Quotidien Hebdomadaire Mensuel

Hebdomadaire Shaarli

Tous les liens d'un semaine sur une page.

Semaine 19 (May 6, 2024)

Over 50,000 Tinyproxy servers vulnerable to critical RCE flaw

Nearly 52,000 internet-exposed Tinyproxy instances are vulnerable to CVE-2023-49606, a recently disclosed critical remote code execution (RCE) flaw.

Mirai Botnet Exploits Ivanti Connect Secure Flaws for Malicious Payload Delivery

Ivanti Connect Secure (ICS) devices are under attack! Two critical vulnerabilities are being exploited to deploy the notorious Mirai botnet.

Kremlin-Backed APT28 Targets Polish Institutions in Large-Scale Malware Campaign

Russia-Linked APT28 Strikes Poland with Malware Campaign Polish government bodies were hit by a sophisticated malware attack orchestrated by the infam

The UK Says a Huge Payroll Data Breach by a ‘Malign Actor’ Has Exposed Details of Military Personnel

The UK Ministry of Defense said a breach at a third-party payroll system exposed as many as 272,000 armed forces personnel and veterans.

Chi sono gli operatori telefonici sfruttati dall’azienda italiana di sorveglianza Carro

Con il sistema Carro Gwp è possibile ottenere in tempo reale informazioni sulla posizione di un cellulare partendo dal solo numero di telefono. La tecnologia è venduta a governi e agenzie di intelligence

Dell API abused to steal 49 million customer records in data breach

The threat actor behind the recent Dell data breach revealed they scraped information of 49 million customer records using an partner portal API they accessed as a fake company.
#API #Breach #Computer #Data #Dell #Forum #Hacking #InfoSec #Limit #Rate #Scraping #Security

Un logiciel russe utilisé par Fedpol et Armasuisse suscite des inquiétudes sécuritaires

Un système russe de décryptage des iPhone et PC est utilisé par Fedpol et Armasuisse. Certains experts n'excluent pas les risques de cybersécurité que font encourir l'usage par ces deux institutions fédérales du logiciel russe.

Safari Flaw Can Expose iPhone Users in the EU to Tracking

Apple's implementation of installing marketplace apps from Safari is heavily flawed and can allow a malicious marketplace to track users across websites

Big Vulnerabilities in Next-Gen BIG-IP

Our ongoing research has identified remotely exploitable vulnerabilities in F5’s Next Central Manager that can give attackers full administrative control of the device, and subsequently allow attackers to create accounts on any F5 assets managed by the Next Central Manager. These attacker-controlled accounts would not be visible from the Next Central Manager itself, enabling ongoing malicious persistence within the environment. At the time of writing, we have not seen any indication that these vulnerabilities have been exploited in the wild.

Zscaler takes "test environment" offline after rumors of a breach

Zscaler says that they discovered an exposed

APT trends report Q1 2024

For more than six years, the Global Research and Analysis Team (GReAT) at Kaspersky has been publishing quarterly summaries of advanced persistent threat (APT) activity. These summaries are based on our threat intelligence research. They provide a representative snapshot of what we have published and discussed in greater detail in our private APT reports. They are designed to highlight the significant events and findings that we feel people should be aware of.

Chinese network behind one of world’s ‘largest online scams’

More than 800,000 people in Europe and the US appear to have been duped into sharing card details and other sensitive personal data with a vast network of fake online designer shops apparently operated from China.

Des infos privées sur la vie du chef des pirates de Lockbit déjà révélées par un hacker éthique

L'identité du leader du gang de hackers Lockbit, le cybercriminel le plus recherché de la planète, a été dévoilée ce 7 mai par les forces de l'ordre. Un expert en cyber est parti en quête d'informations sur ce ressortissant russe. Une demi-heure seulement après le communiqué des forces de l'ordre dévoilant l'identité

UK confirms Ministry of Defence payroll data exposed in data breach

The UK Government confirmed today that a threat actor recently breached the country's Ministry of Defence and gained access to part of the Armed Forces payment network.

What we learned from the indictment of LockBit’s mastermind

Five takeaways from the indictment of Dmitry Yuryevich Khoroshev, the hacker who U.S. and U.K. authorities accuse of being the mastermind of the LockBit ransomware gang.

Une faille informatique grave a fragilisé l’armée allemande

Le media «Zeit online» révèle comment, jusqu’à récemment, il était possible d’accéder à l’intitulé, la date, l’heure ou le nom de la personne invitant à des réunions importantes de la Bundeswehr sur Webex. Au moins 6000 réunions ont été concernées

Proton Mail Discloses User Data Leading to Arrest in Spain

Proton Mail came under scrutiny for its role in a legal request by the Spanish authorities leading to the identification and arrest of a user.

POLITICO Europe

Hackers linked to Beijing’s security services targeted European politicians to gather sensitive data.

CVE-2024-3661: TunnelVision - How Attackers Can Decloak Routing-Based VPNs For a Total VPN Leak — Leviathan Security Group - Penetration Testing, Security Assessment, Risk Advisory

We discovered a fundamental design problem in VPNs and we're calling it TunnelVision. This problem lets someone see what you're doing online, even if you think you're safely using a VPN.

Neuf parlementaires suisses visés par une cyberattaque attribuée à la Chine - rts.ch - Suisse

La presse alémanique a révélé samedi que neuf parlementaires suisses auraient été visés par une attaque informatique chinoise en hiver 2021. Après avoir mené l'enquête, le ministère américain de la Justice accuse sept membres d'un groupe de hackeurs proches du gouvernement chinois.
La cyberattaque menée en 2021 par un groupe de hackeurs semble concerner une centaine de politiciens et politiciennes dans le monde. Plus précisément, les personnalités politiques qui ont été visées portent un regard critique à l'égard du gouvernement chinois.