Author Archives: Greg Otto

Critical flaw in Citrix applications could allow unauthorized access to internal networks

Posted on by

A critical vulnerability has been discovered in Citrix’s Application Delivery Controller (ADC) and Gateway products that could give attackers unauthorized access to enterprise networks as well as the ability to run code on them. Security company Positive Technologies, which first discovered the flaw, says the vulnerability spans several years’ worth of Citrix technology. It estimates that “at least 80,000 companies in 158 countries are potentially at risk.” Citrix’s ADC is a cloud-based application delivery and load balancing tool, while Gateway allows remote access to a company’s applications. The vulnerability affects Citrix ADC and Citrix Gateway 13.0, 12.1, 12.0, 11.1, and 10.5. “Considering the high risk brought by the discovered vulnerability, and how widespread Citrix software is in the business community, we recommend information security professionals take immediate steps to mitigate the threat,” Dmitry Serebryannikov, director of the security audit department for Framingham, Massachusetts-based Positive Technologies, said in a blog post. Citrix […]

The post Critical flaw in Citrix applications could allow unauthorized access to internal networks appeared first on CyberScoop.

Continue reading Critical flaw in Citrix applications could allow unauthorized access to internal networks→

Wawa says payment processing servers were hacked, potentially affecting all of its stores

Posted on by

Popular East Coast convenience store chain Wawa announced Thursday that it found malware on payment processing servers that affected card information gathered from customers at potentially all of its locations. The company said malware had been running sometime after March 4 and was present on most store systems by approximately April 22. Among the information collected was cardholder names, including credit and debit card numbers and expiration dates. Debit card PIN numbers, credit card CVV2 numbers, other PIN numbers, and driver’s license information used to verify age-restricted purchases were not affected, Wawa said. Additionally, ATMs located in Wawa stores were not affected. “I apologize deeply to all of you, our friends and neighbors, for this incident,” Wawa CEO Chris Gheysens said in a release. “You are my top priority and are critically important to all of the nearly 37,000 associates at Wawa. We take this special relationship with you and the protection of your […]

The post Wawa says payment processing servers were hacked, potentially affecting all of its stores appeared first on CyberScoop.

Continue reading Wawa says payment processing servers were hacked, potentially affecting all of its stores→

Exclusive: PR software firm exposes data on nearly 500k contacts

Posted on by

A company that sells content management software and services exposed data on 477,000 media contacts, including 35,000 hashed user passwords, to the public internet. In October, iPRsoftware, a U.S.-based company that specializes in software that manages and disseminates company public relations and marketing, was discovered to be exposing the data along with administrative system credentials and assorted documents. Among the documents were marketing materials for client companies, as well as credentials for the company’s Google and Twitter accounts and a MongoDB hosting provider. Chris Vickery, director of cyber risk research at UpGuard, first contacted the company about the exposure in October. Despite the company’s acknowledgement of the issue, Vickery observed that over the next week, the only thing that changed was the appearance of a log file for the purpose of reviewing activity related to the open repository. When contacted weeks later by CyberScoop about the exposure, a company representative said it […]

The post Exclusive: PR software firm exposes data on nearly 500k contacts appeared first on CyberScoop.

Continue reading Exclusive: PR software firm exposes data on nearly 500k contacts→

‘Sandworm’ book review: To understand cyberwar, you must understand Ukraine

Posted on by

For experts, trying to definitively explain the full scope of a cybersecurity incident is often a difficult and delicate process. They normally don’t find reason to tie attacks back to 13th-century massacres at the hands of Mongolian warlords. Yet, in “Sandworm,” the new book from Wired magazine’s Andy Greenberg, it’s the Mongols’ 13th-century raid on Ukraine (and other brutalities the region has endured) that helps explain why this area in the world has been linked to almost every major cyberattack in the past decade. “Sandworm” chronicles the hacker group of the same name, diving into the hectic moments behind the Russian outfit’s attacks, which have hit targets from the Ukrainian power grid to international shipping conglomerates. The book shows that attacks like BlackEnergy, NotPetya and Olympic Destroyer do not happen in a vacuum. Greenberg weaves them and others into a narrative that illuminates the personalities responsible for studying or thwarting Sandworm’s […]

The post ‘Sandworm’ book review: To understand cyberwar, you must understand Ukraine appeared first on CyberScoop.

Continue reading ‘Sandworm’ book review: To understand cyberwar, you must understand Ukraine→

Twitter: We accidentally used security data to target users with ads

Posted on by

Twitter announced Tuesday that email addresses and phone numbers used to secure accounts had accidentally been used for advertising purposes. In a blog post, the company says the addresses and numbers were used in its “Tailored Audiences” product, which allows advertisers to target ads to customers based on the advertiser’s own marketing lists. “When an advertiser uploaded their marketing list, we may have matched people on Twitter to their list based on the email or phone number the Twitter account holder provided for safety and security purposes,” the blog states. “This was an error and we apologize.” Twitter does not know how many people were impacted by the error. The company says no data was shared with third parties that used the Tailored Audiences feature. Twitter users share phone numbers with the company for security purposes, particularly for its two-factor authentication feature. With that feature, Twitter sends a code to […]

The post Twitter: We accidentally used security data to target users with ads appeared first on CyberScoop.

Continue reading Twitter: We accidentally used security data to target users with ads→

VMware CEO: The security industry has ‘failed its customers’

Posted on by

Pat Gelsinger, the CEO of VMware, says the security industry has “failed its customers” and that security must become more intrinsic if enterprises are ever going to keep up with the threats they face on a daily basis. “Every year we are asking [enterprises] for more money from their security budgets and every year there’s an increasing number and cost of breaches,” Gelsinger said at VMware’s Security Through Innovation Summit produced by FedScoop and StateScoop. “This is a failure.” He compared the state of the industry to lawyers who make a living chasing after car accident victims in the hopes of scoring a personal injury settlement. “We show up after the car accident and then we say ‘Here, you need to buy more tools for forensics to tell you what happened in the car accident,’” Gelsinger said. “We are showing up after the fact. We need to have a better […]

The post VMware CEO: The security industry has ‘failed its customers’ appeared first on CyberScoop.

Continue reading VMware CEO: The security industry has ‘failed its customers’→

Former Yahoo engineer admits to hacking accounts in search for sexual images

Posted on by

A former Yahoo software engineer pleaded guilty Monday to hacking into about 6,000 Yahoo accounts for the purpose of finding nude images and videos of the account holders. Reyes Daniel Ruiz, 34, admitted in federal court Monday that he targeted the accounts of younger women, including his personal friends and work colleagues, in order to pull images and videos from the various accounts. Ruiz cracked the accounts by accessing various internal Yahoo systems, and then using that information to access iCloud, Facebook, Gmail, Dropbox and other online services to find more private images and videos. Ruiz, who left the company in July 2018, also admitted to the court that once Yahoo was started investigating, he destroyed the computer and hard drive on which he stored the images. Under a plea agreement in the San Jose, California, federal court, Ruiz will be charged with one count of computer intrusion. The charge carries a […]

The post Former Yahoo engineer admits to hacking accounts in search for sexual images appeared first on CyberScoop.

Continue reading Former Yahoo engineer admits to hacking accounts in search for sexual images→

‘Unpatchable’ iOS exploit sends jailbreak enthusiasts into a frenzy

Posted on by

A researcher released an “unpatchable” iOS exploit Friday that could make any iPhone from model 4S to 11 susceptible to a permanent jailbreak. First pushed to Twitter by a researcher known as @axi0mX , the exploit works on devices with Apple chipsets from A5 to A11, which have powered iPhones and iPads since 2011. Apple’s newer chip models — A12 and A13 — are not affected. EPIC JAILBREAK: Introducing checkm8 (read “checkmate”), a permanent unpatchable bootrom exploit for hundreds of millions of iOS devices. Most generations of iPhones and iPads are vulnerable: from iPhone 4S (A5 chip) to iPhone 8 and iPhone X (A11 chip). https://t.co/dQJtXb78sG — axi0mX (@axi0mX) September 27, 2019 The exploit, known as “checkm8,” takes advantages of flaws in Apple’s secure boot ROM (bootrom) and allows users to remove restrictions imposed on the devices by Apple or various telecom carriers. On a normal device, users are confined to using Apple’s App […]

The post ‘Unpatchable’ iOS exploit sends jailbreak enthusiasts into a frenzy appeared first on CyberScoop.

Continue reading ‘Unpatchable’ iOS exploit sends jailbreak enthusiasts into a frenzy→

‘No more away games’: Former Cyber Command official says Russia and China have leveled the playing field

Posted on by

A former U.S. Cyber Command official said Thursday that China and Russia’s use of cyberattacks has upended the way the U.S. military thinks about warfare, given the incidents’ direct impact on civilians rather than armed forces. Brett Williams, a former deputy of operations for the command, said at an IT conference in New York City that the two adversaries have made it so the military can no longer “play an away game.” “What I mean by that is [the U.S. likes] to fight away games,” Williams said at an event held by Tierpoint, held during CyberScoop’s NY CyberWeek. “We don’t want to have to fight here [on U.S. soil]. Anything we get into with China and Russia, the first impact is going to be felt on our civilian population.” Williams also said he believes both countries’ actions — he spoke specifically on China’s intellectual property theft and Russia’s targeting of […]

The post ‘No more away games’: Former Cyber Command official says Russia and China have leveled the playing field appeared first on CyberScoop.

Continue reading ‘No more away games’: Former Cyber Command official says Russia and China have leveled the playing field→

Supermicro BMCs were susceptible to remote attacks, according to firmware security startup

Posted on by

Researchers from an enterprise firmware security startup have found an issue with a key component in various Supermicro motherboards that could allow attackers to remotely access some of an organization’s most valuable assets. Issues in the baseboard management controllers of Supermicro’s X9, X10 and X11 platforms that could allow an attacker to easily connect to a server and mount a virtual disk drive to the BMC, according to researchers from Eclypsium. After mounting a drive, an attacker could modify a server, implant malware, or even disable the device entirely. “Threats operating at this level can easily subvert traditional security measures and put the device and the integrity of all its data at risk,” Eclypsium notes in its research, which was released Tuesday. “As such, organizations should begin to treat these layers of security with the attention that it deserves.” The BMC is a processor that measures the physical state of a […]

The post Supermicro BMCs were susceptible to remote attacks, according to firmware security startup appeared first on CyberScoop.

Continue reading Supermicro BMCs were susceptible to remote attacks, according to firmware security startup→