πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ•΄ 3 Months for the Cybercrime Books πŸ•΄

From July through September, US law enforcement handed down major indictments or sanctions against foreign threat groups at least six times.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2020-25623 β€Ό

Erlang/OTP 22.3.x before 22.3.4.6 and 23.x before 23.1 allows Directory Traversal. An attacker can send a crafted HTTP request to read arbitrary files, if httpd in the inets application is used.

πŸ“– Read

via "National Vulnerability Database".
❌ Years-Long β€˜SilentFade’ Attack Drained Facebook Victims of $4M ❌

Facebook detailed an ad-fraud cyberattack that's been ongoing since 2016, stealing Facebook credentials and browser cookies.

πŸ“– Read

via "Threat Post".
β€Ό CVE-2020-7069 β€Ό

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data.

πŸ“– Read

via "National Vulnerability Database".
❌ LatAm Banking Trojans Collaborate in Never-Before-Seen Effort ❌

Eleven different malware families are coordinating on distribution, features, geo-targeting and more.

πŸ“– Read

via "Threat Post".
πŸ•΄ Name That Toon: Castle in the Sky πŸ•΄

Feeling creative? Submit your caption in the comments, and our panel of experts will reward the winner with a $25 Amazon gift card.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Emotet Spoofs DNC In New Attack Campaign πŸ•΄

Thousands of Emotet emails contain a message body pulled directly from the Democratic National Committee website, researchers report.

πŸ“– Read

via "Dark Reading".
❌ Researchers Mixed on Sanctions for Ransomware Negotiators ❌

Financial institutions, cyber-insurance firms, and security firms have all been put on notice by the U.S. Department of the Treasury.

πŸ“– Read

via "Threat Post".
🦿 Vulnerable supply chains introduce increasingly interconnected attack surfaces 🦿

Accenture Security lists five other "extreme but plausible threat scenarios in financial services" in a new report.

πŸ“– Read

via "Tech Republic".
β€Ό CVE-2020-5422 β€Ό

BOSH System Metrics Server releases prior to 0.1.0 exposed the UAA password as a flag to a process running on the BOSH director. It exposed the password to any user or process with access to the same VM (through ps or looking at process details).

πŸ“– Read

via "National Vulnerability Database".
πŸ›  Bing.com Hostname / IP Enumerator 1.0.4 πŸ› 

This tool enumerates hostnames from Bing.com for an IP address. Bing.com is Microsoft's search engine which has an IP: search parameter. Written in Bash for Linux. Requires wget.

πŸ“– Read

via "Packet Storm Security".
❌ Account Takeover Fraud Losses Total Billions Across Online Retailers ❌

Account takeover fraud (ATO) attacks are on the rise, up nearly 300 percent since last year.

πŸ“– Read

via "Threat Post".
❌ Voter Registration β€˜Error’ Phish Hits During U.S. Election Frenzy ❌

Phishing emails tell recipients that their voter's registration applications are incomplete - but instead steal their social security numbers, license data and more.

πŸ“– Read

via "Threat Post".
β€Ό CVE-2020-24568 β€Ό

An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a blind SQL injection in the lancompenent component, allowing logged-in attackers to discover arbitrary information.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-24627 β€Ό

A remote stored xss vulnerability was discovered in HPE KVM IP Console Switches version(s): G2 4x1Ex32 Prior to 2.8.3.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-5979 β€Ό

NVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the NVIDIA Control Panel component in which a user is presented with a dialog box for input by a high-privilege process, which may lead to escalation of privileges.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Biometric Data Collection Demands Scrutiny of Privacy Law πŸ•΄

An IT lawyer digs into the implications of collecting biometric data, why it can't be anonymized, and what nations are doing about it.

πŸ“– Read

via "Dark Reading".
❌ Egregor Ransomware Threatens β€˜Mass-Media’ Release of Corporate Data ❌

The newly discovered ransomware is hitting companies worldwide, including the GEFCO global logistics company.

πŸ“– Read

via "Threat Post".
πŸ•΄ Researchers Adapt AI With Aim to Identify Anonymous Authors πŸ•΄

At Black Hat Asia, artificial intelligence and cybersecurity researchers use neural networks to attempt to identify authors, but accuracy is still wanting.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2020-5984 β€Ό

NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin in which it may have the use-after-free vulnerability while freeing some resources, which may lead to denial of service, code execution, and information disclosure. This affects vGPU version 8.x (prior to 8.5), version 10.x (prior to 10.4) and version 11.0.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-15231 β€Ό

In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting.

πŸ“– Read

via "National Vulnerability Database".