Security News
Cryptocurrency wallet maker Ledger says someone slipped malicious code into one of its JavaScript libraries to steal more than half a million dollars from victims. The library in question is Connect Kit, which allows DApps - decentralized software applications - to connect to and use people's Ledger hardware wallets.
Learn about the different types of VPNs and when to use them. Find out which type of VPN suits your needs with this comprehensive guide.
The Molinière Underwater Sculpture Park has pieces that are colored in part with squid ink. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered.
Finally, law enforcement has had some confirmed actions this week, including arresting a money launderer linked to Hive ransomware and a Russian pleading guilty to running a crypto exchange used by ransomware gangs. December 4th 2023 Tipalti investigates claims of data stolen in ransomware attack.
Former Amazon security engineer Shakeeb Ahmed pleaded guilty this week to hacking and stealing over $12.3 million from two cryptocurrency exchanges in July 2022. The two affected companies are Nirvana Finance, a decentralized crypto exchange, and an unnamed exchange on the Solana blockchain platform that Ahmed hacked using his blockchain audit and smart contract reverse engineering skills.
The Kraft Heinz Company says its systems are all up and running as usual as it probes claims that some of its data was stolen by ransomware crooks. Kraft Heinz, which owns a ton of food and beverage brands including Oscar Meyer, Kool-Aid, Jell-O, Maxwell House, and Grey Poupon, declined to answer our specific questions about the Snatch extortion gang's boasts that it had compromised the manufacturer and obtained internal information.
Today, the U.S. Cybersecurity and Infrastructure Security Agency urged technology manufacturers to stop providing software and devices with default passwords. "This SbD Alert urges technology manufacturers to proactively eliminate the risk of default password exploitation," CISA said, by taking "Ownership of customer security outcomes" and building "Organizational structure and leadership to achieve these goals."
VoIP communications company 3CX warned customers today to disable SQL Database integrations because of risks posed by what it describes as a potential vulnerability. Although the security advisory released today lacks any specific information regarding the issue, it advises customers to take preventive measures by disabling their MongoDB, MsSQL, MySQL, and PostgreSQL database integrations.
The Hunters International ransomware gang claimed to be behind a cyberattack on the Fred Hutchinson Cancer Center that resulted in patients receiving personalized extortion threats. Fred Hutch is a Seattle-based cancer research and patient care and treatment center operating a network of more than ten clinical sites in the region.
Cloud storage provider Box is down in a 'critical' outage, preventing customers from accessing their files. The outage started at approximately 9 AM ET, with the company stating that it is a critical outage impacting logins, uploads, downloads, and API calls.