cyberveille.decio.ch

cyberveille.decio.ch

5334 bookmarks
Custom sorting
QNAP warns severe OpenSSL bug affects most of its NAS devices
QNAP warns severe OpenSSL bug affects most of its NAS devices
Taiwan-based network-attached storage (NAS) maker QNAP warned on Tuesday that most of its NAS devices are impacted by a high severity OpenSSL bug disclosed two weeks ago. Attackers can exploit the vulnerability, tracked as CVE-2022-0778, to trigger a denial of service state and remotely crash unpatched devices.
#QNAP#bleepingcomputer#EN#2022#OpenSSL#bug#CVE-2022-0778#NAS
·bleepingcomputer.com·
QNAP warns severe OpenSSL bug affects most of its NAS devices
Putin's hackers gained full access to Hungary's foreign ministry networks, the Orbán government has been unable to stop them
Putin's hackers gained full access to Hungary's foreign ministry networks, the Orbán government has been unable to stop them
On December 30, 2021, in Moscow, Russian Foreign Minister Sergey Lavrov pinned the Order of Friendship on the suit of his Hungarian counterpart Péter Szijjártó. Although the medal was presented by Lavrov, it was Russian President Vladimir Putin himself who decided to award it. Not coincidentally, the medal, which is in the form of a wreath of olive branches encircling a globe, includes the inscription “Peace and Friendship” in Cyrillic on the back, is the highest Russian state decoration that can be awarded to a foreigner.
#Direkt36#Hungary#EN#2022#Russia#cyberattack#FSB#ministry
·direkt36.hu·
Putin's hackers gained full access to Hungary's foreign ministry networks, the Orbán government has been unable to stop them
Apple and Meta Gave User Data to Hackers Who Used Forged Legal Requests
Apple and Meta Gave User Data to Hackers Who Used Forged Legal Requests
Apple Inc. and Meta Platforms Inc., the parent company of Facebook, provided customer data to hackers who masqueraded as law enforcement officials, according to three people with knowledge of the matter. Apple and Meta provided basic subscriber details, such as a customer’s address, phone number and IP address, in mid-2021 in response to the forged “emergency data requests.” Normally, such requests are only provided with a search warrant or subpoena signed by a judge, according to the people. However, the emergency requests don’t require a court order.
#bloomberg#EN#2022#RecursionTeam#Lapsus$#Apple#Meta#privacy#forged#datarequest
·bloomberg.com·
Apple and Meta Gave User Data to Hackers Who Used Forged Legal Requests
Chrome Releases: Stable Channel Update for Desktop
Chrome Releases: Stable Channel Update for Desktop
High CVE-2022-1096: Type Confusion in V8. Reported by anonymous on 2022-03-23 We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel. Google is aware that an exploit for CVE-2022-1096 exists in the wild.
#CVE-2022-1096#chrome#update#EN#2022
·chromereleases.googleblog.com·
Chrome Releases: Stable Channel Update for Desktop
Cloudflare’s investigation of the January 2022 Okta compromise
Cloudflare’s investigation of the January 2022 Okta compromise
Today, March 22, 2022 at 03:30 UTC we learnt of a compromise of Okta. We use Okta internally for employee identity as part of our authentication stack. We have investigated this compromise carefully and do not believe we have been compromised as a result. We do not use Okta for customer accounts; customers do not need to take any action unless they themselves use Okta.
#cloudflare#Okta#EN#2022#compromise#investigation
·blog.cloudflare.com·
Cloudflare’s investigation of the January 2022 Okta compromise
Exposing initial access broker with ties to Conti
Exposing initial access broker with ties to Conti
Threat Analysis Group (TAG) observed a financially motivated threat actor we refer to as EXOTIC LILY, exploiting a 0day in Microsoft MSHTML (CVE-2021-40444). Investigating this group's activity, we determined they are an Initial Access Broker (IAB) who appear to be working with the Russian cyber crime gang known as FIN12 (Mandiant, FireEye) / WIZARD SPIDER (CrowdStrike).
#GoogleTAG#EXOTICLILY#CVE-2021-40444#0day#reseller#Conti#IAB
·blog.google·
Exposing initial access broker with ties to Conti
PROPHET SPIDER Exploits Citrix ShareFile
PROPHET SPIDER Exploits Citrix ShareFile
At the start of 2022, CrowdStrike Intelligence and CrowdStrike Services investigated an incident in which PROPHET SPIDER exploited CVE-2021-22941 — a remote code execution (RCE) vulnerability impacting Citrix ShareFile Storage Zones Controller — to compromise a Microsoft Internet Information Services (IIS) web server. The adversary exploited the vulnerability to deploy a webshell that enabled the downloading of additional tools. This incident highlights how PROPHET SPIDER continues to evolve their tradecraft while continuing to exploit known web-server vulnerabilities.
#CrowdStrike#PROPHETSPIDER#EN#2022#CVE-2021-22941RCE#webshell#ShareFile#vulnerability#Citrix
·crowdstrike.com·
PROPHET SPIDER Exploits Citrix ShareFile
Raccoon Stealer: “Trash panda” abuses Telegram
Raccoon Stealer: “Trash panda” abuses Telegram
We recently came across a stealer, called Raccoon Stealer, a name given to it by its author. Raccoon Stealer uses the Telegram infrastructure to store and update actual C&C addresses.  Raccoon Stealer is a password stealer capable of stealing not just passwords, but various types of data, including: Cookies, saved logins and forms data from […]
#avast#stealer#EN#2022#RaccoonStealer#Telegram#research#malware#passwordstealer
·decoded.avast.io·
Raccoon Stealer: “Trash panda” abuses Telegram
Denmark: Datatilsynet publishes guidance on use of cloud technologies
Denmark: Datatilsynet publishes guidance on use of cloud technologies
The Danish data protection authority ('Datatilsynet') announced, on 9 March 2022, that it had published a new guide on the use of cloud services, as well as a short overview of frequently asked questions ('FAQs'). In particular, the Datatilsynet stated that the new guide is targeted at data controllers and notes the considerations which data controllers must keep in mind when using a cloud service, including an outline of the pitfalls, opportunities, and obligations that arise when using such technologies. Document PDF
#Denmark#dataguidance#EN#2022#guidance#cloud#privacy#legal#EU#Datatilsynet
·dataguidance.com·
Denmark: Datatilsynet publishes guidance on use of cloud technologies
Iranian linked conglomerate MuddyWater comprised of regionally focused subgroups
Iranian linked conglomerate MuddyWater comprised of regionally focused subgroups
Cisco Talos has observed new cyber attacks targeting Turkey and other Asian countries we believe with high confidence are from groups operating under the MuddyWater umbrella of APT groups. U.S. Cyber Command recently connected MuddyWater to Iran's Ministry of Intelligence and Security (MOIS).
#talosintelligence#Iranian#EN#2022#APT#research#MuddyWater#Turkey#SloughRAT#RAT
·blog.talosintelligence.com·
Iranian linked conglomerate MuddyWater comprised of regionally focused subgroups
NSA Releases Network Infrastructure Security Guidance
NSA Releases Network Infrastructure Security Guidance
The National Security Agency (NSA) has released a new Cybersecurity Technical Report (CTR): Network Infrastructure Security Guidance. The report captures best practices based on the depth and breadth of experience in supporting customers and responding to threats. Recommendations include perimeter and internal network defenses to improve monitoring and access controls throughout the network. PDF Document
#uscert#csirt#CISA#NSA#Guidance#Network#howto#bestpractices#2022#EN
·cisa.gov·
NSA Releases Network Infrastructure Security Guidance
An update on the threat landscape
An update on the threat landscape
Online security is extremely important for people in Ukraine and the surrounding region right now. Government agencies, independent newspapers and public service providers need it to function and individuals need to communicate safely. Google’s Threat Analysis Group (TAG) has been working around the clock, focusing on the safety and security of our users and the platforms that help them access and share important information.
#google#threat#analysis#2022#EN#Ukraine#TAG#GoogleTAG#informations#APT28#UNC1151#Ghostwriter#FancyBear#MustangPanda
·blog.google·
An update on the threat landscape
The Dirty Pipe Vulnerability — The Dirty Pipe Vulnerability documentation
The Dirty Pipe Vulnerability — The Dirty Pipe Vulnerability documentation
This is the story of CVE-2022-0847, a vulnerability in the Linux kernel since 5.8 which allows overwriting data in arbitrary read-only files. This leads to privilege escalation because unprivileged processes can inject code into root processes. It is similar to CVE-2016-5195 “Dirty Cow” but is easier to exploit. The vulnerability was fixed in Linux 5.16.11, 5.15.25 and 5.10.102.
#CVE-2022-0847#dirtypipe#Linux#Kernel#arbitrary#privilege#escalation#vulnerability#EN#2022
·dirtypipe.cm4all.com·
The Dirty Pipe Vulnerability — The Dirty Pipe Vulnerability documentation
Malware now using stolen NVIDIA code signing certificates
Malware now using stolen NVIDIA code signing certificates
Threat actors are using stolen NVIDIA code signing certificates to sign malware to appear trustworthy and allow malicious drivers to be loaded in Windows. This week, NVIDIA confirmed that they suffered a cyberattack that allowed threat actors to steal employee credentials and proprietary data.
#bleepingcomputer#Nvidia#certificates#malware#EN#2022#code#signing
·bleepingcomputer.com·
Malware now using stolen NVIDIA code signing certificates
Tensions internationales – Menace cyber
Tensions internationales – Menace cyber
Les tensions internationales actuelles causées par l’invasion de l’Ukraine par la Russie s’accompagnent d’effets dans le cyberespace. Si les combats en Ukraine sont principalement conventionnels, l’ANSSI constate l’usage de cyberattaques dans le cadre du conflit. Dans un espace numérique sans frontières, ces cyberattaques peuvent affecter des entités françaises et il convient sans céder à la panique de l’anticiper et de s’y préparer. Aussi, afin de réduire au maximum la probabilité de tels événements et d’en limiter les effets, l’ANSSI partage des bonnes pratiques de sécurité ainsi que des éléments sur la menace et invite l’ensemble des acteurs à s’en saisir. A cette fin, ce bulletin centralise et diffuse les éléments d’intérêt cyber en lien avec le contexte actuel pour favoriser le renforcement du niveau de protection de l’ensemble des entités françaises. Il sera mis à jour régulièrement.
#ANSSI#CERTFR#FR#2022#cybermenace#Russie#Kaspersky#rapport#menace
·cert.ssi.gouv.fr·
Tensions internationales – Menace cyber
Destructive Malware Targeting Organizations in Ukraine
Destructive Malware Targeting Organizations in Ukraine
Actions to Take Today: • Set antivirus and antimalware programs to conduct regular scans. • Enable strong spam filters to prevent phishing emails from reaching end users. • Filter network traffic. • Update software. • Require multifactor authentication. Leading up to Russia’s unprovoked attack against Ukraine, threat actors deployed destructive malware against organizations in Ukraine to destroy computer systems and render them inoperable. 
#uscert#csirt#cert#CISA#EN#2022#alert#WhisperGate#HermeticWiper#malware
·cisa.gov·
Destructive Malware Targeting Organizations in Ukraine