Researchers at Aqua Security discovered the “Shadow Resource” attack vector and the “Bucket Monopoly” problem, where threat actors can guess the name of S3 buckets based on their public account IDs.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png2024-08-08 12:07:062024-08-08 12:07:06Vulnerabilities Exposed Widely Used Solar Power Systems to Hacking, Disruption
The SEC has closed its investigation into Progress Software’s handling of a zero-day flaw in MOVEit Transfer. Progress Software announced in a recent SEC filing that no enforcement action will be recommended by the Division of Enforcement.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png2024-08-08 11:06:342024-08-08 11:06:34SEC Ends Probe Into MOVEit Attacks Impacting 95 Million People
Microsoft said it is developing security updates to address two loopholes that it said could be abused to stage downgrade attacks against the Windows update architecture and replace current versions of the Windows files with older versions.
The vulnerabilities are listed below –
CVE-2024-38202 (CVSS score: 7.3) – Windows Update Stack Elevation of Privilege Vulnerability
CVE-2024-21302 (CVSS
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png2024-08-08 11:06:342024-08-08 11:06:34Windows Downgrade Attack Risks Exposing Patched Systems to Old Vulnerabilities
Cybersecurity researchers have discovered a novel phishing campaign that leverages Google Drawings and shortened links generated via WhatsApp to evade detection and trick users into clicking on bogus links designed to steal sensitive information.
“The attackers chose a group of the best-known websites in computing to craft the threat, including Google and WhatsApp to host the attack elements,
A security researcher at SafeBreach demonstrated at the Black Hat 2024 conference that two zero-day vulnerabilities can be exploited in downgrade attacks to revert fully updated Windows systems back to older versions, reintroducing vulnerabilities.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png2024-08-08 11:06:332024-08-08 11:06:33Researcher Discovers Downgrade Attack Abusing Windows Update Process
Hacker Samy Kamkar is debuting his own open source version of a laser microphone—a spy tool that can invisibly pick up the sounds inside your home through a window, and even the text you’re typing.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png2024-08-08 11:06:332024-08-08 11:06:33Watch How a Hacker’s Infrared Laser Can Spy on Your Laptop’s Keystrokes
Roundcube’s vulnerabilities (CVE-2024-42009, CVE-2024-42008) allow attackers to compromise email accounts easily. The two cross-site scripting flaws could lead to the theft of emails, contacts, and passwords, and the sending of unauthorized emails.
A flaw in Microsoft 365’s anti-phishing feature allows attackers to hide the ‘First Contact Safety Tip’ warning in Outlook emails using CSS, increasing the risk of users falling for malicious emails.
https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png00https://www.backbox.org/wp-content/uploads/2018/09/website_backbox_text_black.png2024-08-08 10:06:332024-08-08 10:06:33Microsoft 365 Anti-Phishing Feature can be Bypassed with CSS
BackBox.org offers a range of Penetration Testing services to simulate an attack on your network or application. If you are interested in our services, please contact us and we will provide you with further information as well as an initial consultation.
Critical AWS Vulnerabilities Allow S3 Attack Bonanza
/in General NewsResearchers at Aqua Security discovered the “Shadow Resource” attack vector and the “Bucket Monopoly” problem, where threat actors can guess the name of S3 buckets based on their public account IDs.
darkreading – Read More
Vulnerabilities Exposed Widely Used Solar Power Systems to Hacking, Disruption
/in General NewsVulnerabilities found in solar power systems could have been exploited by hackers to cause disruption and possibly blackouts.
The post Vulnerabilities Exposed Widely Used Solar Power Systems to Hacking, Disruption appeared first on SecurityWeek.
SecurityWeek – Read More
SEC Ends Probe Into MOVEit Attacks Impacting 95 Million People
/in General NewsThe SEC has closed its investigation into Progress Software’s handling of a zero-day flaw in MOVEit Transfer. Progress Software announced in a recent SEC filing that no enforcement action will be recommended by the Division of Enforcement.
Cyware News – Latest Cyber News – Read More
Windows Downgrade Attack Risks Exposing Patched Systems to Old Vulnerabilities
/in General NewsMicrosoft said it is developing security updates to address two loopholes that it said could be abused to stage downgrade attacks against the Windows update architecture and replace current versions of the Windows files with older versions.
The vulnerabilities are listed below –
CVE-2024-38202 (CVSS score: 7.3) – Windows Update Stack Elevation of Privilege Vulnerability
CVE-2024-21302 (CVSS
The Hacker News – Read More
New Phishing Scam Uses Google Drawings and WhatsApp Shortened Links
/in General NewsCybersecurity researchers have discovered a novel phishing campaign that leverages Google Drawings and shortened links generated via WhatsApp to evade detection and trick users into clicking on bogus links designed to steal sensitive information.
“The attackers chose a group of the best-known websites in computing to craft the threat, including Google and WhatsApp to host the attack elements,
The Hacker News – Read More
Researcher Discovers Downgrade Attack Abusing Windows Update Process
/in General NewsA security researcher at SafeBreach demonstrated at the Black Hat 2024 conference that two zero-day vulnerabilities can be exploited in downgrade attacks to revert fully updated Windows systems back to older versions, reintroducing vulnerabilities.
Cyware News – Latest Cyber News – Read More
Watch How a Hacker’s Infrared Laser Can Spy on Your Laptop’s Keystrokes
/in General NewsHacker Samy Kamkar is debuting his own open source version of a laser microphone—a spy tool that can invisibly pick up the sounds inside your home through a window, and even the text you’re typing.
Security Latest – Read More
Roundcube Flaws Allow Easy Email Account Compromise (CVE-2024-42009, CVE-2024-42008)
/in General NewsRoundcube’s vulnerabilities (CVE-2024-42009, CVE-2024-42008) allow attackers to compromise email accounts easily. The two cross-site scripting flaws could lead to the theft of emails, contacts, and passwords, and the sending of unauthorized emails.
Cyware News – Latest Cyber News – Read More
Microsoft 365 Anti-Phishing Feature can be Bypassed with CSS
/in General NewsA flaw in Microsoft 365’s anti-phishing feature allows attackers to hide the ‘First Contact Safety Tip’ warning in Outlook emails using CSS, increasing the risk of users falling for malicious emails.
Cyware News – Latest Cyber News – Read More
AWS Patches Vulnerabilities Potentially Allowing Account Takeovers
/in General NewsAWS has patched vulnerabilities in several products, including flaws that could have been exploited to take over accounts.
The post AWS Patches Vulnerabilities Potentially Allowing Account Takeovers appeared first on SecurityWeek.
SecurityWeek – Read More