Sequoia Capital Discloses Data Breach Following Failed BEC Attack

American firm Sequoia Capital has publicly disclosed a suspected data breach recently. The firm suspects…

Sequoia Capital Discloses Data Breach Following Failed BEC Attack on Latest Hacking News.

Week in security with Tony Anscombe

Privacy bug in Brave browser – Clubhouse audio streamed to external website – Protecting children from cyberbullying in COVID-19 era

The post Week in security with Tony Anscombe appeared first on WeLiveSecurity

Oxford University COVID‑19 lab hacked

Neither clinical research into the coronavirus nor any patient data were affected by the incident

The post Oxford University COVID‑19 lab hacked appeared first on WeLiveSecurity

Safeguarding children against cyberbullying in the age of COVID‑19

As screen time has increased, so has the risk of cyberbullying. What you can do to help protect your children from online harassment?

The post Safeguarding children against cyberbullying in the age of COVID‑19 appeared first on WeLiveSecurity

Critical Vulnerability In VMware Servers Being Scanned After PoC Exploit Release – Patch Now!

A serious vulnerability in VMware servers has just received a fix. However, right after the…

Critical Vulnerability In VMware Servers Being Scanned After PoC Exploit Release – Patch Now! on Latest Hacking News.

Educational Institutions Websites Found Vulnerable to Multiple Threats

As the world went digital following the lockdowns due to the COVID-19 pandemic, educational institutions…

Educational Institutions Websites Found Vulnerable to Multiple Threats on Latest Hacking News.

Misconfigured Baby Monitors Can Allow Intruders To Spy On Your Baby

While baby monitors make parenting easy, they can be a security threat to you as…

Misconfigured Baby Monitors Can Allow Intruders To Spy On Your Baby on Latest Hacking News.

North Korean Hackers Targeting Defense Firms with ThreatNeedle Malware

A prolific North Korean state-sponsored hacking group has been tied to a new ongoing espionage campaign aimed at exfiltrating sensitive information from organizations in the defense industry. Attributing the attacks with high confidence to the Lazarus Group, the new findings from Kaspersky signal an expansion of the APT actor's tactics by going beyond the usual gamut of financially-motivated

Championing worthy causes: How ESET gives a helping hand

A snapshot of some of the ways ESET makes an impact supporting the well-being of people, communities and the environment

The post Championing worthy causes: How ESET gives a helping hand appeared first on WeLiveSecurity

ALERT: Malicious Amazon Alexa Skills Can Easily Bypass Vetting Process

Researchers have uncovered gaps in Amazon's skill vetting process for the Alexa voice assistant ecosystem that could allow a malicious actor to publish a deceptive skill under any arbitrary developer name and even make backend code changes after approval to trick users into giving up sensitive information. The findings were presented on Wednesday at the Network and Distributed System Security

Cisco Releases Security Patches for Critical Flaws Affecting its Products

Cisco has addressed a maximum severity vulnerability in its Application Centric Infrastructure (ACI) Multi-Site Orchestrator (MSO) that could allow an unauthenticated, remote attacker to bypass authentication on vulnerable devices. "An attacker could exploit this vulnerability by sending a crafted request to the affected API," the company said in an advisory published yesterday. "A successful

Facebook ramps up fight against child abuse content

Two new tools will warn users about the risks of searching for and sharing content that exploits children, including the potential legal consequences of doing so

The post Facebook ramps up fight against child abuse content appeared first on WeLiveSecurity

Finnish IT Firm TietoEVRY Shut Down Following Ransomware Attack

Another technology company has fallen prey to a cyber attack. This time, the victim is…

Finnish IT Firm TietoEVRY Shut Down Following Ransomware Attack on Latest Hacking News.

Chinese Hackers Using Firefox Extension to Spy On Tibetan Organizations

Cybersecurity researchers today unwrapped a new campaign aimed at spying on vulnerable Tibetan communities globally by deploying a malicious Firefox extension on target systems. "Threat actors aligned with the Chinese Communist Party's state interests delivered a customized malicious Mozilla Firefox browser extension that facilitated access and control of users' Gmail accounts," Proofpoint said

The Top Free Tools for Sysadmins in 2021

It's no secret that sysadmins have plenty on their plates. Managing, troubleshooting, and updating software or hardware is a tedious task. Additionally, admins must grapple with complex webs of permissions and security. This can quickly become overwhelming without the right tools. If you're a sysadmin seeking to simplify your workflows, you're in luck. We've gathered some excellent software

Google’s Password Checkup tool rolling out to Android devices

People who use devices running Android 9 or newer will be alerted if their login credentials have been stolen

The post Google’s Password Checkup tool rolling out to Android devices appeared first on WeLiveSecurity

Messenger TeleGuard: The world’s most secure messenger competes against WhatsApp

Egnach, Switzerland. Swisscows, Swiss technology company for intelligent software products and services in the field…

Messenger TeleGuard: The world’s most secure messenger competes against WhatsApp on Latest Hacking News.

Russian Hackers Targeted Ukraine Authorities With Supply-Chain Malware Attack

Ukraine is formally pointing fingers at Russian hackers for hacking into one of its government systems and attempting to plant and distribute malicious documents that would install malware on target systems of public authorities. "The purpose of the attack was the mass contamination of information resources of public authorities, as this system is used for the circulation of documents in most

Apple Patched A Stored XSS Vulnerability In iCloud Domain

A serious stored XSS vulnerability existed in the Apple iCloud domain that caught the attention…

Apple Patched A Stored XSS Vulnerability In iCloud Domain on Latest Hacking News.

Barcode Scanner App Fiasco – ‘New Owner’ Responsible For The Disaster

A few days ago, Barcode Scanner app made it to the news for potentially infecting…

Barcode Scanner App Fiasco – ‘New Owner’ Responsible For The Disaster on Latest Hacking News.

Online Trackers Increasingly Switching to Invasive CNAME Cloaking Technique

With browser makers steadily clamping down on third-party tracking, advertising technology companies are increasingly embracing a DNS technique to evade such defenses, thereby posing a threat to web security and privacy. Called CNAME Cloaking, the practice of blurring the distinction between first-party and third-party cookies not only results in leaking sensitive private information without

Experts Warns of Notable Increase in QuickBooks Data Files Theft Attacks

New research has uncovered a significant increase in QuickBooks file data theft using social engineering tricks to deliver malware and exploit the accounting software. "A majority of the time, the attack involves basic malware that is often signed, making it hard to detect using antivirus or other threat detection software," researchers from ThreatLocker said in an analysis shared today with The

How DNS History Contributes to Threat Investigations

Cyberthreats pose risks to any organization. And companies, regardless of size or industry, so long…

How DNS History Contributes to Threat Investigations on Latest Hacking News.

Taking Steps to Secure your Application in 2021

It’s crucial now, more than ever, to ship web applications with strong protection and security…

Taking Steps to Secure your Application in 2021 on Latest Hacking News.

Everything You Need to Know About Evolving Threat of Ransomware

The cybersecurity world is constantly evolving to new forms of threats and vulnerabilities. But ransomware proves to be a different animal—most destructive, persistent, notoriously challenging to prevent, and is showing no signs of slowing down. Falling victim to a ransomware attack can cause significant data loss, data breach, operational downtime, costly recovery, legal consequences, and

Clubhouse chats streamed to third‑party website

The incident raises concerns about the privacy and security of conversations taking place on the platform

The post Clubhouse chats streamed to third‑party website appeared first on WeLiveSecurity

Critical RCE Flaws Affect VMware ESXi and vSphere Client — Patch Now

VMware has addressed multiple critical remote code execution (RCE) vulnerabilities in VMware ESXi and vSphere Client virtual infrastructure management platform that may allow attackers to execute arbitrary commands and take control of affected systems. "A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying

A Python Vulnerability Could Allow Remote Code Execution Attacks

A serious security vulnerability affected the Python language that could potentially lead to remote code…

A Python Vulnerability Could Allow Remote Code Execution Attacks on Latest Hacking News.

Brave Browser Tor Mode Leaked .Onion Addresses To ISP – Glitch Fixed

The Brave browser offers Tor support with its private mode. It means this privacy-oriented feature…

Brave Browser Tor Mode Leaked .Onion Addresses To ISP – Glitch Fixed on Latest Hacking News.

Experts Find a Way to Learn What You're Typing During Video Calls

A new attack framework aims to infer keystrokes typed by a target user at the opposite end of a video conference call by simply leveraging the video feed to correlate observable body movements to the text being typed. The research was undertaken by Mohd Sabra, and Murtuza Jadliwala from the University of Texas at San Antonio and Anindya Maiti from the University of Oklahoma, who say the attack

5 Security Lessons for Small Security Teams for the Post COVID19 Era

A full-time mass work from home (WFH) workforce was once considered an extreme risk scenario that few risk or security professionals even bothered to think about. Unfortunately, within a single day, businesses worldwide had to face such a reality. Their 3-year long digital transformation strategy was forced to become a 3-week sprint during which offices were abandoned, and people started working

Brave browser’s Tor mode exposed users’ dark web activity

A bug in the ad blocking component of Brave’s Tor feature caused the browser to leak users' DNS queries

The post Brave browser’s Tor mode exposed users’ dark web activity appeared first on WeLiveSecurity

Shadow Attacks Let Attackers Replace Content in Digitally Signed PDFs

Researchers have demonstrated a novel class of attacks that could allow a bad actor to potentially circumvent existing countermeasures and break the integrity protection of digitally signed PDF documents. Called "Shadow attacks" by academics from Ruhr-University Bochum, the technique uses the "enormous flexibility provided by the PDF specification so that shadow documents remain

Hackers Exploit Accellion Zero-Days in Recent Data Theft and Extortion Attacks

Cybersecurity researchers on Monday tied a string of attacks targeting Accellion File Transfer Appliance (FTA) servers over the past two months to data theft and extortion campaign orchestrated by a cybercrime group called UNC2546. The attacks, which began in mid-December 2020, involved exploiting multiple zero-day vulnerabilities in the legacy FTA software to install a new web shell named

How to Choose the Right EHS Management Software

A management system that enables you to follow the right (EHS) practices to protect the…

How to Choose the Right EHS Management Software on Latest Hacking News.

Experience-Based Review of Desky Dual Ergo Edge Sit Stand Desk

Even though we all spend a lot of time sitting at a desk, our bodies…

Experience-Based Review of Desky Dual Ergo Edge Sit Stand Desk on Latest Hacking News.

Bluetooth Overlay Skimmer That Blocks Chip-based Transactions

A new Bluetooth overlay skimmer can easily block chip-based cards and hinder transactions. These skimmers…

Bluetooth Overlay Skimmer That Blocks Chip-based Transactions on Latest Hacking News.

Multiple Vulnerabilities In Ninja Forms WordPress Plugin Could Allow Site Takeovers

Some serious security vulnerabilities existed in the Ninja Forms WordPress plugin that risked over a…

Multiple Vulnerabilities In Ninja Forms WordPress Plugin Could Allow Site Takeovers on Latest Hacking News.

Vulnerability In Agora SDK Powering Several Apps Could Allow Spying On Video Calls

A serious vulnerability existed in the Agora SDK providing video chat and streaming facility to…

Vulnerability In Agora SDK Powering Several Apps Could Allow Spying On Video Calls on Latest Hacking News.

LastPass Free Service Changes – Will Only Support Single Device Type Onward

The popular password manager LastPass has recently made an announcement that might not be pleasing…

LastPass Free Service Changes – Will Only Support Single Device Type Onward on Latest Hacking News.

How to Fight Business Email Compromise (BEC) with Email Authentication?

An ever-evolving and rampant form of cybercrime that targets emails as the potential medium to conduct fraud is known as Business Email Compromise. Targeting commercial, government as well as non-profit organizations, BEC can lead to huge amounts of data loss, security breach, and compromised financial assets. It is a common misconception that cybercriminals usually lay their focus on MNCs and

Chinese Hackers Had Access to a U.S. Hacking Tool Years Before It Was Leaked Online

On August 13, 2016, a hacking unit calling itself "The Shadow Brokers" announced that it had stolen malware tools and exploits used by the Equation Group, a sophisticated threat actor believed to be affiliated to the Tailored Access Operations (TAO) unit of the U.S. National Security Agency (NSA). Although the group has since signed off following the unprecedented disclosures, new "conclusive"

New 'Silver Sparrow' Malware Infected Nearly 30,000 Apple Macs

Days after the first malware targeting Apple M1 chips were discovered in the wild, researchers have disclosed yet another previously undetected piece of malicious software that has already infected 29,139 Macs running Intel x86_64 and the iPhone maker's M1 processors. However, the ultimate goal of the operation remains something of a conundrum, what with the lack of a next-stage or final payload

Privacy Bug in Brave Browser Exposes Dark-Web Browsing History of Its Users

Brave has fixed a privacy issue in its browser that sent queries for .onion domains to public internet DNS resolvers rather than routing them through Tor nodes, thus exposing users' visits to dark web websites. The bug was addressed in a hotfix release (V1.20.108) made available yesterday. Brave ships with a built-in feature called "Private Window with Tor" that integrates the Tor anonymity

Microsoft Rolls Out “Kids Mode” For Safe Browsing In Edge Browser

While the internet has become a must-have for the kids, especially during the global lockdown…

Microsoft Rolls Out “Kids Mode” For Safe Browsing In Edge Browser on Latest Hacking News.

Week in security with Tony Anscombe

Avoid COVID-19 vaccine fraud and hoaxes – Romance scams cause record-high losses – Exaramel in the spotlight after attacks in France

The post Week in security with Tony Anscombe appeared first on WeLiveSecurity

TDoS attacks could cost lives, warns FBI

Both hacktivists and extortionists have used telephony denial-of-service attacks as a way to further their goals

The post TDoS attacks could cost lives, warns FBI appeared first on WeLiveSecurity

ScamClub Malvertiser Exploited WebKit Zero-Day To Redirect Users To Shady Sites

Another malicious ad campaign is in the wild targeting iOS users this time. Reportedly, the…

ScamClub Malvertiser Exploited WebKit Zero-Day To Redirect Users To Shady Sites on Latest Hacking News.

New Hack Lets Attackers Bypass MasterCard PIN by Using Them As Visa Card

Cybersecurity researchers have disclosed a novel attack that could allow criminals to trick a point of sale terminal into transacting with a victim's Mastercard contactless card while believing it to be a Visa card. The research, published by a group of academics from the ETH Zurich, builds on a study detailed last September that delved into a PIN bypass attack, permitting bad actors to leverage

Malware authors already taking aim at Apple M1 Macs

The first instance of malicious code native to Apple Silicon M1 Macs emerged a month after the release of devices equipped with the company’s in-house CPUs

The post Malware authors already taking aim at Apple M1 Macs appeared first on WeLiveSecurity

Masslogger Trojan Upgraded to Steal All Your Outlook, Chrome Credentials

A credential stealer infamous for targeting Windows systems has resurfaced in a new phishing campaign that aims to steal credentials from Microsoft Outlook, Google Chrome, and instant messenger apps. Primarily directed against users in Turkey, Latvia, and Italy starting mid-January, the attacks involve the use of MassLogger — a .NET-based malware with capabilities to hinder static analysis —

SolarWinds Hackers Stole Some Source Code for Microsoft Azure, Exchange, Intune

Microsoft on Thursday said it concluded its probe into the SolarWinds hack, finding that the attackers stole some source code but confirmed there's no evidence that they abused its internal systems to target other companies or gained access to production services or customer data. The disclosure builds upon an earlier update on December 31, 2020, that uncovered a compromise of its own network to

Kia Motors USA Suffered Nationwide IT Outage – Reason Undetermined

Kia Motors USA wing has recently suffered a massive nationwide outage. While their website simply…

Kia Motors USA Suffered Nationwide IT Outage – Reason Undetermined on Latest Hacking News.

SHAREit Android App Vulnerabilities Remain Unfixed For Three Months

Popular file sharing app SHAREit for Android has some serious security vulnerabilities that await a…

SHAREit Android App Vulnerabilities Remain Unfixed For Three Months on Latest Hacking News.

Now-Patched Telegram Vulnerabilities Could Allow Spying On Chats Via Animated Stickers

Recently, we heard of a vulnerability targeting the Telegram for macOS client. Right after that,…

Now-Patched Telegram Vulnerabilities Could Allow Spying On Chats Via Animated Stickers on Latest Hacking News.

Annoying macOS Big Sur Data Loss Vulnerability Gets A Fix

Apple has recently patched a serious vulnerability targeting Mac users. Specifically, the vulnerability affected the…

Annoying macOS Big Sur Data Loss Vulnerability Gets A Fix on Latest Hacking News.

First Malware Designed for Apple M1 Chip Discovered in the Wild

One of the first malware samples tailored to run natively on Apple's M1 chips has been discovered, suggesting a new development that indicates that bad actors have begun adapting malicious software to target the company's latest generation of Macs powered by its own processors. While the transition to Apple silicon has necessitated developers to build new versions of their apps to ensure better

U.S. Charges 3 North Korean Hackers Over $1.3 Billion Cryptocurrency Heist

The U.S. Department of Justice (DoJ) on Wednesday indicted three suspected North Korean hackers for allegedly conspiring to steal and extort over $1.3 billion in cash and cryptocurrencies from financial institutions and businesses. The three defendants — Jon Chang Hyok, Kim Il, and Park Jin Hyok — are said to be members of the Reconnaissance General Bureau, a military intelligence division of

4 Steps to Resilient SMB Cybersecurity

Cybersecurity has become an essential part of every organization’s business processes. Many small and medium-sized…

4 Steps to Resilient SMB Cybersecurity on Latest Hacking News.

Why You Should Run Your WordPress Site On Ubuntu

If you are contemplating launching a WordPress website, you might struggle to find the best…

Why You Should Run Your WordPress Site On Ubuntu on Latest Hacking News.

How Technology is Important to Your Business

We live in an age where technology is king. Anywhere you look, you are likely…

How Technology is Important to Your Business on Latest Hacking News.

3 Reasons to Use Manual Testing Alongside Automation Testing

Any web-development project goes hand in hand with quality assurance testing. It’s natural because the…

3 Reasons to Use Manual Testing Alongside Automation Testing on Latest Hacking News.

Agora SDK Bug Left Several Video Calling Apps Vulnerable to Snooping

A severe security vulnerability in a popular video calling software development kit (SDK) could have allowed an attacker to spy on ongoing private video and audio calls. That's according to new research published by the McAfee Advanced Threat Research (ATR) team today, which found the aforementioned flaw in Agora.io's SDK used by several social apps such as eHarmony, Plenty of Fish, MeetMe, and

Researchers Unmask Hackers Behind APOMacroSploit Malware Builder

Cybersecurity researchers have disclosed a new kind of Office malware distributed as part of a malicious email campaign that targeted more than 80 customers worldwide in an attempt to control victim machines and steal information remotely. The tool — dubbed "APOMacroSploit" — is a macro exploit generator that allows the user to create an Excel document capable of bypassing antivirus software,

Attacks targeting IT firms stir concern, controversy

The Exaramel backdoor, discovered by ESET in 2018, resurfaces in a campaign hitting companies that use an outdated version of a popular IT monitoring tool

The post Attacks targeting IT firms stir concern, controversy appeared first on WeLiveSecurity

Romance scams in 2020: Breaking hearts, wallets – and records

As dating apps experience a boom amid COVID-19, losses to romance scams soar too

The post Romance scams in 2020: Breaking hearts, wallets – and records appeared first on WeLiveSecurity

Malvertisers Exploited WebKit 0-Day to Redirect Browser Users to Scam Sites

A malvertising group known as "ScamClub" exploited a zero-day vulnerability in WebKit-based browsers to inject malicious payloads that redirected users to fraudulent websites gift card scams. The attacks, first spotted by ad security firm Confiant in late June 2020, leveraged a bug (CVE-2021–1801) that allowed malicious parties to bypass the iframe sandboxing policy in the browser engine that

Learn How to Manage and Secure Active Directory Service Accounts

There are many different types of accounts in a typical Active Directory environment. These include user accounts, computer accounts, and a particular type of account called a service account.  A service account is a special type of account that serves a specific purpose for services, and ultimately, applications in the environment. These special-purpose Active Directory accounts are also the

Unpatched ShareIT Android App Flaw Could Let Hackers Inject Malware

Multiple unpatched vulnerabilities have been discovered in SHAREit, a popular app with over one billion downloads, that could be abused to leak a user's sensitive data, execute arbitrary code, and possibly lead to remote code execution. The findings come from cybersecurity firm Trend Micro's analysis of the Android version of the app, which allows users to share or transfer files between devices

Managed Service Provider? Watch This Video to Learn about Autonomous XDR

As managed security service providers, you're always on the lookout for new platforms. One that can generate further business, enables you to scale easily without investing in more human resources and provides that value immediately. In the meanwhile, your clients are constantly demanding more security for a lesser cost. Cynet recently published an 8-min video detailing their platform, the Cynet

Beware of COVID‑19 vaccine scams and misinformation

The vaccination push provides a vital shot in the arm for the world’s battle against the pandemic, but it's also a topic ripe for exploitation by fraudsters and purveyors of misinformation

The post Beware of COVID‑19 vaccine scams and misinformation appeared first on WeLiveSecurity

Record‑breaking number of vulnerabilities reported in 2020

High-severity and critical bugs disclosed in 2020 outnumber the sum total of vulnerabilities reported 10 years prior

The post Record‑breaking number of vulnerabilities reported in 2020 appeared first on WeLiveSecurity

Hackers Exploit IT Monitoring Tool Centreon to Target Several French Entities

Russia-linked state-sponsored threat actor known as Sandworm has been linked to a three-year-long stealthy operation to hack targets by exploiting an IT monitoring tool called Centreon. The intrusion campaign — which breached "several French entities" — is said to have started in late 2017 and lasted until 2020, with the attacks particularly impacting web-hosting providers, said the French

A Sticker Sent On Telegram Could Have Exposed Your Secret Chats

Cybersecurity researchers on Monday disclosed details of a now-patched flaw in the Telegram messaging app that could have exposed users' secret messages, photos, and videos to remote malicious actors. The issues were discovered by Italy-based Shielder in iOS, Android, and macOS versions of the app. Following responsible disclosure, Telegram addressed them in a series of patches on September 30

Nuclei- A Fast and Customizable Vulnerability Scanner

Nuclei is a tool that is used to send requests across the given target based…

Nuclei- A Fast and Customizable Vulnerability Scanner on Latest Hacking News.

Vulnerability In Telegram for macOS Retained Self-Destruct Messages On Devices

Heads up Telegram users, especially the ones using it on macOS. The Telegram for macOS…

Vulnerability In Telegram for macOS Retained Self-Destruct Messages On Devices on Latest Hacking News.

Singtel Suffered Third-Party Breach In The Wake Of Accellion FTA Zero-Day Attack

Recently, active exploitation of a zero-day flaw in Accellion FTA software led to a data…

Singtel Suffered Third-Party Breach In The Wake Of Accellion FTA Zero-Day Attack on Latest Hacking News.

Apple Proxies User Traffic From Safari When Using Safe Browsing Feature

Taking one more step towards user privacy, Apple now repels Google tracking of user browsing…

Apple Proxies User Traffic From Safari When Using Safe Browsing Feature on Latest Hacking News.

Apple will proxy Safe Browsing requests to hide iOS users' IP from Google

Apple's upcoming iOS 14.5 update will come with a new feature that will redirect all fraudulent website checks through its own proxy servers as a workaround to preserve user privacy and prevent leaking IP addresses to Google. A built-in security-focused feature in the Safari browser, "Fraudulent Website Warning," alerts users about dangerous websites that have been reported as deceptive,

Week in security with Tony Anscombe

ESET's Q4 2020 threat report is out – How smart sex toys can ruin your privacy – Protecting water supply systems

The post Week in security with Tony Anscombe appeared first on WeLiveSecurity

Fifty shades of vulnerable: How to play it safe with your smart sex toy

While you’re living out your fantasies, your internet-enabled sex toy may be setting you up for a privacy nightmare

The post Fifty shades of vulnerable: How to play it safe with your smart sex toy appeared first on WeLiveSecurity

Yandex Employee Caught Selling Access to Users' Email Inboxes

Russian Dutch-domiciled search engine, ride-hailing and  email service provider Yandex on Friday disclosed a data breach that compromised 4,887 email accounts of its users. The company blamed the incident on an unnamed employee who had been providing unauthorized access to the users' mailboxes for personal gain. "The employee was one of three system administrators with the necessary access