Security firm leaves more than five billion records exposed on unsecured database
A massive database, containing more than five billion records derived from past security breaches between 2012 and 2019, has been left unprotected, without any password protection on the internet. And who left it exposed? A security firm. Researcher Bob Diachenko says that he found the unsecured "data breach database" on a publicly-accessible Elasticsearch instance, managed by British security outfit Keepnet Labs, on March 16th. READ MORE...
Krebs on Security: Security Breach Disrupts Fintech Firm Finastra
Finastra, a company that provides a range of technology solutions to banks worldwide, said today it was shutting down key systems in response to a security breach discovered this morning. The company's public statement and notice to customers does not mention the cause of the outage, but their response so far is straight out of the playbook for dealing with ransomware attacks. READ MORE...
200M Records of US Citizens Leaked in Unprotected Database
Researchers discovered an unprotected database holding 800GB of personal user information, including 200 million detailed user records. The entirety of the database was wiped on March 3. User records inside the database held what appeared to be profiles of US users, according to researchers with Lithuanian research group CyberNews. Data contained exposed individuals' full names and titles, email addresses, phone numbers, birthdates, and even more personal information. READ MORE...
Printing company exposes 343GB of sensitive military data
UK Printing company Doxzoo inadvertently exposed 343GB of data through a misconfigured Amazon Web Services (AWS) S3 bucket, including sensitive information said to relate to branches of the UK and US military. Potentially more than 100,000 users were affected by the data leak, with approximately 270,000 records exposed including personal information and payment information, as well as order details, passport information, and the contents of printing orders. READ MORE...
FBI Warning: Phishing Emails Push Fake Govt Stimulus Checks
FBI's Internet Crime Complaint Center (IC3) today warned of an ongoing phishing campaign delivering spam that uses fake government economic stimulus checks as bait to steal personal information from potential victims. "Look out for phishing emails asking you to verify your personal information in order to receive an economic stimulus check from the government," IC3's alert says. READ MORE...
Pwn2Own hackers go remote, then crack macOS and Oracle machines anyway
If any demographic should be set up to work remotely, it's hackers. The Pwn2Own hacking contest, in which security researchers earn rewards by uncovering flaws in commercial technology, closed its spring 2020 edition Thursday after participants probed systems like the macOS and Oracle VirtualBox. It's a premier competition that global technology firms now use to recruit bug hunters who might be able to help protect widely used products. READ MORE...
Krebs on Security: Zyxel Flaw Powers New Mirai IoT Botnet Strain
In February, hardware maker Zyxel fixed a zero-day vulnerability in its routers and VPN firewall products after KrebsOnSecurity told the company the flaw was being abused by attackers to break into devices. This week, security researchers said they spotted that same vulnerability being exploited by a new variant of Mirai, a malware strain that targets vulnerable Internet of Things (IoT) devices for use in large-scale attacks and as proxies for other cybercrime activity. READ MORE...
Zero-Day Vulnerabilities in LILIN DVRs Exploited by Several Botnets
Cybercrime groups have been exploiting vulnerabilities in digital video recorders (DVRs) made by Taiwan-based surveillance solutions provider LILIN to increase the size of their botnets. Researchers at Chinese cybersecurity firm Qihoo 360 started seeing attacks in late August 2019. The vendor released firmware updates that should patch the exploited flaws on February 14, but the vulnerabilities had a zero-day status until this date. READ MORE...
Keep calm and carry on working (remotely)
As more of the world's population than ever before take their equipment home to begin working remotely, the challenge is for team leaders to ensure their team members remain productive, motivated and engaged, and avoid the issues of isolation. Last year, Buffer, a company specializing in social media content, surveyed 2,500 remote workers on the benefits and challenges associated with teleworking. The number one challenge, at 22%, was the ability to unplug after work. READ MORE...
