Researchers have found 142 million personal details from former guests at the MGM Resorts hotels for sale on the Dark Web, evidence that a data leak from the hotel chain last summer may be far bigger in scope than previously thought. An advertisement on a hacker forum has put 142,479,937 details from "MGM Grand Hotels" guests up for sale for more than $2,900, according to a published report on ZDNet. READ MORE...
Researchers claim to have found evidence that cybercriminals are offering for sale a database containing the personal details of 3.4 million users of an online art and antiques auction website, as well as three million cracked passwords. News of a security breach involving a database of LiveAuctioneers customers became public on Saturday, after the online auction site published a statement appearing to shift the blame onto an unnamed data processing partner. READ MORE...
Data Viper, a security startup that provides access to some 15 billion usernames, passwords and other information exposed in more than 8,000 website breaches, has itself been hacked and its user database posted online. The hackers also claim they are selling on the dark web roughly 2 billion records Data Viper collated from numerous breaches and data leaks, including data from several companies that likely either do not know they have been hacked or have not yet publicly disclosed an intrusion. READ MORE...
A US District court in California has found a Russian hacker guilty of breaking into the networks of LinkedIn, Dropbox, and the now defunct social network Formspring, and selling their user databases on the computer underground. In October 2016, Yevgeniy Nikulin was arrested at a hotel restaurant in central Prague - an event caught on video camera. It had been four years since Nikulin had compromised the PC of a LinkedIn employee, and planted malware to steal their access credentials. READ MORE...
SAP patched a critical vulnerability affecting over 40,000 customers and found in the SAP NetWeaver AS JAVA (LM Configuration Wizard) versions 7.30 to 7.50, a core component of several solutions and products deployed in most SAP environments. The RECON (short for Remotely Exploitable Code On NetWeaver) vulnerability is rated with a maximum CVSS score of 10 out of 10 and can be exploited remotely by unauthenticated attackers to fully compromise unpatched SAP systems according to Onapsis. READ MORE...
A new and targeted ransomware named AgeLocker utilizes the 'Age' encryption tool created by a Google employee to encrypt victim's files. Yesterday, a consultant created a topic in the BleepingComputer forums about a new ransomware used in an attack against their client. After examining the encrypted files, it was discovered that a text header was added to each file that starts with the URL 'age-encryption[.]org,' as shown below. READ MORE...
Multiple Department of Energy research labs lack adequate security controls to safeguard devices like printers and USB drives, leaving the facilities susceptible to data theft, according to an inspector general investigation. "[T]he confidentiality, integrity and availability of systems and data could be directly impacted by the vulnerabilities discovered by our test work," the DOE inspector general said in a memo released last week. READ MORE...
Here's a bureaucratic nightmare that unfolded over the weekend: Digicert is one of the Big Five commercial CAs, short for certificate authorities - companies that sign and vouch for the digital certificates that put the the S in HTTPS and the padlock in your browser's address bar. As we've mentioned before, web certificates and HTTPS (secure HTTP) aren't just about protecting you from surveillance by encrypting the data that flows between your browser and the websites you visit. READ MORE...