Security News > 2020 > June
To explain: SSRF is a way that someone with possibly very limited access to your network can send a legitimate looking query to one of your servers. If you can trick the vulnerable server into calling outside its own network by sending it an otherwise legimitate request, you may be able to capture server data such as secret authentication tokens or special HTTP headers that are usually only visible if you are already inside the network.
On Wednesday, a 33-year-old Philadelphia woman was charged with allegedly torching those cars after the FBI tracked her down via a slew of online clues that shows how findable we all are, be we criminals or somebody to be marketed at or tracked. Namely: her protest T-shirt, which the FBI matched to one sold on the Etsy online marketplace; social media handles; a tattoo of a stylized peace sign on her right forearm; and a Vimeo video that shows a woman matching her description who removed a flaming piece of wooden police barricade from one car and shoved it through the window of another.
UPDATED. Researchers this week said they discovered an unpatched, zero-day vulnerability in firmware for Netgear routers that put 79 device models at risk for full takeover, they said. The flaw, a memory-safety issue present in the firmware's httpd web server, allows attackers to bypass authentication on affected installations of Netgear routers, according to two separate reports: One on the Zero Day Initiative by a researcher called "d4rkn3ss" from the Vietnam Posts and Telecommunications Group; and a separate blog post by Adam Nichols of cybersecurity firm Grimm.
A high-severity vulnerability patched recently by IBM in its Maximo asset management solution makes it easier for hackers to move around in enterprise networks, cybersecurity firm Positive Technologies warned on Thursday. The security hole, tracked as CVE-2020-4529, has been described as a server-side request forgery issue that allows an authenticated attacker to send unauthorized requests from a system, which IBM says can facilitate other attacks.
The alleged hacker who breached the human resource databases of University of Pittsburgh Medical Center in 2014 was arrested this week in Detroit, the Department of Justice announced. The man, Justin Sean Johnson, aka "TDS" and "DS," 29, was indicted on charges of conspiracy, wire fraud and aggravated identity and is believed to have sold exfiltrated personally identifiable information and W-2 information on the dark web.
Citizen Lab has a new report on Dark Basin, a large hacking-for-hire company in India. Dark Basin is a hack-for-hire group that has targeted thousands of individuals and hundreds of institutions on six continents.
Targeted attacks delivering a new piece of malware leveraged an exploit previously associated with the Russian-linked Turla hacking group, Palo Alto Networks reveals. Believed to be operating on behalf of the Russian Federal Security Service and also known as Waterbug, Venomous Bear and KRYPTON, Turla was the first threat actor known to have abused a third-party device driver to disable Driver Signature Enforcement, a security feature introduced in Windows Vista to prevent the loading of unsigned drivers.
Drupal's security team has fixed three vulnerabilities in the popular content management system's core, one of which could be exploited to achieve remote code execution. Drupal is a free and open-source web content management system, and over a million sites run on various versions of it.
Security researchers have discovered a handful of game-changing vulnerabilities that spell trouble for dozens of connected device vendors and their customers. On Tuesday this week security company JSOF unveiled 19 CVEs - four of them critical remote code execution flaws - in a low-level networking software library that render millions of devices vulnerable.
In 1965, Gordon Moore published a short informal paper, Cramming more components onto integrated circuits. Based on not much more but these few data points and his knowledge of silicon chip development - he was head of R&D at Fairchild Semiconductors, the company that was to seed Silicon Valley - he said that for the next decade, component counts by area could double every year.