Security News
![MavenGate Attack Could Let Hackers Hijack Java and Android via Abandoned Libraries](/static/build/img/news/mavengate-attack-could-let-hackers-hijack-java-and-android-via-abandoned-libraries-small.jpg)
Several public and popular libraries abandoned but still used in Java and Android applications have been found susceptible to a new software supply chain attack method called MavenGate. "Access to...
![EFF adds Street Surveillance Hub so Americans can check who's checking on them](/static/build/img/news/eff-adds-street-surveillance-hub-so-americans-can-check-who-s-checking-on-them-small.jpg)
For a country that prides itself on being free, America does seem to have an awful lot of spying going on, as the new Street Surveillance Hub from the Electronic Frontier Foundation shows. The Hub contains detailed breakdowns of the type of surveillance systems used, from bodycams to biometrics, predictive policing software to gunshot detection microphones and drone-equipped law enforcement.
![loanDepot cyberattack causes data breach for 16.6 million people](/static/build/img/news/loandepot-cyberattack-causes-data-breach-for-16-6-million-people-small.jpg)
Mortgage lender loanDepot says that approximately 16.6 million people had their personal information stolen in a ransomware attack disclosed earlier this month. Today, after confirming that millions of people had their data stolen, the company said it would notify individuals impacted by this data breach, providing them with free credit monitoring and identity protection services.
![loanDepot says ransomware gang stole data of 16.6 million people](/static/build/img/news/loandepot-says-ransomware-gang-stole-data-of-16-6-million-people-small.jpg)
Mortgage lender loanDepot says that approximately 16.6 million people had their personal information stolen in a ransomware attack disclosed earlier this month. Today, after confirming that millions of people had their data stolen, the company said it would notify individuals impacted by this data breach, providing them with free credit monitoring and identity protection services.
![Ivanti and Juniper Networks accused of bending the rules with CVE assignments](/static/build/img/news/ivanti-and-juniper-networks-accused-of-bending-the-rules-with-cve-assignments-small.jpg)
The networking giant was accused of patching security flaws without disclosing them as standalone vulnerabilities, while Ivanti was called out for seemingly bundling multiple vulnerabilities under a single registered Common Vulnerabilities and Exposures ID. Security vulnerabilities that are serious enough to require patching to avoid problems for organizations generally need to be registered with a CVE Numbering Authority and added to the CVE program. Once registered with a CVE ID, vulnerabilities can be more easily identified and tracked by organizations, making their patching routine more easily manageable.
![Trezor support site breach exposes personal data of 66,000 customers](/static/build/img/news/trezor-support-site-breach-exposes-personal-data-of-66000-customers-small.jpg)
Trezor issued a security alert after identifying a data breach that occurred on January 17 due to unauthorized access to their third-party support ticketing portal. A subset of 66,000 users who have interacted with Trezor Support since December 2021 may have had their names or usernames, and email addresses exposed to an unauthorized party.
![Subway's data torpedoed by LockBit, ransomware gang claims](/static/build/img/news/subway-s-data-torpedoed-by-lockbit-ransomware-gang-claims-small.jpg)
The LockBit ransomware gang is claiming an attack on submarine sandwich slinger Subway, alleging it has made off with a platter of data.LockBit's post to its leak blog, published on January 21, suggests one of its affiliates breached Subway's database, stealing sensitive data on "All financial aspects" of the fast food franchise.
![Hackers start exploiting critical Atlassian Confluence RCE flaw](/static/build/img/news/hackers-start-exploiting-critical-atlassian-confluence-rce-flaw-small.jpg)
Security researchers are observing exploitation attempts for the CVE-2023-22527 remote code execution flaw vulnerability that affects outdated versions of Atlassian Confluence servers. Atlassian disclosed the security issue last week and noted that it impacts only Confluence versions released before December 5, 2023, along with some out-of-support releases.
![Attackers can steal NTLM password hashes via calendar invites](/static/build/img/news/attackers-can-steal-ntlm-password-hashes-via-calendar-invites-small.jpg)
A recently patched vulnerability in Microsoft Outlook that can be used by attackers to steal users' NTLM v2 hashes can be exploited by adding two headers to an email carrying a specially crafted file, security researcher Dolev Taler has shared on Friday. He and his colleagues from Varonis Threat Labs have revealed two additional ways attackers can get users' NTLM v2 hashes and use them for offline brute-force or authentication relay attacks.
![AI Bots on X (Twitter)](/static/build/img/news/alt/mac-stats-small.jpg)
You can find them by searching for OpenAI chatbot warning messages, like: "I'm sorry, I cannot provide a response as it goes against OpenAI's use case policy." I hadn't thought about this before: identifying bots by searching for distinctive bot phrases.