Служба кибербезопасности Сбербанка предотвратила массовую фишинговую атаку, сообщает пресс-служба банка. Система защиты не допустила рассылки фейковых повесток на военные сборы. Мобилизационные предписания содержали вредоносный файл.
Several old Linux vulnerabilities for which there are no public reports of malicious exploitation have been added to CISA’s KEV catalog.
The post CISA: Several Old Linux Vulnerabilities Exploited in Attacks appeared first on SecurityWeek.
Представители Discord уведомили пользователей об утечке данных, которая стала следствием взлома аккаунта, принадлежащего стороннему агенту службы поддержки. В результате в руки третьих лиц попали имейлы, содержание обращений в техподдержку и прикреплённые вложения.
Киберпреступники взяли в оборот недавно пропатченную уязвимость в плагине WordPress Advanced Custom Fields. Интересно, что с момента публикации демонстрационного эксплойта (PoC) до активной эксплуатации прошло немногим больше суток.
Former ByteDance executive said China government officials maintained access to all TikTok data, including information stored in the United States.
The post Executive Fired From TikTok’s Chinese Owner Says Beijing Had Access to App Data in Termination Suit appeared first on SecurityWeek.
Участник ОПГ, помогавший воровать деньги со счетов пользователей онлайн-банкинга, был пойман и призван к ответу стараниями УФСБ России по Костромской области. Ущерб от преступной деятельности, по оценкам, превысил 2 млрд рублей.
Rockwell Automation customers have been informed about potentially serious vulnerabilities in several products, shortly after news of an investigation into the firm’s China operations.
The post Organizations Informed of Over a Dozen Vulnerabilities in Rockwell Automation Products appeared first on SecurityWeek.
Банки должны отправить в Роскомнадзор данные о своих VPN по обычной электронной почте. Такое требование разослал на днях Банк России. Утечка подобной информации может привести к DDoS-атакам, предупреждают эксперты.
Australian enterprise software maker TechnologyOne said its internal Microsoft 365 system was compromised in a cyberattack.
The post Australian Enterprise Software Maker TechnologyOne Resumes Trading Following Hack appeared first on SecurityWeek.
Exploitation of a critical vulnerability in the Essential Addons for Elementor WordPress plugin started immediately after a patch was released.
The post 1 Million WordPress Sites Impacted by Exploited Plugin Vulnerability appeared first on SecurityWeek.
Twitter launched encrypted messaging, offering select users the ability to communicate more securely. But its new service is much more of a baby step than a giant leap forward.
The post Secure Messaging Arrives on Twitter – Sort of. ‘Don’t Trust It Yet,’ Musk Warns appeared first on SecurityWeek.
ChatGPT maker OpenAI, and other major AI providers such as Google and Microsoft, are coordinating with the Biden administration to let thousands of hackers take a shot at testing the limits of their technology.
The post Mass Event Will Let Hackers Test Limits of AI Technology appeared first on SecurityWeek.
Nickolas Sharp, the former Ubiquiti employee who posed as a hacker and attempted to extort the firm for $2 million, was sentenced to prison.
The post Former Ubiquiti Employee Who Posed as Hacker Sentenced to Prison appeared first on SecurityWeek.
На стартовавшей вчера конференции Google I/O техногигант в числе прочего озвучил изменения, нацеленные на повышение безопасности и приватности Android-приложений в Play Store.
Judge refuses to dismiss shareholder lawsuit alleging that Facebook violated the law and fiduciary duties in failing for years to protect user data privacy.
The post Delaware Judge Refuses to Dismiss Facebook Shareholder Suit Over User Data Privacy Breaches appeared first on SecurityWeek.
Новый дешифратор White Phoenix позволяет частично вернуть в прежнее состояние файлы, пострадавшие от различных семейств программ-вымогателей. Он пригодится тем, кто стал жертвой вредоноса, использующего прерывистое шифрование.
Суд в Москве выписал руководству Высшей школы экономики штраф за утечку персональных данных. Речь о мартовской атаке на почтовые серверы ВШЭ. Тогда в Сеть попали сканы паспортов студентов и сотрудников университета.
YouTube в тестовом виде запустил новую «фичу», которая будет призывать пользователей отключить блокировщики рекламы. Второй вариант — заплатить за премиум-аккаунт, в противном случае вам не дадут смотреть видео.
UK-based Capita says the recent ransomware attack will cost it up to $25 million, but it has not clarified whether that includes a ransom payment to the cybercriminals.
The post Capita Says Ransomware Attack Will Cost It Up to $25 Million appeared first on SecurityWeek.
Американские спецслужбы утверждают, что смогли нейтрализовать шпионскую программу, связанную с ФСБ России. По версии ФБР, вредонос по имени Snake, разработанный в Рязани, 20 лет качал дипломатическую переписку и следил за журналистами.
SAP released 18 new security notes on May 2023 Security Patch Day, including two that resolve critical vulnerabilities in 3D Visual Enterprise License Manager and BusinessObjects.
The post SAP Patches Critical Vulnerabilities With May 2023 Security Updates appeared first on SecurityWeek.
Intel and AMD have informed their customers about a total of more than 100 vulnerabilities found in their products.
The post Chipmaker Patch Tuesday: Intel, AMD Address Over 100 Vulnerabilities appeared first on SecurityWeek.
Joseph James O'Connor pleaded guilty for his role in schemes to hack the Twitter accounts of celebrities like Barack Obama and Elon Musk.
The post Twitter Celebrity Hacker Pleads Guilty in US appeared first on SecurityWeek.
Adobe has patched more than a dozen vulnerabilities, including critical code execution flaws, in its Substance 3D Painter product.
The post Adobe Patches 14 Vulnerabilities in Substance 3D Painter appeared first on SecurityWeek.
Siemens and Schneider Electric’s Patch Tuesday advisories for May 2023 address a few dozen vulnerabilities found in their products.
The post ICS Patch Tuesday: Siemens, Schneider Electric Address Few Dozen Vulnerabilities appeared first on SecurityWeek.
Data protection startup Optery has raised $2.7 million in a seed funding round led by Bayhouse Capital.
The post Data Protection Startup Optery Raises $2.7 Million in Seed Funding appeared first on SecurityWeek.
A public exploit targeting building automation systems brings KNX security back into the spotlight, with Schneider Electric releasing a security bulletin.
The post Building Automation System Exploit Brings KNX Security Back in Spotlight appeared first on SecurityWeek.
US authorities have seized 13 internet domains associated with DDoS-for-hire services.
The post US Seizes Domains of 13 DDoS-for-Hire Services appeared first on SecurityWeek.
A DDoS botnet named AndoryuBot has been seen exploiting CVE-2023-25717, a recent remote code execution vulnerability affecting Ruckus access points.
The post AndoryuBot DDoS Botnet Exploiting Ruckus AP Vulnerability appeared first on SecurityWeek.
Google announces the general availability of ‘rules_oci’ Bazel plugin to improve the security of container images.
The post Google Releases Open Source Bazel Plugin for Container Image Security appeared first on SecurityWeek.
An XSS vulnerability in the Advanced Custom Fields WordPress plugin exposes more than 2 million sites to attacks.
The post Vulnerability in Field Builder Plugin Exposes Over 2M WordPress Sites to Attacks appeared first on SecurityWeek.
Twitter is informing users that tweets posted to their Circle may have been seen by individuals outside the Circle.
The post Private Tweets Exposed Due to Twitter Circle Security Bug appeared first on SecurityWeek.
A $1.1 million payment was made to resolve a ransomware attack on San Bernardino county’s law enforcement computer network.
The post $1.1M Paid to Resolve Ransomware Attack on California County appeared first on SecurityWeek.
Western Digital has confirmed that a ransomware group has stolen customer and other information from its systems.
The post Western Digital Confirms Ransomware Group Stole Customer Information appeared first on SecurityWeek.
Vice President Kamala Harris met with the heads of companies developing AI as the Biden administration rolls out initiatives to ensure the technology improves lives without putting people’s rights and safety at risk.
The post Biden, Harris Meet With CEOs About AI Risks appeared first on SecurityWeek.
Three vulnerabilities in the Azure API Management service could be exploited for internal asset access, DoS, firewall bypass, and the upload of malicious files.
The post Azure API Management Vulnerabilities Allowed Unauthorized Access appeared first on SecurityWeek.
Siemens recently patched a critical vulnerability affecting some of its energy ICS devices that could allow hackers to destabilize a power grid.
The post Critical Siemens RTU Vulnerability Could Allow Hackers to Destabilize Power Grid appeared first on SecurityWeek.
Former Uber security chief Joe Sullivan was sentenced to probation and community service for covering up the data breach suffered by the ride-sharing giant in 2016.
The post Former Uber CSO Joe Sullivan Avoids Prison Time Over Data Breach Cover-Up appeared first on SecurityWeek.
Второго мая Google анонсировала выпуск новой версии Chrome для десктопных и мобильных устройств. Релизы 113.0.5672.63/64 и 113.0.5672.76/77 содержат множество полезных изменений, а также заплатки для 15 дыр; десять из них обнаружили сторонние исследователи.
Meta says it disrupted the new NodeStealer malware, which likely has Vietnamese origins, within weeks after it emerged.
The post Meta Swiftly Neutralizes New ‘NodeStealer’ Malware appeared first on SecurityWeek.
Американские власти вместе с зарубежными коллегами отключили сайты, использовавшиеся для проверки краденых данных банковских карт. В штате Нью-Йорк огласили обвинения, выдвинутые против россиянина Дениса Кулькова, предполагаемого владельца и оператора сервиса Try2Check, популярного у обитателей даркнета.
APT-группировка, известная под именами Dragon Breath, Golden Eye Dog и APT-Q-27, задала новый тренд хорошо подготовленных киберпреступников: использовать несколько сложных вариаций классической сторонней загрузки DLL (DLL sideloading). Такой подход позволил злоумышленникам уйти от детектирования.
Apple has released firmware updates for Beats and AirPods to patch a vulnerability that can be exploited to gain access to headphones via a Bluetooth attack.
The post Apple Releases First-Ever Security Updates for Beats, AirPods Headphones appeared first on SecurityWeek.
На почтовые адреса компаний стали приходить письма от имени крупного поставщика электрооборудования. Приложение к письму содержит ZIP-архив, его открытие загружает на компьютер стилер LokiBot.
Исследователь в области кибербезопасности взломал более десятка пакетов Packagist, часть которых насчитывает сотни миллионов установок. Забавной оказалась причина такого поступка: специалист просто хотел получить работу в сфере ИБ.
Dallas was hit with a ransomware attack that brought down its Police Department and City Hall websites on May 3rd.
The post Ransomware Attack Affects Dallas Police, Court Websites appeared first on SecurityWeek.
В App Store и Google Play “разрастаются” приложения несуществующих турагентств. Покупая там путевки, клиенты становятся жертвами аферистов. Обычно предложения на таких ресурсах дешевле рынка, а сама программа сильно “глючит”.
Ученые из Санкт-Петербурга настроили нейросеть на борьбу с мошенничеством в интернете. Она способна отличать подозрительные транзакции от безопасных и отсеивать мошенников, уверяют разработчики.
Open source BGP implementation FRRouting is affected by three vulnerabilities that can be exploited to cause disruption via DoS attacks.
The post Exploitation of BGP Implementation Vulnerabilities Can Lead to Disruptions appeared first on SecurityWeek.
Подтверждено: внезапное закрытие теневого маркетплейса Monopoly — дело рук правоохраны. По результатам расследований, запущенных в рамках трансграничной операции SpecTor, в США, Западной Европе и Бразилии задержаны 288 предполагаемых покупателей и продавцов наркотиков.
