulevard.
As per recent reports a new social engineering attack attributed to the North Korea-linked Kimsuky hacking group is targeting human rights activists using fake Facebook accounts. This tactic, involving fictitious identities, marks a significant shift from their typical email-based spear-phishing strategies. According to a report by South Korean cybersecurity firm Genians, the attackers pose as […]
The post Alert: Kimsuky Hacking Group Targets Human Rights Activists appeared first on TuxCare.
The post Alert: Kimsuky Hacking Group Targets Human Rights Activists appeared first on Security Boulevard.
Is your website vulnerable to web-automated attacks? Learn how AI can help protect your business and customers from the growing threat of cybercrime.
The post From Phishing to Fraud: How AI Can Safeguard Your Customers appeared first on Security Boulevard.
"The 911 S5 botnet compromised approximately 19 million IP addresses and facilitated the submission of tens of thousands of fraudulent applications related to the Coronavirus Aid, Relief, and Economic Security Act programs by its users, resulting in the loss of billions of dollars to the U.S. government."911 S5 is a residential proxy botnet that allows its paying users, often cybercriminals, to select the IP addresses they can use to connect to the internet using intermediary, internet-connected computers that have been compromised without the computer owners’ knowledge. 911 S5 essentially enables cybercriminals to conceal their originating location, effectively defeating fraud detection systems, the U.S. Treasury explained. The 911 S5 botnet was also implicated in a series of bomb threats made in July 2022, according to the Treasury. Investigators found links of IP addresses within the proxy botnet network being used in this incident. The network was connected to 911 S5, a residential proxy service that allowed users to mask their IP addresses by routing their web activity through compromised devices. The 911 S5 service went offline in July 2022, following a purported hacking incident that damaged essential data. The disruption was reported by independent journalist Brian Krebs. Despite its shutdown, the impacts of its previous operations continued to reverberate, leading to the current sanctions.
Cyber attack tactics are evolving, according to a new report, from advanced campaigns to exploiting weaknesses, and cybersecurity teams should be optimally employed.
The post HP Report Surfaces Shifts in Cyber Attack Tactics appeared first on Security Boulevard.
AttackIQ has released two new attack graphs that seek to emulate the Tactics, Techniques and Procedures (TTPs) associated with and exhibited by the open-source Remote Access Trojan AsyncRAT during its activities in 2023.
The post Emulating the Open-Source Remote Access Trojan (RAT) AsyncRAT appeared first on AttackIQ.
The post Emulating the Open-Source Remote Access Trojan (RAT) AsyncRAT appeared first on Security Boulevard.
Ensuring that your password is unique and strong is essential. Refraining from using obvious words in relation to you like your name or personal information isn’t the way to go! Ensuring the use of multiple different types of characters such as (@#_$%!&), along with not using the same passwords regularly on different sites is recommended. Changing passwords on individual sites also helps as it allows for less easily guessed instances.
It’s recommended that when it comes to safe online shopping, using payment gateways like PayPal, Venmo, or Stripe is better. Other than those, credit cards should be preferred over debit as debit cards are linked to your bank account whilst credit cards can be protected better. Debit cards create higher risk events of personal and sensitive data being obtained.
Multi-factor authentication is an added utility which means that there is another safety layer added before anyone can access your account after knowing your username or password.
Multi-factor authentication protects in 3 layers: first your passwords, or then something personal to only you like your fingerprint, or facial recognition. The 3rd way is through MFA apps, or getting a code sent through your messages or your email, to make sure you can do safe online shopping and the purchase you’re making is actually coming from you.
When not using your own Wi-Fi, ensure you’re using secure, private networks for safe online shopping. Public Wi-Fi networks are much easier to access for scammers as poorly protected connections allow any information you find, very easily retrievable for them. This is especially dangerous if the public Wi-Fi network you’re using is at a mall while you try to access banking or payment sites for any purchases you will be making.
The key to safe online shopping is to use a secure website. The padlock icon near the URL and the URL itself starting with HTTPS means you’re on the right track- The S in the end stands for secure. If that final S isn’t visible, it means that you’re dealing with a site that isn’t encrypted. Search engines like Google tend to flag sites that don’t have a valid Secure Sockets Layer (SSL) certificate as unsecure. It’s better to not input your payment details into sites like these.
Email scams known as phishing have become the most common forms of scamming nowadays. Your inbox may contain an email that may present you with deals, discounts, and sales through names and links which are close misspellings of popular websites. They are easy to fall for and may be hard to detect if the email somehow automatically fails to end up in your spam folder.
Other than e-mails, social media is also a place where links that can’t be trusted would be presented to you. Be wary of TikTok advertisements or ads shown between your Instagram stories which present you with deals and offers that seem too good to be true. Now, it becomes harder to tell with the use of deepfakes and AI to show the promotion of these scam products by influential people.
Ensuring that personal information and data are regularly backed up on your device or saved on the external hard disk is essential now due to ransomware attackers that can access your device and close off your access to important files or delete them entirely. Ensuring you have completed software updates is essential too as they help in ensuring fewer ransomware attacks and vulnerabilities on your devices to invasions.
Some other ways to protect your device through your connection is: One, with a VPN, or two, by ensuring no details are saved on your browsers. VPN or Virtual Private Network encrypts your data and masks your IP addresses. This makes your identity, location, and browser activity hidden from potential attackers.
Secondly, make sure that your device forgets your credit card details or password details. If these are remembered by your browsers, it makes these pieces of information immensely easy for attackers to obtain as they are all stored in one place when accessed by them.
While some of these may seem more easily achievable and accessible than others, they’re all a step in making sure your information is protected. We recommend regularly practicing all the above tips. These steps work even better together. So make sure to update your passwords and data backups, apply VPNs, stay wary of phishing emails, and practice safe online shopping.
Ransomware is a serious threat, so be prepared! The average ransom demand is high, and paying doesn’t guarantee recovery. Backups are crucial for recovery, but testing and proper storage are essential. Ransomware attacks have become a significant threat to organizations of all sizes, and these malicious attacks can encrypt sensitive data, disrupt operations, and […]
The post Essential Strategies for Recovering from Ransomware Attacks appeared first on TuxCare.
The post Essential Strategies for Recovering from Ransomware Attacks appeared first on Security Boulevard.
Source: go.theregister.com – Author: Team Register Interview The cyberattacks against Las Vegas casinos over the summer put a big target on the backs of prime suspects Scattered Spider, according to Mandiant CTO Charles Carmakal. The Google-owned security biz has been tracking the loosely knit crew – believed to be teens and twenty-somethings located in the […]
La entrada Casino cyberattacks put a bullseye on Scattered Spider – and the FBI is closing in – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.
Enlarge (credit: JAVS)
A software maker serving more than 10,000 courtrooms throughout the world hosted an application update containing a hidden backdoor that maintained persistent communication with a malicious website, researchers reported Thursday, in the latest episode of a supply-chain attack.
The software, known as the JAVS Viewer 8, is a component of the JAVS Suite 8, an application package courtrooms use to record, play back, and manage audio and video from proceedings. Its maker, Louisville, Kentucky-based Justice AV Solutions, says its products are used in more than 10,000 courtrooms throughout the US and 11 other countries. The company has been in business for 35 years.
Researchers from security firm Rapid7 reported that a version of the JAVS Viewer 8 available for download on javs.com contained a backdoor that gave an unknown threat actor persistent access to infected devices. The malicious download, planted inside an executable file that installs the JAVS Viewer version 8.3.7, was available no later than April 1, when a post on X (formerly Twitter) reported it. It’s unclear when the backdoored version was removed from the company’s download page. JAVS representatives didn’t immediately respond to questions sent by email.
Source: thehackernews.com – Author: . May 23, 2024NewsroomRansomware / Virtualization Ransomware attacks targeting VMware ESXi infrastructure following an established pattern regardless of the file-encrypting malware deployed. “Virtualization platforms are a core component of organizational IT infrastructure, yet they often suffer from inherent misconfigurations and vulnerabilities, making them a lucrative and highly effective target for threat […]
La entrada Ransomware Attacks Exploit VMware ESXi Vulnerabilities in Alarming Pattern – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.
Source: patents.google.com[/caption]
However, recent research from cybersecurity firm GoGoByte reveals that some of the latest high-end cars such as the Tesla Model 3 incorporating the ultra-wideband technology, remain vulnerable.The researchers, demonstrated a successful relay attack against the latest Tesla Model 3 despite its UWB upgrade, using less than $100 worth of radio equipment to unlock the car instantly.
This vulnerability is particularly concerning as the keyless entry system also controls the car immobilizer that prevents engines from starting until the right key is recognized, potentially allowing an attacker to drive away with the car when successfully compromised.
Deepfake Zoom of Doom: Construction giant Arup Group revealed as victim of January theft—10% of net profit lost.
The post CFO Deepfake Redux — Arup Lost $26M via Video appeared first on Security Boulevard.
“Elder fraud and romance fraud schemes utilized by the subjects often target our most vulnerable citizens and the FBI is committed to pursuing justice for those who were victimized by these schemes.”Together, the fraud schemes of these 10 scammers deceived five state Medicaid programs, two Medicare Administrative Contractors, and two private health insurers, who made payments to them and their co-conspirators instead of depositing the reimbursement payments into bank accounts belonging to the hospitals.
Source: IC3[/caption]
Investment scams were the costliest elder fraud in 2023 and cost victims more than $1.2 billion in losses last year. Tech support scams, business email compromise scams, confidence and romance scams, government impersonation scams, and personal data breaches, all respectively cost victims hundreds of millions of dollars in 2023.
[caption id="attachment_69767" align="aligncenter" width="1400"]
Source: IC3[/caption]
On the state level, Florida ranked second in the country for the number of complaints and reported losses.
“It’s disturbing to hear the stories of financial hardship these schemes create,” said FBI Tampa Field Special Agent Rodney Crawford.“Combatting the financial exploitation of those over 60 years of age continues to be a priority of the FBI,” said FBI Assistant Director Michael Nordwall, who leads the Bureau’s Criminal Investigative Division. “Along with our partners, we continually work to aid victims and to identify and investigate the individuals and criminal organizations that perpetrate these schemes and target the elderly.” The agency regards elderly fraud as a more insidious threat than the report shows. Many of these crimes likely go unreported, as “only about half” of the fraud scam complaints that get through to IC3 include IC3 data, the report said. Media Disclaimer: This article is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.
Bishkek, the capital of Kyrgyzstan, is currently reeling under severe mob violence and escalating cyberattacks on Kyrgyzstan, marking a turbulent period for the nation.
The recent upheaval, primarily targeting foreign students, has drawn significant international attention and diplomatic concerns, particularly from India and Pakistan.
Source: X[/caption]
[caption id="attachment_69158" align="aligncenter" width="922"]
Source: X[/caption]
Source: X[/caption]
One of the hacktivist groups, Silent Cyber Force, posted a message titled "Greetings Citizens Of The World," condemning the violence against foreign students and declaring their intention to take down Kyrgyzstan's governmental websites and large networks.
Their message explicitly mentioned targeting various international adversaries but stated that the current focus is on Kyrgyzstan due to the perceived inaction of its government in protecting foreign students.
[caption id="attachment_69155" align="aligncenter" width="788"]
Source: X[/caption]
Despite these threats, the official websites of the targeted institutions appeared to be functioning normally when accessed. This raises questions about the hackers' actual capabilities or possible tactical delays in executing their threats. The full extent and impact of these cyberattacks on Kyrgyzstan will become clearer once official statements are released.
AttackIQ has released a new attack graph in response to the recently published CISA Advisory (AA24-131A) which disseminates known Tactics, Techniques, and Procedures (TTPs) and Indicators of Compromise (IOCs) associated to Black Basta ransomware, a ransomware variant whose operators have encrypted and stolen data from at least 12 out of 16 critical infrastructure sectors, including the Healthcare and Public Health (HPH) Sector.
The post Response to CISA Advisory (AA24-131A): #StopRansomware: Black Basta appeared first on AttackIQ.
The post Response to CISA Advisory (AA24-131A): #StopRansomware: Black Basta appeared first on Security Boulevard.
Hackers can find templates for DocuSign and other companies for their phishing campaigns on dark web marketplaces for as little as $10.
The post Hackers Use Fake DocuSign Templates to Scam Organizations appeared first on Security Boulevard.
Phish Ahoy! Hacker took advantage of Dell’s lack of anti-scraping defense.
The post Dell Hell Redux — More Personal Info Stolen by ‘Menelik’ appeared first on Security Boulevard.
A few weeks ago, Best Buy revealed its plans to deploy generative AI to transform its customer service function. It’s betting on the technology to create “new and more convenient ways for customers to get the solutions they need” and to help its customer service reps develop more personalized connections with its consumers. By the […]
The post Navigating the New Frontier of AI-Driven Cybersecurity Threats appeared first on Security Boulevard.
It’s never been more important for businesses to invest in the best security measures available to them. Hackers and cybercriminals are constantly attempting to attack organizations and access their data. What’s more, cyber attacks are becoming increasingly sophisticated and new threats are constantly emerging. So, it’s vital that businesses stay up-to-date with security measures to […]
The post How an Intrusion Detection System Can Ensure End-User Security appeared first on TuxCare.
The post How an Intrusion Detection System Can Ensure End-User Security appeared first on Security Boulevard.
In the realm of cybersecurity, vigilance is paramount. Recently, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) flagged a critical vulnerability in GitLab, a popular platform for collaborative software development. This GitLab password exploit tracked as CVE-2023-7028, has been actively exploited in the wild, posing significant risks to organizations utilizing GitLab for their development workflows. […]
The post CISA Alert: GitLab Password Exploit – Act Now For Protection appeared first on TuxCare.
The post CISA Alert: GitLab Password Exploit – Act Now For Protection appeared first on Security Boulevard.
The 2024 RSA Conference can be summed up in two letters: AI. AI was everywhere. It was the main topic of more than 130 sessions. Almost every company with a booth in the Expo Hall advertised AI as a component in their solution. Even casual conversations with colleagues over lunch turned to AI. In 2023, … Continued
The post The Rise of AI and Blended Attacks: Key Takeaways from RSAC 2024 appeared first on DTEX Systems Inc.
The post The Rise of AI and Blended Attacks: Key Takeaways from RSAC 2024 appeared first on Security Boulevard.
It was probably inevitable. Threat researchers detected bad actors using stolen credentials to target LLMs, with the eventual goal of selling the access to other hackers.
The post Novel LLMjacking Attacks Target Cloud-Based AI Models appeared first on Security Boulevard.
Source: X[/caption]
Wavcabs, a transportation service, and Auditco, an auditing company, were among the targets of these Cyber Army Russia Reborn cyberattacks. Wavcabs' online services were disrupted, with users encountering connection timeouts when attempting to access the website. Similarly, Auditco faced technical difficulties, as indicated by error code 522 on their site earlier.
[caption id="attachment_68071" align="alignnone" width="656"]
Source: X[/caption]
The Cyber Express has reached out to both organizations to learn more about this Cyber Army Russia Reborn cyberattack. Despite the severity of these cyber incidents, both Wavcabs and Auditco have not issued official statements regarding the attacks.
The lack of response leaves the claims of Cyber Army Russia Reborn's involvement unverified, highlighting the complexity of attributing cyberattacks to specific actors.
This is another attack that convinces the AI to ignore road signs:
Due to the way CMOS cameras operate, rapidly changing light from fast flashing diodes can be used to vary the color. For example, the shade of red on a stop sign could look different on each line depending on the time between the diode flash and the line capture.
The result is the camera capturing an image full of lines that don’t quite match each other. The information is cropped and sent to the classifier, usually based on deep neural networks, for interpretation. Because it’s full of lines that don’t match, the classifier doesn’t recognize the image as a traffic sign...
The post New Attack Against Self-Driving Car AI appeared first on Security Boulevard.
This is another attack that convinces the AI to ignore road signs:
Due to the way CMOS cameras operate, rapidly changing light from fast flashing diodes can be used to vary the color. For example, the shade of red on a stop sign could look different on each line depending on the time between the diode flash and the line capture.
The result is the camera capturing an image full of lines that don’t quite match each other. The information is cropped and sent to the classifier, usually based on deep neural networks, for interpretation. Because it’s full of lines that don’t match, the classifier doesn’t recognize the image as a traffic sign.
So far, all of this has been demonstrated before.
Yet these researchers not only executed on the distortion of light, they did it repeatedly, elongating the length of the interference. This meant an unrecognizable image wasn’t just a single anomaly among many accurate images, but rather a constant unrecognizable image the classifier couldn’t assess, and a serious security concern.
[…]
The researchers developed two versions of a stable attack. The first was GhostStripe1, which is not targeted and does not require access to the vehicle, we’re told. It employs a vehicle tracker to monitor the victim’s real-time location and dynamically adjust the LED flickering accordingly.
GhostStripe2 is targeted and does require access to the vehicle, which could perhaps be covertly done by a hacker while the vehicle is undergoing maintenance. It involves placing a transducer on the power wire of the camera to detect framing moments and refine timing control.
Research paper.
Recently, a wave of malware attacks has surfaced, exploiting vulnerabilities in the update mechanism of the eScan antivirus software. This eScan antivirus backdoor exploit distributes backdoors and cryptocurrency miners, such as XMRig, posing a significant threat to large corporate networks. In this blog, we’ll look into the details of this eScan antivirus backdoor exploit and […]
The post Backdoors and Miners Amid eScan Antivirus Backdoor Exploit appeared first on TuxCare.
The post Backdoors and Miners Amid eScan Antivirus Backdoor Exploit appeared first on Security Boulevard.
Last week on Malwarebytes Labs:
Stay safe!
Our business solutions remove all remnants of ransomware and prevent you from getting reinfected. Want to learn more about how we can help protect your business? Get a free trial below.
Apple has reportedly sent alerts to individuals in 92 nations on Wednesday, April 10, to say it’s detected that they may have been a victim of a mercenary attack. The company says it has sent out these types of threat notifications to over 150 countries since the start in 2021.
Mercenary spyware is used by governments to target people like journalists, political activists, and similar targets, and involves the use of sophisticated tools like Pegasus. Pegasus is one of the world’s most advanced and invasive spyware tools, known to utilize zero-day vulnerabilities against mobile devices.
The second number became known when Apple changed the wording of the relevant support page. The change also included the title that went from “About Apple threat notifications and protecting against state-sponsored attacks” to “About Apple threat notifications and protecting against mercenary spyware.”
If you look at the before and after, you’ll also notice an extra paragraph, again with the emphasis on the change from “state-sponsored attacks” to “mercenary spyware.”
The cause for the difference in wording might be because “state-sponsored” is often used to indicate attacks targeted at entities, like governments or companies, while these mercenary attacks tend to be directed at individual people.
The extra paragraph specifically calls out the NSO Group and the Pegasus spyware it sells. While the NSO Group claims to only sell to “government clients,” we have no reason to take its word for it.
Apple says that when it detects activity consistent with a mercenary spyware attack it uses two different means of notifying the users about the attack:
Apple says it doesn’t want to share information about what triggers these notifications, since that might help mercenary spyware attackers adapt their behavior to evade detection in the future.
The NSO Group itself argued in a court case started by Meta for spying on WhatsApp users, that it should be recognized as a foreign government agent and, therefore, be entitled to immunity under US law limiting lawsuits against foreign countries.
NSO Group has also said that its tool is increasingly necessary in an era when end-to-end encryption is widely available to criminals.
Apple advises iPhone users to:
We’d like to add:
We don’t just report on phone security—we provide it
Cybersecurity risks should never spread beyond a headline. Keep threats off your mobile devices by downloading Malwarebytes for iOS, and Malwarebytes for Android today.
It’s yet another hardware side-channel attack:
The threat resides in the chips’ data memory-dependent prefetcher, a hardware optimization that predicts the memory addresses of data that running code is likely to access in the near future. By loading the contents into the CPU cache before it’s actually needed, the DMP, as the feature is abbreviated, reduces latency between the main memory and the CPU, a common bottleneck in modern computing. DMPs are a relatively new phenomenon found only in M-series chips and Intel’s 13th-generation Raptor Lake microarchitecture, although older forms of prefetchers have been common for years.
[…]
The breakthrough of the new research is that it exposes a previously overlooked behavior of DMPs in Apple silicon: Sometimes they confuse memory content, such as key material, with the pointer value that is used to load other data. As a result, the DMP often reads the data and attempts to treat it as an address to perform memory access. This “dereferencing” of “pointers”—meaning the reading of data and leaking it through a side channel—is a flagrant violation of the constant-time paradigm.
[…]
The attack, which the researchers have named GoFetch, uses an application that doesn’t require root access, only the same user privileges needed by most third-party applications installed on a macOS system. M-series chips are divided into what are known as clusters. The M1, for example, has two clusters: one containing four efficiency cores and the other four performance cores. As long as the GoFetch app and the targeted cryptography app are running on the same performance cluster—even when on separate cores within that cluster—GoFetch can mine enough secrets to leak a secret key.
The attack works against both classical encryption algorithms and a newer generation of encryption that has been hardened to withstand anticipated attacks from quantum computers. The GoFetch app requires less than an hour to extract a 2048-bit RSA key and a little over two hours to extract a 2048-bit Diffie-Hellman key. The attack takes 54 minutes to extract the material required to assemble a Kyber-512 key and about 10 hours for a Dilithium-2 key, not counting offline time needed to process the raw data.
The GoFetch app connects to the targeted app and feeds it inputs that it signs or decrypts. As its doing this, it extracts the app secret key that it uses to perform these cryptographic operations. This mechanism means the targeted app need not perform any cryptographic operations on its own during the collection period.
Note that exploiting the vulnerability requires running a malicious app on the target computer. So it could be worse. On the other hand, like many of these hardware side-channel attacks, it’s not possible to patch.
Slashdot thread.
Login