The Mirai-based Aquabot botnet has been targeting a vulnerability in Mitel SIP phones for which a proof-of-concept (PoC) exploit exists.
The post Aquabot Botnet Targeting Vulnerable Mitel Phones appeared first on SecurityWeek.
SecurityWeek – Read More
New CPU side-channel attacks named SLAP and FLOP can be exploited to remotely steal data from Apple mobile and desktop devices.
The post New SLAP and FLOP CPU Attacks Expose Data From Apple Computers, Phones appeared first on SecurityWeek.
SecurityWeek – Read More
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued two urgent advisories regarding serious ICS vulnerabilities in industrial control systems (ICS) products. These ICS vulnerabilities, identified in Schneider Electric’s RemoteConnect and SCADAPack x70 Utilities, as well as B&R Automation’s Runtime software, pose online risks to critical infrastructure systems worldwide. The ICS vulnerabilities, if exploited, could lead to potentially devastating impacts on the integrity, confidentiality, and availability of systems within energy, critical manufacturing, and other essential sectors.
The ICS vulnerability in Schneider Electric’s RemoteConnect and SCADAPack x70 Utilities arises from the deserialization of untrusted data, identified as CWE-502. This flaw could allow attackers to execute remote code on affected workstations, leading to several security risks, including the loss of confidentiality and integrity. The issue is triggered when a non-admin authenticated user opens a malicious project file, which could potentially be introduced through email, file sharing, or other methods.
Schneider Electric has assigned the CVE identifier CVE-2024-12703 to this vulnerability, with a base CVSS v3 score of 7.8 and a CVSS v4 score of 8.5. Both versions highlight the severity of the issue, with potential consequences including unauthorized remote code execution.
This vulnerability affects all versions of both RemoteConnect and SCADAPack x70 Utilities, products widely deployed in sectors such as energy and critical manufacturing across the globe. Although Schneider Electric is working on a remediation plan for future product versions, there are interim steps that organizations can take to mitigate the risk. These include:
CISA recommends minimizing the network exposure of control system devices, ensuring they are not directly accessible from the internet, and placing control system networks behind firewalls to isolate them from business networks. When remote access is necessary, using secure methods like Virtual Private Networks (VPNs) is strongly advised. However, organizations should ensure that VPNs are regularly updated and adequately secured.
The second advisory concerns a vulnerability in B&R Automation Runtime, a key software used in industrial control systems. The flaw arises from the use of a broken or risky cryptographic algorithm in the SSL/TLS component of B&R Automation Runtime versions prior to 6.1 and B&R mapp View versions prior to 6.1. Unauthenticated network-based attackers could exploit this vulnerability to impersonate legitimate services on impacted devices, creating opportunities for unauthorized access.
B&R Automation assigned CVE-2024-8603 to this vulnerability, which is identified as CWE-327. The CVSS v3 base score for this flaw is 7.5, indicating a moderately high risk to the affected systems. This vulnerability is especially concerning as it is exploitable remotely, with low attack complexity, making it a viable target for attackers seeking to compromise ICS environments.
The affected products are used worldwide, primarily in the critical manufacturing sector. B&R Automation has released an update (version 6.1) that corrects the issue, and users are strongly encouraged to apply this update to mitigate the risk. In the meantime, CISA recommends several mitigation strategies to limit exposure, including:
While no known public exploits targeting these vulnerabilities have been reported to CISA at the time of publication, the discovery of these flaws in Schneider Electric and B&R Automation products highlights the ongoing risks facing critical infrastructure sectors. Exploiting vulnerabilities in ICS products can lead to serious consequences, including data breaches, operational disruptions, and physical damage to infrastructure.
These incidents emphasize the urgent need for organizations to adopt proactive cybersecurity measures, such as regular patching, file integrity verification, and secure network configurations. By following CISA’s guidance and implementing comprehensive defense-in-depth strategies, organizations can better protect their systems from both known and emerging threats, ultimately reducing their exposure to cyber risks and ensuring the security of critical assets.
The post New ICS Vulnerabilities Discovered in Schneider Electric and B&R Automation Systems appeared first on Cyble.
Blog – Cyble – Read More
Curious about the buzz around AI in cybersecurity? Wonder if it’s just a shiny new toy in the tech world or a serious game changer? Let’s unpack this together in a not-to-be-missed webinar that goes beyond the hype to explore the real impact of AI on cybersecurity.
Join Ravid Circus, a seasoned pro in cybersecurity and AI, as we peel back the layers of AI in cybersecurity through a revealing
The Hacker News – Read More
Engineering firm Smiths Group has disclosed a cyberattack that forced it to take some systems offline and activate business continuity plans.
The post Smiths Group Scrambling to Restore Systems Following Cyberattack appeared first on SecurityWeek.
SecurityWeek – Read More
Atomwaffen Division cofounder and alleged Terrorgram Collective member Brandon Russell is facing a potential life sentence for an alleged plot on a Baltimore electrical station. His case is only the beginning.
Security Latest – Read More
Imagine: you’re calmly working away on your computer, when suddenly a scary message appears on the screen: “Your computer is infected with viruses! Install an antivirus immediately!” or “Your data is at risk! Clean your system immediately!” Panic? That’s what the scammers are hoping for.
This post explains what scareware is and why this threat is dangerous. We also give tips for avoiding falling for scarewarers’ tricks, and protecting you and your family from such attacks.
Scareware is a type of digital fraud that weaponizes users’ fears. The aim is to frighten the victim into visiting a malicious site and downloading something they shouldn’t. Scareware usually mimics antiviruses, system optimizers, registry cleaners, and the like. But other, more exotic types also exist.
The user is not so subtly informed that no fewer than five viruses have been found on their computer. However, the window header contains a small misprint: “Threaths detected” Source
To display their alarming messages, scammers tend to deploy browser pop-up windows and notifications, banner ads, and on occasion even good-old email.
Scareware creators use a variety of social engineering tricks to instill a sense of danger in the user. Often, threatening messages appear at the most unexpected moment — catching the victim off guard.
And scammers frequently hurry the victim into taking rash actions — not giving them time to think things over. Then, when the target has been properly prepared (that is, put into a state of panic), the attackers offer a simple solution to the problem: just install such-and-such software and all your troubles will be gone.
Fake antiviruses pretend to search for malware in the user’s system. Source
Upon receiving a scareware notification, in the best case scenario the victim will install a useless but harmless program on their device and pay a relatively small sum for the pleasure. But sometimes an attack can have more serious consequences. Under the guise of an “antivirus” or “system optimizer”, the victim may be fed proper malware that encrypts data or steals money from online bank accounts.
Sometimes scammers employ a hybrid scheme: scareware combined with sextortion. It may go as follows: the user receives an intimidating email saying they’ve been caught in a compromising video.
To see for themselves, the victim is invited to visit a website where they can watch the footage. However, to view the video, they first need to install a special player. This, of course, is malware in disguise.
In a new variant of the scareware scheme, the user is told that a virus has infected their smartphone. Nothing unusual so far — mobile versions of scareware have been around for ages. Here, however, the focus is artfully placed on what perhaps all smartphone owners fear the most: a faulty screen:
The scareware simulates screen damage caused by a virus that must be removed.Source
Curiously, the “faulty” display — which also blinks for added alarm — is capable of clearly showing the message about the supposed virus infection. How this window is able to float above a damaged screen is a mystery… To “fix” the screen, you just need to tap the button in the box and purchase the offered “antivirus”.
Of course, the best defense against fake “protection” is the real thing. To defeat scareware, install a bona fide antivirus from a reputable developer, keep a close eye on its notifications, and always heed its recommendations.
Also bear in mind that it’s seniors who are most likely to fall victim. So it’s worth helping your older relatives get the right protection since it can be a challenge for them.
Kaspersky official blog – Read More
A critical security flaw has been disclosed in the Cacti open-source network monitoring and fault management framework that could allow an authenticated attacker to achieve remote code execution on susceptible instances.
The flaw, tracked as CVE-2025-22604, carries a CVSS score of 9.1 out of a maximum of 10.0.
“Due to a flaw in the multi-line SNMP result parser, authenticated users can inject
The Hacker News – Read More
Ransomware attacks have reached an unprecedented scale in the healthcare sector, exposing vulnerabilities that put millions at risk. Recently, UnitedHealth revealed that 190 million Americans had their personal and healthcare data stolen during the Change Healthcare ransomware attack, a figure that nearly doubles the previously disclosed total.
This breach shows just how deeply ransomware
The Hacker News – Read More
Threat actors have been exploiting SimpleHelp remote access software shortly after the disclosure of three vulnerabilities.
The post SimpleHelp Remote Access Software Exploited in Attacks appeared first on SecurityWeek.
SecurityWeek – Read More