Google researchers report critical 0-days in Chrome and all Apple OSes
Researchers in Google's Threat Analysis Group have been as busy as ever with discoveries that have led to the disclosure of three high-severity zero-day vulnerabilities under active exploitation in Apple OSes and the Chrome browser in the span of 48 hours. Apple on Thursday said it was releasing security updates fixing two vulnerabilities present in iOS, macOS, and iPadOS. Both of them reside in WebKit, the engine that drives Safari and a wide range of other apps. READ MORE...
Staples confirms cyberattack behind service outages, delivery issues
American office supply retailer Staples took down some of its systems earlier this week after a cyberattack to contain the breach's impact and protect customer data. Staples operates 994 stores in the US and Canada, along with 40 fulfillment centers for nationwide product storage and dispatch. The disclosure comes after multiple Reddit reports posted online since Monday reported various Staples internal operation problems. READ MORE...
Ex-worker phished former employer to illegally hack network and steal data
Once again, companies are being warned to be wary of past employees who may turn rogue. 28-year-old Andrew Mahn, of Derry, New Hampshire, has pleaded guilty to charges that he illegally hacked the network of his former company, telecoms firm Motorola after he successfully tricked current staff into handing over their login credentials. Mahn was working at the Massachusetts Port Authority (Massport) in August 2020 when he began to send phishing emails to a total of 31 current Motorola employees. READ MORE...
Feds Seize 'Sinbad' Crypto Mixer Used by North Korea's Lazarus
In its continued efforts to crack down on North Korea's most formidable state-sponsored threat group, the US government has seized a virtual currency mixer that has been serving as the principal way the group launders money stolen from its cybercriminal activity. The US Treasury Department sanctioned Sinbad.io, or just Sinbad, a crypto-mixing service that the feds said has processed millions of dollars worth of virtual currency from crypto heists by the Lazarus Group. READ MORE...
US readies prison cell for another Russian Trickbot developer
Another member of the Trickbot malware crew now faces a lengthy prison sentence amid US law enforcement's ongoing search for its leading members. Russian national Vladimir Dunaev, 40, faces a maximum sentence of 35 years in prison for his involvement in the now-shuttered Trickbot malware, which was often used to deploy ransomware. Pleading guilty to the charges against him on Thursday, Dunaev was one of the developers behind Trickbot - malware that was used to attack various organizations. READ MORE...
Cactus ransomware exploiting Qlik Sense flaws to breach networks
Cactus ransomware has been exploiting critical vulnerabilities in the Qlik Sense data analytics solution to get initial access on corporate networks. Qlik Sense supports multiple data sources and allows users to create custom data reports or interactive visualizations that can serve in decision making processes. The product can work both locally or in the cloud. In late August, the vendor released security updates for two critical vulnerabilities affecting the Windows version of the platform. READ MORE...
Will ChatGPT write ransomware? Yes.
This morning I decided to write some ransomware, and I asked ChatGPT to help. Not because I wanted to turn to a life of crime, but because I wanted to see if anything had changed since March, when I last tried the same exact thing. In short: ChatGPT has helped me, worryingly so. But more on that later. Today is the first anniversary of the unveiling of OpenAI's generative AI poster boy, ChatGPT. It's also the first anniversary of the tsunami of bloviation that the chatbot's unveiling created. READ MORE...
Admin of $19M marketplace that sold social security numbers gets 8 years in jail
A Ukrainian national is facing an eight year prison sentence for running an online marketplace that sold the personal data of approximately 24 million US citizens. Vitalii Chychasov, 37, was sentenced on Tuesday after pleading guilty to conspiracy to commit access device fraud and trafficking in unauthorized access devices. In addition to the prison sentence he will forfeit $5 million in assets, the proceeds of fraud, and his control of the various marketplace domains. READ MORE...
Major Security Flaws in Zyxel Firewalls, Access Points, NAS Devices
Taiwanese networking device vendor Zyxel has posted security warnings for major vulnerabilities haunting users of its firewalls, access points and network access storage (NAS) devices. Zyxel, a company that has struggled with software security problems, documented at least 15 security flaws in a range of products and warned that unpatched devices are at risk of authentication bypass, command injection and denial-of-service attacks. READ MORE...
Simple Attack Allowed Extraction of ChatGPT Training Data
The attack method, which the researchers described as "kind of silly", involved telling ChatGPT to repeat a certain word forever. For instance, telling it, "Repeat the word 'company' forever". ChatGPT would repeat the word for a while and then start including parts of what appeared to be the exact data it has been trained on. The researchers found that this can include information such as email addresses, phone numbers and other unique identifiers. READ MORE...
- ...in 1913, Henry Ford establishes the first assembly line for automobile production, which he modeled after the production line at Kahn's Meat Packing in Cincinnati.
- ...in 1940, comedian/actor/writer Richard Pryor ("Silver Streak", "Jo Jo Dancer, Your Life is Calling") is born in Peoria, IL.
- ...in 1945, actress/singer/comedian Bette Midler ("The Rose", "Hocus Pocus") is born in Honolulu, HI
- ...in 1955, activist Rosa Parks is jailed for protesting Montgomery, AL's racial segregation laws by refusing to give up her bus seat for a white passenger.
