Silensec Newsletter

Category: News

Top News

Facebook still collecting user information without user permission: 1.5 million email accounts this time round

Not a week goes without a new Facebook blunder.

Remember the most recent revelation of Facebook being caught asking users new to the social network platform for their email account passwords to verify their identity?

At the time, it was suspected that Facebook might be using access to users' email accounts to unauthorizedly and secretly gather a copy of their saved contacts.

Now it turns out that the collection of email contacts was true, Facebook finally admits that they "unintentionally" uploaded email contacts of 1.5 million new users on its servers, without their consent or knowledge.

Read more...

CVE-2019-0803 Windows flaw exploited to deliver PowerShell Backdoor

April 2019 Patch Tuesday security updates addressed a local privilege escalation flaw in Windows operating system, tracked as CVE-2019-0859 that had been exploited by threat actors to deliver a PowerShell backdoor.

The flaw could allow an attacker to escalate privileges on the target system, it exists due to the way the Win32k component handles objects in memory.

Read more...

Major Hacks of the Week

Fraudsters exploiting the notre dame tragedy

The Notre Dame Cathedral in Paris caught fire Monday evening, burning for nine hours before being completely extinguished by 9 a.m. Tuesday morning. This immense tragedy - shared online and in real time across social networks and traditional media outlets - has quickly accounted for millions of new tweets, posts, and shared photos in response.

Unfortunately, hidden among those posting out of genuine sympathy are bad actors looking to personally profit from charitable outreach efforts.

Read more...

Blue Cross of Idaho data breach, 5,600 customers affected.

Blue Cross of Idaho suffered a data breach that might have exposed the personal information of about 5,600 customers (out of a grand total of 560,000 health insurance customers), including their names, subscriber or enrollee numbers, dates of service, provider names, patient account numbers, claims number and payment data, and procedure codes.

According to officials, the portal of Blue Cross of Idaho was breached on March 21 in an attempt to fraudulently reroute financial transactions made by providers. The attackers were locked out and the portal was secured on March 22.

Read more...

Major Vulnerabilities Disclosed

Drupal releases core CMS updates to patch several vulnerabilities

Drupal, the popular open-source content management system, has released security updates to address multiple "moderately critical" vulnerabilities in Drupal Core that could allow remote attackers to compromise the security of hundreds of thousands of websites.

According to the advisories published today by the Drupal developers, all security vulnerabilities Drupal patched this month reside in third-party libraries that are included in Drupal 8.6, Drupal 8.5 or earlier and Drupal 7.

Read more...

 

Unofficial security patches have been released for two Oracle Java Runtime Environment (RE) flaws yet to be fixed discovered by Google Project Zero researcher. The company hasn’t yet released an official update to address the two vulnerabilities. Project Zero experts internally tracked them as 1779, 1780, 1781 and 1782 and rated them as “medium severity.”

Read more...

Legal, Regulatory and Corporate
Security and Beyond

Network DoS attack on PLCs can disrupt physical processes

A team of researchers has demonstrated an interesting type of denial-of-service (DoS) attack on programmable logic controllers (PLCs), where network flooding can lead to the disruption of the physical process controlled by the device.

A paper titled “You Snooze, You Lose: Measuring PLC Cycle Times Under Attacks” was published last year by a group of researchers from the German universities Hochschule Augsburg and Freie Universität Berlin.

The security hole, tracked as CVE-2019-10953, has been classified as “high severity” (CVSS score of 7.5) — industrial cybersecurity professionals have often warned that DoS attacks have a much higher impact in the case of industrial systems compared to IT systems.

Read more...

Payment card data stolen from AeroGrow website

AeroGrow International, the company that makes the popular AeroGarden smart countertop gardens, recently informed customers that their payment card information may have been compromised as a result of a cybersecurity incident impacting its website.

The company's investigation revealed that the malicious code had been present for more than four months, between October 29, 2018, and March 4, 2019.

Read more...

Security Awareness Tip

How to defend your organisation Against fileless malware attacks

The threat of fileless malware and its potential to harm organisations is rapidly growing. Fileless malware leverages what threat actors call "living off the land," meaning the malware uses code that already exists on the average Windows computer.

Given this growing threat, what can security teams do to help defend their organizations against fileless malware?

  1. Ensure Strong Companywide Security Hygiene
  2. Understand Your Access Rights and Privileges
  3. Combat Fileless Malware Threats With Careful Coordination

Read more...

Silensec Editorial Team

Editor: Dr. Almerindo Graziano
Dr. Graziano is the Silensec CEO. He holds an MSc in Electronic Engineering and a PhD in Mobile Computer Security, both from the University of Naples, Italy. Dr. Graziano has consulted in information security for private and government organisations across Europe, Africa and Middle East over the last 15 years. He is also a BSI-certified ISO27001 Lead Auditor trainer and auditor

Vice Editor: George Nicolaou (BSc, MSc)
George Nicolaou (BSc, MSc) leads the Silensec Malware Analysis Lab (MAL). He received his BSc in Computer Science and MSc in Advanced Computing Security from the University of Bath in UK, where he pursued research in malware and vulnerability analysis. For many years George has also been the Head of Research and Development department of the Astalavista Security Community. George is also a frequent speaker at security conferences around the world on advanced malware analysis, reverse engineering and exploit development techniques.

Digital Editor: Salome Omondi (B.Com)
Salome Omondi leads the Silensec Marketing Department. She holds a Bachelors of Commerce and Management from Strathmore University. Miss Omondi publishes the weekly Silensec Newsletter, keeping you up to date with the latest infosec news as well as improving information security awareness.


Please feel free to share this with interested parties via email, and social media. For a free subscription, please subscribe to our Mailing list and feed-image Feed .

For any questions please click on the following contact us link

Silensec HQ (Cyprus)

Silensec Africa

Silensec UK

CYBER RANGES Canada

Silensec Corp. (USA)

  • Address: 251 Little Falls Drive, Wilmington, New Castle County, DE 19808, USA
  • Email: contact@cyberranges.com
  • Tel.: 1-800-959-0163 (toll-free)
  • Web: www.cyberranges.com 

News Feed