👉 What are the latest cybersecurity alerts, incidents, and news?
Mitsubishi Electric, Gogs, Europol, OpenStack, Sonicwall, Ethereum, TotalEnergies, Roll20, Acadian Ambulance Service, Apex North Carolina, California AI Safety Bill, EU cybersecurity, Apple VPN apps, IoT exploitation, United Nations, DFINITY Foundation,Blockchain, MSMEs, Universal Trusted Credentials, Cross-border Trade Financing, Internet Computer Blockchain, Digital Credentials, Cambodia Pilot, Sustainable Development, Economic Empowerment, Digital Trust, Data Privacy, Cloud Security
Listen to the full podcast
Mitsubishi Electric’s GENESIS64 and MC Works64 software have been identified with multiple critical vulnerabilities, including unrestricted resource allocation, improper digital signature validation, and insufficient control over file search paths. These issues, cataloged under CVE-2023-2650, CVE-2023-4807, CVE-2024-1182, CVE-2024-1573, and CVE-2024-1574, pose significant security risks to industrial control systems.
Recent findings by cybersecurity researchers reveal critical vulnerabilities in Gogs, a widely-used open-source code hosting system, posing severe risks to server security and the integrity of hosted source code. These vulnerabilities include an exploitable Argument Injection in Gogs’ built-in SSH server, allowing authenticated attackers to execute commands and potentially steal or manipulate sensitive code.
Europol’s latest position paper addresses significant challenges posed by privacy enhancing technologies (PET) in home routing for lawful interception. The report underscores how home routing, which directs international travelers’ communications through their home network rather than local networks abroad, hampers law enforcement’s ability to intercept communication data under judicial orders.
A critical security vulnerability, identified as CVE-2024-32498, has been found in OpenStack, a widely used open-source cloud platform. This flaw allows authenticated attackers to gain unauthorized access to arbitrary files on the host system, potentially exposing sensitive data like user information and system configurations. The vulnerability affects OpenStack’s Nova and Glance components, crucial for managing virtual disk images.
Beware of malicious PDFs posing as Microsoft 2FA security updates, utilizing deceptive QR codes to redirect users to phishing sites. These tactics exploit users’ trust in familiar services, leading to potential disclosure of sensitive credentials. The phishing pages closely mimic Microsoft’s authentication interface, enhancing the effectiveness of these scams.
In a recent security breach, Ethereum’s mailing list provider was compromised, leading to over 35,000 recipients receiving a phishing email. The email, sent from a spoofed address, tempted users with a fraudulent investment opportunity tied to a supposed collaboration with Lido DAO, promising a high annual percentage yield (APY) on staked Ethereum. Clicking the link in the email directed users to a deceptive website where entering wallet credentials and authorizing transactions would drain their cryptocurrency holdings to the attacker.
TotalEnergies has reported a significant cyberattack that compromised the personal data of 210,715 customers, highlighting vulnerabilities in the energy sector’s digital infrastructure. Unauthorized access to a sales management system exposed sensitive customer information, prompting the company to swiftly address the breach in collaboration with law enforcement and regulatory authorities.
Roll20, a prominent online platform for role-playing games, disclosed a security breach on July 3, revealing unauthorized access to its administrative website. The incident exposed personally identifiable information (PII) of users, including names, email addresses, IP addresses, and partial bank data (last four digits of credit cards). While passwords were protected, Roll20 reassured users that payment information is stored with external processors.
Acadian Ambulance Service has confirmed that it fell victim to a recent cyberattack, which disrupted certain computer systems. Despite this incident, the company assured the public that patient care and dispatching capabilities remain unaffected. Details regarding the nature and timing of the attack were not disclosed, with the company stating that an investigation by a third-party specialist is underway to assess the network security breach.
Apex, North Carolina, faced a significant cybersecurity incident disrupting town systems, attributed to an attempted ransomware attack detected earlier this week. Services such as utility billing and building permits were temporarily offline as the town initiated investigations with support from the North Carolina Joint Cybersecurity Task Force and federal law enforcement.
📢 Cyber News
California lawmakers have moved forward with groundbreaking legislation requiring artificial intelligence (AI) companies to test their systems and implement safety measures to mitigate potential risks, such as threats to the electric grid or misuse in developing chemical weapons. Spearheaded by Democratic state Sen. Scott Wiener, the bill targets AI systems exceeding $100 million in computing power, aiming to prevent catastrophic harms from powerful AI models.
The European Commission has launched funding calls totaling over €210 million through the Digital Europe Programme (DEP). This initiative aims to bolster cybersecurity measures across the EU, allocating €35 million to protect critical infrastructures and industrial installations, €12.8 million for expanding Cybersecurity Operation Centres (SOCs), and €35 million for deploying advanced cybersecurity technologies.
Apple has recently removed several VPN applications from its App Store in compliance with demands from Russia’s federal media watchdog, Roskomnadzor. This action, affecting apps like ProtonVPN, Red Shield VPN, NordVPN, and Le VPN, follows requests citing content deemed illegal in Russia. VPNs are widely used in Russia to bypass internet censorship.
A recent study by Bitdefender and NETGEAR highlights significant security challenges posed by the rapid proliferation of Internet of Things (IoT) devices. Analyzing data from 3.8 million homes and 50 million IoT devices over 12 months, the report reveals a staggering 9.1 billion security events. Key findings include widespread vulnerabilities in devices such as TVs, smart plugs, and DVRs, underscoring the expanding attack surface and potential privacy risks for users.
The United Nations Development Programme (UNDP) has teamed up with the DFINITY Foundation to advance global access for Micro, Small, and Medium Enterprises (MSMEs) using blockchain technology. Through their partnership on the Universal Trusted Credentials (UTC) initiative, launched with the Monetary Authority of Singapore and other key partners, they aim to improve financial inclusion and cross-border trade financing.
Copyright © 2024 CyberMaterial. All Rights Reserved.
