How do you break into the bad guys’ ranks? Master the lingo and research, research, research Feature When AlphV/BlackCat’s website went dark this month, it was like Chrimbo came early for cybersecurity defenders, some of whom seemingly believed law enforcement…
Tag: The Register – Security
Lapsus$ teen sentenced to indefinite detention in hospital after Nvidia, GTA cyberattacks
Arion Kurtaj will remain hospitalized until a mental health tribunal says he can leave Two British teens who were members of the Lapsus$ gang have been sentenced for their roles in a cyber-crime spree that included compromising Uber, Nvidia, and…
Four in five Apache Struts 2 downloads are for versions featuring critical flaw
Seriously, people – please check the stuff you fetch more carefully Security vendor Sonatype believes developers are failing to address the critical remote code execution (RCE) vulnerability in the Apache Struts 2 framework, based on recent downloads of the code.……
Mozilla decides Trusted Types is a worthy security feature
DOM-XSS attacks have become scarce on Google websites since TT debuted Mozilla last week revised its position on a web security technology called Trusted Types, which it has decided to implement in its Firefox browser.… This article has been indexed…
Data loss prevention isn’t rocket science, but NASA hasn’t made it work in Microsoft 365
Privacy review finds breach response plan is a mess, training could be better, but protection regime mostly holds up NASA’s Office of Inspector General has run its eye over the aerospace agency’s privacy regime and found plenty to like –…
Something nasty injected login-stealing JavaScript into 50K online banking sessions
Why keeping your PC secure and free of malware remains paramount IBM Security has dissected some JavaScript code that was injected into people’s online banking pages to steal their login credentials, saying 50,000 user sessions with more than 40 banks…
Cybercrooks book a stay in hotel email inboxes to trick staff into spilling credentials
Research highlights how major attacks like those exploiting Booking.com are executed Cybercriminals are preying on the inherent helpfulness of hotel staff during the sector’s busy holiday season.… This article has been indexed from The Register – Security Read the original…
Manchester’s finest drowning in paperwork as Freedom of Information requests pile up
Enforcement notice issued months after data regulator schooled police force Greater Manchester Police (GMP) must clear the backlog of hundreds of Freedom of Information (FOI) Act requests – some years old – or find itself in contempt of court.… This…
SSH shaken, not stirred by Terrapin vulnerability
No need to panic, but grab those updates or mitigations anyway just to be safe A vulnerability in the SSH protocol can be exploited by a well-placed adversary to weaken the security of people’s connections, if conditions are right.… This…
Philippines, South Korea, Interpol cuff 3,500 suspected cyber scammers, seize $300M
Alleged crims used AI to pose as friends, family, romantic partners – and sold dodgy NFTs A transnational police operation has resulted in the arrest of 3,500 alleged cybercriminals and the seizure of $300 million in cash and digital assets.……
Millions of Xfinity customers’ info, hashed passwords feared stolen in cyberattack
35M-plus Comcast user IDs accessed by intruder via Citrix Bleed Millions of Comcast Xfinity subscribers’ personal data – including potentially their usernames, hashed passwords, contact details, and secret security question-answers – was likely stolen by one or more miscreants exploiting…
Before you go away for Xmas: You’ve patched that critical Perforce Server hole, right?
Microsoft bug hunters highlight weaknesses in source-wrangling suite Four vulnerabilities in Perforce Helix Core Server, including one critical remote code execution bug, should be patched “immediately,” according to Microsoft, which spotted the flaws and disclosed them to the software vendor.……
AlphV/BlackCat hits back as Feds offer decryptor to ransomware victims
Domain seized while gang shrugs at loss of ‘stupid old key’ The US Justice Department is passing a decryptor to more than 500 victims of AlphV/BlackCat’s ransomware following a disruption campaign.… This article has been indexed from The Register –…
AlphV/BlackCat hacked back as feds offer decryptor to ransomware victims
Domain seized while gang shrugs at loss of ‘stupid old key’ The US Justice Department is passing a decryptor to more than 500 victims of AlphV/BlackCat’s ransomware following a disruption campaign.… This article has been indexed from The Register –…
Qakbot’s backbot: FBI-led takedown keeps crims at bay for just 3 months
Experts say malware strain make take years to die off completely Multiple sources are confirming the resurgence of Qakbot malware mere months after the FBI and other law enforcement agencies shuttered the Windows botnet.… This article has been indexed from…
Hacktivists boast: We shut down Iran’s gas pumps today
Predatory Sparrow previously knocked out railways and a steel plant Hacktivists reportedly disrupted services at about 70 percent of Iran’s gas stations in a politically motivated cyberattack.… This article has been indexed from The Register – Security Read the original…
Mr Cooper cyberattack laid bare: 14.7M people’s info stolen, costs hit $25M
Mortgage lender says no evidence of identity theft (yet) after SSNs, DoBs, addresses, more swiped Mortgage lender Mr Cooper has now admitted almost 14.7 million people’s private information, including addresses and bank account numbers, were stolen in an earlier IT…
Cyber-crooks slip into Vans, trample over operations
IT systems encrypted, personal data pilfered from North Face parent, we’re told A digital break-in has disrupted VF Corp’s operations and its ability to fulfill orders, according to the apparel and footwear giant.… This article has been indexed from The…
National Grid latest UK org to zap Chinese kit from critical infrastructure
Move reportedly made after consulting with National Cyber Security Centre The National Grid is reportedly the latest organization in the UK to begin pulling China-manufactured equipment from its network over cybersecurity fears.… This article has been indexed from The Register…
MongoDB warns breach of internal systems exposed customer contact info
PLUS: Cancer patients get ransom notes for Christmas, Delta Dental is the latest MOVEit victim, and critical vulns Infosec in brief MongoDB on Saturday issued an alert warning of “a security incident involving unauthorized access to certain MongoDB corporate systems,…