cybersecurity

Hundreds of HP printer models vulnerable to remote code execution

HP has published security advisories for three critical-severity vulnerabilities affecting hundreds of its LaserJet Pro, Pagewide Pro, OfficeJet, Enterprise, Large Format, and DeskJet printer models.

The first security bulletin warns about about a buffer overflow flaw that could lead to remote code execution on the affected machine. Tracked as CVE-2022-3942, the security issue was reported by Trend Micro’s Zero Day Initiative team.

Although it comes with a severity score of 8.4 (high), as calculated with the Common Vulnerability Scoring System (CVSS), HP lists the bug’s severity as critical.

HP has released firmware security updates for most of the affected products. For the models without a patch, the company provides mitigation instructions that revolve mainly around disabling LLMNR (Link-Local Multicast Name Resolution) in network settings.

KiK team recommends regular vulnerability assessments and penetration tests to ensure your cybersecurity and data protection.

Steps for disabling unused network protocols using the embedded web server (EWS) for LaserJet Pro.

disabling HP LLMNR from printer's network settings

A second security bulletin from HP warns about two critical and one high-severity vulnerability that could be exploited for information disclosure, remote code execution, and denial of service.

The three vulnerabilities are tracked as CVE-2022-24291 (high severity score: 7.5), CVE-2022-24292 (critical severity score: 9.8), and CVE-2022-24293 (critical severity score: 9.8). Credit for reporting them also go to the Zero Day Initiative team.

In this case too, the official recommendation is to update your printer firmware to the designated versions, but this isn’t available for all impacted models.

There’s no mitigation advice to remediate the problem for one of the listed LaserJet Pro models, but it has been marked as pending, so the security updates for that one should become available soon.

Admins of all other models may visit HP’s official software and driver download portal, navigate to select their device model, and install the latest available firmware version.

While not many details have been published about these vulnerabilities, the repercussions of remote code execution and information disclosure are generally far-reaching and potentially dire.

As such, it is recommended to apply the security updates as soon as possible, place the devices behind a network firewall, and impose remote access restriction policies.

cybersecurity vulnerability

The flaw of Windows 10 and 11 with 0-day, which gives administrator rights, again receives an unofficial patch

A Windows local privilege escalation zero-day vulnerability that Microsoft has failed to fully address for several months now, allows users to gain administrative privileges in Windows 10, Windows 11, and Windows Server.

The locally exploited vulnerability in Windows User Profile Service is tracked as CVE-2021-34484 and was given a CVSS v3 score of 7.8. While exploits have been publicly disclosed in the past, they are not believed to be actively exploited in the wild.

The peculiarity of this case lies in the fact that Microsoft has been unable to address the flaw since its discovery last summer and that it has marked the bug as fixed twice.

According to the 0patch team, which has been unofficially providing fixes for discontinued Windows versions and some vulnerabilities that Microsoft won’t address, the flaw is still a zero-day. In fact, Microsoft’s patches failed to fix the bug and broke 0patch’s previous unofficial patch.

The Windows User Profile Service Elevation of Privilege Vulnerability, tracked as CVE-2021-34484, was discovered by security researcher Abdelhamid Naceri and disclosed to Microsoft, who fixed it as part of the August 2021 Patch Tuesday.

Soon after the fix was released, Naceri noticed that Microsoft’s patch was incomplete and presented a proof of concept (PoC) that bypassed it on all Windows versions.

The 0patch team stepped in at that point, releasing an unofficial security update for all Windows versions and making it free to download for all registered users.

Microsoft also responded to this bypass with a second security update released with the January 2022 Tuesday Patch Tuesday, giving the bypass a new tracking ID as CVE-2022-21919 and marking it as fixed. However, Naceri found a way to bypass that fix while commenting that this attempt was worse than the first.

While testing their patch against the researcher’s second bypass, 0patch found that their patch to the “profext.dll” DLL still protected users against the new exploitation method, allowing those systems to remain secure.

However, Microsoft’s second fixing attempt replaced the “profext.dll” file, leading to the removal of the unofficial fix from everyone who had applied the January 2022 Windows updates.

0patch has now ported the fix to work with the March 2022 Patch Tuesday updates and made it available for free to all registered users.

KiK team recommends regular vulnerability assessments and penetration tests to ensure your cybersecurity and data protection.

The Windows versions that can take advantage of the new micro-patch are the following:

Windows 10 v21H1 (32 & 64 bit) updated with March 2022 Updates
Windows 10 v20H2 (32 & 64 bit) updated with March 2022 Updates
Windows 10 v1909 (32 & 64 bit) updated with March 2022 Updates
Windows Server 2019 64 bit updated with March 2022 Updates

It should be noted that Windows 10 1803, Windows 10 1809, and Windows 10 2004 are still protected by 0patch’s original patch, as those devices have reached the end of support and did not receive the Microsoft update that replaced the DLL.

The micro-patch will remain available as a free download to users of the above Windows versions as long as Microsoft hasn’t released a complete fix for the particular LPE problem and all its bypasses.

To those interested in taking up that offering, update your Windows 10 to the latest patch level (March 2022), create a free account in 0patch central, and then install and register the 0patch Agent from here.

cybersecurity malware

Unix rootkit steals ATM banking data

Threat analysts following the activity of LightBasin, a financially motivated group of hackers, report the discovery of a previously unknown Unix rootkit that is used to steal ATM banking data and conduct fraudulent transactions.

The particular group of adversaries has been recently observed targeting telecom companies with custom implants, while back in 2020, they were spotted compromising managed service providers and victimizing their clients.

In a new report by Mandiant, researchers present further evidence of LightBasin activity, focusing on bank card fraud and the compromise of crucial systems.

LightBasin’s new rootkit is a Unix kernel module named “Caketap” that is deployed on servers running the Oracle Solaris operating system.

When loaded, Caketap hides network connections, processes, and files while installing several hooks into system functions to receive remote commands and configurations.

The commands observed by the analysts are the following:

Add the CAKETAP module back to the loaded modules list
Change the signal string for the getdents64 hook
Add a network filter (format p)
Remove a network filter
Set the current thread TTY to not to be filtered by the getdents64 hook
Set all TTYs to be filtered by the getdents64 hook
Displays the current configuration

The ultimate goal of Caketap is to intercept banking card and PIN verification data from breached ATM switch servers and then use the stolen data to facilitate unauthorized transactions.

The messages intercepted by Caketap are destined for the Payment Hardware Security Module (HSM), a tamper-resistant hardware device used in the banking industry for generating, managing, and validating cryptographic keys for PINs, magnetic stripes, and EMV chips.

Caketap manipulates the card verification messages to disrupt the process, stops those that match fraudulent bank cards, and generates a valid response instead.

In a second phase, it saves valid messages that match non-fraudulent PANs (Primary Account Numbers) internally and sends them to the HSM so that routine customer transactions aren’t affected and the implant operations remain stealthy.

“We believe that CAKETAP was leveraged by UNC2891 (LightBasin) as part of a larger operation to successfully use fraudulent bank cards to perform unauthorized cash withdrawals from ATM terminals at several banks,” explains Mandiant’s report.

Other tools linked to the actor in previous attacks include Slapstick, Tinyshell, Steelhound, Steelcorgi, Wingjook, Wingcrack, Binbash, Wiperight, and the Mignogcleaner, all of which Mandiant confirmed as still deployed in LightBasin attacks.

LightBasin is a highly skillful threat actor that takes advantage of relaxed security in mission-critical Unix and Linux systems that are often treated as intrinsically secure or largely ignored due to their obscurity.

This is precisely where adversaries like LightBasic thrive, and Mandiant expects them to continue to capitalize on the same operational strategy.

As for attribution, the analysts spotted some overlaps with the UNC1945 threat cluster but don’t have any concrete links to draw safe conclusions on that front yet.

cybersecurity malware

Ransomware variants used in 722 attacks in last 3 months of 2021

The ransomware space was very active in the last quarter of 2021, with threat analysts observing 722 distinct attacks deploying 34 different variants.

This massive amount of activity creates problems for the defenders, making it harder to keep up with individual group tactics, indicators of compromise, and detection opportunities.

Compared to Q3 2021, the last quarter had 18% higher attack volume, while the comparison to Q2 2021 results in a difference of 22%, so there’s a trend of increasing attack numbers.

The most prevalent ransomware groups in Q4 2021, according to a report by Intel 471, were LockBit 2.0 (29.7%), Conti (19%), PYSA (10.5%), and Hive (10.1%).

Compared to the preceding quarter, only PYSA had a noticeable rise in activity, which was also noted in a report by the NCC Group that examined November 2021 data.

The most targeted region was North America, accounting for almost half of all attacks by the ransomware operations mentioned above. Europe followed with roughly 30%, leaving only 20% to the rest of the world.

The stats are rather balanced for targeted industries, and only the Consumer and Industrial products sector stands out, accounting for one out of four attacks. Manufacturing, professional services, and real estate also had substantial shares.

Targeted industry sectors malware q4 2021

When looking at this from the perspective of trends, compared to Q3 2021 data, the manufacturing sector dropped while consumer and industrial products rose. In addition, life sciences and health care also had a significant rise.

This shift could be due to the seasonal interest for shopping during Christmas and Black Friday/Cyber Monday, which makes associated targets more lucrative.

Ransomware attaks per sector Q4 2021 vs Q3 2021.

Healthcare also obtains a more critical role as we move towards the end of the year, possibly due to the winter in the northern hemisphere bringing higher viral transmission rates.

Ransomware groups aim to disrupt the operations of firms at the worst possible time, to increase the chances of having a quick resolution in their negotiation for the payment of the demanded ransom.

For example, the FBI recently warned that ransomware gangs commonly target companies during mergers and acquisitions to further apply pressure during negotiations.

However, in many cases, the targeted companies are purely opportunistic in nature, where ransomware gangs simply attack whoever they can gain access to rather than based on any vertical or season.

cybersecurity malware

New CaddyWiper data wiping malware hits Ukrainian networks

Newly discovered data-destroying malware was observed earlier today in attacks targeting Ukrainian organizations and deleting data across systems on compromised networks.

“This new malware erases user data and partition information from attached drives,” ESET Research Labs explained.

“ESET telemetry shows that it was seen on a few dozen systems in a limited number of organizations.”

While designed to wipe data across Windows domains it’s deployed on, CaddyWiper will use the DsRoleGetPrimaryDomainInformation() function to check if a device is a domain controller. If so, the data on the domain controller will not be deleted.

This is likely a tactic used by the attackers to maintain access inside the compromised networks of organizations they hit while still heavily disturbing operations by wiping other critical devices.

While analyzing the PE header of a malware sample discovered on the network of an undisclosed Ukrainian organization, it was also discovered that the malware was deployed in attacks the same day it was compiled.

“CaddyWiper does not share any significant code similarity with HermeticWiper, IsaacWiper, or any other malware known to us. The sample we analyzed was not digitally signed,” ESET added.

“Similarly to HermeticWiper deployments, we observed CaddyWiper being deployed via GPO, indicating the attackers had prior control of the target’s network beforehand.”

CaddyWiper is the fourth data wiper malware deployed in attacks in Ukraine since the start of 2022, with ESET Research Labs analysts previously discovering two others and Microsoft a third.

One day before the Russian invasion of Ukraine started, on February 23rd, ESET researchers spotted a data-wiping malware now known as HermeticWiper, used to target Ukraine together with ransomware decoys.

They also discovered a data wiper they dubbed IsaacWiper and a new worm named HermeticWizard the attackers used to drop HermeticWiper wiper payloads, deployed the day Russia invaded Ukraine.

Microsoft also found a wiper now tracked as WhisperGate, used in data-wiping attacks against Ukraine in mid-January, disguised as ransomware.

As Microsoft President and Vice-Chair Brad Smith said, these ongoing attacks with destructive malware against Ukrainian organizations “have been precisely targeted.”

This contrasts with the indiscriminate NotPetya worldwide malware assault that hit Ukraine and other countries in 2017, an attack later linked to Sandworm, a Russian GRU Main Intelligence Directorate hacking group.

Such destructive attacks are part of a “massive wave of hybrid warfare,” as the Ukrainian Security Service (SSU) described them right before the war started.

cybersecurity hardware vulnerability

Exploit Bypasses Existing Spectre-V2 Mitigations in Intel and Arm CPUs

Researchers have disclosed a new technique that could be used to circumvent existing hardware mitigations in modern processors from Intel, AMD, and Arm, and stage speculative execution attacks such as Spectre to leak sensitive information from host memory.

Attacks like Spectre are designed to break the isolation between different applications by taking advantage of an optimization technique called speculative execution in CPU hardware implementations to trick programs into accessing arbitrary locations in memory and thus leak their secrets.

While chipmakers have incorporated both software and hardware defenses, including Retpoline as well as safeguards like Enhanced Indirect Branch Restricted Speculation (eIBRS) and Arm CSV2, the latest method demonstrated by VUSec researchers aims to get around all these protections.

Called Branch History Injection (BHI or Spectre-BHB), it’s a new variant of Spectre-V2 attacks (tracked as CVE-2017-5715) that bypasses both eIBRS and CSV2, with the researchers describing it as a “neat end-to-end exploit” leaking arbitrary kernel memory on modern Intel CPUs.

“The hardware mitigations do prevent the unprivileged attacker from injecting predictor entries for the kernel,” the researchers explained.

“However, the predictor relies on a global history to select the target entries to speculatively execute. And the attacker can poison this history from userland to force the kernel to mispredict to more ‘interesting’ kernel targets (i.e., gadgets) that leak data,” the Systems and Network Security Group at Vrije Universiteit Amsterdam added.

Put differently, a piece of malicious code can use the shared branch history, which is stored in the CPU Branch History Buffer (BHB), to influence mispredicted branches within the victim’s hardware context, resulting in speculative execution that can then be used to infer information that should be inaccessible otherwise.

Spectre-BHB renders vulnerable all Intel and Arm processors that were previously affected by Spectre-V2 along with a number of chipsets from AMD, prompting the three companies to release software updates to remediate the issue.

Intel is also recommending customers to disable Linux’s unprivileged extended Berkeley Packet Filters (eBPF), enable both eIBRS and Supervisor-Mode Execution Prevention (SMEP), and add “LFENCE to specific identified gadgets that are found to be exploitable.”

“The [Intel eIBRS and Arm CSV2] mitigations work as intended, but the residual attack surface is much more significant than vendors originally assumed,” the researchers said.

“Nevertheless, finding exploitable gadgets is harder than before since the attacker can’t directly inject predictor targets across privilege boundaries. That is, the kernel won’t speculatively jump to arbitrary attacker-provided targets, but will only speculatively execute valid code snippets it already executed in the past.”

cybersecurity hardware

100 Million Samsung Galaxy Phones Affected with Flawed Hardware Encryption Feature

A group of academics from Tel Aviv University have disclosed details of now-patched “severe” design flaws affecting about 100 million Android-based Samsung smartphones that could have resulted in the extraction of secret cryptographic keys.

The shortcomings are the result of an analysis of the cryptographic design and implementation of Android’s hardware-backed Keystore in Samsung’s Galaxy S8, S9, S10, S20, and S21 flagship devices, researchers Alon Shakevsky, Eyal Ronen, and Avishai Wool said.

Trusted Execution Environments (TEEs) are a secure zone that provide an isolated environment for the execution of Trusted Applications (TAs) to carry out security critical tasks to ensure confidentiality and integrity.

On Android, the hardware-backed Keystore is a system that facilitates the creation and storage of cryptographic keys within the TEE, making them more difficult to be extracted from the device in a manner that prevents the underlying operating system from having direct access.

Instead, the Android Keystore exposes APIs in the form of Keymaster TA (trusted application) to perform cryptographic operations within this environment, including secure key generation, storage, and its usage for digital signing and encryption. On Samsung mobile devices, the Keymaster TA runs in an ARM TrustZone-based TEE.

However, security flaws uncovered in Samsung’s implementation meant that they could provide an adversary with root privileges a workable path to recover the hardware-protected private keys from the secure element. The list of issues identified is as below –

Initialization Vector (IV) reuse in Keymaster TA (CVE-2021-25444) – An IV reuse vulnerability in Keymaster prior to SMR AUG-2021 Release 1 allows decryption of custom keyblob with privileged process. (Impacts Galaxy S9, J3 Top, J7 Top, J7 Duo, TabS4, Tab-A-S-Lite, A6 Plus, and A9S)

Downgrade attack in Keymaster TA (CVE-2021-25490) – A keyblob downgrade attack in Keymaster prior to SMR Oct-2021 Release 1 allows [an] attacker to trigger IV reuse vulnerability with privileged process. (Impacts Galaxy S10, S20, and S21)

In a nutshell, successful exploitation of the flaws against the Keymaster TA could achieve unauthorized access to hardware-protected keys and data secured by the TEE. Implications of such an attack could range from an authentication bypass to advanced attacks that can break fundamental security guarantees offered by cryptographic systems.

Following responsible disclosure in May and July 2021, the issues were addressed via security updates shipped in August and October 2021 for the affected devices. The findings are expected to be presented at the USENIX Security Symposium later this August.

“Vendors including Samsung and Qualcomm maintain secrecy around their implementation and design of [TrustZone operating systems] and TAs,” the researchers said. “The design and implementation details should be well audited and reviewed by independent researchers and should not rely on the difficulty of reverse engineering proprietary systems.”

cybersecurity Linux vulnerability

Linux Root Vulnerability PwnKit Affects All Major Distros

Оur colleagues from Qualys have just discovered a 12-year-old Linux vulnerability that has remained undetected until now. The bug, dubbed PwnKit, allows hackers to gain full root privileges through an unprivileged user, thanks to a memory corruption vulnerability in polkit’s pkexec. This is a SUID-root program installed on every major Linux distro.

According to the researchers, Polkit is a component for controlling privileges in Unix-like operating systems, including Linux distros. It effectively allows unprivileged processes to communicate with privileged processes currently running. If you are an administrator (or root) you can also use Polkit to push elevated commands if necessary.

Still, the actions required to successfully take advantage of PwnKit are pretty complicated (you can read the full analysis here). “[Qualys has] been able to independently verify the vulnerability, develop an exploit, and obtain full root privileges on default installations of Ubuntu, Debian, Fedora, and CentOS,” the security researchers explain. “Other Linux distributions are likely vulnerable and probably exploitable.

Thankfully this vulnerability was discovered by responsible security researchers and, as far as we know, hasn’t been exploited in the wild just yet. However, the exploit could soon become public, allowing anyone to get their hands on this hack.

Fortunately, PwnKit patches have already been released to all major Linux distros, which plugs the exploit. Thus, it is strongly recommended to install this patch if you are on one of the affected Linux distros. It should be as simple as ensuring your Linux operating system has all available updates applied.

cybersecurity malware UEFI

MoonBounce Malware Hides In BIOS Chip, Persists After Drive Formats

A new type of malware takes a decidedly more stealthy and hard-to-remove path into your OS — it hides in your BIOS chip and thus remains even after you reinstall your OS or format your hard drive.

MoonBounce isn’t the first UEFI malware discovered in the wild that targets SPI flash. Kaspersky says that the likes of LoJax and MosaicRegressor came before it. However, MoonBounce shows “significant advancement, with a more complicated attack flow and greater technical sophistication.” It also seems to have infected a machine remotely.

Kaspersky has observed the growth of Unified Extensible Firmware Interface (UEFI) firmware malware threats since 2019, with most storing malware on the EFI System Partition of the PC’s storage device. However, a sinister development has been spotted over the New Year with a new UEFI malware, detected by Kasperksy’s firmware scanner logs, that implants malicious code into the motherboard’s Serial Peripheral Interface (SPI) Flash. The security researchers have dubbed this flash-resident UEFI malware ‘MoonBounce’.

MoonBounce is undeniably clever in the way it gets into a system and makes itself hard to detect and dispose of. “The source of the infection starts with a set of hooks that intercept the execution of several functions in the EFI Boot Services Table,” explains Kaspersky on its SecureList blog. The hooks are then used to divert function calls to the malicious shellcode that the attackers have appended to the CORE_DXE image. This, in turn, “sets up additional hooks in subsequent components of the boot chain, namely the Windows loader,” said the security researchers. This allows the malware to be injected into an svchost.exe process when the computer boots into Windows.

Transport Technology Company the Only Logged Attack so Far

Of course, Kaspersky was interested to see what the malware would do next. So, on an infected machine, the researchers observed the malware process try and access a URL to fetch the next stage payload and run it in memory. Interestingly, this part of the sophisticated attack didn’t seem to go anywhere, so it wasn’t possible to analyze any further steps in MoonBounce. Perhaps this malware was still in testing when it was spotted, and/or it is being held back for special purposes. In addition, the malware isn’t file-based and does at least some of its operations only in memory, making it hard to see exactly what MoonBounce did on the single host PC on a company’s network.

Below, a flow chart breaks down how MoonBounce boots and deploys from the moment your UEFI PC is switched on, through Windows loading, and into being a usable but infected PC.

A single machine, owned by a transportation company, seems to be the only machine on Kaspersky’s logs that has a MoonBounce infection in its SPI Flash. It isn’t certain how the infection took place, but it is thought it was instigated remotely. That sole machine at a transport technology company seems to have spread non-UEFI malware implants to other machines on the network. With much of its work being file-less and memory resident only, it isn’t easy to observe from this single sample.

APT41 Fingerprints Detected

Another important branch of the work done by security researchers like Kaspersky is looking into who is behind the malware that it discovers, what the purposes of the malware are, and what specific targets the malware is primed for.

Concerning MoonBounce, Kaspersky seems pretty certain that this malware is the product of APT41, “a threat actor that’s been widely reported to be Chinese-speaking.” In this case, the smoking gun is a “unique certificate” that the FBI has previously reported as signaling the use of APT41-owned infrastructure. APT41 has a history of supply chain attacks, so this is a continuation of a central thread of APT41’s nefarious operations.

Safety Measures

To help avoid falling victim to MoonBounce or similar UEFI malware, Kaspersky suggests a number of measures. It recommends users keep their UEFI firmware updated directly from the manufacturer, verify that BootGuard is enabled where available, and enable Trust Platform Modules. Last but not least, it recommends a security solution that scans system firmware for issues so measures can be taken when UEFI malware is detected.

cybersecurity sql injection

SQL Injection in WordPress core (CVE-2022–21661)

The clean_query function is called from get_sql_for_clause. Reading the code of the function will see that the job of this function is to create clauses for the condition in an SQL query, specifically its job will be to process the received data, to combine that data into a condition in the SQL query. and return it to the parent function. So we can control the return data of this function, which means we can control the SQL query and perform SQL Injection.

Analysis

In version 5.8.3, wordpress has fixed this error, comparing commit changes, you can see in the clean_query function that the $query[‘field’] check has been added before processing the $query[‘terms’] variable.

Going back to the clean_query function, without this change, by default the values in $query[‘terms’] will just be de-duplicated and then call $this->transform_query( $query, ‘term_taxonomy_id’ ) ;.

To avoid an if, $query[‘taxonomy’] needs to be empty or a value for is_taxonomy_hierarchical to return false.

In function transform_query will check $query[‘field’] = = $resulting_field, if true will return and do no further processing, so if $query[‘field’] variable is term_taxonomy_id then we can exit the function without changing the $query[‘terms’] variable value.(The comparison here is using = = and suffers from the loophole of Loose comparisons, in some cases this error can be used to create a conditional sentence at will).

After exiting the function, the code flow will return to the location where the clean_query function was called which is the get_sql_for_clause function, the value in the $query[‘terms’] variable will be used directly as the condition of the SQL query and lead to SQL Injection.

So in summary, for SQL Injection to occur, two conditions must be met: $query[‘field’] is term_taxonomy_id $query[‘taxonomy’] is empty or is_taxonomy_hierarchical($query[‘taxonomy’]) === false Flow results in the following error:

Exploit

Although this is an error in the core of wordpress, the way the wordpress core uses it does not trigger the error, so I have turned to the direction of finding errors in plugins and themes. The plugin/theme will call the WP_Query class when you want to query the DB, the way to recognize the error from the source code is when using WP_Query($data) and $data is something you can control.

For example, new WP_Query(json_decode($_POST[‘query_vars’])) then the payload will look like:

query_vars={“tax_query”:{“0”:{“field”:”term_taxonomy_id”,”terms”:[“”]}}} or query_vars={“tax_query”:{“0”:{“taxonomy “:”nav_menu”,”field”:true,”terms”:[“”]}}}

When building an environment for error testing, enabling the DEBUG function will make it possible to detect SQL Injection via error-based:

Conclude

In wordpress patch added $query[‘field’] check first, otherwise $query[‘terms’] will be converted to integer so SQLI can’t happen.

Due to the large number of wordpress plugins and themes, our team only focuses on looking for those with downloads > 100k (free version), in addition to paid plugins/themes or < 100k downloads, we no time to continue.

As a result, quite a few plugins and themes were found affected by the vulnerability (both authen and unauthen).

Hundreds of HP printer models vulnerable to remote code execution

The flaw of Windows 10 and 11 with 0-day, which gives administrator rights, again receives an unofficial patch

Unix rootkit steals ATM banking data

Ransomware variants used in 722 attacks in last 3 months of 2021

New CaddyWiper data wiping malware hits Ukrainian networks

Exploit Bypasses Existing Spectre-V2 Mitigations in Intel and Arm CPUs

100 Million Samsung Galaxy Phones Affected with Flawed Hardware Encryption Feature

Linux Root Vulnerability PwnKit Affects All Major Distros

MoonBounce Malware Hides In BIOS Chip, Persists After Drive Formats

Transport Technology Company the Only Logged Attack so Far

APT41 Fingerprints Detected

Safety Measures

SQL Injection in WordPress core (CVE-2022–21661)

Recent Posts

Categories