ICT Security-Sécurité PC et Internet
112.9K views | +1 today
ICT Security-Sécurité PC et Internet
ICT Security + Privacy + Piracy + Data Protection - Censorship - Des cours et infos gratuites sur la"Sécurité PC et Internet" pour usage non-commercial... (FR, EN+DE)...
Curated by Gust MEES
Your new post is loading...
Your new post is loading...
Scooped by Gust MEES
April 3, 7:02 PM
Scoop.it!

Claude Code Source Leaked via npm Packaging Error, Anthropic Confirms | #AI #CyberSecurity

Claude Code Source Leaked via npm Packaging Error, Anthropic Confirms | #AI #CyberSecurity | ICT Security-Sécurité PC et Internet | Scoop.it

These include a tools system to facilitate various capabilities like file read or bash execution, a query engine to handle LLM API calls and orchestration, multi-agent orchestration to spawn "sub-agents" or swarms to carry out complex tasks, and a bidirectional communication layer that connects IDE extensions to Claude Code CLI.

The leak has also shed light on a feature called KAIROS that allows Claude Code to operate as a persistent, background agent that can periodically fix errors or run tasks on its own without waiting for human input, and even send push notifications to users. Complementing this proactive mode is a new "dream" mode that will allow Claude to constantly think in the background to develop ideas and iterate existing ones.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/t/21st-century-innovative-technologies-and-developments/?&tag=AI

 

Gust MEES's insight:

These include a tools system to facilitate various capabilities like file read or bash execution, a query engine to handle LLM API calls and orchestration, multi-agent orchestration to spawn "sub-agents" or swarms to carry out complex tasks, and a bidirectional communication layer that connects IDE extensions to Claude Code CLI.

The leak has also shed light on a feature called KAIROS that allows Claude Code to operate as a persistent, background agent that can periodically fix errors or run tasks on its own without waiting for human input, and even send push notifications to users. Complementing this proactive mode is a new "dream" mode that will allow Claude to constantly think in the background to develop ideas and iterate existing ones.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/t/21st-century-innovative-technologies-and-developments/?&tag=AI

 

No comment yet.
Scooped by Gust MEES
March 18, 2025 7:28 PM
Scoop.it!

Bedrohung für 1 Milliarde Geräte: Forscher warnen vor Bluetooth-Sicherheitslücke 

Bedrohung für 1 Milliarde Geräte: Forscher warnen vor Bluetooth-Sicherheitslücke  | ICT Security-Sécurité PC et Internet | Scoop.it

Nicht nur Android-Nutzer sind aktuell durch Sicherheitslücken gefährdet. Forscher haben eine gefährliche Backdoor im weit verbreiteten Bluetooth-Chip ESP32 entdeckt. Laut "Tarlogic Security" könnten Angreifer ohne Wissen des Nutzers auf sensible Daten zugreifen oder Geräte fernsteuern. Smartphones, Laptops und Smart-Home-Geräte sind betroffen.

Die spanische Sicherheitsforscher fanden eine undokumentierte Backdoor im ESP32-Chip. Dieser Mikrocontroller des Herstellers Espressif Systems ist in über einer Milliarde Geräte weltweit eingebaut und ermöglicht Wi-Fi- und Bluetooth-Verbindungen.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/topic/securite-pc-et-internet?tag=maker

 

https://www.scoop.it/topic/securite-pc-et-internet?tag=Bluetooth

 

https://www.scoop.it/topic/securite-pc-et-internet?tag=ESP32

 

Gust MEES's insight:

Nicht nur Android-Nutzer sind aktuell durch Sicherheitslücken gefährdet. Forscher haben eine gefährliche Backdoor im weit verbreiteten Bluetooth-Chip ESP32 entdeckt. Laut "Tarlogic Security" könnten Angreifer ohne Wissen des Nutzers auf sensible Daten zugreifen oder Geräte fernsteuern. Smartphones, Laptops und Smart-Home-Geräte sind betroffen.

Die spanische Sicherheitsforscher fanden eine undokumentierte Backdoor im ESP32-Chip. Dieser Mikrocontroller des Herstellers Espressif Systems ist in über einer Milliarde Geräte weltweit eingebaut und ermöglicht Wi-Fi- und Bluetooth-Verbindungen.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/topic/securite-pc-et-internet?tag=maker

 

https://www.scoop.it/topic/securite-pc-et-internet?tag=Bluetooth

 

https://www.scoop.it/topic/securite-pc-et-internet?tag=ESP32

 

No comment yet.
Scooped by Gust MEES
February 9, 2025 12:51 PM
Scoop.it!

Cyberangriff? OpenAI untersucht potenzielles Leck von 20 Millionen Nutzerdaten

Cyberangriff? OpenAI untersucht potenzielles Leck von 20 Millionen Nutzerdaten | ICT Security-Sécurité PC et Internet | Scoop.it

Cyberkriminelle behaupten, private Daten von Millionen OpenAI-Konten gestohlen zu haben. Forscher sind skeptisch, der ChatGPT-Hersteller ermittelt in dem Fall.

 

 
 
 
Gust MEES's insight:

Cyberkriminelle behaupten, private Daten von Millionen OpenAI-Konten gestohlen zu haben. Forscher sind skeptisch, der ChatGPT-Hersteller ermittelt in dem Fall.

 

 
 
 
No comment yet.
Scooped by Gust MEES
December 13, 2024 10:46 AM
Scoop.it!

400 Million Microsoft Users Put At Risk From No Interaction 2FA Bypass

400 Million Microsoft Users Put At Risk From No Interaction 2FA Bypass | ICT Security-Sécurité PC et Internet | Scoop.it

Security researchers have revealed how they discovered a critical Microsoft vulnerability in the two-factor authentication defenses meant to protect users against hacker attacks. The vulnerability, which Microsoft has now remediated, put 400 million users of Office 365 at risk of a 2FA bypass attack requiring no user interaction, triggering no alerts and only taking an hour to complete.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Two-factor+authentication

 

https://www.scoop.it/topic/securite-pc-et-internet/?&tag=2FA

 

https://www.scoop.it/t/securite-pc-et-internet/?&tag=DATA-BREACHES

 

https://www.scoop.it/topic/securite-pc-et-internet/?&tag=MFA

 

Gust MEES's insight:

Security researchers have revealed how they discovered a critical Microsoft vulnerability in the two-factor authentication defenses meant to protect users against hacker attacks. The vulnerability, which Microsoft has now remediated, put 400 million users of Office 365 at risk of a 2FA bypass attack requiring no user interaction, triggering no alerts and only taking an hour to complete.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Two-factor+authentication

 

https://www.scoop.it/topic/securite-pc-et-internet/?&tag=2FA

 

https://www.scoop.it/t/securite-pc-et-internet/?&tag=DATA-BREACHES

 

https://www.scoop.it/topic/securite-pc-et-internet/?&tag=MFA

 

No comment yet.
Scooped by Gust MEES
October 15, 2024 2:31 PM
Scoop.it!

A new 'super-realistic' AI scam could get your Gmail account hacked

A new 'super-realistic' AI scam could get your Gmail account hacked | ICT Security-Sécurité PC et Internet | Scoop.it

A new ‘super-realistic’ AI scam could get your Gmail account hacked
A Microsoft security expert warns Gmail users of a new convincing social engineering attack.

Warning signs of a scam attempt
The advent of generative AI has opened up all kinds of opportunities, but it has also ramped up various risks and dangers.

We’ve previously seen hackers who can use AI-generated codes, phishing emails, or even deepfakes to make even more realistic fraud attempts — ones that even security experts can easily fall for.

 

 
 
 
Gust MEES's insight:

A new ‘super-realistic’ AI scam could get your Gmail account hacked
A Microsoft security expert warns Gmail users of a new convincing social engineering attack.

Warning signs of a scam attempt
The advent of generative AI has opened up all kinds of opportunities, but it has also ramped up various risks and dangers.

We’ve previously seen hackers who can use AI-generated codes, phishing emails, or even deepfakes to make even more realistic fraud attempts — ones that even security experts can easily fall for.

 

 
 
 
No comment yet.
Scooped by Gust MEES
October 8, 2024 2:25 PM
Scoop.it!

Linux-Malware "Perfctl" befällt offenbar schon seit Jahren Linux-Server

Linux-Malware "Perfctl" befällt offenbar schon seit Jahren Linux-Server | ICT Security-Sécurité PC et Internet | Scoop.it

Linux-Malware "Perfctl" befällt offenbar schon seit Jahren Linux-Server.
Eine ausgeklügelte Malware befällt massenweise Linux-Server mit falschen Konfigurationen. Das blieb lange unentdeckt, auch wegen der guten Tarnung.


Eine jetzt entdeckte Malware hat es auf Linux-Server abgesehen: Wie die Experten der Cybersecurity-Beratung Aqua Security berichten, ist das Programm namens "Perfctl" vermutlich schon seit 2021 im Umlauf und befällt Linux-Systeme, um diese heimlich als Proxyserver und für Cryptomining zu nutzen. Das Schadprogramm kann auch als Loader für weitere unerwünschte Programme fungieren.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Linux

 

 

Gust MEES's insight:

Linux-Malware "Perfctl" befällt offenbar schon seit Jahren Linux-Server.
Eine ausgeklügelte Malware befällt massenweise Linux-Server mit falschen Konfigurationen. Das blieb lange unentdeckt, auch wegen der guten Tarnung.


Eine jetzt entdeckte Malware hat es auf Linux-Server abgesehen: Wie die Experten der Cybersecurity-Beratung Aqua Security berichten, ist das Programm namens "Perfctl" vermutlich schon seit 2021 im Umlauf und befällt Linux-Systeme, um diese heimlich als Proxyserver und für Cryptomining zu nutzen. Das Schadprogramm kann auch als Loader für weitere unerwünschte Programme fungieren.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Linux

 

No comment yet.
Scooped by Gust MEES
September 26, 2024 3:42 PM
Scoop.it!

Doomsday 9.9 unauthenticated RCE bug affects 'all Linux'

Doomsday 9.9 unauthenticated RCE bug affects 'all Linux' | ICT Security-Sécurité PC et Internet | Scoop.it

No fix yet plus criticalness plus uncertainty plus talk of example exploit equals nightmare
Jessica Lyons


Details about an as-yet-non-public critical 9.9-out-of-10-severity unauthenticated remote-code execution vulnerability affecting all GNU/Linux systems could be revealed today.

That's according to software developer Simone Margaritelli, who says there's still no fix for the decade-old flaw he disclosed to developers three weeks ago. If it is as described, the bug could be used to hijack Linux-based systems from across the internet or network.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Linux

 

Gust MEES's insight:

No fix yet plus criticalness plus uncertainty plus talk of example exploit equals nightmare
Jessica Lyons


Details about an as-yet-non-public critical 9.9-out-of-10-severity unauthenticated remote-code execution vulnerability affecting all GNU/Linux systems could be revealed today.

That's according to software developer Simone Margaritelli, who says there's still no fix for the decade-old flaw he disclosed to developers three weeks ago. If it is as described, the bug could be used to hijack Linux-based systems from across the internet or network.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Linux

 

No comment yet.
Scooped by Gust MEES
September 25, 2024 10:31 AM
Scoop.it!

Hackers are now using AI-generated code for malware attacks

Hackers are now using AI-generated code for malware attacks | ICT Security-Sécurité PC et Internet | Scoop.it

Software developers have embraced “artificial intelligence” language models for code generation in a big way, with huge gains in productivity but also some predictably dubious developments. It’s no surprise that hackers and malware writers are doing the same.

According to recent reports, there have been several active malware attacks spotted with code that’s at least partially generated by AI.

 

 
 
 
Gust MEES's insight:

Software developers have embraced “artificial intelligence” language models for code generation in a big way, with huge gains in productivity but also some predictably dubious developments. It’s no surprise that hackers and malware writers are doing the same.

According to recent reports, there have been several active malware attacks spotted with code that’s at least partially generated by AI.

 

 
 
 
No comment yet.
Scooped by Gust MEES
July 5, 2024 1:00 PM
Scoop.it!

Hacker Stole Secrets From OpenAI

Hacker Stole Secrets From OpenAI | ICT Security-Sécurité PC et Internet | Scoop.it

The New York Times reported on July 4, 2024, that OpenAI suffered an undisclosed breach in early 2023.

The NYT notes that the attacker did not access the systems housing and building the AI, but did steal discussions from an employee forum. OpenAI did not publicly disclose the incident nor inform the FBI because, it claims, no information about customers nor partners was stolen, and the breach was not considered a threat to national security. The firm decided that the attack was down to a single person with no known association to any foreign government.

Nevertheless, the incident led to internal staff discussions over how seriously OpenAI was addressing security concerns.

 

 
 
 
Gust MEES's insight:

The New York Times reported on July 4, 2024, that OpenAI suffered an undisclosed breach in early 2023.

The NYT notes that the attacker did not access the systems housing and building the AI, but did steal discussions from an employee forum. OpenAI did not publicly disclose the incident nor inform the FBI because, it claims, no information about customers nor partners was stolen, and the breach was not considered a threat to national security. The firm decided that the attack was down to a single person with no known association to any foreign government.

Nevertheless, the incident led to internal staff discussions over how seriously OpenAI was addressing security concerns.

 

 
 
 
No comment yet.
Scooped by Gust MEES
January 24, 2024 1:23 PM
Scoop.it!

Over 5,300 GitLab servers exposed to zero-click account takeover attacks

Over 5,300 GitLab servers exposed to zero-click account takeover attacks | ICT Security-Sécurité PC et Internet | Scoop.it

Over 5,300 internet-exposed GitLab instances are vulnerable to CVE-2023-7028, a zero-click account takeover flaw GitLab warned about earlier this month.

The critical (CVSS score: 10.0) flaw allows attackers to send password reset emails for a targeted account to an attacker-controlled email address, allowing the threat actor to change the password and take over the account.

Although the flaw does not bypass two-factor authentication (2FA), it is a significant risk for any accounts not protected by this extra security mechanism.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/topic/securite-pc-et-internet/?&tag=GitHub

 

 

Gust MEES's insight:

Over 5,300 internet-exposed GitLab instances are vulnerable to CVE-2023-7028, a zero-click account takeover flaw GitLab warned about earlier this month.

The critical (CVSS score: 10.0) flaw allows attackers to send password reset emails for a targeted account to an attacker-controlled email address, allowing the threat actor to change the password and take over the account.

Although the flaw does not bypass two-factor authentication (2FA), it is a significant risk for any accounts not protected by this extra security mechanism.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/topic/securite-pc-et-internet/?&tag=GitHub

 

 

No comment yet.
Scooped by Gust MEES
January 12, 2024 4:26 PM
Scoop.it!

4 key takeaways from NIST’s new guide on AI cyber threats

4 key takeaways from NIST’s new guide on AI cyber threats | ICT Security-Sécurité PC et Internet | Scoop.it

An AI threat guide, outlining cyberattacks that target or leverage machine learning models, was published by the National Institute of Standards and Technology (NIST) on Jan. 4.

The nearly 100-page paper, titled “Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations,” provides a comprehensive overview of the cybersecurity and privacy risks that come with the rapid development of both predictive and generative AI tools over the last few years.

 

 
 
 
 
Gust MEES's insight:

An AI threat guide, outlining cyberattacks that target or leverage machine learning models, was published by the National Institute of Standards and Technology (NIST) on Jan. 4.

The nearly 100-page paper, titled “Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations,” provides a comprehensive overview of the cybersecurity and privacy risks that come with the rapid development of both predictive and generative AI tools over the last few years.

 

 
 
 
 
No comment yet.
Scooped by Gust MEES
January 3, 2024 11:55 AM
Scoop.it!

Google-Konten in Gefahr: Exploit erlaubt böswilligen Zugriff trotz Passwort-Reset 

Google-Konten in Gefahr: Exploit erlaubt böswilligen Zugriff trotz Passwort-Reset  | ICT Security-Sécurité PC et Internet | Scoop.it

Exploit erlaubt böswilligen Zugriff trotz Passwort-Reset
Durch eine Schwachstelle in einem OAuth-Endpunkt können sich Cyberkriminelle dauerhaft Zugriff auf das Google-Konto einer Zielperson verschaffen.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/topic/securite-pc-et-internet

 

Gust MEES's insight:

Exploit erlaubt böswilligen Zugriff trotz Passwort-Reset
Durch eine Schwachstelle in einem OAuth-Endpunkt können sich Cyberkriminelle dauerhaft Zugriff auf das Google-Konto einer Zielperson verschaffen.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/topic/securite-pc-et-internet

 

No comment yet.
Scooped by Gust MEES
September 12, 2023 11:33 AM
Scoop.it!

Free Download Manager site redirected Linux users to malware for years

Free Download Manager site redirected Linux users to malware for years | ICT Security-Sécurité PC et Internet | Scoop.it

A reported Free Download Manager supply chain attack redirected Linux users to a malicious Debian package repository that installed information-stealing malware.

The malware used in this campaign establishes a reverse shell to a C2 server and installs a Bash stealer that collects user data and account credentials.

Kaspersky discovered the potential supply chain compromise case while investigating suspicious domains, finding that the campaign has been underway for over three years.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Linux

 

 

Gust MEES's insight:

A reported Free Download Manager supply chain attack redirected Linux users to a malicious Debian package repository that installed information-stealing malware.

The malware used in this campaign establishes a reverse shell to a C2 server and installs a Bash stealer that collects user data and account credentials.

Kaspersky discovered the potential supply chain compromise case while investigating suspicious domains, finding that the campaign has been underway for over three years.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Linux

 

 

No comment yet.
Scooped by Gust MEES
April 3, 6:35 PM
Scoop.it!

Hackers Are Using Claude Code Leak As Bait to Spread Malware | #AI #CyberSecurity

Hackers Are Using Claude Code Leak As Bait to Spread Malware | #AI #CyberSecurity | ICT Security-Sécurité PC et Internet | Scoop.it

A hacker was quick to pounce on the accidental leak of Anthropic’s AI tool, Claude Code, by spreading malware on a GitHub page that claimed to host the source code. 

Cybersecurity vendor Zscaler spotted a hacker exploiting interest in the Claude Code leak to push two malware strains, Vidar and Ghostsocks. Zscaler traced the threat to a GitHub page from the account “idbzoomh,” which purports to offer the leaked source code for Claude Code and claims: “I spent significant effort rebuilding the entire build system from scratch, fixing every compilation error, and making this source snapshot actually work.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/t/21st-century-innovative-technologies-and-developments/?&tag=AI

 

Gust MEES's insight:

A hacker was quick to pounce on the accidental leak of Anthropic’s AI tool, Claude Code, by spreading malware on a GitHub page that claimed to host the source code. 

Cybersecurity vendor Zscaler spotted a hacker exploiting interest in the Claude Code leak to push two malware strains, Vidar and Ghostsocks. Zscaler traced the threat to a GitHub page from the account “idbzoomh,” which purports to offer the leaked source code for Claude Code and claims: “I spent significant effort rebuilding the entire build system from scratch, fixing every compilation error, and making this source snapshot actually work.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/t/21st-century-innovative-technologies-and-developments/?&tag=AI

 

imitolavalentina951@gmail.com's curator insight, April 3, 9:17 PM
Este articulo muestra los riesgos del uso de la inteligencia artificial en la comunicación digital, ya que puede ser utilizada de manera negativa como en caso de los hackers. Esto se relaciona con la importancia de educar a las personas en el uso responsables de la tecnología, fortaleciendo la seguridad y el manejo adecuado de la información en entornos digitales 
Scooped by Gust MEES
March 13, 2025 10:23 AM
Scoop.it!

WordPress Backup Plugin Vulnerability Affects 5+ Million Websites

WordPress Backup Plugin Vulnerability Affects 5+ Million Websites | ICT Security-Sécurité PC et Internet | Scoop.it

A high-severity vulnerability was discovered and patched in the All-in-One WP Migration and Backup plugin, which has over five million installations. The vulnerability requires no user authentication, making it easier for an attacker to compromise a website, but this is mitigated by a restricted attack method.

The vulnerability was assigned a severity rating of 7.5 (High), which is below the highest severity level, labeled Critical.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/t/securite-pc-et-internet/?&tag=WordPress

 

Gust MEES's insight:

A high-severity vulnerability was discovered and patched in the All-in-One WP Migration and Backup plugin, which has over five million installations. The vulnerability requires no user authentication, making it easier for an attacker to compromise a website, but this is mitigated by a restricted attack method.

The vulnerability was assigned a severity rating of 7.5 (High), which is below the highest severity level, labeled Critical.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/t/securite-pc-et-internet/?&tag=WordPress

 

No comment yet.
Scooped by Gust MEES
December 16, 2024 4:32 PM
Scoop.it!

Critical ‘AuthQuake’ bug let attackers bypass Microsoft MFA

Critical ‘AuthQuake’ bug let attackers bypass Microsoft MFA | ICT Security-Sécurité PC et Internet | Scoop.it

A critical vulnerability in Microsoft’s multi-factor authentication (MFA) — dubbed "AuthQuake" — could let attackers bypass MFA and gain unauthorized access to a user’s account.

Discovered by Oasis Security, the researchers reported in a Dec. 11 blog post that the bypass could let attackers access Outlook emails, OneDrive files, Teams chats, and the Azure Cloud.

Because Microsoft has more than 400 million paid Office 365 seats, the consequences of this vulnerability has potentially high impact across numerous industries, especially since there was about a four-month gap between the time it was reported and a patch was released.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Two-factor+authentication

 

https://www.scoop.it/topic/securite-pc-et-internet/?&tag=2FA

 

https://www.scoop.it/t/securite-pc-et-internet/?&tag=DATA-BREACHES

 

https://www.scoop.it/topic/securite-pc-et-internet/?&tag=MFA

 

Gust MEES's insight:

A critical vulnerability in Microsoft’s multi-factor authentication (MFA) — dubbed "AuthQuake" — could let attackers bypass MFA and gain unauthorized access to a user’s account.

Discovered by Oasis Security, the researchers reported in a Dec. 11 blog post that the bypass could let attackers access Outlook emails, OneDrive files, Teams chats, and the Azure Cloud.

Because Microsoft has more than 400 million paid Office 365 seats, the consequences of this vulnerability has potentially high impact across numerous industries, especially since there was about a four-month gap between the time it was reported and a patch was released.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Two-factor+authentication

 

https://www.scoop.it/topic/securite-pc-et-internet/?&tag=2FA

 

https://www.scoop.it/t/securite-pc-et-internet/?&tag=DATA-BREACHES

 

https://www.scoop.it/topic/securite-pc-et-internet/?&tag=MFA

 

No comment yet.
Scooped by Gust MEES
October 15, 2024 2:39 PM
Scoop.it!

Experts say MFA is no longer enough for enterprises

Experts say MFA is no longer enough for enterprises | ICT Security-Sécurité PC et Internet | Scoop.it

The UK’s cyber watchdog says that companies need to be more mindful with how they handle their multi-factor authentication.

The National Cyber Security Centre (NCSC) said companies can no longer rely on MFA as a blanket solution to their network security woes. The problem, say experts, is that in many cases attackers are now able to intercept MFA keys much in the same way they did passwords.

“Attackers have realized that many of the same social engineering techniques that tricked us into handing over passwords can also be updated to overcome some methods of MFA,” the NCSC said.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Two-factor+authentication

 

https://www.scoop.it/topic/securite-pc-et-internet/?&tag=2FA

 

https://www.scoop.it/t/securite-pc-et-internet/?&tag=DATA-BREACHES

 

https://www.scoop.it/topic/securite-pc-et-internet/?&tag=MFA

 

Gust MEES's insight:

The UK’s cyber watchdog says that companies need to be more mindful with how they handle their multi-factor authentication.

The National Cyber Security Centre (NCSC) said companies can no longer rely on MFA as a blanket solution to their network security woes. The problem, say experts, is that in many cases attackers are now able to intercept MFA keys much in the same way they did passwords.

“Attackers have realized that many of the same social engineering techniques that tricked us into handing over passwords can also be updated to overcome some methods of MFA,” the NCSC said.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Two-factor+authentication

 

https://www.scoop.it/topic/securite-pc-et-internet/?&tag=2FA

 

https://www.scoop.it/t/securite-pc-et-internet/?&tag=DATA-BREACHES

 

https://www.scoop.it/topic/securite-pc-et-internet/?&tag=MFA

 

No comment yet.
Scooped by Gust MEES
October 9, 2024 6:57 PM
Scoop.it!

Internet Archive hacked, data breach impacts 31 million users

Internet Archive hacked, data breach impacts 31 million users | ICT Security-Sécurité PC et Internet | Scoop.it

Internet Archive's "The Wayback Machine" has suffered a data breach after a threat actor compromised the website and stole a user authentication database containing 31 million unique records.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/topic/securite-pc-et-internet

 

Gust MEES's insight:

Internet Archive's "The Wayback Machine" has suffered a data breach after a threat actor compromised the website and stole a user authentication database containing 31 million unique records.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/topic/securite-pc-et-internet

 

No comment yet.
Scooped by Gust MEES
September 30, 2024 11:27 AM
Scoop.it!

ChatGPT Vulnerability Exploited: Hacker Demonstrates Data Theft via ‘SpAIware

ChatGPT Vulnerability Exploited: Hacker Demonstrates Data Theft via ‘SpAIware | ICT Security-Sécurité PC et Internet | Scoop.it

A recent cyber vulnerability in ChatGPT’s long-term memory feature was exposed, showing how hackers could use this AI tool to steal user data. Security researcher Johann Rehberger demonstrated this issue through a concept he named “SpAIware,” which exploited a weakness in ChatGPT’s macOS app, allowing it to act as spyware.

 

 
 
 
Gust MEES's insight:

A recent cyber vulnerability in ChatGPT’s long-term memory feature was exposed, showing how hackers could use this AI tool to steal user data. Security researcher Johann Rehberger demonstrated this issue through a concept he named “SpAIware,” which exploited a weakness in ChatGPT’s macOS app, allowing it to act as spyware.

 

 
 
 
No comment yet.
Scooped by Gust MEES
September 26, 2024 1:22 PM
Scoop.it!

Hackers Could Have Remotely Controlled Kia Cars Using Only License Plates

Hackers Could Have Remotely Controlled Kia Cars Using Only License Plates | ICT Security-Sécurité PC et Internet | Scoop.it

Cybersecurity researchers have disclosed a set of now patched vulnerabilities in Kia vehicles that, if successfully exploited, could have allowed remote control over key functions simply by using only a license plate.

"These attacks could be executed remotely on any hardware-equipped vehicle in about 30 seconds, regardless of whether it had an active Kia Connect subscription," security researchers Neiko Rivera, Sam Curry, Justin Rhinehart, and Ian Carroll said.

The issues impact almost all vehicles made after 2013, even letting attackers covertly gain access to sensitive information including the victim's name, phone number, email address, and physical address.

 

Learn more / En savoir plus / Mehr erfahren: 

 

https://globaleducationandsocialmedia.wordpress.com/2014/01/21/why-is-it-a-must-to-have-basics-knowledge-of-cyber-security-in-a-connected-technology-world/

 

http://www.scoop.it/t/securite-pc-et-internet/?tag=SHODAN+Search+Engine

 

http://www.scoop.it/t/21st-century-learning-and-teaching/?tag=Internet+of+Things

 

http://www.scoop.it/t/securite-pc-et-internet/?tag=smart-TV

 

http://www.scoop.it/t/securite-pc-et-internet/?tag=Internet+of+things

 

 

http://www.scoop.it/t/securite-pc-et-internet/?tag=Cars

 

Gust MEES's insight:

Cybersecurity researchers have disclosed a set of now patched vulnerabilities in Kia vehicles that, if successfully exploited, could have allowed remote control over key functions simply by using only a license plate.

"These attacks could be executed remotely on any hardware-equipped vehicle in about 30 seconds, regardless of whether it had an active Kia Connect subscription," security researchers Neiko Rivera, Sam Curry, Justin Rhinehart, and Ian Carroll said.

The issues impact almost all vehicles made after 2013, even letting attackers covertly gain access to sensitive information including the victim's name, phone number, email address, and physical address.

 

Learn more / En savoir plus / Mehr erfahren: 

 

https://globaleducationandsocialmedia.wordpress.com/2014/01/21/why-is-it-a-must-to-have-basics-knowledge-of-cyber-security-in-a-connected-technology-world/

 

http://www.scoop.it/t/securite-pc-et-internet/?tag=SHODAN+Search+Engine

 

http://www.scoop.it/t/21st-century-learning-and-teaching/?tag=Internet+of+Things

 

http://www.scoop.it/t/securite-pc-et-internet/?tag=smart-TV

 

http://www.scoop.it/t/securite-pc-et-internet/?tag=Internet+of+things

 

No comment yet.
Scooped by Gust MEES
August 22, 2024 6:02 PM
Scoop.it!

Qilin ransomware now steals credentials from Chrome browsers

Qilin ransomware now steals credentials from Chrome browsers | ICT Security-Sécurité PC et Internet | Scoop.it

Attack overview
The attack that Sophos researchers analyzed started with Qilin gaining access to a network using compromised credentials for a VPN portal that lacked multi-factor authentication (MFA).

The breach was followed by 18 days of dormancy, suggesting the possibility of Qilin buying their way into the network from an initial access broker (IAB).

Possibly, Qilin spent time mapping the network, identifying critical assets, and conducting reconnaissance.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Two-factor+authentication

 

https://www.scoop.it/topic/securite-pc-et-internet/?&tag=2FA

 

https://www.scoop.it/t/securite-pc-et-internet/?&tag=DATA-BREACHES

 

https://www.scoop.it/topic/securite-pc-et-internet/?&tag=MFA

 

Gust MEES's insight:

Attack overview
The attack that Sophos researchers analyzed started with Qilin gaining access to a network using compromised credentials for a VPN portal that lacked multi-factor authentication (MFA).

The breach was followed by 18 days of dormancy, suggesting the possibility of Qilin buying their way into the network from an initial access broker (IAB).

Possibly, Qilin spent time mapping the network, identifying critical assets, and conducting reconnaissance.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Two-factor+authentication

 

https://www.scoop.it/topic/securite-pc-et-internet/?&tag=2FA

 

https://www.scoop.it/t/securite-pc-et-internet/?&tag=DATA-BREACHES

 

https://www.scoop.it/topic/securite-pc-et-internet/?&tag=MFA

 

No comment yet.
Scooped by Gust MEES
February 9, 2024 9:54 AM
Scoop.it!

Bootloader-Lücke gefährdet viele Linux-Distributionen | heise online

Bootloader-Lücke gefährdet viele Linux-Distributionen | heise online | ICT Security-Sécurité PC et Internet | Scoop.it

Bootloader-Lücke gefährdet viele Linux-Distributionen
Im Bootloader shim, der Secure-Boot auch für nicht-Windows-Betriebssysteme erlaubt, klafft eine Sicherheitslücke.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Linux

 

Gust MEES's insight:

Bootloader-Lücke gefährdet viele Linux-Distributionen
Im Bootloader shim, der Secure-Boot auch für nicht-Windows-Betriebssysteme erlaubt, klafft eine Sicherheitslücke.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Linux

 

No comment yet.
Scooped by Gust MEES
January 12, 2024 4:30 PM
Scoop.it!

Info-stealers can steal cookies for permanent access to your Google account

Info-stealers can steal cookies for permanent access to your Google account | ICT Security-Sécurité PC et Internet | Scoop.it

Hackers have found a way to gain unauthorized access to Google accounts, bypassing any multi-factor authentication (MFA) the user may have set up. To do this they steal authentication cookies and then extend their lifespan. It doesn’t even help if the owner of the account changes their password.

Since the discovery of the exploit, numerous white and black hat security researchers have looked into and discussed the issue. As a result, the exploit is now built into various information stealers.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Two-factor+authentication

 

https://www.scoop.it/topic/securite-pc-et-internet/?&tag=2FA

 

https://www.scoop.it/t/securite-pc-et-internet/?&tag=DATA-BREACHES

 

https://www.scoop.it/topic/securite-pc-et-internet/?&tag=MFA

 

 

Gust MEES's insight:

Hackers have found a way to gain unauthorized access to Google accounts, bypassing any multi-factor authentication (MFA) the user may have set up. To do this they steal authentication cookies and then extend their lifespan. It doesn’t even help if the owner of the account changes their password.

Since the discovery of the exploit, numerous white and black hat security researchers have looked into and discussed the issue. As a result, the exploit is now built into various information stealers.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/t/securite-pc-et-internet/?&tag=Two-factor+authentication

 

https://www.scoop.it/topic/securite-pc-et-internet/?&tag=2FA

 

https://www.scoop.it/t/securite-pc-et-internet/?&tag=DATA-BREACHES

 

https://www.scoop.it/topic/securite-pc-et-internet/?&tag=MFA

 

 

No comment yet.
Scooped by Gust MEES
January 3, 2024 12:05 PM
Scoop.it!

Google-Nutzer aufgepasst: Trojaner nutzt Cookies, um Konten zu übernehmen

Google-Nutzer aufgepasst: Trojaner nutzt Cookies, um Konten zu übernehmen | ICT Security-Sécurité PC et Internet | Scoop.it

Google-Nutzer aufgepasst: Trojaner nutzt Cookies, um Konten zu übernehmen
Ein relativ neuer Typ von Schadsoftware nutzt Cookies, um Zugang zu Google-Konten zu erlangen. Da er diese auch selbst generieren und entschlüsseln kann, behalten Hacker auch dann Kontrolle über das Konto, wenn das Passwort geändert wird.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/topic/securite-pc-et-internet

 

Gust MEES's insight:

Google-Nutzer aufgepasst: Trojaner nutzt Cookies, um Konten zu übernehmen
Ein relativ neuer Typ von Schadsoftware nutzt Cookies, um Zugang zu Google-Konten zu erlangen. Da er diese auch selbst generieren und entschlüsseln kann, behalten Hacker auch dann Kontrolle über das Konto, wenn das Passwort geändert wird.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/topic/securite-pc-et-internet

 

No comment yet.
Scooped by Gust MEES
December 20, 2023 12:02 PM
Scoop.it!

New JaskaGO Malware Targets Mac and Windows for Crypto, Browser Data

New JaskaGO Malware Targets Mac and Windows for Crypto, Browser Data | ICT Security-Sécurité PC et Internet | Scoop.it

A recently discovered cross-platform malware, appropriately named JaskaGO, has surfaced, targeting both macOS and Windows systems.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/topic/securite-pc-et-internet

 

Gust MEES's insight:

A recently discovered cross-platform malware, appropriately named JaskaGO, has surfaced, targeting both macOS and Windows systems.

 

Learn more / En savoir plus / Mehr erfahren:

 

https://www.scoop.it/topic/securite-pc-et-internet

 

No comment yet.