🛡 Cybersecurity & Privacy 🛡 - News
25.8K subscribers
89.2K links
🗞 The finest daily news on cybersecurity and privacy.

🔔 Daily releases.

💻 Is your online life secure?

📩 lalilolalo.dev@gmail.com
Download Telegram
🔐 Hackers will lurk in your email for more than a week after breaking in 🔐

Beware - cybercriminals could be spending days rooting around in employee inboxes for information they can sell to other crooks, or use to mount further attacks.

📖 Read

via "Security on TechRepublic".
Twitter: Hackers Accessed Private Messages for Elite Accounts

A Dutch elected official is among those whose DMs were hijacked, the company said.

📖 Read

via "Threatpost".
🔏 Best Practices for Data Security in Hybrid Environments 🔏

20 Data Security Experts Share Best Practices for Data Security in Hybrid Environments.

📖 Read

via "Subscriber Blog RSS Feed ".
🕴 Vulnerable Invisible Salamanders and You: A Tale of Encryption Weakness 🕴

A Black Hat presentation will discuss how vulnerabilities found in Facebook Messenger encryption could mean trouble for your secure messages.

📖 Read

via "Dark Reading: ".
Cisco, Zoom and Others Must Bolster Security, Say Privacy Chiefs

Privacy commissioners worldwide urged video conferencing systems like Microsoft, Cisco and Zoom to adopt end-to-end encryption, two-factor authentication and other security measures.

📖 Read

via "Threatpost".
ASUS Home Router Bugs Open Consumers to Snooping Attacks

The two flaws allow man-in-the-middle attacks that would give an attacker access to all data flowing through the router.

📖 Read

via "Threatpost".
Sports team nearly paid a $1.25m transfer fee… to cybercrooks

If a crook is already inside your email, occasionally adding in believable emails of their own... how on earth do you spot the fake ones?

📖 Read

via "Naked Security".
🔐 Malware is down, but IoT and ransomware attacks are up 🔐

Malicious attacks disguised as Microsoft Office files increased 176%, according to SonicWall's midyear threat report.

📖 Read

via "Security on TechRepublic".
ATENTION New - CVE-2020-11440

httpRpmFs in WebCLI in Wind River VxWorks 5.5 through 7 SR0640 has no check for an escape from the web root.

📖 Read

via "National Vulnerability Database".
ATENTION New - CVE-2019-11252

The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs and events for AzureFile and CephFS volumes.

📖 Read

via "National Vulnerability Database".
Sharp Spike in Ransomware in U.S. as Pandemic Inspires Attackers

COVID-19 has changed the face of cybercrime, as the latest malware statistics show.

📖 Read

via "Threatpost".
🕴 CouchSurfing Investigates Potential Data Breach 🕴

The service has reportedly hired a security firm after 17 million user records were found on a public hacking forum.

📖 Read

via "Dark Reading: ".
🛠 Sifter 8.5_2 🛠

Sifter is a osint, recon, and vulnerability scanner. It combines a plethora of tools within different module sets in order to quickly perform recon tasks, check network firewalling, enumerate remote and local hosts, and scan for the blue vulnerabilities within Microsoft systems and if unpatched, exploits them.

📖 Go!

via "Security Tool Files ≈ Packet Storm".
🕴 Data Privacy Challenges for California COVID-19 Contact Tracing Technology 🕴

Developers, governments, and regulators must work with the cybersecurity industry to apply rigorous standards to contact-tracing apps to make sure that the societal impact of COVID-19 doesn't extend into personal privacy.

📖 Read

via "Dark Reading: ".
🔐 How to enable guest accounts from the lock screen in Android 🔐

If you frequently hand your phone over to others, Guest Mode is a feature you should be using on Android. Jack Wallen shows you how to access the feature from your lock screen.

📖 Read

via "Security on TechRepublic".
ATENTION New - CVE-2020-12638

An encryption-bypass issue was discovered on Espressif ESP-IDF devices through 4.2, ESP8266_NONOS_SDK devices through 3.0.3, and ESP8266_RTOS_SDK devices through 3.3. Broadcasting forged beacon frames forces a device to change its authentication mode to OPEN, effectively disabling its 802.11 encryption.

📖 Read

via "National Vulnerability Database".
ATENTION New - CVE-2020-10922

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the EA-HTTP.exe process. The issue results from the lack of proper input validation prior to further processing user requests. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-10527.

📖 Read

via "National Vulnerability Database".
ATENTION New - CVE-2020-10921

This vulnerability allows remote attackers to issue commands on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the EA-HTTP.exe process. The issue results from the lack of authentication prior to allowing alterations to the system configuration. An attacker can leverage this vulnerability to issue commands to the physical equipment controlled by the device. Was ZDI-CAN-10482.

📖 Read

via "National Vulnerability Database".
ATENTION New - CVE-2020-10920

This vulnerability allows remote attackers to execute arbitrary code on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the control service, which listens on TCP port 9999 by default. The issue results from the lack of authentication prior to allowing alterations to the system configuration. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-10493.

📖 Read

via "National Vulnerability Database".
ATENTION New - CVE-2020-10919

This vulnerability allows remote attackers to disclose sensitive information on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. When transmitting passwords, the process encrypts them in a recoverable format using a hard-coded key. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-10185.

📖 Read

via "National Vulnerability Database".