Up to 11 Million People Hit by MOVEit Hack at Government Services Firm Maximus
Government services provider Maximus this week revealed that the personal information of up to 11 million individuals was stolen in the MOVEit cyberattack earlier this year. Disclosed at the end of May, the attack involved the exploitation of a zero-day vulnerability in the MOVEit Transfer managed file transfer (MFT) software, allowing cybercriminals to tap into the data transferred through the service. READ MORE...
Following claims by two ransomware groups, Yamaha confirms cyberattack
Yamaha Corporation, the world's largest producer of musical equipment, has confirmed that has suffered a "cybersecurity incident" during which hackers gained unauthorised access to its systems, and stole data. In a brief statement on the Yamaha Canada website, the maker of musical instruments and audio equipment - which is separate from the spun-off motorcycle division - said its IT team was working with external specialists to "prevent significant damage or malware infiltration" into its network. READ MORE...
Mandiant finds no evidence of data or cryptocurrency theft in JumpCloud attack
One of the JumpCloud customers compromised by last month's cyberattack was a U.S.-based software firm that ultimately had four macOS devices targeted by a cryptocurrency-seeking APT actor, according to Mandiant research released Monday. The incident response firm hasn't observed any data theft and "there is no evidence to suggest cascading compromise," Mark Golembiewski, incident response manager at Mandiant, a unit of Google Cloud, said via email. READ MORE...
'Nitrogen' Ransomware Effort Lures IT Pros via Google, Bing Ads
Hackers are planting fake advertisements - "malvertisements" - for popular IT tools on search engines, hoping to ensnare IT professionals and perform future ransomware attacks. The scheme surrounds pay-per-click ads on sites like Google and Bing, which link to compromised Wordpress sites and phishing pages mimicking download pages for software such as AnyDesk, Cisco AnyConnect, TreeSize Free, and WinSCP. READ MORE...
60,000 Androids have stalkerware-type app Spyhide installed
Stalkerware-type app Spyhide is coded so badly that it's possible to gain access to the back-end databases and retrieve data about everyone that has the app on their device. And it's not a small number. Hacktivist maia arson crimew told TechCrunch she'd found 60,000 compromised Android devices, dating back to 2016. Spyhide, like many other stalkerware-type apps "silently and continually uploads the phone's contacts, messages, photos, call logs and recordings, and granular location in real time." READ MORE...
Peloton Bugs Expose Enterprise Networks to IoT Attacks
People could potentially lose more than just pounds by using a Peloton treadmill, as the Internet-connected fitness equipment also can leak sensitive data or pose as an initial-access pathway through an attack that compromises any of three key attack vectors, a researcher has found. Researchers from Check Point Software took a deep dive into the popular Peloton Tread equipment and found that attackers can enter the system via the OS, applications, or by exploiting APIs to load various malware. READ MORE...
MikroTik vulnerability could be used to hijack 900,000 routers (CVE-2023-30799)
A privilege escalation vulnerability (CVE-2023-30799) could allow attackers to commandeer up to 900,000 MikroTik routers, says VulnCheck researcher Jacob Baines. While exploting it does require authentication, acquiring credentials to access the routers is not that difficult. In addition to this, until October 2021, the default "admin" password was an empty string and there was no prompt for admins to change it. READ MORE...
Almost 40% of Ubuntu users vulnerable to new privilege elevation flaws
Two Linux vulnerabilities introduced recently into the Ubuntu kernel create the potential for unprivileged local users to gain elevated privileges on a massive number of devices. Ubuntu is one of the most widely used Linux distributions, especially popular in the U.S., having an approximate user base of over 40 million. Two recent flaws tracked as CVE-2023-32629 and CVE-2023-2640 discovered by Wiz's researchers S. Tzadik and S. Tamari were recently introduced into the operating system. READ MORE...
Axis Door Controller Vulnerability Exposes Facilities to Physical, Cyber Threats
A potentially serious vulnerability affecting a network door controller made by Swedish security solutions provider Axis Communications can expose facilities to both physical and cyber threats. Axis offers network cameras and other physical security products that are used by government and private sector organizations around the world. The flaw, tracked as CVE-2023-21406 and rated 'high severity', is a heap-based buffer overflow impacting the Axis A1001 network door controller. READ MORE...
'World Of Warcraft' Players Trick AI-Scraping Games Website Into Publishing Nonsense
As someone who writes about video games for a living, I am deeply annoyed/terrified about the prospect of AI-run websites not necessarily replacing me, but doing things like at the very least, crowding me out of Google, given that Google does not seem to care whatsoever whether content is AI-generated or not. That's why it's refreshing to see a little bit of justice dished out in a very funny way from a gaming community. READ MORE...
- ...in 1921, at the University of Toronto, scientists Frederick Banting and Charles Best successfully isolate insulin for the first time.
- ...in 1940, Bugs Bunny first appears on the silver screen in "A Wild Hare."
- ...in 1949, the world's first jet-propelled airliner, the British De Havilland Comet, makes its maiden test-flight in England.
- ...in 1953, the United States, the People's Republic of China, North Korea, and South Korea agree to an armistice, bringing the Korean War to an end.
