πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
πŸ•΄ Threat Group Exploits Chrome Bug to Serve Malicious Ads to iOS Users πŸ•΄

A new exploit developed by eGobbler is allowing it to distribute malvertisements-more than 500 million to date-at huge scale, Confiant says.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Decoding a 'New' Elite Cyber Espionage Team πŸ•΄

Stealthy and well-heeled hacking group went undetected for five years and wields a massive attack framework of some 80 different modules.

πŸ“– Read

via "Dark Reading: ".
πŸ•΄ Security Audit Shows Gains, Though Privacy Lags πŸ•΄

The 2018 Online Trust Audit shows that "encryption everywhere" is improving security, while fuzzy language is slowing privacy gains.

πŸ“– Read

via "Dark Reading: ".
⚠ Microsoft confirms Outlook.com and Hotmail accounts were breached ⚠

Between 1 January and 28 March this year hackers were able to access a β€œlimited number” of consumer Outlook.com, Hotmail and MSN Mail email accounts, Microsoft has confirmed.

πŸ“– Read

via "Naked Security".
⚠ Internet Explorer browser flaw threatens all Windows users ⚠

Nearly four years after it was replaced by Edge as Microsoft’s preferred Windows browser, researchers keep finding unpleasant security flaws in Internet Explorer (IE).

πŸ“– Read

via "Naked Security".
⚠ Ad blocker firms rush to fix security bug ⚠

If you’re using an ad blocker to filter out online commercials, then beware: You might be vulnerable to a new attack revealed on Monday that enables hackers to compromise your browser.

πŸ“– Read

via "Naked Security".
⚠ Mozilla to Apple: Protect user privacy with rotating phone IDs ⚠

Mozilla has criticized Apple for its latest privacy marketing campaign, urging it to provide more automatic protection for users behind the scenes.

πŸ“– Read

via "Naked Security".
πŸ•΄ 7 Tips for an Effective Employee Security Awareness Program πŸ•΄

Breaches and compliance requirements have heightened the need for continuous and effective employee training, security experts say.

πŸ“– Read

via "Dark Reading: ".
❌ Oracle Squashes 53 Critical Bugs in April Security Update ❌

Overall Oracle patched 297 flaws across multiple product as part of its April security update.

πŸ“– Read

via "Threatpost".
πŸ” How criminals use fraud guides from the Dark Web to scam organizations and individuals πŸ”

A review of fraud guides by Terbium Labs reveals the tactics used by cybercriminals to steal and exploit your data.

πŸ“– Read

via "Security on TechRepublic".
πŸ•΄ Selecting the Right Strategy to Reduce Vulnerability Risk πŸ•΄

There's no one-size-fits-all strategy for eliminating vulnerability risk. Knowing how your organization operates is what makes the difference.

πŸ“– Read

via "Dark Reading: ".
πŸ” Two-factor authentication: A cheat sheet πŸ”

A password alone will not protect sensitive information from hackers--two-factor authentication is also necessary. Here's what security pros and users need to know about two-factor authentication.

πŸ“– Read

via "Security on TechRepublic".
⚠ Ep. 028 – SPEWS, Android security and scary Facebook messages [PODCAST] ⚠

Here's the latest Naked Security podcast - enjoy!

πŸ“– Read

via "Naked Security".
πŸ” How to monitor file changes with fswatch πŸ”

Jack Wallen shows you how to install and use the directory monitor tool, fswatch.

πŸ“– Read

via "Security on TechRepublic".
πŸ” How to monitor file changes with fswatch πŸ”

Jack Wallen shows you how to install and use the directory monitor tool, fswatch.

πŸ“– Read

via "Security on TechRepublic".
❌ ThreatList: Bad Bots Account for a Fifth of All Web Traffic, FinServ Hit the Worst ❌

The financial services industry sees nearly half of all website traffic coming from malicious bots.

πŸ“– Read

via "Threatpost".
ATENTIONβ€Ό New - CVE-2018-16561

A vulnerability has been identified in SIMATIC S7-300 CPUs (All versions < V3.X.16). The affected CPUs improperly validate S7 communication packets which could cause a Denial-of-Service condition of the CPU. The CPU will remain in DEFECT mode until manual restart. Successful exploitation requires an attacker to be able to send a specially crafted S7 communication packet to a communication interface of the CPU. This includes Ethernet, PROFIBUS, and Multi Point Interfaces (MPI). No user interaction or privileges are required to exploit the security vulnerability. The vulnerability could allow causing a Denial-of-Service condition of the core functionality of the CPU, compromising the availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known. Siemens confirms the security vulnerability and provides mitigations to resolve the security issue.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2018-16559

A vulnerability has been identified in SIMATIC S7-1500 CPU (All versions >= V2.0 and < V2.5), SIMATIC S7-1500 CPU (All versions <= V1.8.5). Specially crafted network packets sent to port 80/tcp or 443/tcp could allow an unauthenticated remote attacker to cause a Denial-of-Service condition of the device. The security vulnerability could be exploited by an attacker with network access to the affected systems on port 80/tcp or 443/tcp. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the device. At the time of advisory publication no public exploitation of this security vulnerability was known.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2018-16558

A vulnerability has been identified in SIMATIC S7-1500 CPU (All versions >= V2.0 and < V2.5), SIMATIC S7-1500 CPU (All versions <= V1.8.5). Specially crafted network packets sent to port 80/tcp or 443/tcp could allow an unauthenticated remote attacker to cause a Denial-of-Service condition of the device. The security vulnerability could be exploited by an attacker with network access to the affected systems on port 80/tcp or 443/tcp. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the device. At the time of advisory publication no public exploitation of this security vulnerability was known.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2018-13810

A vulnerability has been identified in CP 1604 (All versions < V2.8), CP 1616 (All versions < V2.8). The integrated configuration web server of the affected CP devices could allow a Cross-Site Request Forgery (CSRF) attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires user interaction by a legitimate user. A successful attack could allow an attacker to trigger actions via the web interface that the legitimate user is allowed to perform. At the time of advisory publication no public exploitation of this vulnerability was known.

πŸ“– Read

via "National Vulnerability Database".
ATENTIONβ€Ό New - CVE-2018-13809

A vulnerability has been identified in CP 1604 (All versions < V2.8), CP 1616 (All versions < V2.8). The integrated web server of the affected CP devices could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into following a malicious link. User interaction is required for a successful exploitation. At the time of advisory publication no public exploitation of this vulnerability was known.

πŸ“– Read

via "National Vulnerability Database".