Security Affairs

DECEMBER 1, 2021

Mozilla fixed a critical memory corruption issue affecting its cross-platform Network Security Services (NSS) set of cryptography libraries. Mozilla has addressed a heap-based buffer overflow vulnerability (CVE-2021-43527) in its cross-platform Network Security Services (NSS) set of cryptography libraries. Pierluigi Paganini.

Libraries 352

Libraries Security CMS Communications 352

Security Affairs

FEBRUARY 7, 2020

Japanese defense contractors Pasco and Kobe Steel have disclosed security breaches that they have suffered back in 2016 and 2018. In January, Mitsubishi Electric disclosed a security breach that might have exposed personal and confidential corporate data. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->.

Security 356

Security Manufacturing Data breaches Access 356

Security Affairs

MARCH 22, 2020

Expert discovered an Elasticsearch instance belonging to a security firm containing over 5 billion records of data leaked in previous incidents. ” wrote Security Discovery’s researcher Bob Diachenko. ” wrote Security Discovery’s researcher Bob Diachenko. SecurityAffairs – Security firm, data leak).

Security 279

Security Data breaches Archiving Phishing 279

Security Affairs

FEBRUARY 13, 2020

Since 2016, Microsoft is urging admins to stop using SMBv1, later versions of the protocol implemented security enhancements, such as encryption, pre- authentication integrity checks to prevent man-in-the-middle (MiTM) attacks, and insecure guest authentication blocking. Windows Server 2012: If the command returns false, SMBv1 is not enabled.

Authentication 363

Authentication Communications Encryption IT 363

Krebs on Security

JUNE 8, 2021

Microsoft today released another round of security updates for Windows operating systems and supported software, including fixes for six zero-day bugs that malicious hackers already are exploiting in active attacks. June’s Patch Tuesday addresses just 49 security holes — about half the normal number of vulnerabilities lately.

Security 335

Security Ransomware Phishing Cloud 335

Security Affairs

MAY 21, 2020

In January, the company disclosed a security breach that might have exposed personal and confidential corporate data, at the time, it claimed that attackers did not obtain sensitive information about defense contracts. The post Japan suspects HGV missile data leak in Mitsubishi security breach appeared first on Security Affairs.

Security 312

Security Military Manufacturing Personal data 312

Security Affairs

NOVEMBER 29, 2020

out of 10 in severity by the industry-standard Common Vulnerability Scoring System (CVSS) and impacts all versions of EtherNet/IP Adapter Source Code Stack prior to 2.28, which was released on November 21, 2012. ” reads the security advisory published by Claroty. Also recognize that VPN is only as secure as the connected devices.

Security 355

Security Access Cybersecurity Risk 355

Security Affairs

JANUARY 24, 2020

Danish security researcher Ollypwn has released DOS exploit PoC for critical vulnerabilities in the Windows RDP Gateway. Experts suggest securing vulnerable RDP Gateway servers by installing the security updates ([ 1 ], [ 2 ]) released by Microsoft. link] pic.twitter.com/R43AHUwGV0 — ollypwn (@ollypwn) January 23, 2020.

Education 363

Education Authentication Access Security 363

Security Affairs

JULY 24, 2024

Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Internet Explorer and Twilio Authy bugs to its Known Exploited Vulnerabilities catalog. is a use-after-free issue in Microsoft Internet Explorer 6 through 8. is a use-after-free issue in Microsoft Internet Explorer 6 through 8. CVE-2024-39891 (CVSS score of 5.3)

IT 280

IT Cybersecurity Access Risk 280

Security Affairs

MAY 15, 2020

Security experts from Cyble reported that a threat actor is attempting to sell twenty-nine databases on a hacker forum since May 7. Data appears to come from past data breaches, the oldest one dates back as 2012 while the latest one dates April 2020. Forum members could also buy each database individually. million N/A EatStreet.com 6.4

Sales 336

Sales Data breaches Archiving Passwords 336

Security Affairs

JULY 11, 2020

The Russian hacker Yevgeniy Nikulin found guilty for LinkedIn, Dropbox, and Formspring data breach back in 2012 and the sale of their users’ data. A jury found Russian hacker Yevgeniy Nikulin guilty for the hack of LinkedIn, Dropbox, and Formspring back in 2012 and for the sale of the stolen data on cybercrime black marketplaces.

Sales 295

Sales Passwords Data breaches Phishing 295

Security Affairs

APRIL 21, 2021

Security vendor SonicWall has addressed three zero-day vulnerabilities affecting both its on-premises and hosted Email Security products. SonicWall is warning its customers to update their hosted and on-premises email security products to address three zero-day vulnerabilities that are being actively exploited in the wild.

Security 313

Security Authentication Access Archiving 313

Security Affairs

FEBRUARY 14, 2020

According to the media, these are the largest penalties imposed by the Kremlin on Western IT firms under internet use laws since 2012. The post Russian watchdog fines Twitter, Facebook for not moving user data to local servers appeared first on Security Affairs. ” reported the Associated Press. Pierluigi Paganini.

Personal data 363

Personal data Government Security IT 363

Security Affairs

JULY 8, 2021

According to the experts, the member “integra” has joined the cybercrime forum in September 2012 and has gained a high reputation over the course of time. The threat actor is also a member of another cybercrime forum since October 2012. . A threat actor that goes online with the name “integra” has deposited 26.99 Pierluigi Paganini.

Security 310

Security Access Cybersecurity Information Security 310

Security Affairs

SEPTEMBER 30, 2020

Russian national Yevgeniy Aleksandrovich Nikulin was sentenced to 88 months in prison for hacking LinkedIn, Dropbox, and Formspring in 2012. The Russian national Yevgeniy Aleksandrovich Nikulin was sentenced to 88 months in prison in the United States for hacking LinkedIn, Dropbox, and Formspring in 2012. Source: US Defense Watch.com.

Passwords 280

Passwords Sales Phishing Access 280

Security Affairs

MARCH 16, 2021

Microsoft is reportedly investigating whether the recent attacks against Microsoft Exchange servers could be linked to information leaked by a partner security firm. The information may have been obtained through “private disclosures it [Microsoft] made with some of its security partners.” “Microsoft Corp.

Security 256

Security Access IT Cybersecurity 256

Security Affairs

JUNE 9, 2024

This oversight allows unauthenticated attackers to bypass the previous protection of CVE-2012-1823 by specific character sequences. An attacker can exploit the flaw to bypass protections for a previous vulnerability, CVE-2012-1823, using specific character sequences. ” reads the advisory published by DEVCORE.

Honeypots 357

Honeypots IT Cybersecurity Risk 357

Security Affairs

JANUARY 4, 2021

WikiLeaks founder Julian Assange should not be extradited to the US to stand trial, the Westminster Magistrates’ Court has rejected the US government’s request to extradite him on charges related to illegally obtaining and sharing classified material about national security. Pierluigi Paganini.

Military 357

Military Government Risk Passwords 357

Security Affairs

JUNE 30, 2021

for his key role in the distribution of the Gozi virus that infected more than a million computers from 2007 to 2012. Paunescu was arrested in Romania in 2012, but was able to avoid extradition. The Gozi banking Trojan is not a new threat, it was first spotted by security researchers in 2007. Pierluigi Paganini.

Security 306

Security IT Cybersecurity Information Security 306

Security Affairs

JANUARY 28, 2021

The APT group has been active since 2012, experts linked the group to the Hezbollah militant group. CVE-2012-3152). If you want to receive the weekly Security Affairs Newsletter for free subscribe here. The post Lebanese Cedar APT group broke into telco and ISPs worldwide appeared first on Security Affairs.

Access 356

Access Security Information Security IT 356

Security Affairs

NOVEMBER 24, 2020

Researchers from Intezer have spotted a new variant of an adware and coin-miner botnet that is operated by Stantinko threat actors since 2012. Operators behind the botnet powered a massive adware campaign active since 2012, crooks mainly targeted users in Russia, Ukraine, Belarus, and Kazakhstan searching for pirated software. .

IT 363

IT Security Information Security 363

Security Affairs

NOVEMBER 22, 2019

Lisov operated the infrastructure behind the NeverQuest malware between June 2012 and January 2015, the managed a network of servers containing lists of millions of stolen login credentials. Prison appeared first on Security Affairs. LISOV had administrative-level access to those computer servers.” Pierluigi Paganini.

Passwords 334

Passwords Security Access IT 334

Security Affairs

APRIL 1, 2020

The presence of the ‘ VelvetSweatshop’ hardcoded password is known since 2012 and it is tracked as CVE-2012-0158. The post LimeRAT malware delivered using 8-year-old VelvetSweatshop trick appeared first on Security Affairs. Excel attempts to decrypt and open the file and run any macros it contains.

Passwords 330

Passwords Encryption Security IT 330

Security Affairs

JANUARY 25, 2020

This week, Mitsubishi Electric disclosed a security breach that might have exposed personal and confidential corporate data. Mitsubishi Electric disclosed the security incident only after two local newspapers, the Asahi Shimbun and Nikkei , reported the security breach.

Manufacturing 363

Manufacturing Data breaches Sales Access 363

Security Affairs

JANUARY 20, 2020

Mitsubishi Electric disclosed a security breach that might have exposed personal and confidential corporate information. Mitsubishi Electric disclosed a security breach that might have exposed personal and confidential corporate data. According to the company, attackers did not obtain sensitive information about defense contracts.

Data breaches 363

Data breaches Computer and Electronics Government Manufacturing 363

Krebs on Security

APRIL 16, 2024

For nearly a dozen years, residents of South Carolina have been kept in the dark by state and federal investigators over who was responsible for hacking into the state’s revenue department in 2012 and stealing tax and bank account information for 3.6 13, 2012, after a state IT contractor clicked a malicious link in an email.

Sales 277

Sales Retail Insurance IT 277

Security Affairs

OCTOBER 20, 2021

Its operators have added new exploits and payloads, according to the experts, the new variant leverages WebSockets to implement more secure C2 bidirectional communication. The post PurpleFox botnet variant uses WebSockets for more secure C2 communication appeared first on Security Affairs. Pierluigi Paganini.

Communications 285

Communications Security Encryption IT 285

Security Affairs

MARCH 1, 2020

Data provided in the reports are disconcerting, British telecommunications firms supported GCHQ in collecting a large volume of internet data from undersea cables, the overall amount of information from 2007 to 2012 registered a 7,000-fold increase, meanwhile, the spying system monitored nearly 46 billion private communications “events” every day.

Military 363

Military Communications Data collection Access 363

Security Affairs

MARCH 25, 2022

has indicted four Russian government employees for their role in cyberattacks targeting hundreds of companies and organizations in the energy sector worldwide between 2012 and 2018. ” reads a press release published by DoJ. The conspirators designed the Triton malware to prevent the refinery’s safety systems from functioning (i.e.,

Energy and Utilities 294

Energy and Utilities Government Cybersecurity Military 294

Security Affairs

APRIL 25, 2022

The number of zero-day vulnerabilities exploited in cyberattacks in the wild exploded in the last years, security firm report. Mandiant states that From 2012 to 2021, China exploited more zero-days than any other nation. From 2012 to 2021, China-linked threat actors exploited more zero-days than any other nation-state actors.

Ransomware 298

Ransomware Security Cybersecurity Risk 298

Security Affairs

JUNE 12, 2024

Cybersecurity and Infrastructure Security Agency (CISA) adds Mali GPU Kernel Driver, PHP bugs to its Known Exploited Vulnerabilities catalog. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog.

IT 338

IT Cybersecurity Access Risk 338

The Last Watchdog

SEPTEMBER 13, 2023

Sharing intel for a greater good Now one distinctive type of crowdsourcing — ethical hacking – is positioned to become a much more impactful component of securing modern networks. I had a terrific discussion about this at Black Hat USA 2023 with Casey Ellis, founder and CTO of Bugcrowd , a pioneer in the crowdsourced security market.

Security 228

Security Risk Marketing IT 228

Security Affairs

SEPTEMBER 24, 2023

Stealth Falcon is a nation-state actor active since at least 2012, the group targeted political activists and journalists in the Middle East in past campaigns. The attacks have been conducted from 2012 until 2106, against Emirati journalists, activists, and dissidents. .”

Libraries 357

Libraries Encryption Security IT 357

Security Affairs

MAY 1, 2019

Julian Assange has been sentenced to 11 months in prison for breaching his bail conditions in 2012 and finding asylum into Ecuadorian embassy for more than seven years. Immediately after his arrest, Assange was convicted at Westminster Magistrates’ Court of jumping the bail in June 2012 after the extradition order to Sweden.

Security 269

Security IT 269

Security Affairs

DECEMBER 20, 2018

Microsoft has issued an out-of-band security update to fix a critical zero-day flaw in the Internet Explorer (IE) browser. Microsoft has rolled out an out-of-band security update to address a critical zero-day vulnerability affecting the Internet Explorer (IE) browser. ” reads the security advisory. Pierluigi Paganini.

Security 278

Security IT 278

Security Affairs

MAY 16, 2019

was released back in 2012, it aims at detecting and changes that occur in the Windows operating systems during the installation of third-party applications. replaces the original Attack Surface Analzyer tool, released publicly in 2012.” replaces the original Attack Surface Analzyer tool, released publicly in 2012.”

IT 273

IT Security Risk Information Security 273

Security Affairs

JANUARY 18, 2022

Microsoft has released emergency out-of-band (OOB) updates for Windows to address multiple issues caused by security updates issued as part of the January 2021 Patch Tuesday. Windows Server 2012 R2: KB5010794 Windows Server 2012: KB5010797. Follow me on Twitter: @securityaffairs and Facebook. Pierluigi Paganini.

Security 289

Security Access Information Security IT 289