Canonical has released Ubuntu security updates to address several Ghostscript vulnerabilities identified by security researchers. These vulnerabilities could potentially allow attackers to bypass security restrictions or even execute malicious code on your system. Ghostscript is a widely used tool f...
An international law enforcement operation code-named Operation Morpheus led to the takedown of 593 Cobalt Strike servers used by crooks.
Attackers clear logs before exploitation and use "no caller ID" numbers to negotiate ransoms, complicating detection and forensics efforts.
OVHcloud, a global cloud services provider and one of the largest of its kind in Europe, says it mitigated a record-breaking distributed denial of service (DDoS) attack earlier this year that reached an unprecedented packet rate of 840 million packets per second (Mpps).
Brazil’s national data protection authority has determined that Meta cannot use data originating in the country to train its artificial intelligence.
The Polish government is investigating a potential connection between Russia and a cyberattack on the country’s state news agency.
Authy Users' Phone Numbers Compromised via Twilio API Vulnerability
Twilio has confirmed that an unsecured API endpoint allowed threat actors to verify the phone numbers of millions of Authy multi-factor authentication users, potentially making them vulnerable to SMS phishing and SIM swapping attacks.
FIA (Fédération Internationale de l'Automobile), the auto racing governing body since the 1950s, says attackers gained access to personal data after compromising several FIA email accounts in a phishing attack.
Patelco Credit Union has disclosed it experienced a ransomware attack that led to the proactive shutdown of several of its customer-facing banking systems to contain the incident's impact.
Google ships an Android security update with fixes for 15 vulnerabilities, including a critical-severity flaw in Framework.
Splunk has patched multiple vulnerabilities in Splunk Enterprise, including high-severity remote code execution bugs.
Modern Intel processors, including chips from the Raptor Lake and the Alder Lake generations are susceptible to a new type of a high-precision Branch Target Injection (BTI) attack dubbed 'Indirector,' which could be used to steal sensitive information from the CPU.
Prudential Financial, a global financial services company, has revealed that over 2.5 million people had their personal information compromised in a February data breach.
Well, depends. If the user go to a captive portal to "authenticate" before the VPN could closes, than no. But, if the VPN can "pierce" through it (without any intervention from the AP), than yes. Anyways, If the user is willing to provide authentication data (like social media accounts, etc), nothing matters.
Juniper Networks has released an emergency update to address a maximum severity vulnerability that leads to authentication bypass in Session Smart Router (SSR), Session Smart Conductor, and WAN Assurance Router products.
Remote access giant TeamViewer says Russian spies hacked its corporate network
The remote access giant linked the cyberattack to government-backed hackers working for Russian intelligence, known as APT29.
Related to: https://sh.itjust.works/post/21489427
Fasten your seat belts, secure your tray table, and try not to give away your passwords
Move comes weeks after Mozilla blasted certificate authority for failings
'Poseidon' Mac stealer distributed via Google ads
A competitor of the infamous Atomic Stealer targeting Mac users, has just launched a new campaign to lure in more victims.
A critical vulnerability in GitLab, CVE-2024-5655, has been disclosed, enabling attackers to run pipeline jobs under any user account. This vulnerability,
Yes.
303,481 servers worldwide, according to Shodan.
Interesting. I didn't know that syncthing does hole punching.
From a defense perspective, how would this work with an enterprise firewall, with UDP/TCP only allowed to specific destinations or specific sources. Example: only the internal DNS relay server can access 53/UDP and only the internal proxy server can access 80/443. What I mean is in a network with a very closed firewall, how would Syncthing be able to connect with peers?
Instance Rules
Be respectful. Everyone should feel welcome here.
Not necessarily. Torrent is a way to find a peer for direct connection or via a relay (of course that is more than that). Syncthing, even using a relay server, requires some ports available for at least outbound connection (22000 TCP/UDP or whatever port the relay is using). This should not be possible in a medium security network, let alone a defense network. I don't know if syncthing works without a direct connection (to the peer or relay, something like transport via http proxy).
Honestly, I didn't think about vulnerability in SyncThing when I read the article. But I wondered why defense forces would have p2p open on their networks.
By the messages that they are sending to customers, looks like is related to recent updates to the services, but nothing clear.
related to: https://sh.itjust.works/post/19619469
IoCs available in the original article.
Please note that the attack can only be carried out if the local network itself is compromised.
IoCs available here. Some of them with no detection on VT.
Of course, in the end it is just conflict, and when it spills over into the real world then you have a war. But this is not always the case We have already had disruption in power grids, nuclear plants, hospitals, public offices, critical infrastructure of financial markets (some of them with impact in real lives) without retaliation in the physical world.
Cyberwar, in my perspective, have some nuances. For instance, in a physical conflict, a hostile nation's invasion of my property immediately becomes a state issue. However, this isn't always the case in a cyberwar if a hostile state invades my organization (It's hard to immediately distinguish whether the actor is a nation state, a financially motivated group, hacktivists, or just a guy who eats pizza in his mom's basement). Most of the time, organizations are on their own.
In a cyberwar, espionage is also far more acceptable. This is something the NSA (and FSB/SVR) has been doing for years (against private entities and states). In a way, I understand that it is something similar to what the cold war was (is), but with no boots on the ground.
I'd better say that states have been doing this.
Cyber war, of course. I think that there is a cyber war going on for quite some time now. CWWI (Cyber World War I).
If anyone is still using it, anyways....
Maybe cyber resilience? Quick identify, respond and recover from an incident.
From the article:
Microsoft locked down a server last month that exposed Microsoft employee passwords, keys and credentials to the open Internet, as the company faces growing pressure to strengthen the security of its software. Microsoft was notified of the vulnerability on February 6th and the block on March 5th. It is unclear whether anyone accessed the exposed server during this period.