axsharma

"On 16th December Amey became aware of a complex IT security incident during which a portion of our data was compromised. We have reported the incident to the Information Commissioner’s Office, the National Centre for Cyber Security, and the National Crime Agency." - Amey

The Golang malware breaches Windows, Linux servers and exploits popular vulnerabilities such as a critical RCE in Oracle WebLogic, CVE-2020-14882.

Kaggle, an online community of data scientists and machine learning practitioners has been exposing private competition data in a breach due to a misconfigured API.

The leaked database dump contains ICCID, SIM PUK code, authentication hashes, and customer PII that can be used in SIM swapping attacks and for bypassing 2FA (such as in online banking).

Multiple researchers have linked this strain to MuddyWater (aka SeedWorm and TEMP.Zagros), a government-backed advanced persistent threat (APT) group, first observed in 2017 while mainly targeting Middle Eastern entities.

QR codes lead to public URLs that contain an enumerable report ID field, making it possible for an attacker to scrape all COVID-19 test reports for virtually any passenger.

related to https://news.ycombinator.com/item?id=25091717

Still not sure if this person/community is also behind the one in Romania, they've only suggested Utah and Cali via pics. https://www.bleepingcomputer.com/news/technology/monolith-my...

Steam gaming platform creates world-writable installation directories that can make it easy for malware and malicious actors to escalate privileges and gain persistence on Windows PCs.

The gift that keeps on giving, from exploits to full usernames and passwords.

Government of Canada website https://www.canada.gc.ca is throwing SSL errors due to an expired certificate. Multiple Canadian government sites continue to have links to this older site which are now breaking, instead of redirecting to newer canada.ca.

Google continues to cache a defaced copy at the time of writing.

Mitsubishi Electric and sister companies such as Mitsubishi Polycrystalline have reportedly been hit by cyberattacks

Law enforcement agencies including the U.S. FBI, Romanian Police (Poliția Română, the Australian Federal Police (AFP), the Norwegian National Criminal Investigation Service (Kripos), and Europol were involved in the operation.

The malware "protectors" and testing services helped malware authors make their samples fully undetectable (FUD) to leading antivirus products.

The vulnerability also tracked as SA-CORE-2020-012, exists due to improper validation of filenames of files uploaded to Drupal websites.

E.g. filename.php.txt or filename.html.gif, without an underscore (_) in the extension.

Brazilian customers of largest Latin American e-commerce company MercadoLivre/MercadoLibre were targeted by this multi-stage malware.

C# Discord malware family "CursedGrabber" has hints and clues attributing its authorship to Russian and Ukrainian actors.

The data exposed via public .env files included production server database credentials, including the DB server addresses, ports, usernames, passwords, and API keys.

Coil has accidentally exposed some of its users' email addresses in a mass email announcement sent out today.

Ironically, the mishap happened within an email announcement related to the company's Privacy Policy updates.

The vulnerabilities range from integer underflow/overflow to unauthorized withdrawals and "self-destructs" of smart contracts.

American Bank Systems (ABS) provider to U.S. banks and financial institutions has been hit by Avaddon ransomware ops.

Full 53 GB data dump with personal info of banks and their customers leaked.

DNS cache poisoning hack discovered by Kaminsky in 2008 has returned due to how Linux ICMP rate limiter defaults to 1,000 requests/second. A side-channel attack can be used to deduce open ports and pollute DNS resolvers.

"Discord.dll" a successor to #npm "fallguys" went undetected for over 5 months. The heavily obfuscated multi-file malware exfiltrates web browser files from Yandex, Chrome, Opera, Brave (leveldb storage files) and sends over your IP, PC username, Discord tokens via a Webhook.

The smishing campaign is concerning as it employs multiple HMRC phishing domains and tactics, with new domains added every day as older ones get flagged by spam filters.

Not only do the phishing pages mimic HMRC's web interface meticulously, but they also have entire online banking workflows built into them, depending on who your banking provider is.

Some users allege SQL injections made it possible to also obtain voters' SSN and DOB.

It exploits at least 12 known vulns, targets random IPs in a subnet, mines XMR, evades detection, and gains persistence.

Confusing disclosure timeline: While the vulnerabilities were disclosed today, it is worth noting that fixes for all three vulnerabilities were committed and disclosed to GitHub much earlier.

For example, the fix for CVE-2020-16846 was pushed to GitHub as early as August 18th, and the Salt client test cases for the shell injection flaw also mention multiple Zero-Day Initiative (ZDI) IDs, such as ZDI-CAN-11143. The date of the original report on this identifier, however, is June 2020 as shown in BleepingComputer's post.

Exclusive: Home Depot Canada accidentally sent several customers HUNDREDS of order pick-up emails exposing order info, customer name, order history and last 4 digits of payment card due to "a systems error."

The vulnerabilities that the October 9th upgrade advisory briefly talked about have been fully disclosed this week by Lightning Network.

Monero staff has stated in the same HackerOne report that even though the bug was plagiarized, that they are unable to withdraw the already-paid sum of money.

"NB: this disclosure was stolen (!!) from Guido Vranken's original disclosure without any credit given to him. We missed that this was ripped straight from there as our focus was on reproducing the issue and fixing it. This is beyond scummy. Please don't do this. We've reached out to Guido to pay him a bounty; sadly we can't redact the bounty from Everton Melo."