Page 306 - Vulnerabilities News Today

To revist this article, visit My Profile, then View saved stories. With macOS malware on the rise, Apple has been busy in recent years adding layers of protections that make it a lot more difficult for malicious software to run on Macs. But a vulnerability in the operating system, publicly disclosed and patched today, was exploited to bypass all of them.  Security researcher Cedric Owens discovered the bug in mid-March while looking for ways around macOS defenses. Apples Gatekeeper mechanis...

Tuesday, 27 April 2021 - 11:28 The World Bank’s Country Director for Maldives, Nepal and Sri Lanka, Faris Hadad-Zervos, concluded a successful visit to Sri Lanka recently where he reiterated the World Bank’s commitment to support Sri Lanka’s efforts towards recovery and to build back better from the COVID-19 shock. Based in Kathmandu, Nepal, this latest mission followed the Country Director’s introductory visit to Sri Lanka last November after assuming his new role in July 2020. Hadad-Z...

Mon, Apr 26th 2021 6:25am — Tim Cushing A pretty hilarious turn of events has led to Cellebrites phone hacking tech being hacked by Signals Moxie Marlinspike, revealing the tech law enforcement uses to pull data from seized phones is host to major security flaws. By a truly unbelievable coincidence, I was recently out for a walk when I saw a small package fall off a truck ahead of me. As I got closer, the dull enterprise typeface slowly came into focus: Cellebrite. Inside, we found the latest...

The Economics of Software Flaw Discoveries, Exploits Twitter Casey Ellis, founder and CTO, Bugcrowd The economics of vulnerability discoveries and exploits is always evolving, and knowing those dynamics can provide insights into what attackers are doing, says Casey Ellis, founder and CTO of Bugcrowd, a platform for crowdsourced vulnerability reporting and bug bounties. Researchers are finding more bugs that ever, including CVEs that drop attackers off at privileged points in networks, he says...

minute read Share this article: David “moose” Wolpoff, co-founder and CTO at Randori, talks lesser-known hacking paths, including unresolved “fixme” flags in developer support groups. Blue teamers are in constant battle against hackers — faceless adversaries whose persistence can seem unending. But these actors have processes just like corporate operations, even if theirs are bootlegged. Attackers seek the path of least resistance: Gain access with as little effort as pos...

minute read Share this article: Even if the app is not installed or in use, threat actors can use it to spread malware through email campaigns and take over victims’ machines, new research has found. Hackers are leveraging the popular Telegram messaging app by embedding its code inside a remote access trojan (RAT) dubbed ToxicEye, new research has found. A victim’s computer infected with the ToxicEye malware is controlled via a hacker-operated Telegram messaging account. The To...

minute read Share this article: CVE-2021-22893 allows remote code-execution (RCE) and is being used in the wild by nation-state cyberattackers to compromise VPN appliances in defense, finance and government orgs. A critical zero-day security vulnerability in Pulse Secure VPN devices has been exploited by nation-state actors to launch cyberattacks against U.S. defense, finance and government targets, as well as victims in Europe, researchers said. Download “The Evolution of Ransom...

minute read Share this article: Attacks dubbed ‘Fajan’ by researchers are specifically targeted and appear to be testing various threat techniques to find ones with the greatest impact. A new e-mail-based campaign by an emerging threat actor aims to spread various remote access trojans (RATs) to a very specific group of targets who use Bloomberg’s industry-based services. Cisco Talos Intelligence researchers discovered the campaign, dubbing it and its perpetrator “Fajan” ...

Get Permission A new zero-day vulnerability in Ivantis Pulse Connect Secure products is being combined with recently patched flaws to attack U.S. federal agencies. The U.S. Cybersecurity and Infrastructure Security Agency, Ivanti and FireEye report that U.S. federal agencies and other entities have been compromised by two attack groups. "Their primary goals are maintaining long-term access to networks, collecting credentials, and stealing proprietary data," says Charles Carmakal, senior vic...

The Mozilla Foundation releases Firefox 88, fixing 13 bugs ranging from high to low severity. The Mozilla Foundation fixed a flaw in its Firefox browser that allowed spoofing of the HTTPS secure communications icon, displayed as a padlock in the browser address window. Successful exploitation of the flaw could have allowed a rogue website to intercept browser communications. Padlock Bug: False Sense of Security Tracked as CVE-2021-23998, the secure-lock-icon bug effects both the consumer and c...