Cyber Bites

Webcams could be potentially accessed and manipulated by anyone with an Internet connection, researchers say. More than 15,000 webcams, many of which are located inside people's homes, are potentially accessible to anyone with an Internet connection. Researchers at Wizcase who discovered the cameras say many are vulnerable to attackers who could steal data or adjust the settings. Source: Dark Reading

Thousands of Google users are exposing the contents of their calendars to the public. The information is indexed by search engines and can include email addresses as well as private events from individuals and businesses. The problem is due to misconfiguring Google Calendar to share its contents with others. However, making the data public means that anyone with your Calendar link can access it. Google shows a warning about this but thousands of users seem to...

A local police department in the U.S. are warning of a wave of phishing scams targeting users Venmo mobile payment service with text messages that direct to a fake website. Owned by PayPal, Venmo is a peer-to-peer payment app that allows sending and receiving money to and from contacts on your phone. Source: Bleeping Computer

KUALA LUMPUR: Malaysia's Malindo Air, a subsidiary of Indonesia's Lion Group, said on Wednesday (Sep 18) it was investigating a data breach involving the personal details of its passengers. Malindo Air's statement followed a report by Moscow-based cybersecurity firm Kaspersky Lab that the details of around 30 million passengers of Malindo and fellow Lion Group subsidiary Thai Lion Air were posted in online forums.  Source: Channel News Asia

Greenbone Networks has released details of new research in to the security of the servers used by health providers across the world to store images of X-rays as well as CT, MRI and other medical scans. Of the 2,300 medical image archive systems worldwide that Greenbone analyzed between mid-July and early September 2019, 590 of them were freely accessible on the internet, together containing 24.3 million data records from patients located in 52 different countries....

Researchers have discovered a sophisticated cryptomining program that uses loadable kernel modules (LKMs) to help infiltrate Linux machines, and hides its malicious activity by displaying fake network traffic stats. Dubbed Skidmap, the malware can also grant attackers backdoor access to affected systems by setting up a secret master password that offers access to any user account in the system, according to Trend Micro threat analysts Augusto Remillano II and Jakub Urbanec in a company blog post today. Source: SC Magazine

NAB customers have once again been targeting in an email phishing scam capable of emptying their accounts. The scam uses the display name "National Australia Bank" and informs recipients their account has been "restricted" due to "irregular activity".  Victims are told to click on a provided link to "restore" their account - doing so will redirect them to a NAB-branded phishing page. Source: 9 NEWS

Attention German HR departments: You may want to cross off a certain “Eva Richter” from your list of employment candidates. Especially because her so-called résumé actually infects recipients with the destructive Ordinypt Wiper malware, according to a new report. The fake résumé phishing campaign began on Sept. 11 and is specifically aimed at German-speaking employers, Bleeping Computer reported this past weekend. The campaign sends an email that appears to be a job application, replete with photo and résumé of...

The Guardian's SecureDrop whistleblower submission site was targeted with a phishing page that attempted to harvest the unique "codenames" for sources who submitted information using the service. In addition, this phishing page promoted an Android app that allowed attackers to perform a variety of malicious activity on a victim's device. SecureDrop is a service that media organizations can install on the Tor network in order to allow whistleblowers or sources to submit anonymous information to journalists.  For...

An unsecured database containing 18GB of data exposed more than 20 million records, most of which held details about Ecuadorian citizens. Researchers have discovered a misconfigured database containing 18GB of information, including 20.8 million personal records. Most of the individuals affected are in Ecuador, which to put the leak into context, has a population of only 16.6 million; 6.7 million are children. The difference between the number of records and Ecuador's population can be attributed...