๐Ÿ›ก Cybersecurity & Privacy ๐Ÿ›ก - News
25.9K subscribers
89.2K links
๐Ÿ—ž The finest daily news on cybersecurity and privacy.

๐Ÿ”” Daily releases.

๐Ÿ’ป Is your online life secure?

๐Ÿ“ฉ lalilolalo.dev@gmail.com
Download Telegram
๐Ÿ•ด 25% of BEC Cybercriminals Based in the US ๐Ÿ•ด

While the US is known to be a prime target for BEC attacks, just how many perpetrators are based there came as a surprise to researchers.

๐Ÿ“– Read

via "Dark Reading".
๐Ÿ•ด Treasury Dept. Advisory Shines Spotlight on Ransomware Negotiators ๐Ÿ•ด

With attacks showing no signs of abating, some companies have begun offering services to help reduce ransom demands, buy more time, and arrange payments.

๐Ÿ“– Read

via "Dark Reading".
โŒ Software AG Data Released After Clop Ransomware Strike โ€“ Report โŒ

The Clop group attacked Software AG, a German conglomerate with operations in more than 70 countries, threatening to dump stolen data if the whopping $23 million ransom isnโ€™t paid.

๐Ÿ“– Read

via "Threat Post".
๐Ÿ•ด Phishing in Troubled Waters: 3 Ways Email Attacks May Impact Elections ๐Ÿ•ด

The state of email defenses has a role to play in the US presidential election.

๐Ÿ“– Read

via "Dark Reading".
๐Ÿ” 50 Colleges Where You Can Get a Cybersecurity Degree Online Now ๐Ÿ”

You can gain many valuable cybersecurity skills online now. To celebrate National Cyber Security Awareness Month (NCSAM) we put together a list of 50 schools offering cybersecurity degrees online.

๐Ÿ“– Read

via "Digital Guardian".
๐Ÿ›  Raptor WAF 0.61 ๐Ÿ› 

Raptor is a web application firewall written in C that uses DFA to block SQL injection, cross site scripting, and path traversals.

๐Ÿ“– Read

via "Packet Storm Security".
โ€ผ CVE-2018-20243 โ€ผ

The implementation of POST with the username and password in the URL parameters exposed the credentials. More infomration is available in fineract jira issues 726 and 629.

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2020-15251 โ€ผ

In the Channelmgnt plug-in for Sopel (a Python IRC bot) before version 1.0.3, malicious users are able to op/voice and take over a channel. This is an ACL bypass vulnerability.

๐Ÿ“– Read

via "National Vulnerability Database".
โŒ Lemon Duck Cryptocurrency-Mining Botnet Activity Spikes โŒ

Researchers warn of a spike in the cryptocurrency-mining botnet since August 2020.

๐Ÿ“– Read

via "Threat Post".
๐Ÿ•ด Coalition Pokes Five Eyes on Call for Backdoors ๐Ÿ•ด

The Five Eyes international law enforcement group had called for implementing backdoors for law enforcement in all encryption implementations.

๐Ÿ“– Read

via "Dark Reading".
๐Ÿ•ด Microsoft Fixes Critical Windows TCP/IP Flaw in Patch Rollout ๐Ÿ•ด

The October 2020 Patch Tuesday fixed 87 vulnerabilities, including 21 remote code execution flaws, in Microsoft products and services.

๐Ÿ“– Read

via "Dark Reading".
โ€ผ CVE-2020-25645 โ€ผ

A flaw was found in the Linux kernel in versions before 5.9-rc7. Traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality.

๐Ÿ“– Read

via "National Vulnerability Database".
โ€ผ CVE-2020-12911 โ€ผ

A denial of service vulnerability exists in the D3DKMTCreateAllocation handler functionality of AMD ATIKMDAG.SYS (e.g. version 26.20.15029.27017). A specially crafted D3DKMTCreateAllocation API request can cause an out-of-bounds read and denial of service (BSOD). This vulnerability can be triggered from a non-privileged account.

๐Ÿ“– Read

via "National Vulnerability Database".
โš  Windows โ€œPing of Deathโ€ bug revealed โ€“ patch now! โš 

No one has figured out how to run code with this bug yet - but if they do, you can bet that someone will turn it into a computer worm.

๐Ÿ“– Read

via "Naked Security".
โ€ผ CVE-2020-7330 โ€ผ

Privilege Escalation vulnerability in McAfee Total Protection (MTP) trial prior to 4.0.176.1 allows local users to schedule tasks which call malicious software to execute with elevated privileges via editing of environment variables

๐Ÿ“– Read

via "National Vulnerability Database".
โŒ Cybercriminals Steal Nearly 1TB of Data from Miami-Based International Tech Firm โŒ

Databases of sensitive, financial and personally identifiable info and documents from Intcomex were leaked on Russian-language hacker forum after a ransomware attack.

๐Ÿ“– Read

via "Threat Post".
โŒ Google, Intel Warn on โ€˜Zero-Clickโ€™ Kernel Bug in Linux-Based IoT Devices โŒ

Intel and Google are urging users to update the Linux kernel to version 5.9 or later.

๐Ÿ“– Read

via "Threat Post".
๐Ÿ•ด NIST Quantum Cryptography Program Nears Completion ๐Ÿ•ด

The National Institute of Standards and Technology's first post-quantum cryptography standard will address key issues, approaches, an arms race, and the technology's uncertain future.

๐Ÿ“– Read

via "Dark Reading".
๐Ÿฆฟ Survey finds that IT departments victimized by ransomware forever changed ๐Ÿฆฟ

IT managers at organizations hit by ransomware are nearly three times as likely to feel "significantly behind" when it comes to understanding cyberthreats, compared to their peers that have never been hit.

๐Ÿ“– Read

via "Tech Republic".
โ€ผ CVE-2020-6087 โ€ผ

An exploitable denial of service vulnerability exists in the ENIP Request Path Data Segment functionality of Allen-Bradley Flex IO 1794-AENT/B. A specially crafted network request can cause a loss of communications with the device resulting in denial-of-service. An attacker can send a malicious packet to trigger this vulnerability If the ANSI Extended Symbol Segment Sub-Type is supplied, the device treats the byte following as the Data Size in words. When this value represents a size greater than what remains in the packet data, the device enters a fault state where communication with the device is lost and a physical power cycle is required.

๐Ÿ“– Read

via "National Vulnerability Database".