Critical OAuth Flaws Uncovered in Grammarly, Vidio, and Bukalapak Platforms
Critical security flaws have been disclosed in the Open Authorization (OAuth) implementation of popular online services such as Grammarly, Vidio, and Bukalapak, building upon previous shortcomings uncovered in Booking[.]com and Expo. The weaknesses, now addressed by the respective companies following responsible disclosure between February and April 2023, could have allowed malicious actors to
Malvertising Campaign Targets Brazil’s PIX Payment System with GoPIX Malware
The popularity of Brazil’s PIX instant payment system has made it a lucrative target for threat actors looking to generate illicit profits using a new malware called GoPIX. Kaspersky, which has been tracking the active campaign since December 2022, said the attacks are pulled off using malicious ads that are served when potential victims search for « WhatsApp web » on search engines. […]
Paradigme de la forteresse en cybersécurité : élever les murs ou détecter les intrus ?
Les acteurs malveillants ne disposent pas d’un temps ou de ressources illimités ; chaque fois que leurs tentatives d’infiltration sont contrées, c’est une manche de plus de gagnée.
Alert: PoC Exploits Released for Citrix and VMware Vulnerabilities
Virtualization services provider VMware has alerted customers to the existence of a proof-of-concept (PoC) exploit for a recently patched security flaw in Aria Operations for Logs. Tracked as CVE-2023-34051 (CVSS score: 8.1), the high-severity vulnerability relates to a case of authentication bypass that could lead to remote code execution. « An unauthenticated, malicious actor can inject […]
Ex-NSA Employee Pleads Guilty to Leaking Classified Data to Russia
A former employee of the U.S. National Security Agency (NSA) has pleaded guilty to charges accusing him of attempting to transmit classified defense information to Russia. Jareh Sebastian Dalke, 31, served as an Information Systems Security Designer for the NSA from June 6, 2022, to July 1, 2022, where he had Top Secret clearance to […]
34 Cybercriminals Arrested in Spain for Multi-Million Dollar Online Scams
Spanish law enforcement officials have announced the arrest of 34 members of a criminal group that carried out various online scams, netting the gang about €3 million ($3.2 million) in illegal profits. Authorities conducted searches across 16 locations Madrid, Malaga, Huelva, Alicante, and Murcia, seizing two simulated firearms, a katana sword, a baseball bat, €80,000 in cash, […]
Make API Management Less Scary for Your Organization
While application development has evolved rapidly, the API management suites used to access these services remain a spooky reminder of a different era. Introducing new API management infrastructure with these legacy models still poses challenges for organizations as they modernize. Transitioning from monolithic architectures to agile microservices empowers developers to make quick changes. Using
Pour Doctolib, le « firewall souverain » attendra
Doctolib a récemment justifié son usage de Cloudflare plutôt que d’une technologie « souveraine » ou en tout cas européenne.
Cybersécurité : pourquoi les risques tiers sont difficiles à réduire
Les risques cyber liés aux prestataires, aux éditeurs de logiciels et de services ou aux fournisseurs sont désormais bien connus. Mais il est impossible de laisser aux services juridique et de la conformité le soin de traiter seuls ces problèmes.
Operation Triangulation: Experts Uncover Deeper Insights into iOS Zero-Day Attacks
The TriangleDB implant used to target Apple iOS devices packs in at least four different modules to record microphone, extract iCloud Keychain, steal data from SQLite databases used by various apps, and estimate the victim’s location. The findings come from Kaspersky, which detailed the great lengths the adversary behind the campaign, dubbed Operation Triangulation, went to […]