Month: March 2022
Security Patch Releases for Critical Zero-Day Bug in Java Spring Framework
31 March 2022The maintainers of Spring Framework have released an emergency patch to address a newly disclosed remote code execution flaw that, if successfully exploited, could allow an unauthenticated attacker to take control of a targeted system. Tracked as CVE-2022-22965, the high-severity flaw impacts Spring Framework versions 5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and other older, unsupported […]
Read More
Hackers Increasingly Using ‘Browser-in-the-Browser’ Technique in Ukraine Related Attacks
31 March 2022A Belarusian threat actor known as Ghostwriter (aka UNC1151) has been spotted leveraging the recently disclosed browser-in-the-browser (BitB) technique as part of their credential phishing campaigns exploiting the ongoing Russo-Ukrainian conflict. The method, which masquerades as a legitimate domain by simulating a browser window within the browser, makes it possible to mount convincing social engineering […]
Read More
Bugs in Wyze Cams Could Let Attackers Takeover Devices and Access Video Feeds
31 March 2022Three security vulnerabilities have been disclosed in the popular Wyze Cam devices that grant malicious actors to execute arbitrary code and access camera feeds as well as unauthorizedly read the SD cards, the latter of which remained unresolved for nearly three years after the initial discovery. The security flaws relate to an authentication bypass (CVE-2019-9564), […]
Read More
New Python-based Ransomware Targeting JupyterLab Web Notebooks
31 March 2022Researchers have disclosed what they say is the first-ever Python-based ransomware strain specifically designed to target exposed Jupyter notebooks, a web-based interactive computing platform that allows editing and running programs via a browser. “The attackers gained initial access via misconfigured environments, then ran a ransomware script that encrypts every file on a given path on […]
Read More
Unpatched Java Spring Framework 0-Day RCE Bug Threatens Enterprise Web Apps Security
31 March 2022A zero-day remote code execution (RCE) vulnerability has come to light in the Spring framework shortly after a Chinese security researcher briefly leaked a proof-of-concept (PoC) exploit on GitHub before deleting their account. According to cybersecurity firm Praetorian, the unpatched flaw impacts Spring Core on Java Development Kit (JDK) versions 9 and later and is […]
Read More
QNAP Warns of OpenSSL Infinite Loop Vulnerability Affecting NAS Devices
31 March 2022Taiwanese company QNAP this week revealed that a selected number of its network-attached storage (NAS) appliances are affected by a recently-disclosed bug in the open-source OpenSSL cryptographic library. “An infinite loop vulnerability in OpenSSL has been reported to affect certain QNAP NAS,” the company said in an advisory published on March 29, 2022. “If exploited, […]
Read More
IT Firm Globant Confirms Breach after LAPSUS$ Leaks 70GB of Data
31 March 2022The LAPSUS$ data extortion gang announced their return on Telegram after a week-long “vacation,” leaking what they claim is data from software services company Globant. “We are officially back from a vacation,” the group wrote on their Telegram channel – which has nearly around 54,000 members as of writing – posting images of extracted data […]
Read More
Researchers Expose Mars Stealer Malware Campaign Using Google Ads to Spread
30 March 2022A nascent information stealer called Mars has been observed in campaigns that take advantage of cracked versions of the malware to steal information stored in web browsers and cryptocurrency wallets. “Mars Stealer is being distributed via social engineering techniques, malspam campaigns, malicious software cracks, and keygens,” Morphisec malware researcher Arnold Osipov said in a report […]
Read More
Honda’s Keyless Access Bug Could Let Thieves Remotely Unlock and Start Vehicles
30 March 2022A duo of researchers has released a proof-of-concept (PoC) demonstrating the ability for a malicious actor to remote lock, unlock, and even start Honda and Acura vehicles by means of what’s called a replay attack. The attack is made possible, thanks to a vulnerability in its remote keyless system (CVE-2022-27254) that affects Honda Civic LX, […]
Read More
Improve Your Hacking Skills with 9 Python Courses for Just $39
30 March 2022For anyone with interest in cybersecurity, learning Python is a must. The language is used extensively in white hat hacking, and professionals use Python scripts to automate tests. It also has a use in the “soft” side of cybersecurity — like scraping the web for compromised data and detecting bugs. Featuring nine full-length video courses, […]
Read More