Security News
South Korea's 'Korea Atomic Energy Research Institute' disclosed yesterday that their internal networks were hacked last month by North Korean threat actors using a VPN vulnerability. The Korea Atomic Energy Research Institute, or KAERI, is the governement-sponsored institute for the research and application of nuclear power in South Korea.
Scammers are sending fake replacement devices to Ledger customers exposed in a recent data breach that are used to steal cryptocurrency wallets. In a post on Reddit, a Ledger user shared a devious scam after receiving what looks like a Ledger Nano X device in the mail.
Financial software company Intuit has notified TurboTax customers that some of their personal and financial information was accessed by attackers following what looks like a series of account takeover attacks. "We have more than 100 million customers and see billions of transactions per year with ATO notifications going to less than.0003% of customers and some of those confirmed by the customer after the fact as their activity," Rick Heineman, Intuit Corporate Communications Vice President, told BleepingComputer.
New data from the February hack of CD Projekt Red, the videogame-development company behind Cyberpunk 2077 and the Witcher series, is circulating online. It added that it's in the process of clarifying just which data is being circulated, "Though we believe it may include current/former employee and contractor details in addition to data related to our games. Furthermore, we cannot confirm whether or not the data involved may have been manipulated or tampered with following the breach."
Chinese-backed threat actors breached New York City's Metropolitan Transportation Authority network in April using a Pulse Secure zero-day. MTA mitigated the vulnerability on April 21, one day after Pulse Secure issued an advisory, and CISA published an alert on the Pulse Secure zero-day exploited in the attack.
Apple's AirTag product has been hacked twice since its recent launch, in a pair of fascinating and informative stories that give you some great insights into how cybersecurity researchers think. The good news is that you don't need to ditch your AirTags if you already splashed out and bought some - these "Hacks" don't put your privacy at risk - and we explain why.
Report the hack to your customers and business stakeholders. The disaster recovery plan outlines the steps needed to operate the business with degraded systems or missing business-critical data.
The United States Department of Justice this week announced the sentencing of a Russian national for his role in a group that attempted to obtain $1.5 million in tax refunds from the Department of the Treasury. According to court documents, between June 2014 and November 2016, Bogdanov and co-conspirators hacked into the computers of private tax preparation firms in the US and stole personally identifiable information, including Social Security numbers and dates of birth.
The owner of the AirTag that called home can decrypt the location in the Find My message, but has no idea which relay device passed the message on. By limiting the length of the hidden message and repeating the same Bluetooth "Public keys" over and over again, Bräunlein's hope was that eventually a complete copy of all the data packets containing the hidden data might make it to Apple.
Apple recently announced a tracking device that it calls the AirTag, a new competitor in the "Smart label" product category. Products like the AirTag also announce themselves with regular Bluetooth beaconing transmissions, just like your phone does when it's in discoverable mode.