The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

Cybersecurity researchers on Monday said they uncovered evidence of attempted attacks by a Russia-linked hacking operation targeting a Ukrainian entity in July 2021. Broadcom-owned Symantec, in a new report published Monday, attributed the attacks to an actor tracked as Gamaredon (aka Shuckworm or Armageddon), a cyber-espionage collective known to be active since at least 2013. In November 2021, Ukrainian intelligence agencies  branded  the group as a "special project" of Russia's Federal Security Service (FSB), in addition to pointing fingers at it for carrying out over 5,000 cyberattacks against public authorities and critical infrastructure located in the country. Gamaredon attacks typically originate with phishing emails that trick the recipients into installing a custom remote access trojan called Pterodo. Symantec disclosed that, between July 14, 2021 and August 18, 2021, the actor installed several variants of the backdoor as well as deployed additional scripts...

DDoS (Distributed Denial of Service) attacks are making headlines almost every day.  2021 saw a 434%  upsurge in DDoS attacks, 5.5 times higher than 2020.  Q3 2021 saw a 24%  increase in the number of DDoS attacks in comparison to Q3 2020.  Advanced DDoS attacks that are typically targeted, known as smart attacks, rose by 31% in the same period. Further,  73% of DDoS attacks  in Q3 2021 were multi-vector attacks that combined multiple techniques to attack the targeted systems. The largest percentage of DDoS targets (40.8%) was in the US Banks, and financial institutions were the biggest DDoS and DoS attack targets in the past couple of years.  Does this mean businesses and organizations that aren't in the banking and financial services sector are safe from  DDoS attacks ? Most definitely not! Every business is a potential DDoS target. Read on to know why and what measures to take to keep your business effectively protected.  Common D...

Details have emerged about a previously undocumented malware campaign undertaken by the Iranian MuddyWater advanced persistent threat (APT) group targeting Turkish private organizations and governmental institutions. "This campaign utilizes malicious PDFs, XLS files and Windows executables to deploy malicious PowerShell-based downloaders acting as initial footholds into the target's enterprise," Cisco Talos researchers Asheer Malhotra and Vitor Ventura  said  in a newly published report. The  development  comes as the U.S. Cyber Command, earlier this month,  linked the APT  to the Iranian Ministry of Intelligence and Security (MOIS). The intrusions, which are believed to have been orchestrated as recently as November 2021, were directed against Turkish government entities, including the Scientific and Technological Research Council of Turkey ( TÜBİTAK ), using weaponized Excel documents and PDF files hosted on attacker-controlled or media-sharing websit...

A number of security vulnerabilities have been disclosed in 42 Gears' SureMDM device management solution that could be weaponized by attackers to perform a supply chain compromise against affected organizations. Cybersecurity firm Immersive Labs, in a  technical write-up  detailing the findings, said that 42Gears released a series of updates between November 2021 and January 2022 to close out multiple flaws affecting both the platform's Linux agent and the web console. The India-based company's  SureMDM  is a cross-platform mobile device management service that allows enterprises to remotely monitor, manage, and secure a fleet of company-owned systems for dedicated-use and employee-owned devices. 42Gears  claims  that SureMDM is used by over 10,000 companies worldwide. The issues identified in the web dashboard are also of critical in nature, potentially allowing an attacker to gain code execution over individual devices, desktops, or servers. Further...

Samba has issued  software updates  to address multiple security vulnerabilities that, if successfully exploited, could allow remote attackers to execute arbitrary code with the highest privileges on affected installations. Chief among them is  CVE-2021-44142 , which  impacts  all versions of Samba before 4.13.17 and concerns an  out-of-bounds  heap read/write vulnerability in the VFS module " vfs_fruit " that provides compatibility with Apple SMB clients. Samba  is a popular freeware implementation of the Server Message Block (SMB) protocol that allows users to access files, printers, and other commonly shared resources over a network. "All versions of Samba prior to 4.13.17 are vulnerable to an out-of-bounds heap read write vulnerability that allows remote attackers to execute arbitrary code as root on affected Samba installations that use the VFS module vfs_fruit," the maintainers said in an advisory published on January 31. According to ...

With just about everything delivered from the cloud these days, employees can now collaborate and access what they need from anywhere and on any device. While this newfound flexibility has changed the way we think about productivity, it has also created new cybersecurity challenges for organizations. Historically, enterprise data was stored inside data centers and guarded by perimeter-based security tools. But with users using endpoints and networks your IT teams don't manage, this approach has become antiquated. To combat this new reality, organizations have turned to tactics such as relying on device management and antivirus software, as well as single sign-on and multi-factor authentication. Some vendors have even begun to claim these measures as a form of  Zero Trust , a popular idea where organizations should not trust any entity and provide access to its applications and data until its risk levels are verified. In this blog, I will break down what is and what isn't Zero T...

Researchers have demonstrated a new type of fingerprinting technique that exploits a machine's graphics processing unit (GPU) as a means to persistently track users across the web. Dubbed  DrawnApart , the method "identifies a device from the unique properties of its GPU stack," researchers from Australia, France, and Israel said in a new paper, adding "variations in speed among the multiple execution units that comprise a GPU can serve as a reliable and robust device signature, which can be collected using unprivileged JavaScript." A device fingerprint or machine fingerprint is information that is collected about the hardware, installed software, as well as the web browser and its associated add-ons from a remote computing device for the purpose of unique identification. Fingerprints can be a double-edged sword. On the one hand, a fingerprint algorithm may allow a service provider (e.g., bank) to detect and prevent identity theft and credit card fraud. But ...

A regional court in the German city of Munich has ordered a website operator to pay €100 in damages for transferring a user's personal data — i.e., IP address — to Google via the search giant's Fonts library without the individual's consent. The unauthorized disclosure of the plaintiff's IP address by the unnamed website to Google constitutes a contravention of the user's privacy rights, the court said, adding the website operator could theoretically combine the gathered information with other third-party data to identify the "persons behind the IP address." The violation amounts to the "plaintiff's loss of control over a personal data to Google," the ruling  issued by Landgericht München's third civil chamber in Munich read. Google Fonts is a  font embedding service  library from Google, allowing developers to add fonts to their Android apps and websites simply by referencing a stylesheet. As of January 2022, Google Fonts is a repos...