The Last Watchdog

APRIL 4, 2022

They are often unaware of the risks they take on, which can include hacking, fraud, phishing, and more. SMBs and enterprises alike have been struggling with APIs as a mechanism for information security. The fact that there are so many different APIs is the main challenge for enterprises when it comes to API security.

Hacking 222

Hacking Penetration Testing Data breaches Authentication 222

Security Affairs

JANUARY 19, 2020

The availability online of a new collection of Telnet credentials for more than 500,000 servers, routers, and IoT devices made the headlines. According to ZDNet that first published the news, the list was leaked on a popular hacking forum by the operator of a DDoS booter service. . SecurityAffairs – Telnet credentials, hacking).

IoT 82

IoT DDOS InfoSec Internet 82

Security Affairs

MARCH 26, 2024

A new variant of TheMoon malware infected thousands of outdated small office and home office (SOHO) routers and IoT devices worldwide. The Black Lotus Labs team at Lumen Technologies uncovered an updated version of “ TheMoon ” bot targeting end-of-life (EoL) small home/small office (SOHO) routers and IoT devices.

IoT 116

IoT Cybercrime Internet Internet 116

Hot for Security

FEBRUARY 16, 2021

Seismic monitoring equipment is vulnerable to common cybersecurity threats like those faced by IoT devices, a new research paper warns. Non-encrypted data, insecure protocols and poor user authentication mechanisms are among the security issues that leave seismological networks open to breaches, the authors note.

IoT 128

IoT InfoSec Data collection Encryption 128

Security Affairs

JANUARY 18, 2023

The vulnerabilities discovered in the Netcomm routers are a a stack based buffer overflow and an authentication bypass, respectively tracked as CVE-2022-4873 and CVE-2022-4874. CVE-2022-4874 – Authentication bypass in Netcomm router models NF20MESH, NF20, and NL1902 allows an unauthenticated user to access content.

Hacking 82

Hacking Authentication Software Internet 82

Security Affairs

AUGUST 23, 2023

Four vulnerabilities in the TP-Link Tapo L530E smart bulb and impacting the mobile app used to control them expose users to hack. The first vulnerability is an improper authentication issue on Tapo L503E, an attacker can exploit the issue to impersonate the device during the session key exchange step. “Vulnerability 1.

Passwords 84

Passwords Authentication Mobile IoT 84

Security Affairs

SEPTEMBER 25, 2020

According to SAM Seamless Network , over 200,000 businesses are using Fortigate VPN with default settings, exposing them to the risk of a hack. The configuration of the VPN solutions is important to keep organizations secure and to avoid dangerous surprises. SecurityAffairs – hacking, Fortigate VPN). Pierluigi Paganini.

VPN 111

VPN Hacking IoT Advertising 111

Security Affairs

OCTOBER 1, 2019

Security Labs discovered a new IOT bot named “GUCCI”. It seems like the IOT botnet is named after an Italian luxury brand of fashion and leather goods. The IOT threat detection engine picked the infection IP has shown below hosting number of bins for different architectures. Compromising C&C. Inference.

IoT 71

IoT Advertising Engineering Architecture 71

Security Affairs

AUGUST 27, 2021

Researchers from Nozomi Networks discovered a critical vulnerability that can be exploited to hack a video surveillance product made by Annke. The vulnerability, tracked as CVE-2021-32941 can be exploited by an attacker to hack a video surveillance product made by Annke, a provider of home and business security solutions.

Surveillance 98

Surveillance Hacking Firmware Manufacturing 98

Security Affairs

SEPTEMBER 2, 2019

Akamai researcher Larry Cashdollar reported that a cryptocurrency miner that previously hit only Arm-powered IoT devices it now targeting Intel systems. The researchers revealed that one of his honeypots was hit by this IoT malware that targets Intel machines running Linux. “This one seems to target enterprise systems.”

IoT 86

IoT Cryptocurrency Malware System Administration 86

Security Affairs

AUGUST 24, 2021

On August 15, firmware security company IoT Inspector published details about the flaws. “On August 16th, three days ago, multiple vulnerabilities in a software SDK distributed as part of Realtek chipsets were disclosed by IoT Inspector Research Lab [1]. ” reported IoT Inspector. Pierluigi Paganini.

IoT 120

IoT Firmware Internet Internet 120

Security Affairs

MARCH 8, 2022

Many IoT and medical devices are affected by seven serious flaws, collectively tracked as Access:7, in widely used Axeda platform. “Access:7 could enable hackers to remotely execute malicious code, access sensitive data or alter configuration on medical and IoT devices running PTC’s Axeda remote code and management agent.”reads

Manufacturing 77

Manufacturing IoT Authentication Financial Services 77

Security Affairs

SEPTEMBER 3, 2023

Hacks QakBot, Quietly Removes Botnet Infections Under Siege: Rapid7-Observed Exploitation of Cisco ASA SSL VPNs Why is.US Being Used to Phish So Many of Us?

Social Engineering 99

Social Engineering Spyware Data breaches Surveillance 99

SiteLock

AUGUST 27, 2021

Up next, Black Hat, one of the world’s largest information security conferences, took place in early August 2018 in Sin City. The conference held many briefings on politics, legislation, and Machine Learning (ML) and Artificial Intelligence (AI) in cybersecurity, as well as the challenge of endpoint security for many IoT devices.

Small Business 98

Small Business Artificial Intelligence Firmware IoT 98

Security Affairs

AUGUST 5, 2022

Researchers from FortiGuard Labs have discovered a new IoT botnet tracked as RapperBot which is active since mid-June 2022. ssh/authorized_keys, anyone with the corresponding private key can authenticate the SSH server without supplying a password. SecurityAffairs – hacking, RapperBot). Once stored public keys stored in ~/.ssh/authorized_keys,

IoT 133

IoT Malware Passwords Authentication 133

Security Affairs

JULY 13, 2021

ModiPwn flaw (CVE-2021-22779) in some of Schneider Electric’s Modicon PLCs can allow attackers to bypass authentication mechanisms and take over the device. The vulnerability can allow attackers to bypass authentication mechanisms which can lead to native remote-code-execution on vulnerable PLCs.” Pierluigi Paganini.

Authentication 109

Authentication IoT Engineering Encryption 109

Security Affairs

MARCH 9, 2022

Three flaws in APC Smart-UPS devices, tracked as TLStorm, could be exploited by remote attackers to hack and destroy them. Researchers from IoT security company Armis have discovered three high-impact security flaws, collectively tracked as TLStorm, affecting APC Smart-UPS devices. SecurityAffairs – hacking, IoT).

Firmware 89

Firmware IoT Authentication Backups 89

Security Affairs

MARCH 31, 2022

Bitdefender researchers discovered three security vulnerabilities in the popular Wyze Cam devices that can be exploited by threat actors to execute arbitrary code and access camera feeds. SecurityAffairs – hacking, Wyze cam devices). The post Flaws in Wyze cam devices allow their complete takeover appeared first on Security Affairs.

IoT 70

IoT Firmware Marketing Authentication 70

Security Affairs

JUNE 23, 2023

FortiNAC helps organizations protect their network infrastructure by providing visibility and control over devices that connect to the network, such as laptops, smartphones, IoT devices, and other endpoints. Fortinet has released security updates to address a critical vulnerability, tracked as CVE-2023-33299 (CVSS score 9.6/10),

IoT 90

IoT Authentication Hacking Information Security 90

Security Affairs

FEBRUARY 19, 2023

Every week the best security articles from Security Affairs are free for you in your email box. If you want to also receive for free the newsletter with the international press subscribe here.

DDOS 79

DDOS Data breaches Surveillance Ransomware 79

Security Affairs

FEBRUARY 6, 2021

Researchers from Israeli IoT security firm Vdoo found six vulnerabilities in the Realtek RTL8195A Wi-Fi module that could have been exploited to gain root access and take control of a device’s wireless communications. If you want to receive the weekly Security Affairs Newsletter for free subscribe here. Pierluigi Paganini.

IoT 97

IoT Wireless Authentication Passwords 97

Security Affairs

JULY 1, 2021

Microsoft researchers discovered multiple vulnerabilities in the firmware of the Netgear DGN-2200v1 series router that can allow attackers to bypass authentication, access stored credentials, and even take over devices. “The critical security issues (those with CVSS Score: 7.1 – 9.4) SecurityAffairs – hacking, IoT).

Firmware 126

Firmware Authentication Encryption Passwords 126

Security Affairs

FEBRUARY 14, 2023

“The attack itself is carried out locally by a user with authentication to the targeted system. An authenticated attacker could exploit the vulnerability by convincing a victim, through social engineering, to download and open a specially crafted file from a website which could lead to a local attack on the victim computer.”

Social Engineering 83

Social Engineering Engineering Authentication IoT 83

Security Affairs

NOVEMBER 16, 2022

Researchers from FortiGuard Labs discovered the previously undetected RapperBot IoT botnet in August, and reported that it is active since mid-June 2022. ssh/authorized_keys, anyone with the corresponding private key can authenticate the SSH server without supplying a password. SecurityAffairs – hacking, RapperBot).

DDOS 96

DDOS IoT Malware Architecture 96

Security Affairs

OCTOBER 21, 2021

An actionable way to defend against remote access threats is to require multi factor authentication (MFA) for these connections. IoT Devices. IoT devices include wearable devices, coffee makers, sensors, and cameras, all of which connect to the Internet. Many organizations don’t have visibility into all of their IoT devices.

IoT 113

IoT Phishing Passwords Scams 113

Security Affairs

JUNE 3, 2019

Supra Smart Cloud TV allows remote file inclusion in the openLiveURL function, which allows a local attacker to broadcast fake video without any authentication. An attacker could broadcast any video without any authentication, the worst case attacker could leverage this vulnerability to broadcast a fake emergency message (Scary right?).

Hacking 68

Hacking Authentication Advertising Cybersecurity 68

Security Affairs

APRIL 15, 2023

Siemens Metaverse, a virtual space built to mirror real machines, factories, and other highly complex systems, has exposed sensitive data, including the company’s office plans and internet of things (IoT) devices. It contained ComfyApp credentials and endpoints.

Manufacturing 96

Manufacturing IoT Technology Authentication 96

Security Affairs

DECEMBER 15, 2020

Experts from IoT security firm Sternum discovered vulnerabilities discovered in Medtronic’s MyCareLink Smart 25000 Patient Reader product that could be exploited to take control of a paired cardiac device. SecurityAffairs – hacking, Medtronic). ” states the advisory. Pierluigi Paganini.

Firmware 94

Firmware Authentication Mobile IoT 94

Security Affairs

JULY 20, 2022

million vehicles can allow hackers to remotely hack them. Cybersecurity and Infrastructure Security Agency (CISA) published an advisory to warn of multiple security vulnerabilities in MiCODUS MV720 Global Positioning System (GPS) trackers which are used by over 1.5 SecurityAffairs – hacking, MiCODUS). million vehicles.

Manufacturing 99

Manufacturing Passwords Mobile Authentication 99

Security Affairs

NOVEMBER 15, 2023

The Cybernews research team discovered that Strendus, a Mexican-licensed online casino, had left public access to 85GB of its authentication logs, with hundreds of thousands of entries containing private gamblers’ data. IoCs are pieces of evidence or data that suggest a security incident or breach has occurred. Amount of leaked data.

Passwords 96

Passwords Identity Theft Social Engineering Spyware 96

Security Affairs

MAY 14, 2023

Researchers from FortiGuard Labs first discovered the previously undetected RapperBot IoT botnet in August, and reported that it is active since mid-June 2022. ssh/authorized_keys, anyone with the corresponding private key can authenticate the SSH server without supplying a password. ” We are in the final!

IoT 91

IoT Malware Passwords Authentication 91

Security Affairs

JULY 14, 2020

Researchers spotted a new version of the Mirai IoT botnet that includes an exploit for a vulnerability affecting Comtrend routers. Malware researchers at Trend Micro have discovered a new version of the Mirai Internet of Things (IoT) botnet that includes an exploit for the CVE-2020-10173 vulnerability impacting Comtrend routers.

IoT 93

IoT Advertising DDOS Authentication 93

Security Affairs

MARCH 3, 2023

“An authenticated, local attacker could send maliciously crafted commands to a vulnerable TPM allowing access to sensitive data. ” Quarkslab researchers pointed out that the vulnerabilities could potentially affect billions of devices, including IoT devices, servers, and embedded systems. ” states Quarkslab.

Firmware 96

Firmware IoT Authentication Hacking 96

Security Affairs

AUGUST 18, 2022

.” Millions of devices, including routers and access points, are exposed to hacking. A remote attacker can exploit the flaw to execute arbitrary code without authentication by sending to the vulnerable devices specially crafted SIP packets with malicious SDP data. SecurityAffairs – hacking, Realtek). Pierluigi Paganini.

Firmware 145

Firmware IoT Hacking Authentication 145

Security Affairs

JULY 1, 2020

Netgear is addressing ten vulnerabilities affecting nearly 80 of its products, including issues discovered at the Pwn2Own hacking competition. Netgear is releasing security patches to address ten vulnerabilities affecting nearly 80 of its products. Authentication is not required to exploit this vulnerability.”

Authentication 123

Authentication Firmware Hacking Mobile 123

CyberSecurity Insiders

APRIL 11, 2023

An element of NIST SP 800-63 , Digital Identity Guidelines and ISO 27001 and 27002 are customized and applied as one framework in the Integrated Information Security Management System (ISMS) of my organization. The authorization process must only apply after the identification and authentication processes respectively and not before.

Authentication 100

Authentication Passwords Accountability Government 100

Security Affairs

MAY 2, 2023

FortiGuard Labs researchers observed a worrisome level of attacks attempting to exploit an authentication bypass vulnerability in TBK DVR devices. Threat actors are attempting to exploit a five-year-old authentication bypass issue, tracked as CVE-2018-9995 (CVSS score of 9.8), in TBK DVR devices.

Authentication 97

Authentication Retail Surveillance Education 97