Category: News

From thehackernews.com

Continuous integration vendor Travis CI has patched a serious security flaw that exposed API keys, access tokens, and credentials, potentially putting organizations that use public source code repositories at risk of further attacks.

The issue — tracked as CVE-2021-41077 — concerns unauthorized access and plunder of secret environment data associated with a public open-source project during the software build process. The problem is said to have lasted during an eight-day window between September 3 and September 10.

Felix Lange of Ethereum has been credited with discovering the leakage on September 7, with the company’s Péter Szilágyi pointing out that “anyone could exfiltrate these and gain lateral movement into 1000s of [organizations].”

Read more…

From thehackernews.com

New details have been revealed about a recently remediated critical vulnerability in Netgear smart switches that could be leveraged by an attacker to potentially execute malicious code and take control of vulnerable devices.

The flaw — dubbed “Seventh Inferno” (CVSS score: 9.8) — is part of a trio of security weaknesses, called Demon’s Cries (CVSS score: 9.8) and Draconian Fear (CVSS score: 7.8), that Google security engineer Gynvael Coldwind reported to the networking, storage, and security solutions provider.

The disclosure comes weeks after Netgear released patches to address the vulnerabilities earlier this month, on September 3.

Successful exploitation of Demon’s Cries and Draconian Fear could grant a malicious party the ability to change the administrator password without actually having to know the previous password or hijack the session bootstrapping information, resulting in a full compromise of the device.

Read more…

From zerofox.com

Adversaries have evolved to target financial organizations in a new, effective way, introducing the cyber puppeteer kit. While cyber puppeteer kits are often confused with phishing kits, there is an important difference. Cyber puppeteer kits are more personalized, interactive and successful than the traditional phishing kit. This makes them a substantial threat to an organization’s employees, customers, critical assets and more.

Read more…

From heimdalsecurity.com

Microsoft addressed a number of critical vulnerabilities that were collectively known as OMIGOD.

The vulnerabilities were identified in the Open Management Infrastructure (OMI) software agent, which was quietly installed on more than half of Azure Linux machines.

Open Administration Suite (OMS), Azure Insights, and Azure Automation also utilize OMI, a software service for IT management that supports most UNIX systems and contemporary Linux platforms. OMI is used by many Azure services, including Open Management Suite (OMS), Azure Insights, and Azure Automation.

Read more…

From securityweek.com

A group of researchers from North Carolina State University has built a software toolkit to explore vulnerabilities in Apple’s mobile processors and used the findings to devise a cache timing attack.

Using the permanent exploit known as checkm8 as a starting point, the researchers implemented a BootROM toolkit to test Apple’s A10 Fusion system-on-a-chip (SoC) and then came up with a new access-driven cache timing attack based on the Prime+Probe method.

“We find that the SoC employs a randomized cache-line replacement policy as well as a hardware-based L1 prefetcher. We propose statistical innovations which specifically account for these hardware structures and thus further the state-of-the-art in cache timing attacks,” the academics note in their research paper.

The checkm8 exploit can be used against most iPhone models (ranging from iPhone 5 to the iPhone X), but the researchers focused on iPhone 7, which was the most common Apple mobile device on the market in 2019, when the research started.

Read more…

From itsecuritynews.info

A Russian hacker who collaborated with the well-known REvil group confirmed that cybercriminals returned to active work after a two-month break. He named political reasons the main reason for the temporary suspension of their activities. This refutes the claims of REvil members themselves, who explained this with precautions after the disappearance of one of the community members.

An anonymous cybercriminal said that the group initially planned only to suspend its activities, but not to end it completely. According to him, this step was due to the difficult geopolitical situation.

Read more…

From arstechnica.com

Hacktivist collective Anonymous claims to have obtained gigabytes of data from Epik, which provides domain name, hosting, and DNS services for a variety of clients. These include the Texas GOP, Gab, Parler, and 8chan, among other right-wing sites. The stolen data has been released as a torrent. The hacktivist collective says that the data set, which is over 180GB in size, contains a “decade’s worth of data from the company.”

Anonymous says the data set is “all that’s needed to trace actual ownership and management of the fascist side of the Internet that has eluded researchers, activists, and, well, just about everybody.” If this information is correct, Epik’s customers’ data and identities could now fall into the hands of activists, researchers, and just about anyone curious enough to take a peek.

Read more…