Recherche : [E*N] - Cyberveille

n their push for AI-generated content, tech companies are dancing on the edge between fucking around and finding out. https://www.vice.com/en/article/88xdez/generative-ai-is-a-disaster-and-companies-dont-seem-to-really-care

08/10/2023 12:58:58

Tech companies continue to insist that AI-generated content is the future as they release more trendy chatbots and image-generating tools. But despite reassurances that these systems will have robust safeguards against misuse, the screenshots speak for themselves.

Google Online Security Blog: Expanding our exploit reward program to Chrome and Cloud https://security.googleblog.com/2023/10/expanding-our-exploit-reward-program-to.html?m=1

08/10/2023 11:35:26

In 2020, we launched a novel format for our vulnerability reward program (VRP) with the kCTF VRP and its continuation kernelCTF. For the first time, security researchers could get bounties for n-day exploits even if they didn’t find the vulnerability themselves. This format proved valuable in improving our understanding of the most widely exploited parts of the linux kernel. Its success motivated us to expand it to new areas and we're now excited to announce that we're extending it to two new targets: v8CTF and kvmCTF.

Genetics firm 23andMe says user data stolen in credential stuffing attack https://www.bleepingcomputer.com/news/security/genetics-firm-23andme-says-user-data-stolen-in-credential-stuffing-attack/

07/10/2023 09:44:05

23andMe has confirmed to BleepingComputer that it is aware of user data from its platform circulating on hacker forums and attributes the leak to a credential-stuffing attack.

Mirai Botnet's New Wave: hailBot,kiraiBot, catDDoS, and Their Fierce Onslaught - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks. https://nsfocusglobal.com/mirai-botnets-new-wave-hailbot-kiraibot-catddos-and-their-fierce-onslaught/

07/10/2023 01:20:26

Several new Mirai variant families were widely deployed in September 2023, among which hailBot, kiraiBot and catDDoS are the most active.

New Supermicro BMC Vulnerabilities Could Expose Many Servers to Remote Attacks https://www.securityweek.com/new-supermicro-bmc-vulnerabilities-could-expose-many-servers-to-remote-attacks/

05/10/2023 12:47:44

Supermicro has released BMC IPMI firmware updates to address multiple vulnerabilities impacting select motherboard models.

Binarly REsearch Uncovers Major Vulnerabilities in Supermicro BMCs https://binarly.io/posts/Binarly_REsearch_Uncovers_Major_Vulnerabilities_in_Supermicro_BMCs/index.html

05/10/2023 12:46:23

Behind the screens: An overview of hidden attack surfaces in powerful BMC chip infrastructure.

The evolutionary tale of a persistent Python threat https://checkmarx.com/blog/the-evolutionary-tale-of-a-persistent-python-threat/

05/10/2023 12:41:52

Since early April 2023, an attacker has been relentlessly deploying hundreds of malicious packages through various usernames, accumulating nearly 75,000 downloads. Our team at Checkmarx’s Supply Chain Security has been on this malicious actor’s trail since early April, documenting each step of its evolution. We have been actively observing an attacker who seems to be evermore refining their craft.

Ransomware Negotiation: Dos and Don’ts! https://www.neteye-blog.com/2023/09/ransomware-negotiation-dos-and-donts/

05/10/2023 12:07:19

Double extortion ransomware attacks have reached very high numerical values. One of the key elements, when suffering such an attack, concerns the negotiation that can be initiated (not always!) with the ransomware gang. The analysis, carried out by the SEC4U team, of hundreds of negotiations makes it possible to apply a scientific approach to this

CVE: Zero-Day Privilege Escalation in Confluence Server & Data Center https://www.rapid7.com/blog/post/2023/10/04/etr-cve-2023-22515-zero-day-privilege-escalation-in-confluence-server-and-data-center/

04/10/2023 22:04:13

On 10/4/2023, Atlassian published a security advisory on CVE-2023-22515, a privilege escalation vulnerability affecting Confluence Server & Data Center.

Sony confirms data breach impacting thousands in the U.S. https://www.bleepingcomputer.com/news/security/sony-confirms-data-breach-impacting-thousands-in-the-us/#google_vignette

04/10/2023 16:50:10

Sony Interactive Entertainment (Sony) has notified current and former employees and their family members about a cybersecurity breach that exposed personal information.

CVE-2023-4911: Looney Tunables - Local Privilege Escalation in the glibc’s ld.so https://blog.qualys.com/vulnerabilities-threat-research/2023/10/03/cve-2023-4911-looney-tunables-local-privilege-escalation-in-the-glibcs-ld-so#potential-impact-of-looney-tunables

04/10/2023 09:33:44

The Qualys Threat Research Unit (TRU) has discovered a buffer overflow vulnerability in GNU C Library's dynamic loader's processing of the GLIBC_TUNABLES…

Vulnerable Arm GPU drivers under active exploitation. Patches may not be available | Ars Technica https://arstechnica.com/security/2023/10/vulnerable-arm-gpu-drivers-under-active-exploitation-patches-may-not-be-available/?

03/10/2023 21:39:01

Vulnerability allows attackers to tamper with data stored in device memory.

Qualcomm says hackers exploit 3 zero-days in its GPU, DSP drivers https://www.bleepingcomputer.com/news/security/qualcomm-says-hackers-exploit-3-zero-days-in-its-gpu-dsp-drivers/

03/10/2023 17:31:45

Qualcomm is warning of three zero-day vulnerabilities in its GPU and Compute DSP drivers that hackers are actively exploiting in attacks.

Microsoft Defender Flags Tor Browser as a Trojan and Removes it from the System https://deform.co/microsoft-defender-flags-tor-browser-as-a-trojan-and-removes-it-from-the-system/

02/10/2023 21:00:20

Windows users have recently begun mass-reporting that Microsoft's Defender antivirus program, which is integrated into Windows 10 and 11 by default, is

Critical vulnerabilities in Exim threaten over 250k email servers worldwide | Ars Technica https://arstechnica.com/security/2023/09/critical-vulnerabilities-in-exim-threaten-over-250k-email-servers-worldwide/

02/10/2023 18:47:43

Remote code execution requiring no authentication fixed. 2 other RCEs remain unpatched.

Routers have been rooted by Chinese spies US and Japan warn https://www.theregister.com/2023/09/27/us_japan_routers/

30/09/2023 00:51:22

BlackTech crew looking to steal sensitive data traffic

NSA chief announces new AI Security Center, 'focal point' for AI use by government, defense industry https://breakingdefense.com/2023/09/nsa-stands-up-ai-security-center-as-focal-point-for-guiding-ai-use-by-government-defense-industry/

30/09/2023 00:15:23

"We must build a robust understanding of AI vulnerabilities, foreign intelligence threats to these AI systems and ways to counter the threat in order to have AI security," Gen. Paul Nakasone said. "We must also ensure that malicious foreign actors can't steal America’s innovative AI capabilities to do so.”

Vulnerability in popular ‘libwebp’ code more widespread than expected https://therecord.media/libwebp-vulnerability-more-widespread-than-expected

28/09/2023 21:11:47

Initial alerts about a bug in the obscure but widely used libwebp library have expanded into concerns that it affects not only web browsers like Chrome, but also many other common pieces of software.

CVE-2023-42793 https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793/rapid7-analysis

27/09/2023 19:28:40

CVE-2023-42793 is a critical authentication bypass published on September 19, 2023 that affects on-premises instances of JetBrains TeamCity, a CI/CD server. Th…

New GPU Side-Channel Attack Allows Malicious Websites to Steal Data https://www.securityweek.com/new-gpu-side-channel-attack-allows-malicious-websites-to-steal-data/

27/09/2023 19:25:15

GPUs from AMD, Apple, Arm, Intel, Nvidia and Qualcomm are vulnerable to a new type of side-channel attack named GPU.zip.

Liens par page

Filtres