Security Affairs

NOVEMBER 1, 2021

An attacker with access to the dispenser controller’s USB port can install an outdated or modified firmware version to bypass the encryption and make cash withdrawals. A research published by Positive Technologies in 2018 revealed that 69 percent of ATMs were vulnerable to such attacks and could be easily hacked in a few minutes.

Hacking 117

Hacking Firmware Encryption Manufacturing 117

Security Affairs

NOVEMBER 25, 2022

The researchers discovered the issue by analyzing firmware images used devices from the above manufacturers. The experts analyzed one of the core frameworks EDKII used as a part of any UEFI firmware which has its own submodule and wrapper over the OpenSSL library ( OpensslLib ) in the CryptoPkg component. that dates back to 2009.

Firmware 100

Firmware Manufacturing Hacking Software 100

Security Affairs

AUGUST 6, 2018

HP has released firmware updates that address two critical remote code execution vulnerabilities in some models of inkjet printers. HP has released firmware updates to address two critical RCE flaws affecting some Inkjet printers. Go to the Upgrading Printer Firmware page and follow the instructions provided to install the firmware.

Firmware 45

Firmware Advertising Software Hacking 45

Schneier on Security

OCTOBER 3, 2019

Data Collected: 22 Vendors 1,294 Products 4,956 Firmware versions 3,333,411 Binaries analyzed Date range of data: 2003-03-24 to 2019-01-24 (varies by vendor, most up to 2018 releases). [.]. They look at the actual firmware. It represents a wide range of either found in the home, enterprise or government deployments.

IoT 207

IoT Firmware Data collection Architecture 207

Security Affairs

MARCH 8, 2020

Netgear has addressed a critical remote code execution vulnerability that could be exploited by an unauthenticated attacker to take over AC Router Nighthawk (R7800) hardware running firmware versions prior to 1.0.2.68. NETGEAR strongly recommends that you download the latest firmware as soon as possible.”

Firmware 116

Firmware Wireless Advertising Authentication 116

Security Affairs

NOVEMBER 11, 2021

Ax with firmware 1.04b12 and earlier CVE-2016-1555 Netgear WN604 before 3.3.3 CVE-2017-6077 NETGEAR DGN2200 devices with firmware through 10.0.0.50 Beta, D6220, D6400, D7000 CVE-2018-10561, CVE-2018-10562 GPON home routers CVE-2013-3307 Linksys X3000 1.0.03 CVE-2018-10088 XiongMai uc-httpd 1.0.0 A2pvI042j1.d26m

IoT 124

IoT Firmware Malware Wireless 124

CyberSecurity Insiders

SEPTEMBER 10, 2021

Presenting their find at the IEEE International Conference on Distributed Computing Systems in 2018, a team of researchers refined their invention even further that led to the innovation of a firmware that blocks ransomware from encrypting data on a computer network.

Ransomware 92

Ransomware Firmware Antivirus Encryption 92

Security Affairs

OCTOBER 3, 2018

The vulnerabilities are traked as CVE-2018-9074 , CVE-2018-9075 , CVE-2018-9076 , CVE-2018-9077 , CVE-2018-9078 , CVE-2018-9079 , CVE-2018-9080 , CVE-2018-9081 and CVE-2018-9082. 20 and publicly disclosed the vulnerabilities on September 30. Pierluigi Paganini.

Hacking 81

Hacking Firmware Advertising Backups 81

Security Affairs

FEBRUARY 23, 2022

Cyclops Blink is believed to be a replacement for the VPNFilter botnet, which was first exposed in 2018 and at the time was composed of more than 500,000 compromised routers and network-attached storage (NAS) devices. The malware leverages the firmware update process to achieve persistence.

Malware 92

Malware Firmware Architecture Firewall 92

Security Affairs

APRIL 7, 2021

Attackers are actively exploiting the CVE-2018-13379 flaw in Fortinet VPN to deploy the Cring ransomware to organizations in the industrial sector. “The primary causes of the incident include the use of an outdated and vulnerable firmware version on the Fortigate VPN server (version 6.0.2 ” continues Kaspersky.

VPN 99

VPN Ransomware Antivirus Firmware 99

Security Affairs

APRIL 19, 2022

Lenovo warns of vulnerabilities in its Unified Extensible Firmware Interface (UEFI) shipped with at least 100 notebook models. The vulnerabilities affecting the Lenovo UEFI result from the use of two UEFI firmware drivers, named SecureBackDoor and SecureBackDoorPeim respectively. ” reads the advisory published by Lenovo.

Firmware 86

Firmware Manufacturing Hacking Cybersecurity 86

CyberSecurity Insiders

NOVEMBER 11, 2021

Ax with firmware 1.04b12 and earlier. NETGEAR DGN2200 devices with firmware through 10.0.0.50. CVE-2018-10561, CVE-2018-10562. CVE-2018-10088. Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.2, Affected products include: NAS326 before firmware V5.21(AAZF.7)C0

Malware 85

Malware IoT Firmware Authentication 85

Security Affairs

DECEMBER 22, 2022

the malware operators have removed CVE-2018-12613, a phpMyAdmin vulnerability that could allow threat actors to view or execute files. Maintain device health with updates: Make sure devices are up to date with the latest firmware and patches. . “Since the release of Zerobot 1.1, ” reads the analysis published by Microsoft.

IoT 117

IoT DDOS Malware Firmware 117

Security Affairs

APRIL 2, 2022

The threat actors added TOTOLINK exploits just a week after the exploit codes were publicly released on GitHub in the attempt to compromise the largest number of devices as possible before the owners upgrade to the latest firmware releases. TOTOLINK has already addressed these flaws with the release of new firmware for vulnerable devices.

DDOS 86

DDOS Firmware Surveillance IoT 86

Security Affairs

JULY 3, 2023

For this reason, if the customer has SSL-VPN enabled, Fortinet is advising customers to take immediate action to upgrade to the most recent firmware release. Experts recommend organizations using FortiGate firewall, or anything else powered by FortiOS, to follow Fortinet’s advisory for this issue and upgrade their firmware immediately.

Firewall 84

Firewall VPN Firmware Internet 84

Security Affairs

JANUARY 15, 2021

Cisco announced it will no longer release firmware updates to fix 74 vulnerabilities affecting its RV routers, which reached end-of-life (EOL). Cisco will no longer release firmware updates to address 74 vulnerabilities affecting some of its RV routers that reached end-of-life (EOL). ” reads the advisory.

Small Business 83

Small Business Firmware Software Hacking 83

SiteLock

AUGUST 27, 2021

Up next, Black Hat, one of the world’s largest information security conferences, took place in early August 2018 in Sin City. A topic of importance came from Kryptowire, a mobile security research firm that found firmware vulnerabilities in as many as 10 million Android devices in the United States that have remote escalation privileges.

Small Business 98

Small Business Artificial Intelligence Firmware IoT 98

Security Affairs

OCTOBER 3, 2020

“The program underscores HP’s commitment to delivering defense-in-depth across all aspects of printing—including supply chain, cartridge chip, cartridge packaging, firmware and printer hardware.” HP covered printers in its bug bounty program since 2018 paying rewards that range between $500 and $10,000 per flaw.

Firmware 98

Firmware Advertising Hacking Cybersecurity 98

Malwarebytes

FEBRUARY 24, 2022

But the NCSC warns that it is likely that Sandworm is capable of compiling the same or very similar malware for other architectures and firmware. When it comes to infected appliances, Cyclops Blink persists on reboot and throughout the legitimate firmware update process.

Malware 145

Malware Firewall Firmware DDOS 145

Security Affairs

DECEMBER 29, 2018

. “During the 0DAYALLDAY Research Event a vulnerability was discovered ( CVE-2018-5560 ) in the Guardzilla Security Video System Model #: GZ521W. The vulnerability lies within the design and implementation of Amazon Simple Storage Service (S3) credentials inside the Guardzilla Security Camera firmware.”

Firmware 84

Firmware Surveillance IoT Passwords 84

Security Affairs

JULY 28, 2020

The first campaign likely began in early 2014 and continued until mid-2017, while the second started in late 2018 and was still active in late 2019. The experts observed that once a device has been infected, the malicious code can prevent the installation of firmware updates. ” reads the alert.

Malware 106

Malware Firmware Advertising Manufacturing 106

IT Security Guru

SEPTEMBER 27, 2023

Securing and attacking Modbus has therefore been a topic for years, and it was first in 2018 that the Modbus Security protocol (MSP) was published, nearly 40 years after the initial introduction of Modbus. To help mitigate this issue, the Modbus Security Protocol was developed and released in 2018.

Authentication 114

Authentication Firmware Firewall Network Security 114

Security Affairs

JULY 29, 2018

“Cisco Talos recently discovered several vulnerabilities present within the firmware of the Samsung SmartThings Hub.” Samsung SmartThings Hub runs a Linux-based firmware and allows for communications with various IoT devices using various wireless standards Zigbee, Z-Wave, and Bluetooth. RCE Chain – CVE-2018-3911.

Firmware 53

Firmware IoT Advertising Wireless 53

Google Security

AUGUST 9, 2021

In 2018, Google introduced the Titan Security Key as a direct defense against credential phishing. All Titan Security Keys are built with a hardware secure element chip that includes firmware engineered by Google to verify the key’s integrity. These keys will be available for all users starting tomorrow, August 10.

Mobile 123

Mobile Phishing Firmware Retail 123

Security Affairs

DECEMBER 23, 2018

A privilege escalation vulnerability tracked as CVE-2018-15465 affects the Cisco Adaptive Security Appliance (ASA) software. The flaw was discovered by experts at Tenable that explained that an authenticated remote unprivileged user can change or download the running configuration or replace the appliance firmware where they shouldn’t.

Firmware 111

Firmware Authentication Software Advertising 111

Security Affairs

NOVEMBER 1, 2018

The BLEEDINGBIT vulnerabilities affect several Texas Instruments chips, the CVE-2018-16986 flaw affects CC2640 and CC2650 chips running BLE-STACK 2.2.1 “The security vulnerability for CVE-2018-16986 is present in these TI chips when scanning is used (e.g. to address the CVE-2018-16986 flaw. or earlier.

Firmware 80

Firmware Manufacturing IoT Mobile 80

The Last Watchdog

SEPTEMBER 5, 2023

In 2018, UK regulators got the regulatory ball rolling taking steps that would eventually result in mandated minimum requirements for IoT data storage, communications and firmware update capabilities. other European nations and Singapore soon began moving in this direction, as well.

IoT 220

IoT Government Internet Internet 220

Security Affairs

OCTOBER 6, 2018

The most severe vulnerability tracked as CVE-2018-16593 is a command-injection flaw that resides in the Sony application Photo Sharing Plus that allows users to share multimedia content from their mobile devices via Sony Smart TVs. . Click the Firmware update link for details about how to check the software version.

Wireless 91

Wireless IoT Advertising Firmware 91

Security Affairs

MAY 19, 2021

The experts focused their analysis on the Mercedes-Benz User Experience (MBUX) infotainment system, which was first presented by the carmaker in 2018. Four vulnerabilities could be exploited by attackers remotely control some functions of the vehicle, fortunately, none could be used to control physical features of the cars.

Hacking 97

Hacking Firmware Engineering Software 97

SecureWorld News

SEPTEMBER 30, 2021

CISA encourages users and administrators to review Hikvision's Security Advisory HSRC-202109-01 and apply the latest firmware updates. In 2018, the U.S. See security researcher Watchful IP's technical blogpost for more information.". agencies and organizations using Chinese technology. still using banned Chinese tech.

Firmware 71

Firmware Surveillance Government Technology 71

Security Affairs

JULY 10, 2022

But the recommended mitigation strategy is to upgrade the vulnerable BCM firmware through Over-the-Air (OTA) Updates if feasible. However, some old vehicles may not support OTA.” ” the experts recommended. Follow me on Twitter: @securityaffairs and Facebook.

Firmware 99

Firmware Marketing Engineering Hacking 99

Schneier on Security

JANUARY 5, 2018

The second is that some of the patches require updating the computer's firmware. In November, Intel released a firmware update to fix a vulnerability in its Management Engine (ME): another flaw in its microprocessors. 2018 will be the year of microprocessor vulnerabilities, and it's going to be a wild ride.

Firmware 197

Firmware Software Engineering Phishing 197

Security Affairs

JUNE 23, 2020

This info includes printer names, locations, models, firmware versions, organization names, and even WiFi network names. In December 2018, the TheHackerGiraffe used the Printer Exploitation Toolkit (PRET) to hijack +50k vulnerable printers to Promote PewDiePie YouTube Channel. ” continues the report. .

Internet 100

Internet Internet Firmware Advertising 100

Security Affairs

NOVEMBER 20, 2018

The vulnerabilities are two remote code execution (RCE) flaws(CVE-2018-3950, CVE-2018-3951), a denial-of-service issue (CVE-2018-3948), and a server information disclosure bug (CVE-2018-394). The CVE-2018-3948 DoS flaw affects the URI-parsing function of the TL-R600VPN HTTP server.

Authentication 70

Authentication Advertising Firmware Hacking 70

Security Affairs

SEPTEMBER 16, 2018

Once again thank you! · Domestic Kitten – An Iranian surveillance operation under the radar since 2016. · The main source of infection on ICS systems was the internet in H1 2018. · A growing number of iOS apps collect and sell location data. · Chinese LuckyMouse APT has been using a digitally signed network filtering driver in recent (..)

Firmware 59

Firmware Advertising Surveillance Data breaches 59

Security Affairs

JULY 16, 2018

Anubhav explained that the passwords are related to Dahua DVRs running very old firmware that is known to be affected by a five-year-old vulnerability tracked as CVE-2013-6117. Even if the vulnerability has been patched, many Dahua devices are still running ancient firmware. — Ankit Anubhav (@ankit_anubhav) July 13, 2018.

IoT 59

IoT Engineering Passwords Firmware 59

eSecurity Planet

APRIL 28, 2022

CVE-2018-13379. CVE-2018-0171. It suggests that companies should use a centralized patch management system while regularly updating their software, applications, operating systems, and firmware on IT network assets. Microsoft Netlogon Remote Protocol (MS-NRPC). Elevation of privilege. CVE-2020-0688. CVE-2019-11510.

Cybersecurity 110

Cybersecurity Software Firmware Internet 110