πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.9K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ•΄ The Long Shadow of Stuxnet: New Microsoft Print Spooler Vulns Revealed πŸ•΄

Researchers Peleg Hader and Tomer Bar of SafeBreach share details of the three vulnerabilities they found in Windows Print Spooler that could allow an attacker to sneak into the network through an old printer service mechanism.

πŸ“– Read

via "Dark Reading: ".
❌ Black Hat 2020: Satellite Comms Globally Open to $300 Eavesdropping Hack ❌

Attackers can listen in on internet traffic for high-value targets a continent away, like shipping fleets and oil installations, using some basic home-television gear.

πŸ“– Read

via "Threatpost".
πŸ•΄ Broadcom: Staying Safe with WastedLocker Ransomware Variant on the Prowl πŸ•΄

SPONSORED CONTENT: Stealthier and more patient than some predecessors, WastedLocker lingers surreptitiously for as long as it needs to for maximum payoff, says Jon DiMaggio with Broadcom's Symantec division. He explains how Windows servers are at a different risk level than their open-source counterparts, and how WastedLocker identifies "valuable" targets.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Using IoT Botnets to Manipulate the Energy Market πŸ•΄

Tohid Shekari, phD candidate at Georgia Tech, talks about the session that he and Georgia Tech professor Raheem Beyah gave about a stealthy and adaptable way to use IoT botnets for financial gain or market downfall.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Why Satellite Communication Eavesdropping Will Remain A Problem πŸ•΄

Oxford PhD candidate James Pavur shows that SATCOM security has still made no progress since previous Black Hat disclosures, and discusses the physical and economic limitations that slow make it unlikely to improve anytime soon.

πŸ“– Read

via "Dark Reading: ".
πŸ” Android phones could spy on users via flaws in Qualcomm chip πŸ”

Vulnerabilities were found in a Qualcomm Snapdragon chip that could let attackers obtain photos, videos, call recordings, and other data on Android phones, says Check Point Research.

πŸ“– Read

via "Security on TechRepublic".
ATENTIONβ€Ό New - CVE-2020-13793

Unsafe storage of AD credentials in Ivanti DSM netinst 5.1 due to a static, hard-coded encryption key.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2020-12441

Denial-of-Service (DoS) in Ivanti Service Manager HEAT Remote Control 7.4 due to a buffer overflow in the protocol parser of the Ò€˜HEATRemoteServiceÒ€ℒ agent. The DoS can be triggered by sending a specially crafted network packet.

πŸ“– Read

via "National Vulnerability Database".
❌ Canon Admits Ransomware Attack in Employee Note, Report ❌

The consumer-electronics giant has suffered partial outages across its U.S. website and internal systems, reportedly thanks to the Maze gang.

πŸ“– Read

via "Threatpost".
πŸ•΄ OpenText Blends Security, Data Protection for Greater Cyber Resilience πŸ•΄

SPONSORED CONTENT: Infosec professionals are taking advantage of technology hybrids to keep users, data, and their networks more safe, according to Hal Lonas of OpenText's Webroot division. And they're also finding new ways to use artificial intelligence and machine learning to improve security management and reduce risk.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Office 365's Vast Attack Surface & All the Ways You Don't Know You're Being Exploited Through It πŸ•΄

Mandiant incident response managers Josh Madeley and Doug Bienstock describe how thoroughly Microsoft 365 (formerly known as Office 365) extends into corporate networks, describe both sophisticated and simple attacks they've detected, and suggest mitigations as businesses rely more heavily on the cloud.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Information Operations Spotlighted at Black Hat as Election Worries Rise πŸ•΄

From Russia's "best-in-class" efforts at widening social divides in Western democracies to China's blunt attacks on dissidents, information operations are becoming a greater threat, says a Stanford researcher.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Exploiting Google Cloud Platform With Ease πŸ•΄

Security engineer Dylan Ayrey and Cruise senior infrastructure security engineer Allison Donovan describe fundamental weaknesses in GCP identity management that enable privilege escalation and lateral movement.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ On 'Invisible Salamanders' and Insecure Messages πŸ•΄

Cornell researcher Paul Grubbs discusses how vulnerabilities found in Facebook Messenger encryption could mean trouble for your secure messages.

πŸ“– Read

via "Dark Reading: ".
πŸ” What Does a Data Breach Cost in 2020? πŸ”

Ponemon Institute's annual Cost of a Data Breach report tracks how industry data breach costs have changed over time.

πŸ“– Read

via "Subscriber Blog RSS Feed ".
❌ Black Hat 2020: Mercedes-Benz E-Series Rife with 19 Bugs ❌

Researchers went into detail about the discovery and disclosure of 19 security flaws they found in Mercedes-Benz vehicles, which have all been fixed.

πŸ“– Read

via "Threatpost".
πŸ•΄ Where Dark Reading Goes Next πŸ•΄

Dark Reading Editor-in-Chief gives a complete rundown of all the Dark Reading projects you might not even know about, his insight into the future of the security industry, and how we plan to cover it.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ A Mix of Optimism and Pessimism for Security of the 2020 Election πŸ•΄

DHS CISA's Christopher Krebs and Georgetown University's Matt Blaze at Black Hat USA give the lowdown on where things stand and what still needs to happen to protect the integrity of November's election.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Researchers Create New Framework to Evaluate User Security Awareness πŸ•΄

Approaches based on questionnaires and self-evaluation are not always a good indicator of how well a user can mitigate social engineering threats.

πŸ“– Read

via "Dark Reading: ".
ATENTIONβ€Ό New - CVE-2020-15114

In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This results in a denial of service, since the endpoint can become stuck in a loop of requesting itself until there are no more available file descriptors to accept connections on the gateway.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2020-11937

In whoopsie, parse_report() from whoopsie.c allows a local attacker to cause a denial of service via a crafted file. The DoS is caused by resource exhaustion due to a memory leak. Fixed in 0.2.52.5ubuntu0.5, 0.2.62ubuntu0.5 and 0.2.69ubuntu0.1.

πŸ“– Read

via "National Vulnerability Database".