Security News > 2021
The rollout of vaccines for the coronavirus has been a much-needed piece of good news following the devastating effects of the pandemic in 2020. A report published Thursday by fraud prevention company Bolster looks at the latest ways in which bad actors are capitalizing on the new vaccines.
Microsoft is rolling out a built-in password generator and a leaked credentials monitoring feature on Windows and macOS systems running the latest Microsoft Edge version. Microsoft Edge 88 now helps you improve the security of your online accounts with the password generator which suggests secure and strong passwords when updating existing credentials or signing up for new accounts.
Steal the Active Directory Federation Services token-signing certificate and use it to forge tokens for arbitrary users. This would allow the attacker to authenticate into a federated resource provider as any user, without the need for that user's password or their corresponding multi-factor authentication mechanism.
Amazon has awarded an $18,000 bug bounty for an exploit chain that could have allowed an attacker to take complete control of a Kindle e-reader simply by knowing the targeted user's email address. The first vulnerability in the exploit chain was related to the "Send to Kindle" feature, which allows users to send an e-book in MOBI format to their Kindle device via email as an attachment.
Some of the laptops distributed by the UK Department for Education to vulnerable students have been found to be infected with malware as reported by the BBC. The devices are given out for free by the government to support disadvantaged students unable to access remote education during the COVID-19 pandemic, including children and young people who have no digital devices, have only a smartphone, or share a single device with other family members. Infection is not widespread. However, as revealed by Bradford Schools teachers, some of the files found on the government-provided Windows laptops were infected with malware as discovered while preparing the devices for delivery to students.
Bugs in several messaging/video chat mobile apps allowed attackers to spy on targeted users's surroundings. The vulnerabilities - in Signal, Google Duo, Facebook Messenger, JioChat, and Mocha - could be triggered by simply placing a call to the target's device - no other action was needed.
The CHwapi hospital in Belgium is suffering from a cyberattack where threat actors claim to have encrypted 40 servers and 100 TB of data using Windows Bitlocker. On Sunday, CHwapi suffered an attack that caused the hospital to redirect patients to other hospitals and delay surgical procedures.
QNAP urges customers to secure their network-attached storage devices against an ongoing malware campaign that infects and exploits them to mine bitcoin without their knowledge. QNAP also published a knowledgebase article in November explaining that NAS devices with dovecat and dedpma running processes are compromised and running a Bitcoin miner malware.
Hackers hitting thousands of organizations worldwide in a massive phishing campaign forgot to protect their loot and let Google index the stolen passwords for public searches. The phishing campaign has been running for more than half a year and uses dozens of domains that host the phishing pages.
A relatively new crypto-mining malware that surfaced last year and infected thousands of Microsoft SQL Server databases has now been linked to a small software development company based in Iran. First documented by Chinese tech giant Tencent last September, MrbMiner was found to target internet-facing MSSQL servers with the goal of installing a cryptominer, which hijacks the processing power of the systems to mine Monero and funnel them into accounts controlled by the attackers.