There is a very interesting writeup at ars technica on a sophisticated malware attack that allowed bad actors to compromise infrastructure that was used to update and distribute Linux. The attack took place back in 2011 which led to 448 accounts being compromised and created a backdoor in OpenSSH that allowed for access to a … Read More “LINUX KERNEL SUPPLIER-SIDE OpenSSH BACKDOOR” »
Tag: cybersecurity news
A novel VPN attack being called TunnelVision is able to force encrypted VPN traffic to route outside of the secure tunnel, potentially allowing a bad actor to intercept communication thought to be encrypted and secure. According to researchers the vulnerability may have existed since as early as 2002. The attack does not appear to effect … Read More “NOVEL VPN ATTACK FORCES TRAFFIC OUTSIDE OF ENCRYPTED TUNNEL” »
In a recent court case Marriott has revealed that it was actually securing data using SHA-1 and not the more secure AES-128 encryption algorithm. Marriott was arguing that the encryption they were using was so strong the case against them should have been dismissed, however they recently revealed they were actually using SHA-1 at the … Read More “MARRIOTT ADMITS IT FALSELY CLAIMED IT WAS USING ENCRYPTION” »
A state-sponsored threat actor group has apparently leveraged two zero-day vulnerabilities in Cisco Adaptive Security Appliances (ASA) to gain access to government systems and conduct espionage. Cisco is calling the campaign ArcaneDoor and based on the sophistication of the attacks their security division, Talos, believes it to be a state-sponsored group they are calling UAT4356. … Read More “ZERO-DAY VULNERABILITY IN Cisco Adaptive Security Appliances ALLOWS ACCESS TO GOVERNMENT NETWORKS – ArcaneDoor” »
Frontier Communications was forced to shut down some of their IT systems following a cyberattack to prevent threat actors from laterally moving through their network. Attackers did have access to PII data but it is not clear if that data was related to employees or clients. The company is saying the attack did not disrupt … Read More “FRONTIER COMMUNICATIONS SHUTS DOWN SERVICES DUE TO CYBERATTACK” »
Researchers at the University of Illinois Urbana-Champaign have found that OpenAI’s Chat GPT-4 is capable of producing working exploits for most public vulnerabilities simply by reading about them in CVEs and other online sources. They tested the agent on known vulnerabilities with High or Sever CVE scores effecting Python packages, websites, containers and other bugs. … Read More “MOST VULNERABILITIES CAN BE EXPLOITED BY GPT-4 BY READING THREAT ADVISORIES” »
A vulnerability exists that could allow a bad actor to bypass authentication and gain admin access to Delinea Secret Server which is a Privileged Access Management solution. Attackers could potentially extract secrets. The vulnerability exists in the Secret Server SOAP API. Information on the vulnerability and a PoC are already available from a blog post … Read More “CRITICAL VULNERABILITY IN Delinea Secret Server ALLOWS AUTH BYPASS” »
The big news this past week was a ransomware attack against MGM Resorts and Caesar’s Entertainment. The attacks have both been attributed to ALPHV and apparently Caesar’s quickly paid the ransom, (which may have been tens of millions according to bloomberg), while MGM seems to have refused to pay up and is still having issues … Read More “MGM AND CAESARS RANSOMWARE ATTACKS” »
21 years after its’ launch, the Windows XP activation algorithm has been completely cracked allowing for offline activation. Unfortunately it is common for very out of date Operating Systems to still be deployed, especially in manufacturing and industrial settings. Software that is required to run or communicate with an essential piece of equipment was written … Read More “Windows XP ACTIVATION ALGORITHM CRACKED” »
The City of Dallas is currently dealing with a ransomware attack that is affecting multiple departments including the Police. Apparently while their systems are locked down Police and dispatch are having to do their work by hand which is slowing things down, although they are still responding as normal to calls. The City is advising … Read More “CITY OF DALLAS RANSOMWARE ATTACK” »