MFA-Minded Attackers Continue to Figure Out Workarounds
While MFA can improve overall security posture, it's not a "silver bullet" -- and hacks continue. As online users become increasingly aware of and use multifactor authentication (MFA), attackers are devising new ways to circumvent the technology - and often with great success. Earlier this month, for example, security firm Proofpoint reported its disclosure of critical vulnerabilities in Microsoft WS-Trust that could be used to circumvent MFA on cloud services that use the technology - chief among them, Microsoft 365. READ MORE...
Hacker Uploads Documents to WHO, UNESCO Websites
A hacker has found a way to upload PDF files to the websites of several organizations, including the World Health Organization (WHO) and UNESCO. The attack, first reported by Cyberwarzone.com, does not appear particularly sophisticated and its impact is likely low, but the same vulnerabilities could have been exploited by more advanced threat actors for more serious attacks. The files were uploaded by a hacker who uses the online moniker m1gh7yh4ck3r. READ MORE...
$150 Million Stolen From Singaporean Crypto-Exchange KuCoin
Singapore-based cryptocurrency exchange KuCoin over the weekend announced that hackers managed to steal large amounts of cryptocurrencies from multiple hot wallets. KuCoin is among the top five busiest trading exchanges out there, having a daily trading volume average of around $100 million, based on data from CoinGecko. On Saturday, the exchange announced that it identified a number of large withdrawals in Bitcoin, ERC-20 and other tokens from its hot wallets, and that it launched an investigation into the matter. READ MORE...
Amazon introduces eero Pro 6 and eero 6, delivering Wi-Fi 6 performance
Amazon introduced the newest additions to the eero family-eero Pro 6 and eero 6. These all-new mesh wifi systems feature Wi-Fi 6, the latest technology delivering faster speeds, higher performance, and better support for simultaneously connected devices. Getting fast, reliable coverage throughout your home is easy with the eero 6 series, which offers Wi-Fi 6 coverage for more than 75 devices simultaneously. Featuring a built-in Zigbee smart home hub. READ MORE...
Hardware security: Emerging attacks and protection mechanisms
Maggie Jauregui's introduction to hardware security is a fun story: she figured out how to spark, smoke, and permanently disable GFCI (Ground Fault Circuit Interrupter - the two button protections on plugs/sockets that prevent you from electrocuting yourself by accident with your hair dryer) wirelessly with a walkie talkie. "I could also do this across walls with a directional antenna, and this also worked on AFCI's (Arc Fault Circuit Interrupts - part of the circuit breaker box in your garage). READ MORE...
Cybersecurity lessons learned from data breaches and brand trust matters
Your brand is a valuable asset, but it's also a great attack vector. Threat actors exploit the public's trust of your brand when they phish under your name or when they counterfeit your products. The problem gets harder because you engage with the world across so many digital platforms - the web, social media, mobile apps. These engagements are obviously crucial to your business. Something else should be obvious as well: guarding your digital trust - public confidence in your digital security. READ MORE...
Twitter Says Bug Leading to API Key Leak Patched
Twitter last week started sending emails to developers to inform them of a vulnerability that might have resulted in the disclosure of developer information, including API keys. The issue, which has been fixed, potentially resulted in details about Twitter developer applications being stored in the browser's cache when the app builders visited the developer.twitter.com website, the company said in an email sent to developers, which was shared online. Designed to provide developers using the Twitter platform and APIs with access to documentation. READ MORE...
Louis Vuitton fixes data leak and account takeover vulnerability
Louis Vuitton has quietly patched a security vulnerability on its website that allowed for user account enumeration and even allowed account takeover via password resets. Founded in 1854, Louis Vuitton is a prominent luxury French fashion brand and merchandise company with over 121,000 employees and a $15 billion annual revenue. The easily exploitable flaw resided within the MyLV account section of the website. Creating a MyLV account lets a Louis Vuitton shopper track online orders, access purchase history, obtain e-receipts. READ MORE...
ThunderX ransomware silenced with release of a free decryptor
This week, Tesorion was able to find a flaw in the ransomware's encryption so that victims can decrypt their files without paying a ransom. This decryptor can decrypt files encrypted by the ransomware's current version and have the .tx_locked extension, as shown below. To use the decryptor, you will also need to upload both a copy of the readme.txt ransom note and an encrypted file so that a decryption key can be generated. The ThunderX Ransomware decryptor. READ MORE...
Too many staff have privileged work accounts for no good reason, reckon IT bods
Ever seen a Trello board you thought you shouldn't? If you're in UK or US, you're not alone. Around 40 per cent of staff in British and American corporations have access to sensitive data that they don't need to complete their jobs, according to recent research. In a survey commissioned by IT security firm Forcepoint of just under 900 IT professionals, 40 per cent of commercial sector respondents and 36 per cent working in the public sector said they had privileged access to sensitive data through work. READ MORE...
- ...in 1867, the US takes control of Midway Island.
- ...in 1924, a team of US Army aviators completes the first ever aerial circumnavigation of the world, covering 27,553 miles in 175 days.
- ...in 1959, Explorer VI, the U.S. satellite, takes the first video pictures of Earth.
- ...in 2008, SpaceX launches the first private spacecraft, Falcon 1.
