Amazon's Ring cameras were used to spy on customers
Every single Amazon Ring employee was able to access every single customer video, even when it wasn't necessary for their jobs. Not only that, but the employees-along with workers from a third-party contractor in Ukraine-could also download any of those videos and then save and share them as they liked, before July 2017. That's what the FTC has alleged in a recent complaint, for which Amazon is facing a settlement of $5.8 million. READ MORE...
Information of 2.5M People Stolen in Ransomware Attack at Massachusetts Health Insurer
Point32Health, the second-largest health insurer in Massachusetts, is in the process of informing more than 2.5 million individuals that their personal and protected health information was stolen in a recent ransomware attack. Identified on April 17 and initially disclosed on April 20, the attack impacted systems related to Point32Health's Harvard Pilgrim Health Care, and resulted in the exfiltration of data pertaining to both current and former health plan subscribers and dependents. READ MORE...
Enzo Biochem Ransomware Attack Exposes Information of 2.5M Individuals
Biotechnology company Enzo Biochem has revealed that the clinical test information of roughly 2.47 million individuals was exposed in a recent ransomware attack. The incident, the company notes in a Form 8-K filing with the US Securities and Exchange Commission (SEC), occurred on April 6, resulting in certain systems being disconnected from the internet. On April 11, Enzo Biochem's investigation revealed that the attackers accessed and exfiltrated certain information from its systems. READ MORE...
US hospital forced to divert ambulances after cyberattack
The Idaho Falls Community Hospital fell victim to a cyberattack on Monday May 29, 2023. As a result, the hospital had to divert ambulances to other nearby hospitals and close some of its clinics. The hospital is keeping the public updated through its website and Facebook page. The hospital said that patients will be contacted by their provider if their appointments are impacted. READ MORE...
Decade-old critical vulnerability in Jetpack patched on millions of WordPress websites
Jetpack, an extremely popular WordPress plugin that provides a variety of functions including security features for around five million websites, has received a critical security update following the discovery of a bug that has lurked unnoticed since 2012. Jetpack's maintainers, Automattic, announced on Tuesday that it had worked closely with the WordPress security team to push out an automatic patch for every version of Jetpack since 2.0. READ MORE...
This malicious PyPI package mixed source and compiled code to dodge detection
Researchers recently uncovered the following novel attack on the Python Package Index (PyPI). ReversingLabs detected a Python package in April that mixed malware with compiled code as a way to evade detection by security tools that only check source code files and not compiled output. It may be the first supply chain attack to take advantage of the fact that Python byte code (PYC) files can be directly executed, and it comes amid a spike in malicious submissions to the Python Package Index. READ MORE...
Malicious Chrome extensions with 75M installs removed from Web Store
Google has removed from the Chrome Web Store 32 malicious extensions that could alter search results and push spam or unwanted ads. Collectively, they come with a download count of 75 million. The extensions featured legitimate functionality to keep users unaware of the malicious behavior that came in obfuscated code to deliver the payloads. The potential for abuse ranges from inserting ads into webpages to stealing sensitive information. READ MORE...
Kremlin claims Apple helped NSA spy on diplomats via iPhone backdoor
Russian intelligence has accused American snoops and Apple of working together to backdoor iPhones to spy on "thousands" of diplomats worldwide. These allegations from the Kremlin's Federal Security Service (FSB) coincide with Kaspersky today saying it uncovered spyware on "several dozen" iPhones belonging to the Russian infosec giant's top and middle-management. READ MORE...
High-Severity Vulnerabilities Patched in Splunk Enterprise
Splunk on Thursday announced Splunk Enterprise security updates that resolve multiple high-severity vulnerabilities, including some impacting third-party packages used by the product. The most severe of these is CVE-2023-32707, a privilege escalation issue that allows low-privileged users with the 'edit_user' capability to escalate privileges to administrator, via a specially crafted web request. READ MORE...
Biometric Bypass: BrutePrint Makes Short Work of Fingerprint Security
Weaknesses in the biometric security architecture of Android phones could allow attackers to brute-force an encoded fingerprint, if they have physical access to a targeted phone for hours and have a copy of a fingerprint database. Using two logical vulnerabilities in how fingerprint sensors and the trusted execution environment (TEE) handles errors, an attacker with physical access to a smartphone can gain the ability to submit an unlimited number of encoded fingerprints. READ MORE...
New MOVEit Transfer zero-day mass-exploited in data theft attacks
Hackers are actively exploiting a zero-day vulnerability in the MOVEit Transfer file transfer software to steal data from organizations. MOVEit Transfer is a managed file transfer (MFT) solution developed by Ipswitch, a subsidiary of US-based Progress Software Corporation, that allows the enterprise to securely transfer files between business partners and customers using SFTP, SCP, and HTTP-based uploads. READ MORE...
- ...in 1865, the U.S. Civil War officially ends with the surrender of Gen. Edmund Kirby Smith, dissolving the last Confederate army.
- ...in 1935, Baseball Hall of Famer Babe Ruth ends his Major League playing career after 22 seasons.
- ...in 1953, Queen Elizabeth II is formally crowned monarch of the United Kingdom.
- ...in 1967, The Beatles album "Sgt. Pepper's Lonely Hearts' Club Band" is released in the US.
