Krebs on Security

APRIL 26, 2019

But according to an in-depth analysis shared with KrebsOnSecurity by security researcher Paul Marrapese , iLnkP2P devices offer no authentication or encryption and can be easily enumerated, allowing potential attackers to establish a direct connection to these devices while bypassing any firewall restrictions.

IoT 261

IoT Manufacturing Passwords Computer and Electronics 261

Schneier on Security

NOVEMBER 15, 2019

In this work, we per-form a black-box timing analysis of TPM 2.0 Our analysis reveals that some of these devices feature secret-dependent execution times during signature generation based on elliptic curves. devices deployed on commodity computers.

Authentication 87

Authentication Manufacturing 87

Security Affairs

JUNE 12, 2022

The flaws impact products manufactured by LenelS2, a provider of advanced physical security solutions (i.e. The experts focused on Carrier’s LenelS2 access control panels, manufactured by HID Mercury. “Analysis begins at the lowest level of hardware. CVE-2022-31483 Authenticated arbitrary file write <=1.265 Base 9.1,

Access 87

Access Authentication Manufacturing Cybersecurity 87

Security Affairs

AUGUST 7, 2021

Threat actors are actively exploiting a critical authentication bypass issue (CVE-2021-20090 ) affecting home routers with Arcadyan firmware. Threat actors actively exploit a critical authentication bypass vulnerability, tracked as CVE-2021-20090 , impacting home routers with Arcadyan firmware to deploy a Mirai bot.

IoT 143

IoT Authentication Manufacturing Security 143

Security Affairs

JANUARY 4, 2023

Cybersecurity researcher Sam Curry and his colleagues discovered many vulnerabilities in the vehicles manufactured by tens of carmakers and services implemented by vehicle solutions providers. For instance, if a dealer wanted to access the dealer portal at a physical BMW dealership, they would have to authenticate through this portal.

Sales 98

Sales Access Manufacturing Authentication 98

Security Affairs

JULY 20, 2022

” The MiCODUS MV720 GPS Tracker is a popular vehicle GPS tracker manufactured in China, which is used by consumers for theft protection and location management, and by organizations for vehicle fleet management. The analysis of the sector usage on a global scale revealed significant differences by continent in the typical user profile.

Passwords 99

Passwords Manufacturing Military Authentication 99

Security Affairs

JULY 3, 2023

reads the advisory The vulnerability is a heap-based buffer overflow issue and according to the vendor it may have been exploited in a limited number of attacks aimed at government, manufacturing, and critical infrastructure sectors. The researcher describes the issue as a reachable pre-authentication that impacts every SSL VPN appliance.

Manufacturing 83

Manufacturing Authentication Risk Security 83

Security Affairs

MARCH 21, 2023

Cryptocurrency ATM manufacturers General Bytes suffered a security incident that resulted in the theft of $1.5M GENERAL BYTES is the world’s largest Bitcoin, Blockchain, and Cryptocurrency ATM manufacturer. The hackers were also able to turn off the two-factor authentication (2FA). worth of cryptocurrency. and 20230120.44.”

Manufacturing 79

Manufacturing Passwords Blockchain Cloud 79

Security Affairs

NOVEMBER 27, 2023

“Their analysis shows that the civil aviation sector of terrorist Russia is on the verge of collapse.” The state-sponsored hackers claimed to have stolen sensitive documents that contained proof of a crisis in Russia’s aviation industry. ” continues the announcement.

Military 110

Military Manufacturing Government Authentication 110

Security Affairs

APRIL 30, 2020

EventBot is a mobile banking trojan and infostealer that abuses Android’s accessibility features to steal user data from financial applications, read user SMS messages, and steal SMS messages to allow the malware to bypass two-factor authentication.” ” reads the analysis published by Cybereason.

Financial Services 107

Financial Services Libraries Encryption Authentication 107

Security Affairs

NOVEMBER 14, 2022

The malicious code was used in attacks targeting multiple sectors including the gaming industry, technology industry, and luxury car manufacturers. ” The analysis of the ksmdx sample reveals functions to perform scanning operations, software updates and cryptomining activities. ” reads the post published by Akamai.

Mining 91

Mining Manufacturing Authentication Security 91

Security Affairs

AUGUST 27, 2021

CVE-2021-33885 – Insufficient Verification of Data Authenticity (CVSS 9.7) CVE-2021-33882 – Missing Authentication for Critical Function (CVSS 8.2) An attacker doesn’t need any authentication to conduct the attack. The flaws were privately reported to the medical manufacturer on January 11 that addressed in B.

Authentication 104

Authentication Cybersecurity Manufacturing Access 104

Security Affairs

SEPTEMBER 23, 2021

” reads the analysis published by Guardicore. ”The most notable thing about these requests was that they requested the relative path of /Autodiscover/Autodiscover.xml with the Authorization header already populated with credentials in HTTP basic authentication.”

Authentication 86

Authentication Manufacturing Passwords Marketing 86

Security Affairs

JUNE 26, 2023

In the most recent campaign, the group targeted organizations in the communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education sectors. The Volt Typhoon group has been active since at least mid-2021 it carried out cyber operations against critical infrastructure.

Cleanup 79

Cleanup Libraries Access Manufacturing 79

Security Affairs

JULY 31, 2019

A few hours ago, I have written about an interesting analysis of the possible hack of avionics systems, not DHS warns of cyber attacks against small airplanes. Manufacturers of aircraft should review implementation of CAN bus networks to compensate for the physical attack vector.” ” concludes the alert. Pierluigi Paganini.

Computer and Electronics 76

Computer and Electronics Manufacturing Access Authentication 76

Security Affairs

MAY 8, 2023

Micro-Star International AKA MSI designs, manufactures, and sells motherboards and graphics cards for customers in the United States, Canada, and internationally. The authenticity of the leaked private key was confirmed by Alex Matrosov, founder of firmware security firm Binarly. MSI is headquartered in Taipei, Taiwan.

Data breaches 80

Data breaches Ransomware Manufacturing Authentication 80

Krebs on Security

APRIL 8, 2019

Last week, a similar analysis led to the takedown of 74 cybercrime groups operating openly on Facebook with more than 385,000 members. Facebook is making users searchable by marketers and others via phone number , even when that phone number was only provided solely for the purposes of multi-factor authentication.

Passwords 198

Passwords Privacy Manufacturing Phishing 198

IBM Big Data Hub

JUNE 14, 2023

Smart manufacturing (SM)—the use of advanced, highly integrated technologies in manufacturing processes—is revolutionizing how companies operate. Smart manufacturing, as part of the digital transformation of Industry 4.0 , deploys a combination of emerging technologies and diagnostic tools (e.g.,

Manufacturing 75

Manufacturing Blockchain Analytics Artificial Intelligence 75

Security Affairs

AUGUST 13, 2019

Security expert discovered multiple flaws in 4G routers manufactured by several companies, some of them could allow attackers to take over the devices. G Richter, a security researcher at Pen Test Partners discovered multiple vulnerabilities 4G routers manufactured by different vendors. high severity CVSS v3. 0 base score) .

Risk 93

Risk Manufacturing Passwords Authentication 93

eSecurity Planet

AUGUST 14, 2023

Cybersecurity and Infrastructure Security Agency (CISA) recently published an analysis of the top 12 vulnerabilities exploited in 2022. Tenable’s CEO accused Microsoft of “grossly irresponsible, if not blatantly negligent” responses to vulnerability disclosures that affect popular and important tools such as Azure.

Cybersecurity 96

Cybersecurity Access IoT Manufacturing 96

Security Affairs

FEBRUARY 18, 2020

Experts at firmware security firm Eclypsium have discovered that many peripheral device manufacturers have not implemented security checks to prevent the installation of firmware from an untrusted source. This means that these components have no way to validate that the firmware loaded by the device is authentic and should be trusted.

Authentication 118

Authentication Manufacturing Security Ransomware 118

Security Affairs

SEPTEMBER 4, 2019

The issue affects several modern Android-based phones, including devices manufactured by Samsung, Huawei, LG and Sony. ” reads the analysis published by CheckPoint. This is possible because there it isn’t implemented any authenticity check. Authenticated with IMSI for Huawei, LG or Sony devices.

Phishing 79

Phishing Authentication Manufacturing Compliance 79

Security Affairs

NOVEMBER 23, 2019

VNC is widely adopted in industrial environments and many manufacturers of industrial control systems (ICS) leverage on VNC to implement remote control for their products. ” reads the analysis published by Kaspersky. Kaspersky has analyzed the popular open-source VNC systems LibVNC, UltraVNC, TightVNC, and TurboVNC.

Manufacturing 113

Manufacturing Risk Authentication Passwords 113

IBM Big Data Hub

FEBRUARY 13, 2024

Such analysis and decision-making are often optimized with the help of various technologies, including artificial intelligence tools and data analytics platforms. The immutable ledger of blockchain authenticates a product’s origin and journey through the value chain.

Blockchain 84

Blockchain Artificial Intelligence Risk Manufacturing 84

Security Affairs

AUGUST 24, 2021

“Supported by IoT Inspector ’s firmware analysis platform, we performed vulnerability research on those binaries and identified more than a dozen vulnerabilities – ranging from command injection to memory corruption affecting UPnP, HTTP (management web interface), and a custom network service from Realtek.”

IoT 122

IoT Manufacturing Authentication Security 122

IBM Big Data Hub

FEBRUARY 19, 2024

Integrated supply chain analytics software, such as IBM Planning Analytics , connect complex data sets for more insightful analytics and scenario analysis that can help avoid demand-and-supply mismatches or fulfillment delays.

Blockchain 86

Blockchain Analytics Artificial Intelligence Marketing 86

Security Affairs

AUGUST 27, 2021

Researchers at industrial and IoT cybersecurity firm Nozomi Networks have discovered a critical flaw affecting a video surveillance product made by Annke, a popular manufacturer of surveillance systems and solutions. At the end of the process, the firmware was rewritten to the device’s memory. The mainboard of the Annke N48PBB.

Cybersecurity 99

Cybersecurity IoT Access Manufacturing 99

IBM Big Data Hub

FEBRUARY 14, 2024

Voice-based queries use natural language processing (NLP) and sentiment analysis for speech recognition so their conversations can begin immediately. Automotive With applications of AI, automotive manufacturers are able to more effectively predict and adjust production to respond to changes in supply and demand.

Artificial Intelligence 86

Artificial Intelligence Retail Unstructured data Insurance 86

Security Affairs

JULY 28, 2020

The malicious code specifically targets QNAP NAS devices manufactured by Taiwanese company QNAP, it already infected over 62,000 QNAP NAS devices. CGI password logger This installs a fake version of the device admin login page, logging successful authentications and passing them to the legitimate login page. ” reads the alert.

Manufacturing 104

Manufacturing Cybersecurity Encryption Authentication 104

Security Affairs

OCTOBER 1, 2018

. “Just like the regular dnschanger , this campaign attempts to guess the password on the router’s web authentication page or bypass the authentication through the dnscfg. ” reads the analysis published by the experts. Further details, including IoCs are reported in the analysis published by Qihoo 360 NetLab.

Phishing 77

Phishing Authentication Passwords IoT 77

Security Affairs

MARCH 26, 2021

The researchers shared a detailed analysis on Security Affairs , they explained that once the malware has infected a Windows machine, it overwrites the existing Master Boot Record, with a custom MBR and encrypts the hard drive using the DiskCryptor tool. Use multifactor authentication where possible.

Ransomware 144

Ransomware Encryption File names Passwords 144

Security Affairs

JULY 10, 2020

The security duo, composed of Pierre Kim and Alexandre Torres, disclosed seven vulnerabilities in the firmware of FTTH OLT devices manufactured by C-Data. ” reads the analysis published by the experts. The most severe issue is the presence of Telnet backdoor accounts hardcoded in the firmware. ” continues the experts.

Manufacturing 97

Manufacturing Access Encryption Authentication 97

Security Affairs

SEPTEMBER 23, 2020

Since March, the attackers have been trying to conduct multistage attacks on large corporate networks of medical labs, banks, manufacturers, and software developers in Russia. As part of post-exploitation activities, OldGremlin used Cobalt Strike to move laterally and obtain authentication data of domain administrator. About Group-IB.

Ransomware 100

Ransomware Phishing Encryption Authentication 100

Security Affairs

JANUARY 7, 2019

The hot tubs could be remotely controlled by an app, dubbed Balboa Water App, that lack of authentication mechanisms. We bought a few spares for research” reads the analysis published by Pen Test Partners. Security experts at Pen Test Partners have discovered thousands of connected hot tubs vulnerable to remote cyber attacks.

IoT 105

IoT Manufacturing Authentication Passwords 105

Security Affairs

JUNE 22, 2019

This attack takes advantage of the way open ADB ports don’t have authentication by default, similar to the Satori botnet variant we previously reported.” ” reads the analysis published by Trend Micro. ” continues the analysis. The script for a. By adding the additional record “0.0.0.0

Mining 66

Mining Honeypots Authentication Communications 66

Security Affairs

AUGUST 2, 2020

reads the alert. “Analysis shows a significant number of infected devices. The malicious code specifically targets QNAP NAS devices manufactured by Taiwanese company QNAP, it already infected over 62,000 QNAP NAS devices. This alert focuses on the second campaign as it is the most recent threat.”

Passwords 99

Passwords Manufacturing Encryption Authentication 99

Security Affairs

OCTOBER 21, 2019

” reads the analysis published by ESET researcher Mathieu Tartare. PortReus e was used by the Winnti cyberespionage group to target a high-profile Asian mobile software and hardware manufacturer. are related to authentication and event logging.” ” continues the analysis.

Passwords 45

Passwords Authentication Manufacturing Communications 45