πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.9K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ” Why developed countries are more vulnerable to cybercrime πŸ”

Developed nations have higher incomes, technology, urbanization, and digitalization, which are all factors for greater cyber risk, says VPN provider NordVPN.

πŸ“– Read

via "Security on TechRepublic".
ATENTIONβ€Ό New - CVE-2020-10946

Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the page parameter to service-monitoring/src/index.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2020-10945

Centreon before 19.10.7 exposes Session IDs in server responses.

πŸ“– Read

via "National Vulnerability Database".
πŸ” Majority of COVID phishing attacks coming from US IP addresses, report finds πŸ”

An anti-phishing firm discovered that most of the malicious coronavirus emails were coming from the United States.

πŸ“– Read

via "Security on TechRepublic".
πŸ•΄ HackerOne Bounties Hit $100M Milestone πŸ•΄

The bug-hunting platform has now paid more than $100 million in bounties since October 2013.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Security 101: SQL Injection πŸ•΄

A carefully crafted attack can convince a database to reveal all its secrets. Understanding the basics of what the attack looks like and how to protect against it can go a long way toward limiting the threat.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Cloud Security Architect Proves Hardest Infosec Role to Fill πŸ•΄

Nearly 70% of businesses struggle to recruit, hire, and retain cybersecurity talent, and many link security incidents to lack of skills.

πŸ“– Read

via "Dark Reading: ".
πŸ” Insider Behind $1 Billion Trade Secret Theft Case Sentenced πŸ”

The FBI on Wednesday shared details around a recent $1 billion trade secret theft case and reminded companies to report suspected crimes like trade secret theft.

πŸ“– Read

via "Subscriber Blog RSS Feed ".
ATENTIONβ€Ό New - CVE-2020-10936

Sympa before 6.2.56 allows privilege escalation.

πŸ“– Read

via "National Vulnerability Database".
❌ DoubleGun Group Builds Massive Botnet Using Cloud Services ❌

The latest campaign spread malware via pirate gaming portals.

πŸ“– Read

via "Threatpost".
πŸ•΄ Stay-at-Home Orders Coincide With Massive DNS Surge πŸ•΄

A variety of sites saw as much as seven times the number of domain requests in late March and early April, suggesting attackers attempted massive denial-of-service attacks.

πŸ“– Read

via "Dark Reading: ".
ATENTIONβ€Ό New - CVE-2020-11059

In AEgir greater than or equal to 21.7.0 and less than 21.10.1, aegir publish and aegir build may leak secrets from environment variables in the browser bundle published to npm. This has been fixed in 21.10.1.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Netwalker Ransomware Tools Reveal Attacker Tactics and Techniques πŸ•΄

Malware and related files show that ransomware operators don't need a cutting-edge arsenal to be effective.

πŸ“– Read

via "Dark Reading: ".
ATENTIONβ€Ό New - CVE-2020-11075

In Anchore Engine version 0.7.0, a specially crafted container image manifest, fetched from a registry, can be used to trigger a shell escape flaw in the anchore engine analyzer service during an image analysis process. The image analysis operation can only be executed by an authenticated user via a valid API request to anchore engine, or if an already added image that anchore is monitoring has its manifest altered to exploit the same flaw. A successful attack can be used to execute commands that run in the analyzer environment, with the same permissions as the user that anchore engine is run as - including access to the credentials that Engine uses to access its own database which have read-write ability, as well as access to the running engien analyzer service environment. By default Anchore Engine is released and deployed as a container where the user is non-root, but if users run Engine directly or explicitly set the user to 'root' then that level of access may be gained in the execution environment where Engine runs. This issue is fixed in version 0.7.1.

πŸ“– Read

via "National Vulnerability Database".
⚠ Android β€˜StrandHogg 2.0’ flaw lets malware assume identity of any app ⚠

A critical security flaw in Android could be used by attackers to β€œassume the identity” of legitimate apps in order to carry out on-device phishing attacks, say researchers.

πŸ“– Read

via "Naked Security".
πŸ” How user credentials from LiveJournal wound up on the Dark Web πŸ”

Hackers are trying to sell 26 million LiveJournal account credentials following a reported data breach that happened years ago.

πŸ“– Read

via "Security on TechRepublic".
πŸ” Phishing attack impersonates Amazon Web Services to steal user credentials πŸ”

The emails spoof an automated notification from AWS to try to capture Amazon account credentials, according to Abnormal Security.

πŸ“– Read

via "Security on TechRepublic".
πŸ” Who is the weak link in mobile security? This study suggests it's the C-suite πŸ”

A survey of IT pros and top execs found that IT is worried about the lax attitude their bosses have toward security.

πŸ“– Read

via "Security on TechRepublic".
πŸ” Even the most tech-savvy Americans have bad online safety habits πŸ”

92% of Americans say they care about online safety and data privacy, yet a new report from iProov showed 44% polled shared passwords and mobile devices with their partners.

πŸ“– Read

via "Security on TechRepublic".
πŸ” Google, Microsoft most spoofed brands in latest phishing attacks πŸ”

Scammers are increasingly exploiting file sharing sites such as Google Docs and Microsoft Sway to steal user credentials, according to Barracuda Networks.

πŸ“– Read

via "Security on TechRepublic".
⚠ Pablo Escobar’s brother sues Apple for $2.6b over FaceTime flaw ⚠

Roberto Escobar says a FaceTime eavesdropping bug led to his address being leaked, assassination threats, and being forced into hiding.

πŸ“– Read

via "Naked Security".