Articles In Security

By Nancy Rand, Posted in Security

June 5, CNN – U.S. government hacked; feds think China is the culprit. Four million current and former federal employees, from nearly every government agency, might have had their personal information stolen by Chinese hackers, U.S. investigators said. U.S. officials believe this could be the biggest breach ever of the government's computer networks. China called the allegation irresponsible. Source June 4, Softpedia – (International) Hoard of vulnerabilities found in SysAid Help Desk. A security researc... read more.

  • June 05, 2015

By Nancy Rand, Posted in Security

June 2, Securityweek – (International) Exploit for recently patched Flash flaw added to Magnitude, Neutrino, Nuclear Pack. Security researchers from Kafeine discovered that the Magnitude, Neutrino, and Nuclear Pack exploit kits (EKs) are leveraging a recently published Adobe Flash Player memory corruption vulnerability to deliver variants of the Andromeda malware and CryptoWall ransomware. Source June 2, Softpedia – (International) Dyre banking trojan aims at Europe and North America, infections double u... read more.

  • June 04, 2015

By Nancy Rand, Posted in Security

June 1, IDG News Service – (International) Apple vulnerability could allow firmware modifications, researcher says. A security researcher discovered a vulnerability in the firmware of Apple computers made before mid-2014 in which an attacker could tamper with the system’s unified extensible firmware interface (UEFI) and install a rootkit by exploiting a flaw that unlocks UEFI code when a computer goes to sleep and reawakens. Source May 30, Softpedia – (International) Blue coat patches SSL visibility appl... read more.

  • June 02, 2015

By Nancy Rand, Posted in Security

May 29, Softpedia – (International) Non-sophisticated malware steals thousands of credentials from targeted SMBs. Security researchers from Kaspersky discovered a large malware campaign, dubbed Grabit that has infiltrated small and medium businesses worldwide across a variety of sectors with a commercial keylogger called HawkEye and several remote administration tools (RATs) distributed via emails containing malicious macro-laden Microsoft Word documents. The researchers reported that the campaign has colle... read more.

  • June 01, 2015

By Nancy Rand, Posted in Security

May 28, Softpedia – (International) Apache Cordova glitch allows tampering with mobile app behavior. A security researcher at Trend Micro discovered a high-severity security flaw in Android apps built with Apache Cordova which could allow an attacker to use locally compromised apps or remote web servers to inject malicious intent bundles by taking advantage of default behavior preferences in the Cordova framework. Source May 27, Softpedia – (International) Flash Player vulnerability exploited 2 weeks aft... read more.

  • May 29, 2015

By Nancy Rand, Posted in Security

May 26, Securityweek – (International) New Linux-based router worm used in social network scheme. Security researchers at ESET discovered a new piece of malware, known as Moose, that primarily spreads by compromising unsecure Linux-based consumer routers and can eavesdrop on communications. Compromised devices steal unencrypted network traffic, mostly from social network sites, and act as a proxy service for botnet operators. Source May 26, Associated Press– (National) IRS says thieves stole tax info fro... read more.

  • May 29, 2015

By Nancy Rand, Posted in Security

May 26, Softpedia – (International) Apache HBase fixes denial-of-service, info disclosure flaw. Apache released a fix for a vulnerability in its HBase software in which a remote attacker with network access could create a denial-of-service (DoS) condition and read sensitive information by exploiting insecure Access Control Lists (ACLs) on the ZooKeeper quorum. Source May 26, Securityweek – (International) Synology fixes XSS, command injection vulnerabilities in NAS software. Taiwan-based Synology release... read more.

  • May 27, 2015

By Nancy Rand, Posted in Security

May 22, Softpedia – (International) Apache Hive infrastructures vulnerable to authentication flaw in HiveServer2. Apache reported that a vulnerability in all versions of its HiveServer2 interface for Apache Hive enterprise data warehouse infrastructure in which users without proper credentials could gain access by exploiting a flaw in the Lightweight Directory Access Protocol (LDAP) authentication mode. The company recommended that users update to the newest version or disable unauthenticated binds in the L... read more.

  • May 26, 2015

By Nancy Rand, Posted in Security

May 20, Softpedia – (International) TLS protocol flawed, HTTPS connections susceptible to FREAK-like attack. Cryptography and security researchers discovered that approximately 8.4 percent of the top one million domains containing mail and web servers are vulnerable to an attack dubbed Logjam, in which an attacker could compromise a secure communication between a client and server by downgrading the transport layer security (TLS) connection to 512-bit export-grade cryptography due to left over variants of t... read more.

  • May 26, 2015

By Nancy Rand, Posted in Security

May 19, Securityweek – (International) Attackers use trojanized version of PuTTY to steal SSH credentials. Security researchers at Symantec discovered that actors are using a malicious version of the PuTTY open-source secure shell (SSH) software to access systems remotely and steal data by copying secure server connection info and login details to be sent to an attacker-controlled server. The software bypasses common firewalls and security products due to its whitelisted status and used by system and databa... read more.

  • May 21, 2015