Security News > 2023 > September
Phishing attacks typically take the form of seemingly legitimate communication, often via email, but can also occur through text messages, phone calls, or social media messages. In this Help Net Security round-up, we bring insights from cybersecurity experts who share their knowledge about phishing attacks and the evolving strategies employed by cybercriminals to deceive and compromise unsuspecting victims.
There are over 12,000 professionals in the CIS Benchmarks communities. CIS is always looking for volunteers to join and help develop the CIS Benchmarks.
The Coffee Meets Bagel dating platform confirms last week's outage was caused by hackers breaching the company's systems and deleting company data. Last week, Coffee Meets Bagel suffered a worldwide outage, with users upset that they could not coordinate planned dates or continue communicating with their matches.
Qualys's method for ranking these security holes took into account several factors, we're told, including the number of attackers known to exploit the vulnerability. Finally, more mature exploit code and inclusion in the US government's CISA list of top-exploited vulnerabilities will also boost a bug's rank on Qualys' index.
An Atlas VPN zero-day vulnerability affecting the Linux client leaks a user's real IP address simply by visiting a website. Atlas VPN is a VPN product that offers a cost-effective solution based on WireGuard and supports all major operating systems.
Online cryptocurrency casino Stake.com announced that its ETH/BSC hot wallets had been compromised to perform unauthorized transactions, with over $40 million in crypto reportedly stolen. The threat group was linked to the theft of $35 million from Atomic Wallet in June, $60 million from Alphapo in July, and another $37.3 million from CoinsPaid also in July.
The power of the EU's Digital Services Act to actually police the world's very large online platforms has been tested in a new study focused on Russian social media disinformation. The independent study of the DSA's risk management framework published by the EU's executive arm, the European Commission, concluded that commitments by social media platforms to mitigate the reach and influence of global online disinformation campaigns have been generally unsuccessful.
Atlas VPN has confirmed the existence of a zero-day vulnerability that may allow website owners to discover Linux users' real IP address. Details about this zero-day vulnerability as well as exploit code have been publicly released on Reddit several days ago by the person who discovered the flaw and purportedly first tried to privately share the discovery with Atlas VPN. About the Atlas VPN zero-day vulnerability.
The Chaes malware has returned as a new, more advanced variant that includes a custom implementation of the Google DevTools protocol for direct access to the victim's browser functions, allowing it to steal data using WebSockets. A new feature that stands out is Chaes' use of the Chrome DevTools Protocol to steal data from the web browser, including the real-time modification of web pages, execution of JavaScript code, debugging, network request management, memory management, cookie and cache management, and more.
Three critical-severity remote code execution vulnerabilities impact ASUS RT-AX55, RT-AX56U V2, and RT-AC86U routers, potentially allowing threat actors to hijack devices if security updates are not installed.The flaws, which all have a CVSS v3.1 score of 9.8 out of 10.0, are format string vulnerabilities that can be exploited remotely and without authentication, potentially allowing remote code execution, service interruptions, and performing arbitrary operations on the device.