Security Affairs

OCTOBER 1, 2019

Security Labs discovered a new IOT bot named “GUCCI”. It seems like the IOT botnet is named after an Italian luxury brand of fashion and leather goods. The IOT threat detection engine picked the infection IP has shown below hosting number of bins for different architectures. Compromising C&C. Inference.

IoT 74

IoT Advertising Engineering Architecture 74

Security Affairs

SEPTEMBER 2, 2019

Akamai researcher Larry Cashdollar reported that a cryptocurrency miner that previously hit only Arm-powered IoT devices it now targeting Intel systems. The researchers revealed that one of his honeypots was hit by this IoT malware that targets Intel machines running Linux. “This one seems to target enterprise systems.”

IoT 88

IoT Cryptocurrency Malware System Administration 88

The Security Ledger

MARCH 13, 2019

Forget about Congress's latest attempt to regulate IoT security. The post Spotlight: CTIA’s IoT Cybersecurity Certification is a Big Deal. Forget about Congress’s latest attempt to regulate IoT security. Federal Government to meet strict information security standards. Here’s why.

IoT 40

IoT Cybersecurity Internet Internet 40

Security Affairs

MARCH 8, 2022

Many IoT and medical devices are affected by seven serious flaws, collectively tracked as Access:7, in widely used Axeda platform. “Access:7 could enable hackers to remotely execute malicious code, access sensitive data or alter configuration on medical and IoT devices running PTC’s Axeda remote code and management agent.”reads

Manufacturing 82

Manufacturing IoT Authentication Financial Services 82

Security Affairs

AUGUST 24, 2021

On August 15, firmware security company IoT Inspector published details about the flaws. “On August 16th, three days ago, multiple vulnerabilities in a software SDK distributed as part of Realtek chipsets were disclosed by IoT Inspector Research Lab [1]. ” reported IoT Inspector.

IoT 122

IoT Firmware Internet Internet 122

Security Affairs

MAY 11, 2023

Industrial and IoT cybersecurity firm Claroty disclosed technical details of five vulnerabilities that be exploited to hack some Netgear router models. ” reads the advisory published by the security firm. The remaining ones are authentication bypass and command injection flaws. ” concludes the advisory.

Hacking 95

Hacking Firmware Authentication DNS 95

Security Affairs

AUGUST 5, 2022

Researchers from FortiGuard Labs have discovered a new IoT botnet tracked as RapperBot which is active since mid-June 2022. ssh/authorized_keys, anyone with the corresponding private key can authenticate the SSH server without supplying a password. The bulk of the malware code contains an implementation of an SSH 2.0

IoT 135

IoT Malware Passwords Authentication 135

The Last Watchdog

APRIL 4, 2022

SMBs and enterprises alike have been struggling with APIs as a mechanism for information security. To protect against these attacks, businesses need to implement a wide range of strong API security measures such as authentication, authorization, encryption, and vulnerability scanning.

Hacking 222

Hacking Penetration Testing Data breaches Authentication 222

Security Affairs

JULY 13, 2021

ModiPwn flaw (CVE-2021-22779) in some of Schneider Electric’s Modicon PLCs can allow attackers to bypass authentication mechanisms and take over the device. The vulnerability can allow attackers to bypass authentication mechanisms which can lead to native remote-code-execution on vulnerable PLCs.”

Authentication 110

Authentication IoT Engineering Encryption 110

Security Affairs

JULY 14, 2020

Researchers spotted a new version of the Mirai IoT botnet that includes an exploit for a vulnerability affecting Comtrend routers. Malware researchers at Trend Micro have discovered a new version of the Mirai Internet of Things (IoT) botnet that includes an exploit for the CVE-2020-10173 vulnerability impacting Comtrend routers.

IoT 96

IoT Advertising DDOS Authentication 96

Security Affairs

MARCH 31, 2022

Bitdefender researchers discovered three security vulnerabilities in the popular Wyze Cam devices that can be exploited by threat actors to execute arbitrary code and access camera feeds. An unauthenticated access to contents of the SD card. ” Follow me on Twitter: @securityaffairs and Facebook.

IoT 74

IoT Firmware Marketing Authentication 74

SiteLock

AUGUST 27, 2021

Up next, Black Hat, one of the world’s largest information security conferences, took place in early August 2018 in Sin City. The conference held many briefings on politics, legislation, and Machine Learning (ML) and Artificial Intelligence (AI) in cybersecurity, as well as the challenge of endpoint security for many IoT devices.

Small Business 98

Small Business Artificial Intelligence Firmware IoT 98

Security Affairs

MARCH 9, 2022

Researchers from IoT security company Armis have discovered three high-impact security flaws, collectively tracked as TLStorm, affecting APC Smart-UPS devices. SecurityAffairs – hacking, IoT). Three flaws in APC Smart-UPS devices, tracked as TLStorm, could be exploited by remote attackers to hack and destroy them.

Firmware 93

Firmware IoT Authentication Backups 93

The Last Watchdog

DECEMBER 31, 2019

Physical security is the protection of personnel and IT infrastructure (such as hardware, software, and data) from physical actions and events that could cause severe damage to an organization. Related: Good to know about IoT Physical security is often a second thought when it comes to information security.

Cyber Risk 173

Cyber Risk Risk Firewall Surveillance 173

Security Boulevard

AUGUST 11, 2023

Biometrics are known to have been a boon to digital security and data protection, but there are a variety of other use cases across industries. Biometrics are automated methods used to identify an individual or verify/authenticate an individual's identity based on physiological characteristics and behavioral traits.

Healthcare 52

Healthcare Authentication Passwords IoT 52

Security Affairs

FEBRUARY 14, 2023

“The attack itself is carried out locally by a user with authentication to the targeted system. An authenticated attacker could exploit the vulnerability by convincing a victim, through social engineering, to download and open a specially crafted file from a website which could lead to a local attack on the victim computer.”

Social Engineering 87

Social Engineering Engineering Authentication IoT 87

Security Affairs

DECEMBER 15, 2020

Experts from IoT security firm Sternum discovered vulnerabilities discovered in Medtronic’s MyCareLink Smart 25000 Patient Reader product that could be exploited to take control of a paired cardiac device.

Firmware 100

Firmware Authentication Mobile IoT 100

Security Affairs

JUNE 23, 2023

FortiNAC helps organizations protect their network infrastructure by providing visibility and control over devices that connect to the network, such as laptops, smartphones, IoT devices, and other endpoints. Fortinet has released security updates to address a critical vulnerability, tracked as CVE-2023-33299 (CVSS score 9.6/10),

IoT 93

IoT Authentication Hacking Information Security 93

Security Affairs

APRIL 15, 2023

Siemens Metaverse, a virtual space built to mirror real machines, factories, and other highly complex systems, has exposed sensitive data, including the company’s office plans and internet of things (IoT) devices. It contained ComfyApp credentials and endpoints.

Manufacturing 98

Manufacturing IoT Technology Authentication 98

Security Affairs

MAY 14, 2023

Researchers from FortiGuard Labs first discovered the previously undetected RapperBot IoT botnet in August, and reported that it is active since mid-June 2022. ssh/authorized_keys, anyone with the corresponding private key can authenticate the SSH server without supplying a password. ” We are in the final!

Malware 94

Malware IoT Passwords Authentication 94

Security Affairs

FEBRUARY 26, 2024

pic.twitter.com/ucfPwk7zi6 — 安坂星海 Azaka VTuber (@AzakaSekai_) February 18, 2024 Azaka noticed that the hacking firm has a DDoS system relying on a bot that can infect Windows, Linux, or generic IoT devices. The individuals responsible for the data theft and their motivations remain unknown.

Hacking 107

Hacking Government Spyware Marketing 107

Security Affairs

SEPTEMBER 3, 2023

ransomware builder used by multiple threat actors Cisco fixes 3 high-severity DoS flaws in NX-OS and FXOS software Cybercrime Unpacking the MOVEit Breach: Statistics and Analysis Cl0p Ups The Ante With Massive MOVEit Transfer Supply-Chain Exploit FBI, Partners Dismantle Qakbot Infrastructure in Multinational Cyber Takedown U.S.

Social Engineering 105

Social Engineering Spyware Data breaches Surveillance 105

SC Magazine

MAY 18, 2021

It changed what was considered normal within that network, introducing more users overall, more mobile devices popping up on the network, and new cloud applications and IoT devices. They replaced their telecommunications network and built a new software-defined wide area network to handle policy, security and networking functions.

IoT 70

IoT Telecommunications Manufacturing Firewall 70

SecureList

FEBRUARY 1, 2022

Let’s see if there are any informational security issues with these wearables. Authentication for data transfer using this port is completely optional, and even when authentication is present, there is no encryption; in other words, the authentication data is sent as readable text.

Phishing 115

Phishing Healthcare IoT Authentication 115

CyberSecurity Insiders

OCTOBER 1, 2021

People rely on unique identities, like usernames, passwords and two-factor authentication, to get access to network data and services. The CyberSecurity Breakthrough Awards recognize innovation, hard work and success in a range of information security categories. There are two actors on every network: people and machines.

Cybersecurity 52

Cybersecurity Digital transformation IoT Marketing 52

Security Affairs

MARCH 3, 2023

“An authenticated, local attacker could send maliciously crafted commands to a vulnerable TPM allowing access to sensitive data. ” Quarkslab researchers pointed out that the vulnerabilities could potentially affect billions of devices, including IoT devices, servers, and embedded systems. ” states Quarkslab.

Firmware 97

Firmware IoT Authentication Hacking 97

Security Affairs

NOVEMBER 15, 2023

The Cybernews research team discovered that Strendus, a Mexican-licensed online casino, had left public access to 85GB of its authentication logs, with hundreds of thousands of entries containing private gamblers’ data. The data was first indexed by IoT devices on March 8th, 2023. The data was likely compromised by unauthorized actors.

Passwords 102

Passwords Identity Theft Social Engineering Spyware 102

Security Affairs

JUNE 3, 2021

Researchers from Israeli IoT security firm Vdoo found multiple vulnerabilities in the Realtek RTL8170C Wi-Fi module that could allow to elevate privileges and hijack wireless communications. ” reads a reported published by Vdoo.

Wireless 88

Wireless IoT Encryption Firmware 88

Security Affairs

JULY 20, 2022

CVE-2022-2141 (CVSS score: 9.8) – Improper authentication allows a user to send some SMS commands to the GPS tracker without a password. CVE-2022-33944 (CVSS score: 6.5) – The main web server has an authenticated IDOR vulnerability on POST parameter “Device ID,” which accepts arbitrary Device IDs.

Manufacturing 99

Manufacturing Passwords Mobile Authentication 99

Security Affairs

OCTOBER 9, 2021

The configuration file, first indexed on an IoT search engine on September 7, appears to be the main configuration file of the application hosted on the ‘upliftmedia’ subdomain of Sky.com, and includes plain text access credentials to databases hosted on the Sky.com domain. What’s the impact?

IoT 113

IoT Media Engineering Education 113

Security Affairs

MAY 7, 2021

While performing the search, we made sure that the open databases we found required no authentication whatsoever and were open for anyone to access, as opposed to those that had default credentials enabled. We excluded the latter because it would require us to log in to those databases without authorization, which would be unethical.

Passwords 129

Passwords Authentication Identity Theft Engineering 129

Security Affairs

SEPTEMBER 17, 2019

Internet-connected embedded devices are often placed into a broader category referred to as IoT devices. According to the experts, the level of security for IoT devices is slightly improved since SOHOpelessly Broken 1.0,

Manufacturing 85

Manufacturing IoT Advertising Authentication 85

Security Affairs

MAY 2, 2023

FortiGuard Labs researchers observed a worrisome level of attacks attempting to exploit an authentication bypass vulnerability in TBK DVR devices. Threat actors are attempting to exploit a five-year-old authentication bypass issue, tracked as CVE-2018-9995 (CVSS score of 9.8), in TBK DVR devices.

Authentication 98

Authentication Retail Surveillance Education 98

Security Affairs

APRIL 16, 2021

Gafgyt (also known as Bashlite) is a prominent malware family for *nix systems, which mainly target vulnerable IoT devices like Huawei routers, Realtek routers and ASUS devices. Gafgyt uses existing vulnerabilities in IoT devices to turn them into bots and later perform DDoS attacks on specifically targeted IP addresses.

Malware 120

Malware DDOS IoT Firmware 120

SC Magazine

APRIL 26, 2021

As critical infrastructure facilities increasingly converge their IT and OT systems, visibility into traditionally isolated operational systems is turning into a key security challenge. So far, “it’s been going really well,” she said. However, such modernization is not without risk.

CISO 82

CISO IoT VPN InfoSec 82

Malwarebytes

SEPTEMBER 3, 2021

The state of IoT is poor enough as it is, security wise. But the sector is only as secure as the technology it relies on, so our food supply requires secure IoT devices and Cloud services for food and agriculture too. Use multi-factor authentication with strong pass phrases where possible.

Ransomware 139

Ransomware Manufacturing Passwords Internet 139

The Security Ledger

SEPTEMBER 18, 2020

. » Related Stories Spotlight Podcast: CTO Zulfikar Ramzan on RSA’s Next Act: Security Start-Up Spotlight Podcast: Taking a Risk-Based Approach to Election Security PKI Points the Way for Identity and Authentication in IoT. Unfortunately, the information security industry has been slow to respond.

Manufacturing 52

Manufacturing Engineering IoT Cyber threats 52