Industry group sounds alarm over 'Tardigrade' malware targeting biomanufacturing sector
A group of likely foreign government-sponsored hackers is behind cyberattacks on two bio-manufacturing companies that occurred this year, using a kind of malware capable of operating with independence within a network, an industry group warned. The Bioeconomy Information Sharing and Analysis Center (BIO-ISAC) dubbed the malware "Tardigrade" after the resilient micro-animal, and said it looks like the work of an advanced persistent threat group, a term that most often refers to government-backed attackers. READ MORE...
How a malicious Android app could covertly turn the DSP in your MediaTek-powered phone into an eavesdropping bug
Check Point Research will today spill the beans on security holes it found within the audio processor firmware in millions of smartphones, which can be potentially exploited by malicious apps to secretly eavesdrop on people. The infosec outfit believes as many as 37 per cent of smartphones globally are vulnerable. The flaws, patches for which were released last month, lie deep within handsets: in the code that controls an audio-processing unit inside system-on-chips designed by Taiwan's MediaTek. READ MORE...
Threat actors find and compromise exposed services in 24 hours
Researchers set up 320 honeypots to see how quickly threat actors would target exposed cloud services and report that 80% of them were compromised in under 24 hours. Malicious actors are constantly scanning the Internet for exposed services that could be exploited to access internal networks or perform other malicious activity. To track what software and services are targeted by threat actors, researchers create publicly accessible honeypots. READ MORE...
Researcher Awarded $10,000 for Google Cloud Platform Vulnerability
Security researcher David Schütz says he received over $10,000 in bug bounty payouts from Google after reporting a Google Cloud project vulnerability and subsequent bypasses to rolled-out fixes. In March, Schütz discovered that a URL allow-list bypass could be used to leak the access token for the internal Google Cloud Platform (GCP) project "cxl-services." READ MORE...
Researchers warn of severe risks from 'Printjack' printer attacks
A team of Italian researchers has compiled a set of three attacks called 'Printjack,' warning users of the significant consequences of over-trusting their printer. The attacks include recruiting the printers in DDoS swarms, imposing a paper DoS state, and performing privacy breaches. As the researchers point out, modern printers are still vulnerable to elementary flaws and lag behind other IoT and electronic devices that are starting to conform with cybersecurity and data privacy requirements. READ MORE...
Zero-day proof-of-concept exploit lands for Windows make-me-admin vulnerability
The day has a 'y' in it, so it must be time for another zero day to drop for a Microsoft product. In this case, a local privilege-elevation vulnerability to gain control of fully patched Windows 10, 11, and Server systems up to the 2022 build. Dubbed InstallerFileTakeOver by its author Abdelhamid Naceri, the proof-of-concept code was dropped onto the Microsoft-owned GitHub and, based on our testing, does indeed seem to work. READ MORE...
- ...in 1859, naturalist Charles Darwin publishes "On the Origin of Species."
- ...in 1864, French painter and illustrator Henri de Toulouse-Lautrec, who immortalized the colorful world of Parisian nightlife, is born in Albi, France.
- ...in 1938, early NBA star and Cincinnati Royals point guard Oscar Robinson is born in Charlotte, TN.
- ...in 1971, an unidentifed man known as "D.B. Cooper" hijacks a Northwest Airlines 727 and parachutes away with a $200,000 ransom, never to be seen or apprehended since.
