Suche
Beiträge, die mit SECURITY getaggt sind
Ireland dodges bullet as Dublin voters narrowly reject gangland boss
Gerry “The Monk” Hutch led through 10 nail-biting rounds of vote counting — but Ireland’s EU heavyweight knocked him out at the final bell.Shawn Pogatchnik (POLITICO)
I showed her this, and said she should probably get consent from others when using the app. Today she told me she'd uninstalled it and thanked me for the warning!
We can't expect people to figure this out. We need better regulation.
#AI #Security #Privacy
Two critical security flaws impacting the Spam protection, Anti-Spam & FireWall plugin WordPress could allow an unauthenticated attacker to install & enable malicious plugins on susceptible sites.
https://www.wordfence.com/blog/2024/11/200000-wordpress-sites-affected-by-unauthenticated-critical-vulnerabilities-in-anti-spam-by-cleantalk-wordpress-plugin/
#wordpress #it #security #privacy #engineer #media #tech #news
IT-security researchers at ESET have exposed a malicious campaign by the Russia-linked RomCom group, which combined two previously unknown (zero-day) vulnerabilities to compromise targeted systems including Windows and Firefox.
https://www.welivesecurity.com/en/eset-research/romcom-exploits-firefox-and-windows-zero-days-in-the-wild/
#firefox #windows #zerodays #backdoor #it #security #privacy #engineer #media #tech #news
![[ImageSource: ESET]
RomCom Victims Heatmap
ESET’s investigation shows that RomCom targeted various sectors, including government entities in Ukraine, the pharmaceutical industry in the US and the legal sector in Germany, for both espionage and cybercrime purposes. The group, also known as Storm-0978, Tropical Scorpius or UNC2596, is known for both opportunistic attacks and targeted espionage.
From October 10th to November 4th, ESET’s data showed that users visiting these malicious websites were primarily located in Europe and North America, with the number of victims ranging from one to as many as 250 in some countries.](https://nerdculture.de/system/media_attachments/files/113/566/540/454/526/125/original/a38df4b9fc8e27b0.png "[ImageSource: ESET]
RomCom Victims Heatmap
ESET’s investigation shows that RomCom targeted various sectors, including government entities in Ukraine, the pharmaceutical industry in the US and the legal sector in Germany, for both espionage and cybercrime purposes. The group, also known as Storm-0978, Tropical Scorpius or UNC2596, is known for both opportunistic attacks and targeted espionage.
From October 10th to November 4th, ESET’s data showed that users visiting these malicious websites were primarily located in Europe and North America, with the number of victims ranging from one to as many as 250 in some countries.")
![[ImageSource: ESET]
RomCom Attack Flow
The exploit chain worked by first redirecting users to fake websites, which used domains designed to appear legitimate and included the names of other organizations, before sending them to a server hosting the exploit code.
These fake sites often used the prefix or suffix “redir” or “red” to a legitimate domain, and the redirection at the end of the attack took the victims to the legitimate website, hiding the attack. Once the exploit successfully ran, it installed RomCom’s custom backdoor, giving the attackers remote access and control over the infected machine.
"The compromise chain is composed of a fake website that redirects the potential victim to the server hosting the exploit and should the exploit succeed, shellcode is executed that downloads and executes the RomCom backdoor," said ESET researcher Damien Schaeffer.](https://nerdculture.de/system/media_attachments/files/113/566/541/026/775/880/original/526a5abb2bd31355.png "[ImageSource: ESET]
RomCom Attack Flow
The exploit chain worked by first redirecting users to fake websites, which used domains designed to appear legitimate and included the names of other organizations, before sending them to a server hosting the exploit code.
These fake sites often used the prefix or suffix “redir” or “red” to a legitimate domain, and the redirection at the end of the attack took the victims to the legitimate website, hiding the attack. Once the exploit successfully ran, it installed RomCom’s custom backdoor, giving the attackers remote access and control over the infected machine.
\"The compromise chain is composed of a fake website that redirects the potential victim to the server hosting the exploit and should the exploit succeed, shellcode is executed that downloads and executes the RomCom backdoor,\" said ESET researcher Damien Schaeffer.")
RomCom exploits Firefox and Windows zero days in the wild
ESET Research details the analysis of a previously unknown vulnerability in Mozilla products exploited in the wild and another previously unknown Microsoft Windows vulnerability, combined in a zero-click exploit.www.welivesecurity.com
Russia could test NATO loyalty to ‘mutual defense’ clause – POLITICO - EUROPE SAYS
'But if such views gain the upper hand in the government headquarters in Moscow, the risk of aEUROPE SAYS (EUROPESAYS.COM)
German spy chief: Russia could test NATO loyalty to ‘mutual defense’ clause
Russia’s military will be in a position to launch an attack against NATO by the end of the decade, Germany’s foreign intelligence chief said.Nette Nöstlinger (POLITICO)
https://alecmuffett.com/article/110710
#journalism #opsec #security
Runa Sandvik: “Introduction to Investigative Journalism: Digital Security” | Global Investigative Journalism Network
Quote: This chapter presents numerous tips and tools to help you secure accounts, computers and phones, communications, and personal information. In addition to specific tools and settings, we have…Dropsafe
Apple has released emergency security updates for macOS Sequoia that fix two zero-day vulnerabilities that “may have been actively exploited on Intel-based Mac systems”. As per usual, Apple didn’t share details about the attacks in which patched vulnerabilities are exploited.
[CVE-2024-44309 & CVE-2024-44308]
https://support.apple.com/en-us/121753
#apple #macos #update #it #security #privacy #engineer #media #tech #news
![Apple has transitioned to using Intel processors on Macs in June 2006 and stopped shipping them altogether in June 2023, after starting using its own silicon in 2020.
The two vulnerabilities “may have been actively exploited on Intel-based Mac systems”, but it’s unclear at this time whether that means that they can’t be exploited on Apple-based Macs.
[⚠️In any case, all MacOS Sequoia users should update their systems as soon as possible.⚠️]
CVE-2024-44309 affects WebKit, the browser engine used in the Safari web browser and all iOS and iPadOS web browsers, and can be triggered when it’s made to process maliciously crafted web content. It can enable a cross site scripting (XSS) attack.
CVE-2024-44308 affects JavaScriptCore (the built-in JavaScript engine for WebKit) and can likewise be exploited via maliciously crafted web content. It can lead to arbitrary code execution.
<Both vulnerabilities have been reported by security researchers Clément Lecigne and Benoît Sevens of Google’s Threat Analysis Group (TAG).>](https://nerdculture.de/system/media_attachments/files/113/550/115/235/161/948/original/b9eaecf4b0b1233b.jpeg "Apple has transitioned to using Intel processors on Macs in June 2006 and stopped shipping them altogether in June 2023, after starting using its own silicon in 2020.
The two vulnerabilities “may have been actively exploited on Intel-based Mac systems”, but it’s unclear at this time whether that means that they can’t be exploited on Apple-based Macs.
[⚠️In any case, all MacOS Sequoia users should update their systems as soon as possible.⚠️]
CVE-2024-44309 affects WebKit, the browser engine used in the Safari web browser and all iOS and iPadOS web browsers, and can be triggered when it’s made to process maliciously crafted web content. It can enable a cross site scripting (XSS) attack.
CVE-2024-44308 affects JavaScriptCore (the built-in JavaScript engine for WebKit) and can likewise be exploited via maliciously crafted web content. It can lead to arbitrary code execution.
<Both vulnerabilities have been reported by security researchers Clément Lecigne and Benoît Sevens of Google’s Threat Analysis Group (TAG).>")
About the security content of macOS Sequoia 15.1.1 - Apple Support
This document describes the security content of macOS Sequoia 15.1.1.Apple Support
‘Stop killing people’: EU’s top diplomat tells Israel to approve Lebanon cease-fire
“No more excuses,” the bloc’s foreign policy chief Josep Borrell said.Seb Starcevic (POLITICO)
EU’s top diplomat tells Israel to approve Lebanon cease-fire – POLITICO - EUROPE SAYS
“Let’s hope that today, Netanyahu’s government will approve the cease-fire agreement,” Borrell said. “No more excuses. No moreEUROPE SAYS (EUROPESAYS.COM)
Threat hunters are warning about an updated version of the Python-based NodeStealer that's now equipped to extract more information from victims Facebook Ads Manager accounts and harvest credit card data stored in web browsers.
https://www.netskope.com/blog/python-nodestealer-targets-facebook-ads-manager-with-new-techniques
#facebook #socialmedia #ads #malware #it #security #privacy #engineer #media #tech #news
![[ImageSource: Netskope Threat Labs]
"We recently found several Python NodeStealer samples that collect budget details of the account using Facebook Graph API," Michael Alcantara explained. "The samples initially generate an access token by logging into adsmanager.facebook[.]com using cookies collected on the victim's machine."
Aside from collecting the tokens and business-related information tied to those accounts, the malware includes a check that's explicitly designed to avoid infecting machines located in Vietnam as a way to evade law enforcement actions, further solidifying its origins.](https://nerdculture.de/system/media_attachments/files/113/543/801/247/637/214/original/8f9c7aab48f850ec.png "[ImageSource: Netskope Threat Labs]
\"We recently found several Python NodeStealer samples that collect budget details of the account using Facebook Graph API,\" Michael Alcantara explained. \"The samples initially generate an access token by logging into adsmanager.facebook[.]com using cookies collected on the victim's machine.\"
Aside from collecting the tokens and business-related information tied to those accounts, the malware includes a check that's explicitly designed to avoid infecting machines located in Vietnam as a way to evade law enforcement actions, further solidifying its origins.")
![[ImageSource: Netskope Threat Labs]
On top of that, certain NodeStealer samples have been found to use the legitimate Windows Restart Manager to unlock SQLite database files that are possibly being used by other processes. This is done so in an attempt to siphon credit card data from various web browsers.
Data exfiltration is achieved using Telegram, underscoring that the messaging platform still continues to be a crucial vector for threat actors despite recent changes to its policy.
Malvertising via Facebook is a lucrative infection pathway, often impersonating trusted brands to disseminate all kinds of malware. This is evidenced by the emergence of a new campaign starting November 3, 2024, that has mimicked the Bitwarden password manager software through Facebook sponsored ads to install a rogue Google Chrome extension.
<https://www.bitdefender.com/en-us/blog/labs/inside-bitdefender-labs-investigation-of-a-malicious-facebook-ad-campaign-targeting-bitwarden-users>](https://nerdculture.de/system/media_attachments/files/113/543/801/854/620/038/original/d2a5cca00b79cd0a.png "[ImageSource: Netskope Threat Labs]
On top of that, certain NodeStealer samples have been found to use the legitimate Windows Restart Manager to unlock SQLite database files that are possibly being used by other processes. This is done so in an attempt to siphon credit card data from various web browsers.
Data exfiltration is achieved using Telegram, underscoring that the messaging platform still continues to be a crucial vector for threat actors despite recent changes to its policy.
Malvertising via Facebook is a lucrative infection pathway, often impersonating trusted brands to disseminate all kinds of malware. This is evidenced by the emergence of a new campaign starting November 3, 2024, that has mimicked the Bitwarden password manager software through Facebook sponsored ads to install a rogue Google Chrome extension.
<https://www.bitdefender.com/en-us/blog/labs/inside-bitdefender-labs-investigation-of-a-malicious-facebook-ad-campaign-targeting-bitwarden-users>")
Python NodeStealer Targets Facebook Ads Manager with New Techniques - Netskope
Summary In September 2023, Netskope Threat Labs reported a Python-based NodeStealer targeting Facebook business accounts. NodeStealer collects FacebookJan Michael Alcantara (Netskope)
#BaaghiTV #International #Israel #Lebanon #Suspension #InPersonClasses #Education #EducationalInstitutes #Beirut #AirStrikes #Safety #Security
https://en.baaghitv.com/lebanon-announces-decision-to-suspend-in-person-classes-in-beirut/
Iran Update, November 24, 2024 - EUROPE SAYS
Iran Update, November 24, 2024 Kelly Campa, Katherine Wells, Alexandra Braverman, Ria Reddy, Siddhant Kishore, Davit Gasparyan,EUROPE SAYS (EUROPESAYS.COM)
Benjamin Netanyahu arrest warrant: Where can he still go in Europe?
Here are the countries that would handcuff the Israeli prime minister over the Gaza war.Seb Starcevic (POLITICO)
That could allow a local attacker to gain root privileges without requiring user interaction. Needrestart is a utility that scans a system to determine the services that need to be restarted after applying shared library updates.
https://blog.qualys.com/vulnerabilities-threat-research/2024/11/19/qualys-tru-uncovers-five-local-privilege-escalation-vulnerabilities-in-needrestart
#linux #ubuntu #it #security #privacy #engineer #tech #media #news
![Multiple decade-old security vulnerabilities have been disclosed in the needrestart package.
The vulnerabilities are believed to have existed since the introduction of interpreter support in needrestart 0.8, which was released on April 27, 2014.
"These needrestart exploits allow Local Privilege Escalation (LPE) which means that a local attacker is able to gain root privileges," Ubuntu said in an advisory, noting they have been addressed in version 3.8.
<https://ubuntu.com/blog/needrestart-local-privilege-escalation>
The 5 flaws are listed below:
• CVE-2024-48990 [CVSS score: 7.8] - A vulnerability that allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.
• CVE-2024-48991 [CVSS score: 7.8] - A vulnerability that allows local attackers to execute arbitrary code as root by winning a race condition & tricking needrestart into running their own, fake Python interpreter.
• CVE-2024-48992 [CVSS score: 7.8] - A vulnerability that allows local attackers to execute arbitrary code as root by tricking needrestart into running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable.
• CVE-2024-11003 [CVSS score: 7.8] and CVE-2024-10224 [CVSS score: 5.3] - Two vulnerabilities that allows a local attacker to execute arbitrary shell commands as root by taking advantage of an issue in the libmodule-scandeps-perl package. (before version 1.36)](https://nerdculture.de/system/media_attachments/files/113/521/649/340/089/036/original/9c79a893744b5d47.jpeg "Multiple decade-old security vulnerabilities have been disclosed in the needrestart package.
The vulnerabilities are believed to have existed since the introduction of interpreter support in needrestart 0.8, which was released on April 27, 2014.
\"These needrestart exploits allow Local Privilege Escalation (LPE) which means that a local attacker is able to gain root privileges,\" Ubuntu said in an advisory, noting they have been addressed in version 3.8.
<https://ubuntu.com/blog/needrestart-local-privilege-escalation>
The 5 flaws are listed below:
• CVE-2024-48990 [CVSS score: 7.8] - A vulnerability that allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.
• CVE-2024-48991 [CVSS score: 7.8] - A vulnerability that allows local attackers to execute arbitrary code as root by winning a race condition & tricking needrestart into running their own, fake Python interpreter.
• CVE-2024-48992 [CVSS score: 7.8] - A vulnerability that allows local attackers to execute arbitrary code as root by tricking needrestart into running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable.
• CVE-2024-11003 [CVSS score: 7.8] and CVE-2024-10224 [CVSS score: 5.3] - Two vulnerabilities that allows a local attacker to execute arbitrary shell commands as root by taking advantage of an issue in the libmodule-scandeps-perl package. (before version 1.36)")
Qualys TRU Uncovers Five Local Privilege Escalation Vulnerabilities in needrestart | Qualys Security Blog
The Qualys Threat Research Unit (TRU) has identified five Local Privilege Escalation (LPE) vulnerabilities within the needrestart component…Saeed Abbasi (Qualys, Inc.)
T-Mobile has joined a list of major organizations like AT&T, Verizon & Lumen Technologies that have been singled out as part of what appears to be a full-blown Chinese threat actors cyber espionage campaign.
https://www.wsj.com/politics/national-security/t-mobile-hacked-in-massive-chinese-breach-of-telecom-networks-4b2d7f92
#us #telecom #companies #breach #it #security #privacy #engineer #media #tech #news
The makings of a grand Trump deal in the Middle East
Former Israeli Prime Minister Ehud Barak says it’s possible the new U.S. administration may enter into interconnected talks with Putin about Ukraine, Iran and the Middle East.Jamie Dettmer (POLITICO)
Gaza Security Forces Ambush Gang Accused of Looting Aid with Israeli Support
The gang members are “operating in cooperation with the Israeli forces” to target aid convoys, Hamas’s Basem Naim said.Sharif Abdel Kouddous (Drop Site News)
So on one hand this looks like a programme of communicative disruption... but one might wonder whether its a sign of the start of something else (my old IR training leads me to pose the Q. at least).
#internet #communications #security
h/t FT
Israeli Strikes Reportedly Destroy Iran’s Covert Nuclear Facility - EUROPE SAYS
What You Need to Know: Israeli airstrikes in late October reportedly destroyed Talegahn 2, a covert Iranian nuclearEUROPE SAYS (EUROPESAYS.COM)
eSIM security vs. a physical SIM: An eSIM is safer
Apart from, the convenience of being able to easily enable an eSIM (without waiting for a physical SIM delivery), the ease of switching SIM profiles when travelling, and not having a physical card that gets damaged, these eSIMs also have some security advantages too.
eSIM (embedded subscriber identity module) technology employs various additional security measures that make it less prone to hacking than physical SIMs. Those measures include a secure element, which stores sensitive data and protects it from unauthorized access or tampering, adding an extra layer of protection against hacking attempts.
They cannot be cloned, as they cannot be physically accessed from outside the phone. Also, if your phone is stolen, it is not like a physical SIM where a thief can just remove the SIM card (the eSIM is always active inside the phone).
In other aspects they are quite similar to physical SIM cards, for example, with SIM swapping, as SIM swapping is done virtually on the network side and has little to do with the SIM in your phone.
But remember that no online device is ever fully immune to hacking. So whilst eSIMs are a step up from physical SIM cards, they may not be fully immune.
See https://nordvpn.com/blog/is-esim-safe
#Blog, #eSIM, #security, #technology
Microsoft’s November Patch Update fixes 91 Windows security vulnerabilities, including 4 zero-days. The critical fixes address actively exploited flaws in Windows. It is strongly recommended that users apply these updates as soon as possible to mitigate possible security risks. Updates can be installed via Windows Update.
https://msrc.microsoft.com/update-guide/
#microsoft #windows #update #it #security #privacy #engineer #media #tech #news
• Folgen: https://www.kuketz-blog.de/bleib-aktuell/
• Forum: https://www.kuketz-forum.de/
• Chat: https://www.kuketz-blog.de/chat/
Bleib informiert und diskutiere mit!
#blog #sicherheit #security #datenschutz #privacy #mastodon #newsletter #rss #matrix #signal #discourse #forum
Bleib aktuell
RSS, Newsletter oder Social Media: Immer informiert über neue Beiträge • IT-Sicherheit & Datenschutz aus Karlsruhewww.kuketz-blog.de
The focus of civil society has been taken up with climate change as an existential threat, so the build up of nukes in the US, China & Russia has (perhaps) escaped out notice.... Now Jessica Matthews (Carnegie) sees a revival of the sorts of nuclear politics that for those around my age (now in our 50s/60s) will be both familiar from our past & likely unwelcome.... it doesn't look good.
#NuclearWeapons #security
https://www.theguardian.com/world/2024/nov/14/nuclear-weapons-war-new-arms-race-russia-china-us
Amid an economic crisis caused by Israeli policies and Palestinian Authority corruption, teachers are bringing #schools and streets to a standstill until their demands are met: https://www.972mag.com/palestinian-teachers-strike-pa-repression/ #WestBank #Gaza #occupation #education #security
Defying PA repression, Palestinian teachers lead biggest strike in years
Amid an economic crisis caused by Israeli policies and PA corruption, teachers are bringing schools and streets to a standstill until their demands are met.Ben Reiff (+972 Magazine)
Wired has published a guide to protecting yourself from surveillance by the US government
The guide discusses the potential increase in government surveillance under a second Trump administration and offers advice on upgrading personal privacy protections, including using end-to-end encrypted messengers and securing devices.
#privacy #security #civilrights
Google fixed two actively exploited Android zero-day flaws as part of its November security updates, addressing a total of 51 vulnerabilities. Tracked as CVE-2024-43047 & CVE-2024-43093, the two issues are marked as exploited in limited, targeted attacks.
https://source.android.com/docs/security/bulletin/2024-11-01
#google #android #update #zerodays #it #security #privacy #engineer #media #tech #news
#privacy #security #anonymity #journalism #whistleblowing
https://mullvad.net
#privacy #security #VPN #AzireVPN #MullvadVPN
Mullvad VPN - Free the internet
Free the internet from mass surveillance and censorship. Fight for privacy with Mullvad VPN and Mullvad Browser.Mullvad
With Trump, Netanyahu’s got his work cut out for him
“Trump’s not going to give him a blank check.”Jamie Dettmer (POLITICO)
New Russian church raises suspicions in Swedish town
It’s feared Russia could use the church as cover for future intelligence or sabotage operations.Charlie Duxbury (POLITICO)
-- Niccolo Machiavelli
⬆ #Wisdom #Quotes #NiccoloMachiavelli #Security #Vice #Virtue
⬇ #Photography #Panorama #Palms #Florida
Iran’s Nuclear Program Can’t Be Bombed Out of Existence - EUROPE SAYS
The Middle East is on the brink of full-scale regional war. Israel recently launched retaliatory strikes against Iran.EUROPE SAYS (EUROPESAYS.COM)
Security Boosted For France-Israel Match - EUROPE SAYS
Text size A high police presence is being prepared for the France v Israel Nations League match atEUROPE SAYS (EUROPESAYS.COM)
Greece’s main opposition further dismantled – POLITICO - EUROPE SAYS
In September 2023, Kasselakis was elected from nowhere to head Syriza. Since then, the party has been miredEUROPE SAYS (EUROPESAYS.COM)
Greece’s main opposition further dismantled
Syriza party’s recently deposed leader Stefanos Kasselakis announced the creation of a new political movement, taking at least four MPs with him.Nektaria Stamouli (POLITICO)