Security Affairs

APRIL 3, 2023

’ The shared responsibility model allows application owners to add an authentication function by simply clicking a button. The vulnerability is related to a misconfiguration in ‘Shared Responsibility confusion.’ Below is the disclosure timeline: Jan. 31, 2023 – Wiz Research reported the Bing issue to MSRC Jan.

Accountability 79

Accountability Education Media Authentication 79

Security Affairs

APRIL 21, 2024

The Akira ransomware has been active since March 2023, the threat actors behind the malware claim to have already hacked multiple organizations in multiple industries, including education, finance, and real estate. In some attacks, threat actors created an administrative account named itadm.

Ransomware 106

Ransomware Encryption Antivirus VPN 106

Security Affairs

SEPTEMBER 8, 2023

An unauthenticated, remote attacker can exploit the vulnerability to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user.

Ransomware 135

Ransomware VPN Authentication Hacking 135

Security Affairs

FEBRUARY 10, 2022

. “The Federal Bureau of Investigation is issuing this announcement to inform mobile carriers and the public of the increasing use of Subscriber Identity Module (SIM) swapping by criminals to steal money from fiat and virtual currency accounts.” Use a variation of unique passwords to access online accounts.

Mobile 91

Mobile Cryptocurrency Authentication Accountability 91

Security Affairs

SEPTEMBER 24, 2023

educational nonprofit organization National Student Clearinghouse disclosed a data breach that impacted approximately 900 US schools. National Student Clearinghouse encourages impacted individuals to remain vigilant by reviewing their account statements and monitoring their free credit reports for suspicious activity.

Data breaches 112

Data breaches Education Ransomware Software 112

Security Affairs

APRIL 13, 2023

Successful exploitation can lead to remote, unauthenticated access to Redis and MongoDB instances via crafted authentication requests. ” reads the advisory published by the vendor.

Authentication 81

Authentication Education Media Hacking 81

Security Affairs

APRIL 28, 2023

The company also fixed a high-severity post-authentication command injection issue ( CVE-2023-27991 , CVSS score: 8.8) The vulnerability can be exploited by a remote, authenticated attacker to execute some OS commands. ” reads the advisory published by the vendor. affecting some specific firewall versions. through 5.35.

Firewall 94

Firewall Firmware VPN Authentication 94

Security Affairs

APRIL 4, 2023

Below is the list of flaws exploited by the ransomware gang’s affiliate: CVE-2021-27876 : The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. It supports multiple authentication schemes: SHA authentication is one of these.

Backups 93

Backups Ransomware Authentication Penetration Testing 93

Security Affairs

FEBRUARY 4, 2022

billion Azure AD brute force authentication attacks and detected 35.7 Enabling multi-factor authentication (MFA) and passwordless authentication would allow customers to protect their accounts from brute force attacks. billion Azure AD brute force authentication attacks and intercepted 35.7

Phishing 91

Phishing Authentication Education Cyber threats 91

Security Affairs

APRIL 21, 2023

“A vulnerability in the web UI of Cisco IND could allow an authenticated, remote attacker to execute arbitrary commands with administrative privileges on the underlying operating system of an affected device.” ” reads the advisory. “This vulnerability is due to improper input validation when uploading a Device Pack.

Authentication 90

Authentication Education Media Hacking 90

Security Affairs

MARCH 31, 2023

and all versions before it, allowing authenticated users, like shop customers or site members, to change the site’s settings and can potentially lead to a complete site takeover. The expert reported that the issue impacts Elementor Pro when it is installed on a site that has WooCommerce activated. The issue impacts version v3.11.6

Authentication 97

Authentication Education Accountability Media 97

Security Affairs

APRIL 12, 2023

SAP April 2023 security updates include a total of 24 notes, 19 of which are new vulnerabilities. SAP fixed two critical bugs that affect the Diagnostics Agent and the BusinessObjects Business Intelligence Platform.

Education 82

Education Media Authentication Passwords 82

Security Affairs

MAY 2, 2023

FortiGuard Labs researchers observed a worrisome level of attacks attempting to exploit an authentication bypass vulnerability in TBK DVR devices. Threat actors are attempting to exploit a five-year-old authentication bypass issue, tracked as CVE-2018-9995 (CVSS score of 9.8), in TBK DVR devices.

Authentication 98

Authentication Retail Surveillance Education 98

Security Affairs

NOVEMBER 15, 2023

The ransomware gang hit organizations in multiple industries, including the education, healthcare, manufacturing, information technology, and government sectors. The group relied on compromised credentials to authenticate to internal VPN access points. The victims of the group are “targets of opportunity.”

Ransomware 116

Ransomware Manufacturing Healthcare Education 116

Security Affairs

AUGUST 22, 2023

The Akira ransomware has been active since March 2023, the threat actors behind the malware claim to have already hacked multiple organizations in multiple industries, including education, finance, and real estate. Sophos researchers observed in May the threat actor using compromised Cisco VPN accounts to breach target networks. .

VPN 88

VPN Ransomware Hacking Education 88

Security Affairs

APRIL 22, 2023

PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of system. CVE-2023-27350 (CVSS score – 9.8) – PaperCut MF/NG Improper Access Control Vulnerability.

Education 90

Education Media Authentication Cybersecurity 90

Security Affairs

APRIL 5, 2023

.” The researchers reported the issues to the United States Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA), which assigned the following five CVEs: Use of Hard-coded Credentials CWE-798 ( CVE-2023–1748 , CVSS3.0: Improper Authentication Validation CWE-287 ( CVE-2023–1752 , CVSS3.0:

Manufacturing 90

Manufacturing Media Firewall Education 90

Security Affairs

APRIL 24, 2023

PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of system. The PoC code allows attackers to bypass authentication and execute code on vulnerable PaperCut servers. The issue results from improper access control.

Authentication 94

Authentication Software Education Malware 94

CyberSecurity Insiders

JULY 21, 2021

This means companies have to be proactive and instill the right habits, which often means resisting the bad habits that lead to millions of successful cyberattacks every year – from the use of generic and easy-to-crack account credentials to the willingness to click on suspicious links and attachments in emails from untrusted sources.

Social Engineering 145

Social Engineering Password Management Passwords Phishing 145

Security Affairs

APRIL 30, 2023

Nominate here: [link] Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini ( SecurityAffairs – hacking, newsletter ) The post Security Affairs newsletter Round 417 by Pierluigi Paganini – International edition appeared first on Security Affairs.

Cybercrime 88

Cybercrime Malware Hacking Accountability 88

Security Affairs

OCTOBER 12, 2023

Posteinfo, confirm your identity Using spoofing techniques, a text message ostensibly from Posteinfo collected in the history of legitimate messages invites identity confirmation to avoid bank account suspension. He is also the author of the book “La Gestione della Cyber Security nella Pubblica Amministrazione”.

Phishing 115

Phishing Scams Education Passwords 115

Security Affairs

MAY 4, 2023

In order to exploit the flaw, an attacker has to upgrade an affected device to a crafted version of the firmware. “This vulnerability is due to a missing authentication process within the firmware upgrade function.” ” reads the advisory published by Cisco.

Firmware 85

Firmware Education Media Authentication 85

Security Affairs

JULY 21, 2019

US Department of Education warned that hackers have breached at least 62 college and university networks by exploiting a vulnerability in the Ellucian Banner Web Tailor module of the Ellucian Banner ERP. “An improper authentication vulnerability (CWE-287) was identified in Banner Web Tailor and Banner Enterprise Identity Services.

Accountability 83

Accountability Education Authentication Advertising 83

Security Affairs

MAY 25, 2023

In the most recent campaign, the group targeted organizations in the communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education sectors. The APT group is using almost exclusively living-off-the-land techniques and hands-on-keyboard activity to evade detection.

Accountability 75

Accountability VPN Manufacturing Firewall 75

Security Affairs

DECEMBER 17, 2020

The FBI PIN, Number 20201210-001, was issued on December 10, 2020, and provides details about Doppelpaymer’s criminal activity and the sectors on which the group focuses (Healthcare, Emergency Services, and Educational Institutions). PIN Number 20201210-001. Patch operating systems, software, firmware, and endpoints. Pierluigi Paganini.

Ransomware 139

Ransomware Backups Firmware Accountability 139

Security Affairs

APRIL 8, 2023

Nominate here: [link] Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini ( SecurityAffairs – hacking, CISA) The post CISA adds Veritas Backup Exec flaws to its Known Exploited Vulnerabilities catalog appeared first on Security Affairs.

Backups 80

Backups Spyware Ransomware Education 80

Security Affairs

APRIL 18, 2023

The removal of these repositories should break authentication for panels currently in use. The operators behind the RedLine will be forced to set up new panels to recover their operations. No fallback channels were observed.

Malware 86

Malware Education Media Authentication 86

Security Affairs

FEBRUARY 28, 2024

“These operations have targeted various industries, including Aerospace & Defense, Education, Energy & Utilities, Governments, Hospitality, Manufacturing, Oil & Gas, Retail, Technology, and Transportation. ” reads the joint report. ” continues the report.

Energy and Utilities 97

Energy and Utilities Government Firewall Malware 97

Security Affairs

MAY 4, 2023

” CERT-UA urges Ukrainian critical organizations using multi-factor authentication for VPN accounts, network segmentation and filtering of incoming, outgoing and inter-segment information flows. The CERT also provided Indicators of Compromise (IoCs) for these attacks.

VPN 86

VPN Education Accountability Cyber Attacks 86

SiteLock

AUGUST 27, 2021

If cybercriminals gain this type of access to your site, it allows them to exploit for financial gain all kinds of sensitive data such as usernames, passwords, phone numbers, and bank account numbers. This helps provide an additional layer of security to the form and the website. Broken Authentication and Session Management.

Small Business 98

Small Business Passwords Authentication Accountability 98

Security Affairs

APRIL 5, 2023

The discovery of STYX coincides with Resecurity financial crime risk analysts observing a significant increase in threat actors offering money-laundering services that exploit digital banking and cryptocurrency accounts. Resecurity’s investigation of STYX also yielded the discovery of 100 mules accounts.

Banking 79

Banking Cybercrime Accountability Risk 79

CyberSecurity Insiders

JANUARY 6, 2023

First launched in 2004 and updated most recently in 2018, the PCI Data Security (PCI DSS) standard is continually updated to reflect the evolving challenges of the cyberthreat landscape. is clearly failing to protect cardholder account details effectively in today’s environment. Apply secure configurations to all system components.

Antivirus 138

Antivirus Retail Software Accountability 138

eSecurity Planet

AUGUST 22, 2023

The technologies for secure remote access can range from VPNs and multi-factor authentication to more advanced access and zero trust controls. We’ll cover a range of best practices for remote access security, from the simple and the practical to the more advanced. Avoid using default or simple-to-guess passwords.

Passwords 75

Passwords Authentication Encryption VPN 75

Security Affairs

APRIL 20, 2023

Once gained access to the K8s API server, the researchers used the node’s kubelet credentials to examine various cluster resources, including secrets, service accounts, and pods. When examining the pod list, we found pods belonging to other tenants in the same cluster. .

Accountability 70

Accountability Education Media Authentication 70

Security Affairs

MARCH 2, 2021

*Patches available now, action required to apply* Full remote code execution, without authentication. The first zero-day, tracked as CVE-2021-26855 , is a server-side request forgery (SSRF) vulnerability in Exchange that could be exploited by an attacker to authenticate as the Exchange server by sending arbitrary HTTP requests.

Authentication 101

Authentication Internet Internet Hacking 101

Security Affairs

APRIL 15, 2023

Volvo’s retailer exposed its database’s authentication information, including MySQL and Redis database hosts, open ports and credentials. The exposure of this key is particularly dangerous because it could have been used to decrypt user cookies, which often hold sensitive information such as credentials or session IDs.

Retail 91

Retail Manufacturing Passwords Phishing 91

Security Affairs

APRIL 24, 2023

“With this level of detail, impersonating network or internal hosts would be far simpler for an attacker, especially since the devices often contain VPN credentials or other easily cracked authentication tokens.” ” concludes the report.

Hacking 91

Hacking VPN Marketing Authentication 91