Eversource, the largest energy supplier in New England, has suffered a data breach after customers' personal information was exposed on an unsecured cloud server. Eversource Energy is the latest energy delivery company in New England, powering 4.3 million electric and natural gas customers throughout Connecticut, Massachusetts, and New Hampshire. In a data breach notification shared with BleepingComputer, Eversource Energy is warning customers that the cloud storage server exposed their name... READ MORE...
Oh dear. Facebook has suffered another data breach. Hot on the heels of the revelation that the phone numbers and personal data of half a billion Facebook users had been leaked online, the social network has goofed again. But this time it's Facebook's PR team rather than its users who have been left exposed. Someone in Facebook's EMEA Communications team seems to have accidentally forwarded an internal email to… a journalist covering the story of the Facebook data breach. READ MORE...
Three zero-day vulnerabilities helped an attacker install a backdoor, access files and emails, and move laterally into a target network. SonicWall has deployed patches for three zero-day vulnerabilities in its email security tools and reports at least one known instance in which these flaws were exploited in an active attack. The vulnerabilities exist in SonicWall Email Security (ES), an email security tool built to protect inbound and outbound messages and defend against advanced threats . READ MORE...
Threat actors like attacking the technology because they provide a convenient entry point to enterprise networks. Attacks on virtual private networks, like those this week targeting a trio of known vulnerabilities in Pulse Secure appliances, have intensified in recent months along with the increase in remote and hybrid work environments since the outbreak of COVID-19. The trend requires organizations to patch VPN and other externally facing devices with the highest priority. READ MORE...
200 other companies also targeted, but no data lost. Japan has accused a member of the Chinese Communist Party of conducting cyber-attacks on its space agency and 200 other local entities. Tokyo's Metropolitan Police yesterday said they've filed a case against a Chinese national who they said works for a state-owned telco and, while living in Japan, rented servers to attack the Japan Aerospace Exploration Agency (JAXA) in 2016. READ MORE...
Attackers are promoting sites impersonating the Microsoft Store, Spotify, and an online document converter that distribute malware to steal credit cards and passwords saved in web browsers. The attack was discovered by cybersecurity firm ESET who issued a warning yesterday on Twitter to be on the lookout for the malicious campaign. In a conversation with Jiri Kropac, ESET's Head of Threat Detection Labs, BleepingComputer learned that the attack is conducted through malicious advertising. READ MORE...
Lots of things that we rely on, and that are generally regarded as bringing value, convenience and benefit to our lives…can be used for harm as well as good. Even the proverbial double-edged sword, which theoretically gave ancient warriors twice as much fighting power by having twice as much attack surface, turned out to be, well, a double-edged sword. With no "safe edge" at the rear, double-edged sword that was mishandled, or driven back by an assailant's counter-attack, became a direct threat. READ MORE...
Organizations in the automotive industry are no stranger to demands and mandates regarding car and passenger safety, so addressing the issue of cybersecurity of computerized, connected vehicles should, in theory, not be a huge problem. Despite thieves regularly finding ways to boost cars by exploiting vulnerabilities in modern keyless locking systems and researchers demonstrating how attackers could fiddle with car settings, the infotainment system, the break system, the steering system. READ MORE...
Security researchers at Human Security (formerly White Ops) have discovered a massive botnet of Android devices being used to conduct fraud in the connected TV advertising ecosystem. The sophisticated mobile botnet, dubbed Pareto, is made up on nearly a million infected mobile Android devices pretending to be millions of people watching ads on smart TVs and other devices. Human Security said the botnet used dozens of mobile apps to impersonate or spoof more than 6,000 CTV apps. READ MORE...
In a rare, groundbreaking decision, Linux kernel project maintainers have imposed a ban on the University of Minnesota (UMN) from contributing to the open-source Linux project. The move comes after a group of UMN researchers were caught submitting a series of malicious code commits, or patches that deliberately introduced security vulnerabilities in the official Linux codebase, as a part of their research activities. READ MORE...
Industrial automation giant Rockwell Automation has started releasing firmware updates for some of its Stratix switche to address another round of vulnerabilities introduced by the use of Cisco's IOS XE software. Rockwell Automation regularly releases firmware updates for its Stratix devices to address vulnerabilities introduced by the use of Cisco software. In fact, a majority of the security advisories released by the company for its Stratix products address flaws that exist in Cisco software. READ MORE...