Tag: data
-
Misconfigurations expose MyGiftCardSupply, Roomster customer data
Tags: dataFirst seen on scworld.com Jump to article: www.scworld.com/brief/misconfigurations-expose-mygiftcardsupply-roomster-customer-data
-
Randall Munroe’s XKCD ‘Skew-T Log-P’
Tags: datavia the comic humor & dry wit of Randall Munroe, creator of XKCD Permalink First seen on securityboulevard.com Jump to article: https://securityboulevard.com/2025/01/randall-munroes-xkcd-skew-t-log-p/
-
FireScam infostealer poses as Telegram Premium app to surveil Android devices
Once installed, it helps itself to your data like it’s a free buffet First seen on theregister.com Jump to article: www.theregister.com/2025/01/06/firescam_android_malware/
-
Supply Chain Attack Targets Key Ethereum Development Tools
A new supply chain attack targets Ethereum tools, exploiting npm packages to steal sensitive data First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/supply-chain-attack-targets/
-
WordPress Plugin Exploited to Turn Legitimate Sites Into Phishing Traps
A WordPress plugin known as PhishWP, has been discovered on Russian cybercrime forums and is being exploited by cybercriminals to steal sensitive data from unsuspecting users. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/01/wordpress-plugin-exploited-to-turn-legitimate-sites-into-phishing-traps/
-
India Proposes Digital Data Rules with Tough Penalties and Cybersecurity Requirements
The Indian government has published a draft version of the Digital Personal Data Protection (DPDP) Rules for public consultation.”Data fiduciaries must provide clear and accessible information about how personal data is processed, enabling informed consent,” India’s Press Information Bureau (PIB) said in a statement released Sunday.”Citizens are empowered with rights to demand data erasure, First…
-
New PhishWP Plugin Enables Sophisticated Payment Page Scams
The PhishWP plugin enables scammers to create fake payment pages, stealing sensitive data via Telegram First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/phishwp-plugin-enables-payment/
-
More telecom firms were breached by Chinese hackers than previously reported
Tags: access, at&t, attack, breach, china, cisco, communications, cyber, cyberespionage, cybersecurity, data, defense, disinformation, espionage, exploit, finance, fortinet, framework, government, group, hacker, Hardware, infrastructure, intelligence, international, microsoft, mobile, network, phone, regulation, risk, risk-management, router, spy, technology, threat, vulnerabilityChinese hackers linked to the Salt Typhoon cyberespionage operation have breached even more US telecommunications firms than initially reported.New victims, Charter Communications, Consolidated Communications, and Windstream, add to a growing list that already includes AT&T, Verizon, T-Mobile, and Lumen Technologies.Earlier, the US authorities informed that nine telecom firms have been affected by the Chinese espionage…
-
Open source vulnerability scanner found with a serious vulnerability in its own code
A widely popular open-source tool, Nuclei, used for scanning vulnerabilities and weaknesses in websites, cloud applications, and networks is found to have a high-severity flaw that could potentially allow attackers to execute malicious codes on local systems.The flaw tracked as CVE-2024-43405 is assigned a CVSS score of 7.4 out of 10 and is said to…
-
Is Your Car Spying on You? What It Means That Tesla Shared Data in the Las Vegas Explosion
Many cars know where you’ve been and where you are going, and also often have access to your contacts, call logs, texts and other sensitive information thanks to cell phone syncing. The post Is Your Car Spying on You? What It Means That Tesla Shared Data in the Las Vegas Explosion appeared first on SecurityWeek.…
-
FireScam Android Malware Poses as Telegram Premium to Steal Data and Control Devices
An Android information stealing malware named FireScam has been found masquerading as a premium version of the Telegram messaging app to steal data and maintain persistent remote control over compromised devices.”Disguised as a fake ‘Telegram Premium’ app, it is distributed through a GitHub.io-hosted phishing site that impersonates RuStore a popular app store in the Russian…
-
Cybercriminals Target Ethereum Developers with Fake Hardhat npm Packages
Cybersecurity researchers have revealed several malicious packages on the npm registry that have been found impersonating the Nomic Foundation’s Hardhat tool in order to steal sensitive data from developer systems.”By exploiting trust in open source plugins, attackers have infiltrated these platforms through malicious npm packages, exfiltrating critical data such as private keys, mnemonics, First seen…
-
IT Giant Atos Responds to Ransomware Group’s Data Theft Claims
IT services giant Atos has responded to the data breach claims made by a ransomware group named Space Bears. The post IT Giant Atos Responds to Ransomware Group’s Data Theft Claims appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/it-giant-atos-responds-to-ransomware-groups-data-theft-claims/
-
Malicious EditThisCookie Extension Attacking Chrome Users to Steal Data
The popular cookie management extension EditThisCookie has been the target of a malicious impersonation. Originally a trusted tool for Chrome users, EditThisCookie allowed users to manage cookie data in their browsers. However, after significant scrutiny, the legitimate version has been removed from the Chrome Web Store, leaving users vulnerable to a fake extension that has…
-
Russian-Speaking Attackers Target Ethereum Devs with Fake Hardhat npm Packages
Cybersecurity researchers have revealed several malicious packages on the npm registry that have been found impersonating the Nomic Foundation’s Hardhat tool in order to steal sensitive data from developer systems.”By exploiting trust in open source plugins, attackers have infiltrated these platforms through malicious npm packages, exfiltrating critical data such as private keys, mnemonics, First seen…
-
Reflecting on Y2K: Lessons for the Next Tech Crisis and AI Safety
Join us as we reminisce about Y2K, the panic, the preparations, and the lessons learned 25 years later. We also discuss the implications for future technology like AI and potential cybersecurity crises. Plus, in our ‘Aware Much’ segment, Scott shares tips on protecting your data if your phone is stolen. Happy New Year and welcome……
-
Windows 11 BitLocker Bypassed to Extract Encryption Keys
An attacker with physical access can abruptly restart the device and dump RAM, as analysis of this memory may reveal FVEK keys from recently running Windows instances, compromising data encryption. The effectiveness of this attack is, however, limited because the data stored in RAM degrades rapidly after the power is cut off. The script flashimage.sh…
-
Malicious npm Packages Stealing Developers’ Sensitive Data
Attackers published 20 malicious npm packages impersonating legitimate Nomic Foundation and Hardhat plugins, where these packages, downloaded over 1,000 times, compromised development environments and potentially backdoored production systems and resulted in financial losses. They are utilizing Ethereum smart contracts, such as 0xa1b40044EBc2794f207D45143Bd82a1B86156c6b, to store and distribute Command & Control (C2) server addresses to compromised systems,…
-
Garak An Open Source LLM Vulnerability Scanner for AI Red-Teaming
Garak is a free, open-source tool specifically designed to test the robustness and reliability of Large Language Models (LLMs). Inspired by utilities like Nmap or Metasploit, Garak identifies potential weak points in LLMs by probing for issues such as hallucinations, data leakage, prompt injections, toxicity, jailbreak effectiveness, and misinformation propagation. This guide covers everything you…
-
12 cybersecurity resolutions for 2025
Tags: advisory, ai, api, attack, awareness, breach, business, ceo, chatgpt, china, ciso, communications, control, crowdstrike, cyber, cyberattack, cybersecurity, data, data-breach, deep-fake, defense, detection, email, identity, insurance, jobs, law, malicious, phishing, ransomware, risk, risk-assessment, risk-management, strategy, supply-chain, technology, threat, tool, training, vulnerabilityAs cyber threats continue to evolve, CISOs must prepare for an increasingly complex threat landscape. From dealing with AI-driven attacks to managing changing regulatory requirements, it’s clear that 2025 will be another big year for CISOs.But staying ahead requires more than just implementing the next cutting-edge set of tools or technologies. It demands a shift…
-
Windows Registry Privilege Escalation Vulnerability PoC Released
Researchers have released a proof of concept (PoC) exploit for a critical privilege escalation vulnerability affecting Microsoft Windows. This vulnerability, CVE-2024-43452, allows attackers to gain elevated privileges on a compromised system, potentially leading to unchecked access to sensitive data and critical system resources. Vulnerability Details The Windows Registry database stores configuration settings and options for…
-
Im Kontext der Datensicherheit sind LLMs als Menschen zu betrachten
Große Sprachmodelle und die Frage der Data Security Sicherheitsfragen rund um LLMs. Angesichts der rasanten KI-Entwicklung wird immer deutlicher, dass die grundlegenden Leitplanken, Plausibilitätsprüfungen und prompt-basierten Sicherheitsmaßnahmen, die derzeit gelten, durchlässig und unzureichend sind. Bei der Entwicklung von Strategien zur Verbesserung der Datensicherheit in KI-Workloads ist es entscheidend, die Perspektive zu ändern und… First seen…
-
Malicious Packages Weaponize OAST for Stealthy Data Exfiltration and Reconnaissance
Researchers at Socket have uncovered a series of malicious campaigns exploiting Out-of-Band Application Security Testing (OAST) techniques. Traditionally First seen on securityonline.info Jump to article: securityonline.info/malicious-packages-weaponize-oast-for-stealthy-data-exfiltration-and-reconnaissance/
-
How Reliable Secret Storage Enhances Cloud Security
Why is Effective Secret Storage So Crucial to Cloud Security? In an increasingly digitized world where every information is stored in the digital form, it’s crucial to question: how are these confidential secrets stored, and how do they affect our overall cloud security? This question lies at the heart of effective data protection strategies today….…
-
Unlocking the Potential of Machine Identity Management
The Untapped Potential of Machine Identity Management Are you aligning your cybersecurity efforts with the contemporary needs and trends? Organizations often overlook the significance and strategic depth of Non-Human Identities (NHIs) and Secrets Security Management. This lapse can expose businesses, particularly those operating in the cloud, to potential security breaches and data leaks. The Concept……
-
FireScam malware poses as Telegram app to steal sensitive Android data
First seen on scworld.com Jump to article: www.scworld.com/news/firescam-android-malware-poses-as-telegram-app-to-steal-sensitive-data
-
New FireScam Infostealer Spyware Hits Android via Fake Telegram Premium
Researchers at Cyfirma have discovered FireScam, an Android malware disguised as ‘Telegram Premium’ that steals data, monitors activity, and infiltrates devices. Learn about its distribution, functionality, and the impact on user privacy. First seen on hackread.com Jump to article: hackread.com/firescam-infostealer-spyware-android-fake-telegram-premium/
-
Privacy Roundup: Week 1 of Year 2025
Tags: access, ai, android, apple, authentication, botnet, breach, browser, business, captcha, chrome, compliance, cve, cybersecurity, data, data-breach, detection, email, encryption, exploit, finance, firmware, flaw, google, group, hacker, healthcare, HIPAA, infrastructure, injection, Internet, law, leak, login, malware, open-source, password, phishing, privacy, router, service, software, threat, tool, update, virus, vulnerabilityThis is a news item roundup of privacy or privacy-related news items for 29 DEC 2024 – 4 JAN 2024. Information and summaries provided here are as-is for warranty purposes. Note: You may see some traditional “security” content mixed-in here due to the close relationship between online privacy and cybersecurity – many things overlap; for…
-
New FireScam Android data-theft malware poses as Telegram Premium app
A new Android malware named ‘FireScam’ is being distributed as a premium version of the Telegram app via phishing websites on GitHub that mimick the RuStore, Russia’s app market for mobile devices. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-firescam-android-data-theft-malware-poses-as-telegram-premium-app/