Read Time:7 Second
Fota Wildlife Park in Co Cork has told visitors to its website to cancel credit and debit cards, following a cyber-attack
Category Archives: News
US Authorities Issue RansomHub Ransomware Alert
Read Time:6 Second
Agencies under the #Stopransomware banner publish details of RansomHub group’s tactics, indicators of compromise and essential mitigations
South Korea Police Investigates Telegram Over Deepfake Porn
Read Time:5 Second
The Asian country’s law enforcement suspects the instant messaging app of abetting deepfake sex crimes
Verkada Facing $3m Penalty After Hackers Viewed Sensitive Video Footage
Read Time:8 Second
The US FTC has proposed a $2.95m fine for security camera firm Verkada for alleged security failings that allowed hackers to access customers’ video footage
SQL Injection Attack on Airport Security
Read Time:1 Minute, 17 Second
Interesting vulnerability:
…a special lane at airport security called Known Crewmember (KCM). KCM is a TSA program that allows pilots and flight attendants to bypass security screening, even when flying on domestic personal trips.
The KCM process is fairly simple: the employee uses the dedicated lane and presents their KCM barcode or provides the TSA agent their employee number and airline. Various forms of ID need to be presented while the TSA agent’s laptop verifies the employment status with the airline. If successful, the employee can access the sterile area without any screening at all.
A similar system also exists for cockpit access, called the Cockpit Access Security System (CASS). Most aircraft have at least one jumpseat inside the cockpit sitting behind the flying pilots. When pilots need to commute or travel, it is not always possible for them to occupy a revenue seat, so a jumpseat can be used instead. CASS allows the gate agent of a flight to verify that the jumpseater is an authorized pilot. The gate agent can then inform the crew of the flight that the jumpseater was authenticated by CASS.
[attack details omitted]
At this point, we realized we had discovered a very serious problem. Anyone with basic knowledge of SQL injection could login to this site and add anyone they wanted to KCM and CASS, allowing themselves to both skip security screening and then access the cockpits of commercial airliners.
We ended up finding several more serious issues but began the disclosure process immediately after finding the first issue.
Cicada3301 Ransomware Group Emerges From the Ashes of ALPHV
Read Time:5 Second
Truesec claims new Cicada3301 ransomware-as-a-service group could have ties to ALPHV/BlackCat and Brutus
IT worker charged over $750,000 cyber extortion plot against former employer
Read Time:13 Second
A former IT engineer is facing federal charges in the United States after his former employer found it had been locked out of its computer systems and received a demand for $750,000.
Read more in my article on the Hot for Security blog.
Scores of Organizations Hit By Novel Voldemort Malware
Read Time:4 Second
Proofpoint has uncovered a new cyber-espionage campaign deploying new malware dubbed “Voldemort”
Friday Squid Blogging: Economic Fallout from Falklands Halting Squid Fishing
Published Vulnerabilities Surge by 43%
Read Time:7 Second
Forescout highlighted a 43% increase in published vulnerabilities in H1 2024, with attackers targeting flaws in VPNs and network infrastructure for initial access