In a way of working that looks like someone digging a trench while the other behind is covering it, and a third one is digging it yet again, this is another example of how bad software keeps cyber security in business. (Great read, by the way) Bad software may be too harsh and flaws may range from exposed credentials, and misconfiguration to more advanced issues like miss-after-use or implicit…
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png2024-11-05 10:07:312024-11-05 10:07:31Schneider Electric Launches Probe After Hackers Claim Theft of User Data
Taiwanese network-attached storage (NAS) appliance maker Synology has addressed a critical security flaw impacting DiskStation and BeePhotos that could lead to remote code execution.
Tracked as CVE-2024-10443 and dubbed RISK:STATION by Midnight Blue, the zero-day flaw was demonstrated at the Pwn2Own Ireland 2024 hacking contest by security researcher Rick de Jager.
RISK:STATION is an ”
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png2024-11-05 10:07:312024-11-05 10:07:31Synology Urges Patch for Critical Zero-Click RCE Flaw Affecting Millions of NAS Devices
An ongoing campaign is targeting npm developers with hundreds of typosquat versions of their legitimate counterparts in an attempt to trick them into running cross-platform malware.
The attack is notable for utilizing Ethereum smart contracts for command-and-control (C2) server address distribution, according to independent findings from Checkmarx, Phylum, and Socket published over the past few
Canadian law enforcement authorities have arrested an individual who is suspected to have conducted a series of hacks stemming from the breach of cloud data warehousing platform Snowflake earlier this year.
The individual in question, Alexander “Connor” Moucka (aka Judische and Waifu), was apprehended on October 30, 2024, on the basis of a provisional arrest warrant, following a request by the
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png2024-11-05 07:07:292024-11-05 07:07:29Canadian Suspect Arrested Over Snowflake Data Breach and Extortion Attacks
The Iran-linked group Emennet Pasargad aims to undermine public confidence in Israeli and Western nations by using hack-and-leak campaigns and disrupting government services, including elections.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png2024-11-05 07:07:282024-11-05 07:07:28Iranian APT Group Targets IP Cameras, Extends Attacks Beyond Israel
Google has warned that a security flaw impacting its Android operating system has come under active exploitation in the wild.
The vulnerability, tracked as CVE-2024-43093, has been described as a privilege escalation flaw in the Android Framework component that could result in unauthorized access to “Android/data,” “Android/obb,” and “Android/sandbox” directories and its sub-directories,
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png2024-11-05 04:06:432024-11-05 04:06:43Google Warns of Actively Exploited CVE-2024-43093 Vulnerability in Android System
The Pakistan-based advanced persistent threat actor has been carrying on a cyber-espionage campaign targeting organizations on the subcontinent for more than a decade, and it’s now using a new and improved “ElizaRAT” malware.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png2024-11-04 23:06:432024-11-04 23:06:43APT36 Refines Tools in Attacks on Indian Targets
BackBox.org offers a range of Penetration Testing services to simulate an attack on your network or application. If you are interested in our services, please contact us and we will provide you with further information as well as an initial consultation.
QNAP fixed NAS backup zero-day demonstrated at Pwn2Own Ireland 2024
/in General NewsIn a way of working that looks like someone digging a trench while the other behind is covering it, and a third one is digging it yet again, this is another example of how bad software keeps cyber security in business. (Great read, by the way) Bad software may be too harsh and flaws may range from exposed credentials, and misconfiguration to more advanced issues like miss-after-use or implicit…
Source
TechSplicer – Read More
Schneider Electric Launches Probe After Hackers Claim Theft of User Data
/in General NewsHackers claim to have stolen sensitive information, including user data, after breaching Schneider Electric’s Jira system.
The post Schneider Electric Launches Probe After Hackers Claim Theft of User Data appeared first on SecurityWeek.
SecurityWeek – Read More
Synology Urges Patch for Critical Zero-Click RCE Flaw Affecting Millions of NAS Devices
/in General NewsTaiwanese network-attached storage (NAS) appliance maker Synology has addressed a critical security flaw impacting DiskStation and BeePhotos that could lead to remote code execution.
Tracked as CVE-2024-10443 and dubbed RISK:STATION by Midnight Blue, the zero-day flaw was demonstrated at the Pwn2Own Ireland 2024 hacking contest by security researcher Rick de Jager.
RISK:STATION is an ”
The Hacker News – Read More
Malware Campaign Uses Ethereum Smart Contracts to Control npm Typosquat Packages
/in General NewsAn ongoing campaign is targeting npm developers with hundreds of typosquat versions of their legitimate counterparts in an attempt to trick them into running cross-platform malware.
The attack is notable for utilizing Ethereum smart contracts for command-and-control (C2) server address distribution, according to independent findings from Checkmarx, Phylum, and Socket published over the past few
The Hacker News – Read More
Canadian Suspect Arrested Over Snowflake Data Breach and Extortion Attacks
/in General NewsCanadian law enforcement authorities have arrested an individual who is suspected to have conducted a series of hacks stemming from the breach of cloud data warehousing platform Snowflake earlier this year.
The individual in question, Alexander “Connor” Moucka (aka Judische and Waifu), was apprehended on October 30, 2024, on the basis of a provisional arrest warrant, following a request by the
The Hacker News – Read More
Iranian APT Group Targets IP Cameras, Extends Attacks Beyond Israel
/in General NewsThe Iran-linked group Emennet Pasargad aims to undermine public confidence in Israeli and Western nations by using hack-and-leak campaigns and disrupting government services, including elections.
darkreading – Read More
Google Warns of Actively Exploited CVE-2024-43093 Vulnerability in Android System
/in General NewsGoogle has warned that a security flaw impacting its Android operating system has come under active exploitation in the wild.
The vulnerability, tracked as CVE-2024-43093, has been described as a privilege escalation flaw in the Android Framework component that could result in unauthorized access to “Android/data,” “Android/obb,” and “Android/sandbox” directories and its sub-directories,
The Hacker News – Read More
Schneider Electric says hackers accessed internal project execution tracking platform
/in General NewsFrench multinational Schneider Electric confirmed on Monday that it is investigating a cyberattack following confirmation of a breach.
The Record from Recorded Future News – Read More
APT36 Refines Tools in Attacks on Indian Targets
/in General NewsThe Pakistan-based advanced persistent threat actor has been carrying on a cyber-espionage campaign targeting organizations on the subcontinent for more than a decade, and it’s now using a new and improved “ElizaRAT” malware.
darkreading – Read More
Okta Fixes Auth Bypass Bug After 3-Month Lull
/in General NewsThe bug affected accounts with 52-character user names, and had several pre-conditions that needed to be met in order to be exploited.
darkreading – Read More