Japanese electrical engineering company Yokogawa has released firmware updates for its STARDOM controllers to address a critical vulnerability that can be exploited remotely to take control of the device.
http://feedproxy.google.com/~r/Securityweek/~3/4Z1OndHMaXE/hardcoded-credentials-expose-yokogawa-controllers-attacks
Eventbrite-owned ticket distribution service Ticketfly shut down its website on Thursday after it was defaced by a hacker who calls himself “IsHaKdZ.”
http://feedproxy.google.com/~r/Securityweek/~3/6AWjyaOLrfE/personal-data-compromised-ticketfly-hack
HackerOne announced on Wednesday the results of “Hack the DTS,” the fifth bug bounty program run by the U.S. Department of Defense (DOD).
http://feedproxy.google.com/~r/Securityweek/~3/gZQBot5oGJs/tens-vulnerabilities-found-pentagon-travel-management-system
Earlier this year, a security researcher discovered that it was possible to bypass Google’s reCAPTCHA via HTTP parameter pollution.
http://feedproxy.google.com/~r/Securityweek/~3/qBNr7DuBJ7w/http-parameter-pollution-leads-recaptcha-bypass
Google this week released Chrome 67 to the stable channel to provide various improvements, including patches for 34 vulnerabilities.
http://feedproxy.google.com/~r/Securityweek/~3/8GYIsPBhsls/chrome-67-patches-34-vulnerabilities
Vulcan Cyber is the latest Israel-based cybersecurity startup to emerge from stealth mode. The company, whose main product is a vulnerability remediation platform, announced on Wednesday that it raised $4 million in seed funding.
http://feedproxy.google.com/~r/Securityweek/~3/zQjyFvUbtjA/vulcan-cyber-emerges-stealth-4-million-seed-round
Updates released on Tuesday for the Git version control system patch two security flaws, including a serious vulnerability that can be exploited for remote code execution using specially crafted repositories.
http://feedproxy.google.com/~r/Securityweek/~3/0irDZnHrkgw/remote-code-execution-vulnerability-patched-git
Three vulnerabilities discovered by a researcher in IBM’s QRadar product can be chained for an exploit that allows a remote and unauthenticated attacker to bypass authentication and execute arbitrary commands with root privileges.
http://feedproxy.google.com/~r/Securityweek/~3/ir-_2xhHtfU/flaws-ibm-qradar-allow-remote-command-execution
(credit: Linksys)
The FBI is advising users of consumer-grade routers and network-attached storage devices to reboot them as soon as possible to counter Russian-engineered malware that has infected hundreds of thousands devices.
Researchers from Cisco’s Talos security team first disclosed the existence of the malware on Wednesday. The detailed report said the malware infected more than 500,000 devices made by Linksys, Mikrotik, Netgear, QNAP, and TP-Link. Known as VPNFilter, the malware allowed attackers to collect communications, launch attacks on others, and permanently destroy the devices with a single command. The report said the malware was developed by hackers working for an advanced nation, possibly Russia, and advised users of affected router models to perform a factory reset, or at a minimum to reboot.
Later in the day, The Daily Beast reported that VPNFilter was indeed developed by a Russian hacking group, one known by a variety of names, including Sofacy, Fancy Bear, APT 28, and Pawn Storm. The Daily Beast also said the FBI had seized an Internet domain VPNFilter used as a backup means to deliver later stages of the malware to devices that were already infected with the initial stage 1. The seizure meant that the primary and secondary means to deliver stages 2 and 3 had been dismantled, leaving only a third fallback, which relied on attackers sending special packets to each infected device.
Read 7 remaining paragraphs | Comments
https://arstechnica.com/?p=1314777
Schneider Electric this week announced that an update for its EcoStruxure Machine Expert product patches a high severity vulnerability that can be exploited remotely to obtain sensitive data.
http://feedproxy.google.com/~r/Securityweek/~3/2kAYORjOcss/flaw-schneider-plc-programming-tool-allows-remote-attacks