πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.9K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ“’ Women and BAME individuals are hardest hit by cyber crime πŸ“’

Malwarebytes calls on the technology industry to do more to provide secure internet access to everyone

πŸ“– Read

via "ITPro".
πŸ“’ UK’s next National Cyber Strategy to reflect need for security industrial base πŸ“’

The country’s upcoming National Cyber Security Strategy will 'hopefully' be released later this year

πŸ“– Read

via "ITPro".
πŸ“’ Hackers spoof Zix in credential phishing attack πŸ“’

The attack has impacted around 75,000 Office 365, Google Workspace and Exchange users

πŸ“– Read

via "ITPro".
πŸ“’ Large companies fall short on domain security πŸ“’

Most large businesses still need to implement enterprise-level controls

πŸ“– Read

via "ITPro".
β€Ό CVE-2021-32466 β€Ό

An uncontrolled search path element privilege escalation vulnerability in Trend Micro HouseCall for Home Networks version 5.3.1225 and below could allow an attacker to escalate privileges by placing a custom crafted file in a specific directory to load a malicious library. Please note that an attacker must first obtain the ability to execute low-privileged code on the target system to exploit this vulnerability.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-35028 β€Ό

A command injection vulnerability in the CGI program of the Zyxel VPN2S firmware version 1.12 could allow an authenticated, local user to execute arbitrary OS commands.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-36745 β€Ό

A vulnerability in Trend Micro ServerProtect for Storage 6.0, ServerProtect for EMC Celerra 5.8, ServerProtect for Network Appliance Filers 5.8, and ServerProtect for Microsoft Windows / Novell Netware 5.8 could allow a remote attacker to bypass authentication on affected installations.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-33923 β€Ό

Insecure permissions in Confluent Ansible (cp-ansible) 5.5.0, 5.5.1, 5.5.2 and 6.0.0 allows local attackers to access some sensitive information (private keys, state database).

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-33924 β€Ό

Confluent Ansible (cp-ansible) version 5.5.0, 5.5.1, 5.5.2 and 6.0.0 is vulnerable to Incorrect Access Control via its auxiliary component that allows remote attackers to access sensitive information.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-35027 β€Ό

A directory traversal vulnerability in the web server of the Zyxel VPN2S firmware version 1.12 could allow a remote attacker to gain access to sensitive information.

πŸ“– Read

via "National Vulnerability Database".
β™ŸοΈ The Rise of One-Time Password Interception Bots β™ŸοΈ

In February, KrebsOnSecurity wrote about a novel cybercrime service that helped attackers intercept the one-time passwords (OTPs) that many websites require as a second authentication factor in addition to passwords. That service quickly went offline, but new research reveals a number of competitors have since launched bot-based services that make it relatively easy for crooks to phish OTPs from targets.

πŸ“– Read

via "Krebs on Security".
🦿 Top 5 tips for using password managers 🦿

Password managers are a good way to keep your passwords unique, strong and safe. Tom Merritt gives us five tips on how to use them correctly.

πŸ“– Read

via "Tech Republic".
🦿 How to use password managers: 5 tips 🦿

Tom Merritt gives tips for staying safe with password managers.

πŸ“– Read

via "Tech Republic".
πŸ—“οΈ What does the future hold for browser security? Check out the latest features destined for mobile and desktop πŸ—“οΈ

A rundown of leading web browsers’ privacy and security features – both in place and in the pipeline

πŸ“– Read

via "The Daily Swig".
❌ Threat Actors Weaponize Telegram Bots to Compromise PayPal Accounts ❌

A campaign is stealing one-time password tokens to gain access to PayPal, Apple Pay and Google Pay, among others.

πŸ“– Read

via "Threat Post".
πŸ—“οΈ Navistar confirms data breach involved employee healthcare information πŸ—“οΈ

US truck manufacturer breaks bad news to employees and retired workers

πŸ“– Read

via "The Daily Swig".
πŸ•΄ Sneaky Android Trojan Siphons Millions Using Premium SMS πŸ•΄

More than 200 applications on the Google Play store have, until recently, allowed cybercriminals to deliver malicious Web content to victims' phones, likely garnering tens of millions of dollars.

πŸ“– Read

via "Dark Reading".
πŸ•΄ 3 Security Initiatives AWS's New CEO Should Prioritize πŸ•΄

As Adam Selipsky takes the helm at Amazon Web Services, security must be one of the first things he addresses. Here are three initiatives that should take priority.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2021-40651 β€Ό

OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php (modname parameter), which can disclose arbitrary file from the server's filesystem as long as the application has access to the file.

πŸ“– Read

via "National Vulnerability Database".
πŸ›  Google Tsunami Security Scanner Pre-Alpha πŸ› 

Tsunami is a general purpose network security scanner with an extensible plugin system for detecting high severity vulnerabilities with high confidence. It was originally written by Google and open sourced in July of 2020.

πŸ“– Read

via "Packet Storm Security".
❌ SAS 2021: β€˜Tomiris’ Backdoor Linked to SolarWinds Malware ❌

Newly discovered code resembles the Kazuar backdoor and the Sunshuttle second-stage malware distributed by Nobelium in the SolarWinds supply-chain attacks.

πŸ“– Read

via "Threat Post".