United Nations data breach exposed over 100k UNEP staff records
Today, researchers have responsibly disclosed a security vulnerability by exploiting which they could access over 100,000 private employee records of United Nations Environmental Programme (UNEP). The data breach stemmed from exposed Git directories and credentials, which allowed the researchers to clone Git repositories and gather a large amount of personally identifiable information (PII) associated with over 100k employees. Git directory exposed WordPress DB and Git credentials. READ MORE...
Dassault Falcon Jet reports data breach after ransomware attack
Dassault Falcon Jet has disclosed a data breach that may have led to the exposure of personal information belonging to current and former employees, as well as their spouses and dependents. Dassault Falcon Jet is the US subsidiary of French aerospace company Dassault Aviation which designs and builds military aircraft, business jets, and space systems. The Dassault subsidiary has 2,453 employees and it is focused on marketing and providing aviation and maintenance services for Falcon aircrafts. READ MORE...
Ransomware Gangs Scavenge for Sensitive Data by Targeting Top Executives
In their attempt to extort as much money as quickly as possible out of companies, ransomware gangs know some effective techniques to get the full attention of a firm's management team. And one of them is to specifically target the sensitive information stored on the computers used by a company's top executives, in the hope of finding valuable data that can best pressure bosses into approving the payment of a sizeable ransom. READ MORE...
Russian man sentenced to 12 years in prison for massive JPMorgan data heist
A U.S. federal judge on Thursday sentenced Andrei Tyurin, a 37-year-old Russian man, to 12 years in prison for his role in a hacking scheme that prosecutors say involved the theft of personal data from over 100 million customers of big U.S. financial firms. The brazen hacking operation, which ran from 2012 to 2015, is one of the biggest to hit Wall Street in recent memory. It involved Tyurin allegedly working with an Israeli man named Gery Shalon among others, to breach big-name companies. READ MORE...
Sunburst backdoor shares features with Russian APT malware
Kaspersky researchers found that the Sunburst backdoor, the malware deployed during the SolarWinds supply-chain attack, shows feature overlaps with Kazuar, a .NET backdoor tentatively linked to the Russian Turla hacking group. Turla (aka VENOMOUS BEAR and Waterbug) has been coordinating information theft and espionage campaigns as far back as 1996 and is the main suspect behind attacks targeting the Pentagon and NASA, the U.S. Central Command, and the Finnish Foreign Ministry. READ MORE...
Researchers Show Google's Titan Security Keys Can Be Cloned
Researchers have found a way to clone Google's Titan Security Keys through a side-channel attack, but conducting an attack requires physical access to a device for several hours, as well as technical skills, custom software, and relatively expensive equipment. Security key devices are considered highly efficient when it comes to protecting accounts against takeover attempts and, unlike other types of two-factor authentication (2FA) systems, they are much more difficult to compromise. READ MORE...
DoS Vulnerabilities Found in Rockwell's FactoryTalk Linx and RSLinx Classic Products
Researchers have discovered vulnerabilities that expose Rockwell Automation's FactoryTalk Linx and RSLinx Classic products to denial-of-service (DoS) attacks. According to an advisory published by Rockwell late last month, researchers from cybersecurity firm Tenable discovered a total of four DoS vulnerabilities, three affecting FactoryTalk Linx and one impacting the FactoryTalk Services Platform. FactoryTalk Linx, formerly RSLinx Enterprise. READ MORE...
SQL injection: The bug that seemingly can't be squashed
It's a common vulnerability that - despite being easily remedied - continues to plague our software and, if left undetected before deployment, provides a small window of opportunity to would-be attackers. December 2020 marked SQL injection's 22nd birthday (of sorts). Despite this vulnerability being old enough to drink, we're still letting it get the better of us instead of squashing it for good. In August this year, Freepik Company disclosed that they had fallen victim to an SQL injection. READ MORE...
- ...in 1755, Founding Father, first Treasury Secretary, and Broadway musical inspiration Alexander Hamilton is born in the British West Indies.
- ...in 1908, President Theodore Roosevelt designates the Grand Canyon a national monument.
- ...in 1942, E Street Band saxophonist Clarence Clemons, AKA "The Big Man", is born in Norfolk County, VA.
- ...in 1973, Major League Baseball's American League adopts the designated hitter rule.
