Security Affairs

JULY 16, 2018

A security researcher discovered that the IoT search engine ZoomEye has cached login passwords for tens of thousands of Dahua DVRs. The IoT search engine ZoomEye has cached login passwords for tens of thousands of Dahua DVRs, the discovery was made by security researcher Ankit Anubhav, Principal Researcher at NewSky Security.

IoT 58

IoT Engineering Passwords Firmware 58

Security Affairs

MARCH 23, 2020

Netlab shared its findings with LILIN on January 19, 2020, and the vendor addressed the issues with the release of the firmware update (version 2.0b60_20200207). The new firmware released by the vendors validated the hostname passed as input to prevent command execution. ” reads the advisory published by Netlab.

Firmware 105

Firmware Surveillance Manufacturing Advertising 105

Security Affairs

SEPTEMBER 3, 2019

Researchers at firmware security firm Eclypsium discovered multiple vulnerabilities referred as USBAnywhere that could be exploited to potentially allow an attacker to take over the baseboard management controller (BMC) for three different models of Supermicro server boards: the X9, X10, and X11. ” continues the analysis.

Hacking 85

Hacking Firmware Media Authentication 85

Security Affairs

JULY 28, 2020

CGI password logger This installs a fake version of the device admin login page, logging successful authentications and passing them to the legitimate login page. The first campaign likely began in early 2014 and continued until mid-2017, while the second started in late 2018 and was still active in late 2019.

Malware 105

Malware Firmware Advertising Manufacturing 105

Security Affairs

OCTOBER 1, 2018

GhostDNS scans for the IP addresses used by routers that use weak or no password then accesses them and changes the DNS settings to a rogue DNS server operated by the attackers. Js DNSChanger is written in JavaScript and includes 10 attack scripts designed to infect 6 routers or firmware packages. Pierluigi Paganini.

DNS 77

DNS Malware Firmware Phishing 77

Security Affairs

JUNE 25, 2020

In 2014 its global sales reached $55.91 “One of the screenshots seems to consist of LG Electronics official firmware or software update releases that assist their hardware products to work more efficiently.” Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. ” continues Cyble.

Computers and Electronics 101

Computers and Electronics Ransomware Mobile Telecommunications 101

Security Affairs

FEBRUARY 3, 2020

L inear eMerge E3 smart building access systems designed by N ortek Security & Control (NSC) are affected by a severe vulnerability (CVE-2019-7256) that has yet to be fixed and attackers are actively scanning the internet for vulnerable devices. Passwords can be found in p roduct documentation and compiled lists available on the Internet.”

DDOS 77

DDOS Hacking Internet Internet 77

Security Affairs

APRIL 4, 2019

Firmware updates that address this vulnerability are not currently available. Chaining the two flaws it is possible to take over the Cisco RV320 and RV325 routers, the hackers exploit the bugs to obtain hashed passwords for a privileged account and run arbitrary commands as root. through 1.4.2.20.

Small Business 79

Small Business Firmware Advertising VPN 79

Security Affairs

SEPTEMBER 4, 2019

An attacker could use these credentials to log on to the APs FTP server and steal the configuration file that includes SSIDs and passwords. “An This FTP server can be accessed with hardcoded credentials that are embedded in the firmware of the AP. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

DNS 77

DNS Hacking Firmware Wireless 77

Security Affairs

OCTOBER 13, 2020

The number of sensors and smart devices connected to the internet is exponentially rising, which are the 5 Major Vulnerabilities for IoT devices. Unfortunately, at that moment, there were over 300,000 of those cameras connected to the internet. Simple or reused passwords are still a problem. Poor credentials. Vicious insider.

IoT 134

IoT Cybersecurity Manufacturing Internet 134

Security Affairs

SEPTEMBER 20, 2020

The Mozi botnet was spotted by security experts from 360 Netlab, at the time of its discovered it was actively targeting Netgear, D-Link, and Huawei routers by probing for weak Telnet passwords to compromise them. The sample spreads via Telnet with weak passwords and some known exploits (see the list below). Pierluigi Paganini.

IoT 124

IoT DDOS Architecture Passwords 124

Security Affairs

JULY 13, 2019

“ Malware then guesses routers’ passwords , which new research from Avast shows are often weak. The router attacks involved an exploit kit that attempts to find the router IP on a network, then attempts to guess the password using common login credentials. ” reads a blog post published by Avast. concludes Avast.

DNS 74

DNS Passwords Advertising Banking 74

Security Affairs

MARCH 30, 2019

Chaining the two flaws it is possible to take over the Cisco RV320 and RV325 routers, the hackers exploit the bugs to obtain hashed passwords for a privileged account and run arbitrary commands as root. Firmware updates that address this vulnerability are not currently available. Pierluigi Paganini.

Small Business 75

Small Business Firmware Advertising Engineering 75

Security Affairs

OCTOBER 10, 2018

Unfortunately, the cloud ID is not sufficiently random and complex to make guessing correct cloud IDs hard because the analysis of the Xiongmai firmware revealed it is derived from the device’s MAC address. The experts also discovered an undocumented user with the name “default” and password “tluafed.”. ” continues the analysis.

Surveillance 82

Surveillance Hacking Firmware Manufacturing 82

Security Affairs

MAY 2, 2019

Others issues can be exploited by a remote, unauthenticated attacker to change admin and moderator passwords and view presentations. Tenable started reporting the vulnerabilities to vendors in January, but at the time of the public disclosure, only Extron and Barco have released firmware updates. Pierluigi Paganini.

Wireless 76

Wireless Firmware Advertising Authentication 76

Security Affairs

SEPTEMBER 10, 2019

The hardware of the terminals is equipped with Shenzen technology, while the firmware is based on BusyBox Linux Debian. . The telnetd service is being deactivated and old and weak passwords are as well being removed or changed. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Pierluigi Paganini.

IoT 84

IoT Hacking Firmware Advertising 84

Security Affairs

APRIL 26, 2019

An attacker could chain the issues to steal password theft and possibly remotely compromise the devices, he only needs to know the IP address of the P2P server used by the device. Furthermore, even if software patches were issued, the likelihood of most users updating their device firmware is low. ” reported Brian Krebs.

IoT 83

IoT Hacking Manufacturing Advertising 83

eSecurity Planet

NOVEMBER 1, 2021

The European Union is poised to place more demands on manufacturers to design greater security into their wireless and Internet of Things (IoT) devices. New vulnerabilities are created every day by cybercriminals, leading to many IoT devices being installed with out-of-date firmware and other exploitable vulnerabilities.”.

Wireless 100

Wireless IoT Manufacturing Mobile 100

Security Affairs

FEBRUARY 18, 2020

Successfully dumped the smartlock’s firmware. And after having successfully dumped the firmware we can proceed at extracting some valuable evidences for the forensics case. Artifacts extracted from the FW analysis: Smartlock Passwords & User’s Logs. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->.

IoT 84

IoT Hacking Firmware Advertising 84

Security Affairs

JULY 20, 2018

The first bug can only be exploited by an authenticated attacker, but Positive Technologies says all Diqee 360 devices come with a default password of 888888 for the admin account, which very few users change, and which attackers can incorporate into their exploit chain. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->.

Firmware 43

Firmware Surveillance Authentication Technology 43

Security Affairs

JULY 31, 2019

“The flash version of the web interface contains a hard-coded username and password, which may allow an authenticated attacker to escalate privileges.” “To update to the latest firmware, each user should select the “Check for Upgrade” option in the “Centrals” menu in the GUI. ” concludes the CISA advisory.

Backups 58

Backups Authentication Advertising Firmware 58

Security Affairs

DECEMBER 24, 2018

The communications are not encrypted, however the WiFi password is sent encrypted during set up (albeit trivial to decrypt).” ’ ~ Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->. Pierluigi Paganini.

IoT 79

IoT Hacking DNS Authentication 79

Security Affairs

OCTOBER 20, 2018

CVE-2018-18472 – XXE and Unauthenticated Remote Command Execution in Axentra Hipserv NAS firmware. . It’s used in different devices from different vendors, the affected devices sharing the firmware are: Netgear Stora. The company provides a firmware with a web interface that mainly uses PHP as a serverside language.

Firmware 61

Firmware IoT VPN Authentication 61

Privacy and Cybersecurity Law

NOVEMBER 6, 2018

California recently became the first state in the union to pass a cybersecurity law addressing “smart” devices and Internet of Things (IoT) technology. The term IoT generally refers to anything connected to the internet, including smart home devices (e.g., Amazon’s Alexa, NEST thermostats, etc.). Code § 1798.91.06(a))

IoT 45

IoT Cybersecurity Manufacturing Technology 45

Privacy and Cybersecurity Law

NOVEMBER 5, 2018

California recently became the first state in the union to pass a cybersecurity law addressing “smart” devices and Internet of Things (IoT) technology. The term IoT generally refers to anything connected to the internet, including smart home devices (e.g., Amazon’s Alexa, NEST thermostats, etc.). Code § 1798.91.06(a))

IoT 45

IoT Cybersecurity Manufacturing Technology 45

Malwarebytes

APRIL 5, 2023

2000 Children’s Internet Protection Act (CIPA): Requires K–12 schools to restrict children’s exposure to obscene digital content, monitor the online activity of minors, and educate students about appropriate behavior on the internet. Keep all operating systems, software, and firmware up to date.

Education 61

Education Ransomware Cybersecurity Risk 61

Digital Shadows

NOVEMBER 10, 2022

For instance, financially-motivated threat actors often plant in malicious URLs spoofing these events to fraudulent sites, hoping to maximize their chances of scamming naive internet users for a quick (illicit) profit. Nowadays, such pages are necessary to build a brand, generate new business, and resolve customer issues.

Cyber threats 52

Cyber threats Media Social Engineering Mobile 52

SecureList

NOVEMBER 26, 2021

The vulnerability is in MSHTML, the Internet Explorer engine. Apart from Trojanized installers, we also observed infections involving use of a UEFI (Unified Extensible Firmware Interface) and MBR (Master Boot Record) bootkit. logins, passwords, etc.), It also includes a Bitcoin wallet stealing module. Gamers beware.

Malware 86

Malware Banking Energy and Utilities Accountability 86

ForAllSecure

OCTOBER 5, 2021

In 2016, the Mirai IoT botnet shut down part of the internet, yet variations still plague us today. Vamosi: The internet. Vamosi: Dyn was an internet performance management and web application security company that has since been bought by Oracle. The results can be massive enough to bring down parts of the internet.

IoT 52

IoT DDOS Malware Internet 52

ForAllSecure

MAY 13, 2022

I kind of felt like it was giving back a bit to the community that I had kind of taken a lot from like when I was growing up by being IRC channels, and I had found the internet, all this information that was available. It was all this discovery on the internet that brought me to it. I moved here at the end of 2014.

Engineering 52

Engineering Energy and Utilities Computers and Electronics Firmware 52