Apple also did not specify exactly who was making use of the zero-day vulnerability, but research from Google’s Threat Analysis Group (the original discoverers) indicates that it is known to have been exploited as part of a “very sophisticated” attack chain involving WebKit vulnerabilities that were disclosed and patched late last year.
Multiple government agencieshave come together in a coordinated effort to expel a suspected China-backed espionage group. The campaign was prompted by cyber attacks on critical infrastructure, which reportedly was able to gain “limited” access to some of the nation’s telcos before being rebuffed.
Though the Chinese hackers appear to have compromised Notepad++’s host server and had the ability to push malicious software updates to all of its users, they did not do so for the vast majority. They instead appeared to want to maintain a “low and slow” approach to get at targets of espionage interest.
Misconfigured Supabase database allowing full read/write access to all platform data resulted in a data leak that exposed some 1.5 million API authentication tokens along with 35,000 email addresses and about 4,000 private messages.
The potential danger of support systems being exploited lies in the fact that the ticket receipt message will originate from a trusted source, thus extremely likely being greenlit right through automated spam and security scanning. But if the ability to attach files or even include a text URL is removed, what can the attackers gain from this?
Reports of a new Instagram data breach several days ago are being walked back as it becomes increasingly likely that a mysterious wave of password reset requests was caused by a new dark web compilation of very old information.
Investors and token holders are raising serious questions about Truebit’s security auditing and monitoring in the wake of the $26M crypto hack, as the five-year-old smart contract that was exploited was well out of date and had seemingly been tested by the attackers several times.
The new UK cyber action plan is in motion due to a self-diagnosed “critically high” cyber risk among numerous public services, with years of poor funding leading to a swamp of legacy systems and technical debt that now impacts some 28% of all government departments. This has manifested as a series of recent and crippling attacks.
Agencies are warning of yet another highly advanced, state-sponsored group of Chinese hackers using malware that have been evading detection for years and have an average victim dwell time of 393 days.
The Modi government publicly admitted to the order to smartphone makers after it was leaked to major media outlets, and has formally reversed course on the security app plan. It took only several days of outcry about potential snooping and spying to cause the change of plans.