Security News > 2020
Vulnerabilities in two popular WordPress plugins, ThemeREX Addons and ThemeGrill Demo Importer, are being exploited to hack websites. Just days after the existence of the flaw was made public, ThemeGrill customers started reporting that the security hole had apparently been exploited to hack their websites.
Networking software giant Citrix Systems says malicious hackers were inside its networks for five months between 2018 and 2019, making off with personal and financial data on company employees, contractors, interns, job candidates and their dependents. The FBI told Citrix the hackers likely got in using a technique called "Password spraying," a relatively crude but remarkably effective attack that attempts to access a large number of employee accounts using just a handful of common passwords.
Hamas has been caught taking a classic "Catfish" approach, to tempt Israeli soldiers into installing spyware on their phones. The IDF told the Times of Israel that the idea was to catch male targets' attention, strike up a rapport and eventually lure the soldiers into installing a special app on their phones.
Google this week announced that users in 10 countries can now take advantage of the hardware based two-factor authentication functionality offered by the Titan Security Keys. These security keys provide additional security for users at higher risk, including IT administrators, executives, politicians, and activists, as they are often the intended victims of targeted attacks.
Over 20,000 web servers have been compromised via trojanized WordPress themes to deliver malware through malicious ads, Prevailion researchers have discovered. They are taking advantage of the widespread use of the WordPress content management system, an increased demand for premium themes and victims' lack of security awareness to get them to unknowingly compromise their own web servers.
In the second global insider data breach survey, IT leaders found that 78% think employees have put data at risk accidentally in the past 12 months and 75% believe employees put data at risk intentionally. At the same time, 58% of managers said employee reporting is more likely than any breach detection system to alert them to an insider data breach.
Washington has the right to block US federal agencies from buying products by Huawei on cybersecurity grounds, a judge has ruled, dismissing the Chinese telecom giant's legal challenge to a purchase ban. Huawei filed the suit nearly a year ago, claiming that Congress had failed to provide evidence to support a law that stopped government agencies from buying its equipment, services, or working with third parties that are Huawei customers.
Tax season is upon us and cybercriminals have taken notice, unleashing a tidal wave of attacks targeting every US citizen and tax prep company. "This information is also valuable and could be used or resold for identity fraud purposes. Additionally, the employees legitimate tax documents can also be found here. This could be used by the attackers to file fraudulent tax returns on the employee's behalf to direct their tax returns to the attacker's coffers." Threat researchers at Zix-AppRiver released a report last week detailing their efforts monitoring and actively battling a series of Business Email Compromise attacks on CPAs and law firms over the past month.
Amazon's Ring is mandating the use of two-factor authentication for all users, a move designed to help stop creepy takeovers of the web-connected home security cameras. Ring users have had the option to use two-factor authentication, but now it will be mandatory, writes Ring President Leila Rouhi in a blog post.
One site registered in Russia offers a coronavirus cure for $300. Check Point Research found a spike in coronavirus domain name registrations earlier this month as hackers increase malicious activity around the illness. Check Point listed "Vaccinecovid-19.com" as an example of a malicious site.