Researchers have released technical details on a high-severity privilege-escalation flaw in HP printer drivers (also used by Samsung and Xerox), which impacts hundreds of millions of Windows machines. If exploited, cyberattackers could bypass security products; install programs; view, change, encrypt or delete data; or create new accounts with more extensive user rights. The bug (CVE-2021-3438) Read more about 16-Year-Old HP Printer-Driver Bug Impacts Millions of Windows Machines[…]

The security shortcoming can be exploited using the wonderfully named PetitPotam technique. It involves abusing Redmond’s MS-EFSRPC (Encrypting File System Remote Protocol) to take over a corporate Windows network. It seems ideal for penetration testers, and miscreants who have gained a foothold in a Windows network. Specifically, security researcher Gilles Lionel found it was possible Read more about You, too, can be a Windows domain controller and do whatever you like, with this trick which requires no authentication at all[…]

Like most Internet-of-things (IoT) devices these days, Amazon’s Echo Dot gives users a way to perform a factory reset so, as the corporate behemoth says, users can “remove any… personal content from the applicable device(s)” before selling or discarding them. But researchers have recently found that the digital bits that remain on these reset devices Read more about Thinking about selling your Echo Dot—or any IoT device? Turns out passwords and other data remain even after a reset[…]

While it will come as no comfort to those who had their Western Digital My Book Live NAS drives wiped last week, it seems they were attacked by a combination of two exploits, and possibly caught in the fallout of a rivalry between two different teams of hackers. (Image credit: Western Digital) Initially, after the Read more about Another Exploit Hits WD My Book Live Owners – wipes could be rival hacker groups fighting for botnet control[…]

Things are not looking good for LinkedIn right now. Just two months after a jaw-dropping 500 million profiles from the networking site were put up for sale on a popular hacker forum, a new posting with 700 million LinkedIn records has appeared. The seller, “GOD User” TomLiner, stated they were in possession of the 700 Read more about 700 Million LinkedIn Records Leaked June 2021 – again[…]

It was a closed source backdoored system. This goes to show that weakening encryption for political reasons and trusting software that can’t be audited independently is a Bad Idea ™ A weakness in the algorithm used to encrypt cellphone data in the 1990s and 2000s allowed hackers to spy on some internet traffic, according to Read more about Bombshell Report Finds Phone Network Encryption Was Deliberately Weakened[…]

Volkswagen says more than 3.3 million customers had their information exposed after one of its vendors left a cache of customer data unsecured on the internet. The car maker said in a letter that the vendor, used by Volkswagen, its subsidiary Audi and authorized dealers in the U.S. and Canada, left the customer data spanning Read more about Volkswagen says a vendor’s security lapse exposed 3.3 million drivers’ details[…]

Indonesia’s government has admitted to leaks of personal data from the agency that runs its national health insurance scheme On May 20th Kominfo, Indonesia’s Ministry of Communication and Information Technology, acknowledged it was aware of a post on notorious stolen-data-mart Raidforums offering to sell a million records leaked from the Badan Penyelenggara Jaminan Sosial (BPJS), Read more about Indonesia’s national health insurance scheme leaks at least a million citizens’ records[…]

[…] Check Point Research (CPR) recently discovered that in the last few months, many application developers put their data and users’ data at risk. By not following best practices when configuring and integrating 3rd party cloud services into applications, millions of users’ private data was exposed. In some cases, this type of misuse only affects Read more about Mobile app developers’ misconfiguration of third party services leave personal data of over 100 million exposed – Check Point Research[…]

An NHS Digital-run vaccine-booking website exposed just how many vaccines individual people had received – and did so with no authentication, according to the Guardian. The booking page, aimed at English NHS patients wanting to book first and second coronavirus jabs, would tell anyone at all whether a named person had had zero, one or Read more about NHS Digital booking website had unexpected side effect: It leaked people’s jab status[…]

Russian spies from APT29 responded to Western agencies outing their tactics by adopting a red-teaming tool to blend into targets’ networks as a legitimate pentesting exercise. Now, the UK’s National Cyber Security Centre (NCSC) and the US warn, the SVR is busy exploiting a dozen critical-rated vulns (including RCEs) in equipment ranging from Cisco routers Read more about Russian cyber-spies changed tactics after the UK and US outed their techniques – so here’s a list of those changes[…]

[…] Peloton, the at-home fitness brand synonymous with its indoor stationary bike and beleaguered treadmills, has more than three million subscribers. Even President Biden is said to own one. The exercise bike alone costs upwards of $1,800, but anyone can sign up for a monthly subscription to join a broad variety of classes. As Biden Read more about Peloton’s leaky API let anyone grab riders’ private account data – and only fixed the issue after repeated prodding[…]

Big-three consumer credit bureau Experian just fixed a weakness with a partner website that let anyone look up the credit score of tens of millions of Americans just by supplying their name and mailing address, KrebsOnSecurity has learned. Experian says it has plugged the data leak, but the researcher who reported the finding says he Read more about Experian API Exposed Credit Scores of Most Americans[…]

Microsoft has taken a look at memory management code used in a wide range of equipment, from industrial control systems to healthcare gear, and found it can be potentially exploited to hijack devices. […] Drilling down to the nitty-gritty: Microsoft’s Azure Defender for IoT security research group looked at memory allocation functions, such as malloc(), Read more about BadAlloc: Microsoft looked at memory allocation code in tons of devices and found this one common security flaw[…]

Online shoppen en de rekening naar iemand anders sturen, blijkt kinderlijk eenvoudig met Afterpay. Dat constateert de Consumentenbond, die de beveiliging van de achterafbetaaldienst heeft onderzocht. Honderden consumenten kregen spookfacturen van Afterpay en Klarna, betaaldiensten waarmee consumenten online aankopen pas na ontvangst hoeven te betalen. De bedragen varieren van enkele tientjes tot honderden euro’s. Met Read more about Fraudulent orders via Afterpay stupidly easy. To resolve Afterpay wants to breach victims privacy, cost them lots of time.[…]

The US Department of Defense puzzled Internet experts by apparently transferring control of tens of millions of dormant IP addresses to an obscure Florida company just before President Donald Trump left the White House, but the Pentagon has finally offered a partial explanation for why it happened. The Defense Department says it still owns the Read more about Pentagon doesn’t really explain odd transfer of 175 million IP addresses to obscure company starting 5 minutes before Trump left office[…]

Cellebrite makes software to automate physically extracting and indexing data from mobile devices. They exist within the grey – where enterprise branding joins together with the larcenous to be called “digital intelligence.” Their customer list has included authoritarian regimes in Belarus, Russia, Venezuela, and China; death squads in Bangladesh; military juntas in Myanmar; and those Read more about Signal maker exploits Cellebrite – authoritarian govt phone spying software – to create false reports on phones scanned by them and then forever after[…]

Two file-scrambling nasties, Qlocker and eCh0raix, are said to be tearing through vulnerable QNAP storage equipment, encrypting data and demanding ransoms to restore the information. In response, QNAP said on Thursday users should do the following to avoid falling victim: Install the latest software updates for the Multimedia Console, Media Streaming Add-on, and Hybrid Backup Read more about If you have a QNAP NAS, stop what you’re doing right now and install latest updates before Qlocker gets you[…]

Web sites for customers of agricultural equipment maker John Deere contained vulnerabilities that could have allowed a remote attacker to harvest sensitive information on the company’s customers including their names, physical addresses and information on the Deere equipment they own and operate. The researcher known as “Sick Codes” (@sickcodes) published two advisories on Thursday warning Read more about Deere John: Researcher Warns Ag Giant’s Site Provides a Map to Customers, Equipment[…]

Apple’s AirDrop feature is a convenient way to share files between the company’s devices, but security researchers from Technische Universitat Darmstadt in Germany are warning that you might be sharing way more than just a file. According to the researchers, it’s possible for strangers to discover the phone number and email of any nearby AirDrop Read more about Apple AirDrop Security Flaw Exposes iPhone Numbers, Emails: Researchers[…]

[…] WhatsApp representatives told Forbes that the easiest way to protect yourself against this kind of an attack is to make sure you’ve associated an email address with your two-step verification process so the attacker won’t be able to spoof your identity. You can do that right now by pulling up WhatsApp, loading its Settings, Read more about How to Keep Attackers From Locking You Out of WhatsApp[…]

A user in a low level hacking forum on Saturday published the phone numbers and personal data of hundreds of millions of Facebook users for free online. The exposed data includes personal information of over 533 million Facebook users from 106 countries, including over 32 million records on users in the US, 11 million on Read more about Stolen Data of 533 Million Facebook Users Leaked Online[…]

News that Ubiquiti’s cloud servers had been breached emerged on January 11, 2021, when the company emailed customers the text found in this support forum post. That missive stated: “We recently became aware of unauthorized access to certain of our information technology systems hosted by a third-party cloud provider.” That announcement continued, “We have no Read more about Wi-Fi slinger Ubiquiti hints at source code leak after claim of ‘catastrophic’ cloud intrusion emerges[…]