Cyber News, Author at CyberConvoy Blog

Unpatched 15-year old Python bug allows code execution in 350k projects

09/21/2022
Cyber News
Exploit, Hacking, Patching, PrivEsc, Python, Security, Software

Disclosed in 2007 and tagged as CVE-2007-4559, the security issue never received a patch, the only mitigation provided being a documentation update warning developers about the risk.

21 September

Microsoft 365 phishing attacks impersonate U.S. govt agencies

09/21/2022
Cyber News
Breach, Exploit, Hacking, Malware, Phishing, PrivEsc

The lure in these phishing emails is a request for bids for lucrative government projects, taking them to phishing pages that are clones of legitimate federal agency portals

21 September

VMware, Microsoft warn of widespread Chromeloader malware attacks

09/21/2022
Cyber News
Breach, C2, Exploit, Hacking, PrivEsc, Ransomware, RCE, Security

Because adware doesn't create notable damage to victims' systems, besides eating up some bandwidth, it is usually a threat that is ignored or downplayed by analysts

21 September

Emotet botnet now pushes Quantum and BlackCat ransomware

09/19/2022
Cyber News
C2, Exploit, Hacking, Malware, Phishing, PrivEsc, Ransomware

The botnet is now being used to install a Cobalt Strike beacon on infected systems as a second-stage payload

19 September

Google, Microsoft can get your passwords via web browser’s spellcheck

09/19/2022
Cyber News
Breach, Exploit, Hacking, Hardening, PrivEsc, Security, Technology

Depending on the website you visit, the form data may itself include PII—including but not limited to Social Security Numbers (SSNs)/Social Insurance Numbers (SINs), name, address, email, date of birth (DOB), contact information, bank and payment information, etc

19 September

CISA orders agencies to patch Windows, iOS bugs used in attacks

09/19/2022
Cyber News
0day, Hacking, Patching, PrivEsc, Technology

The elevation of privileges bug in the Windows Common Log File System Driver is tracked as CVE-2022-37969, enabling local attackers to gain SYSTEM privileges following successful exploitation.

19 September

Patch now! Microsoft issues critical security updates as PCs attacked through zero-day flaw

The most urgent of the vulnerabilities to patch is arguably a privilege escalation flaw in the Windows Common Log File System (CLFS), for which exploit code has been made publicly available.

14 September

Microsoft Teams stores auth tokens as cleartext in Windows, Linux, Macs

The newly discovered security issue impacts Windows, Linux, and Mac versions of the application. It refers to Microsoft Teams storing user authentication tokens in clear text without protecting access to them.

14 September

A Massive Hacking Campaign Stole 10,000 Login Credentials From 130 Different Organizations

Researchers say that the hackers used a pretty standard tool, a phishing toolkit, to target employees of the companies that they wanted to breach. Such kits are prepackaged hacking tools that can be purchased usually for pretty low prices on the dark web

10 September

NSA and CISA share tips to secure the software supply chain

09/10/2022
Cyber News
Hardening, Security, Software, SupplyChain

Developers will find helpful guidance from NSA and partners on developing secure code, verifying third party components, hardening the built environment, and delivering the code. Until all DevOps is DevSecOps, the software development lifecycle will be at risk

10 September

Cyber News, Author at CyberConvoy Blog - Page 10 of 14