ENCS, the European Network for Cyber Security, and E.DSO, the European Distribution System Operators’ Association, announced the launch of security requirements for Distribution Automation (DA) of Remote Terminal Units (RTUs). The requirements provide European distribution system operators (DSOs) with a defined set of practical considerations for procuring secure RTUs and are a significant step forward to industry wide requirements.
A team of five security researchers found 55 vulnerabilities in Apple online services which they have analyzed for three months from July to September. The flaws — including 11 critical severity, 29 high severity, 13 medium severity, and 2 low severity vulnerabilities — could have allowed an attacker to take over a victim’s iCloud account and the sessions of Apple employees with the capability of accessing management tools and sensitive resources.
Microsoft found a new ransomware MalLocker.B, targeting Android users and lock their screen as part of a ransomware attack. This new ransomware family is known for being hosted on arbitrary websites and distributed on online forums using various social engineering baits, including masquerading as popular apps, video players or cracked games.
MDSec researcher David Middlehurst discovered that The Windows Update client (wuauclt) can be used by attackers to execute malicious code on Windows 10 systems by loading it from an arbitrary specially crafted DLL with specific command-line options.
Cybersecurity experts at CyberNews hijacked close to 28,000 unsecured printers worldwide and forced them to print out a guide on printer security. During their experiment they found over 800,000 printers that had network printing features enabled and were accessible over the internet.
Intel is warning of a rare critical-severity vulnerability affecting several of its motherboards, server systems and compute modules. The flaw could allow an unauthenticated, remote attacker to achieve escalated privileges. The recently patched flaw (CVE-2020-8708) ranks 9.6 out of 10 on the CVSS scale, making it critical.
The Chinese government has deployed an update to its national censorship tool, known as the Great Firewall (GFW), to block encrypted HTTPS traffic that uses TLS 1.3 with ESNI (Encrypted Server Name Indication) enabled.
FireEye is extending its private bug-bounty program to the public. The expanded program, like its predecessors, will be run in partnership with Bugcrowd. Anyone with credentials on the Bugcrowd platform can submit vulnerabilities to the program, which will pay a bounty of $50 to $2,500 depending on the bug’s severity and potential impact.
Troy Hunt, the security expert who handles the breach notification website Have I Been Pwned, announced that he is ready to make the code behind the site available in open source. According to him, the code will be turned over to the public for the betterment of the project and for the betterment of everyone who uses it.
Сybersecurity researchers have discovered critical vulnerabilities in industrial VPN implementations primarily used to provide remote access to operational technology (OT) networks that could allow hackers to overwrite data, execute malicious code, and compromise industrial control systems (ICS).
Japan is poised to start work on global quantum key distribution service and associated infrastructure. Toshiba as a lead contractor of this project aims to build a wide-area network that can accommodate over 100 quantum cryptographic devices and 10,000 users around the world.
NATO Cooperative Cyber Defence Centre of Excellence, NATO CCDCOE, published “Malware Reverse Engineering Handbook”. It gives an overview of how to analyze malware executables that are targeting the Windows platform. The authors are presenting the most common techniques used in malware investigation and also incident response and collaboration tools.
A coalition of dozens of top cybersecurity and Internet freedom groups, academics and experts sent a blistering letter to the sponsors of an anti-encryption Senate bill they say would make hundreds of millions of Americans more vulnerable to hacking. The bill, called the Lawful Access to Encrypted Data Act, is the harshest among a number of efforts to weaken encryption across the Justice Department and Congress.
Business giant SAP released a patch for a major vulnerability that impacts the vast majority of its customers. The bug, codenamed RECON, exposes companies to easy hacks, according to cloud security firm Onapsis. Onapsis says RECON allows malicious threat actors to create an SAP user account with maximum privileges on SAP applications exposed on the internet, granting attackers full control over the hacked companies’ SAP resources.
