TECHZONE™

Industrial Remote Access Tool Ewon Cosy+ Vulnerable to Root Access Attacks https://thehackernews.com/2024/08/industrial-remote-access-tool-ewon-cosy.html Security vulnerabilities have been disclosed in the industrial remote access solution Ewon Cosy+ that could be abused to gain root privileges to the devices and stage follow-on attacks. The elevated access could then be weaponized to decrypt encrypted firmware files and encrypted data such as passwords in configuration files, and even get correctly signed X.509 VPN certificates for foreign

EastWind Attack Deploys PlugY and GrewApacha Backdoors Using Booby-Trapped LNK Files https://thehackernews.com/2024/08/russian-government-hit-by-eastwind.html The Russian government and IT organizations are the target of a new campaign that delivers a number of backdoors and trojans as part of a spear-phishing campaign codenamed EastWind. The attack chains are characterized by the use of RAR archive attachments containing a Windows shortcut (LNK) file that, upon opening, activates the infection sequence, culminating in the deployment of malware such

Rogue PyPI Library Solana Users, Steals Blockchain Wallet Keys https://thehackernews.com/2024/08/rogue-pypi-library-solana-users-steals.html Cybersecurity researchers have discovered a new malicious package on the Python Package Index (PyPI) repository that masquerades as a library from the Solana blockchain platform but is actually designed to steal victims' secrets. "The legitimate Solana Python API project is known as 'solana-py' on GitHub, but simply 'solana' on the Python software registry, PyPI," Sonatype researcher Ax Sharma

Black Hat USA 2024 recap – Week in security with Tony Anscombe https://www.welivesecurity.com/en/videos/black-hat-usa-2024-recap-week-security-tony-anscombe/ Unsurprisingly, many discussions focused on the implications of the recent CrowdStrike outage, including the lessons it may have offered for bad actors

Black Hat USA 2024: All eyes on election security https://www.welivesecurity.com/en/cybersecurity/black-hat-usa-2024-election-security/ In this high-stakes year for democracy, the importance of robust election safeguards and national cybersecurity strategies cannot be understated

Researchers Uncover 10 Flaws in Google's File Transfer Tool Quick Share https://thehackernews.com/2024/08/researchers-uncover-10-flaws-in-googles.html As many as 10 security flaws have been uncovered in Google's Quick Share data transfer utility for Android and Windows that could be assembled to trigger remote code execution (RCE) chain on systems that have the software installed. "The Quick Share application implements its own specific application-layer communication protocol to support file transfers between nearby, compatible devices,"

New Malware Hits 300,000 Users with Rogue Chrome and Edge Extensions https://thehackernews.com/2024/08/new-malware-hits-300000-users-with.html An ongoing, widespread malware campaign has been observed installing rogue Google Chrome and Microsoft Edge extensions via a trojan distributed via fake websites masquerading as popular software. "The trojan malware contains different deliverables ranging from simple adware extensions that hijack searches to more sophisticated malicious scripts that deliver local extensions to steal private data

Microsoft Warns of Unpatched Office Vulnerability Leading to Data Exposure https://thehackernews.com/2024/08/microsoft-warns-of-unpatched-office.html Microsoft has disclosed an unpatched zero-day in Office that, if successfully exploited, could result in unauthorized disclosure of sensitive information to malicious actors. The vulnerability, tracked as CVE-2024-38200 (CVSS score: 7.5), has been described as a spoofing flaw that affects the following versions of Office - Microsoft Office 2016 for 32-bit edition and 64-bit editions Microsoft

Experts Uncover Severe AWS Flaws Leading to RCE, Data Theft, and Full-Service Takeovers https://thehackernews.com/2024/08/experts-uncover-severe-aws-flaws.html Cybersecurity researchers have discovered multiple critical flaws in Amazon Web Services (AWS) offerings that, if successfully exploited, could result in serious consequences. "The impact of these vulnerabilities range between remote code execution (RCE), full-service user takeover (which might provide powerful administrative access), manipulation of AI modules, exposing sensitive data, data

Microsoft Reveals Four OpenVPN Flaws Leading to Potential RCE and LPE https://thehackernews.com/2024/08/microsoft-reveals-four-openvpn-flaws.html Microsoft on Thursday disclosed four medium-severity security flaws in the open-source OpenVPN software that could be chained to achieve remote code execution (RCE) and local privilege escalation (LPE). "This attack chain could enable attackers to gain full control over targeted endpoints, potentially resulting in data breaches, system compromise, and unauthorized access to sensitive information

New Flaws in Sonos Smart Speakers Allow Hackers to Eavesdrop on Users https://thehackernews.com/2024/08/new-flaws-in-sonos-smart-speakers-allow.html Cybersecurity researchers have uncovered weaknesses in Sonos smart speakers that could be exploited by malicious actors to clandestinely eavesdrop on users. The vulnerabilities "led to an entire break in the security of Sonos's secure boot process across a wide range of devices and remotely being able to compromise several devices over the air," NCC Group security researchers Alex Plaskett and

DOJ Charges Nashville Man for Helping North Koreans Get U.S. Tech Jobs https://thehackernews.com/2024/08/doj-charges-nashville-man-for-helping.html The U.S. Department of Justice (DoJ) on Thursday charged a 38-year-old individual from Nashville, Tennessee, for allegedly running a "laptop farm" to help get North Koreans remote jobs with American and British companies. Matthew Isaac Knoot is charged with conspiracy to cause damage to protected computers, conspiracy to launder monetary instruments, conspiracy to commit wire fraud, intentional

CISA Warns of Hackers Exploiting Legacy Cisco Smart Install Feature https://thehackernews.com/2024/08/cisa-warns-of-hackers-exploiting-legacy.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has disclosed that threat actors are abusing the legacy Cisco Smart Install (SMI) feature with the aim of accessing sensitive data. The agency said it has seen adversaries "acquire system configuration files by leveraging available protocols or software on devices, such as abusing the legacy Cisco Smart Install feature." It also

Black Hat USA 2024: How cyber insurance is shaping cybersecurity strategies https://www.welivesecurity.com/en/business-security/black-hat-usa-2024-cyber-insurance-shaping-cybersecurity-strategies/ Cyber insurance is not only a safety net, but it can also be a catalyst for advancing security practices and standards

University Professors Targeted by North Korean Cyber Espionage Group https://thehackernews.com/2024/08/university-professors-targeted-by-north.html The North Korea-linked threat actor known as Kimsuky has been linked to a new set of attacks targeting university staff, researchers, and professors for intelligence gathering purposes. Cybersecurity firm Resilience said it identified the activity in late July 2024 after it observed an operation security (OPSEC) error made by the hackers. Kimsuky, also known by the names APT43, ARCHIPELAGO,

0.0.0.0 Day: 18-Year-Old Browser Vulnerability Impacts MacOS and Linux Devices https://thehackernews.com/2024/08/0000-day-18-year-old-browser.html Cybersecurity researchers have discovered a new "0.0.0.0 Day" impacting all major web browsers that malicious websites could take advantage of to breach local networks. The critical vulnerability "exposes a fundamental flaw in how browsers handle network requests, potentially granting malicious actors access to sensitive services running on local devices," Oligo Security researcher Avi Lumelsky

Automated Security Validation: One (Very Important) Part of a Complete CTEM Framework https://thehackernews.com/2024/08/automated-security-validation-one-very.html The last few years have seen more than a few new categories of security solutions arise in hopes of stemming a never-ending tidal wave of risks. One of these categories is Automated Security Validation (ASV), which provides the attacker’s perspective of exposures and equips security teams to continuously validate exposures, security measures, and remediation at scale. ASV is an important element

Windows Downgrade Attack Risks Exposing Patched Systems to Old Vulnerabilities https://thehackernews.com/2024/08/windows-downgrade-attack-risks-exposing.html Microsoft said it is developing security updates to address two loopholes that it said could be abused to stage downgrade attacks against the Windows update architecture and replace current versions of the Windows files with older versions. The vulnerabilities are listed below - CVE-2024-38202 (CVSS score: 7.3) - Windows Update Stack Elevation of Privilege Vulnerability CVE-2024-21302 (CVSS

New Phishing Scam Uses Google Drawings and WhatsApp Shortened Links https://thehackernews.com/2024/08/new-phishing-scam-uses-google-drawings.html Cybersecurity researchers have discovered a novel phishing campaign that leverages Google Drawings and shortened links generated via WhatsApp to evade detection and trick users into clicking on bogus links designed to steal sensitive information. "The attackers chose a group of the best-known websites in computing to craft the threat, including Google and WhatsApp to host the attack elements,

Unlock the Future of Cybersecurity: Exclusive, Next Era AI Insights and Cutting-Edge Training at SANS Network Security 2024 https://thehackernews.com/2024/08/unlock-future-of-cybersecurity.html The Immersive Experience Happening This September in Las Vegas!In an era of relentless cybersecurity threats and rapid technological advancement, staying ahead of the curve is not just a necessity, but critical. SANS Institute, the premier global authority in cybersecurity training, is thrilled to announce Network Security 2024, a landmark event designed to empower cybersecurity professionals