News

A public exploit module for the BlueKeep Windows vulnerability has been added today to the open-source Metasploit penetration testing framework, developed by Rapid7 in collaboration with the open-source community. BlueKeep is a wormable remote code execution (RCE) security flaw discovered in the Windows Remote Desktop Protocol (RDP) service which enables unauthenticated attackers to run arbitrary code remotely, to launch denial of service attacks, and, in some cases, to take full control of unpatched systems. Source: Bleeping Computer

A web page pretending to offer an official application from PayPal is currently spreading a new variant of Nemty ransomware to unsuspecting users. It appears that the operators of this file-encrypting malware are trying various distribution channels as it was recently observed as a payload from the RIG exploit kit (EK). Source: Bleeping Computer

The job website says it cannot notify users since the exposure occurred on a third-party organization's servers. An unprotected Web server has been offering information on Monster.com users for some time — and neither Monster nor the third party it says purchased the data has notified the victims. According to reports, private information on job seekers using the site from 2014 through 2017 exposed includes phone numbers, home addresses, email addresses, and prior work experience. No...

Android smartphone users have been hit by a new malware - Joker. Aleksejs Kuprins, a security researcher at cybersecurity threat intelligence specialists CSIS Security Group, said 'Joker' spyware -- which derives its name from one of the command-and-control servers found by CSIS researchers -- has been detected in 24 apps that have collectively been installed over 472,000 times. Source: ZeeBiz

New Bedford, Massachusetts' refusal to pay a $5.3 million ransom highlights how victim towns and cities may be hitting the limit to what they're willing to spend to speed recovery. Cyber extortionists' ransom demands have surged in recent years, as ransomware cotinues to cripple the operations of manufacturers, hospitals, and — most recently — local governments. Yet those demands may have hit an upper limit. Source: Dark Reading

Tide's method for protecting passwords splinters them up into tiny pieces and stores them on distributed nodes. One method that cryptographers often use to protect a secret is to split it up into multiple smaller pieces and allocate the individual portions for safekeeping to various different parties. It's only when a certain minimum number of those parties bring their portions together that the secret can be reconstructed in its entirety. Source: Dark Reading

The summer school holiday has not ended for students in Flagstaff, Arizona, as a ransomware attack hitting the School District computers forces the decision to cancel classes for today. The schedule for tomorrow is uncertain. All schools are impacted by the incident and there are no after-school activities. The district learned of a "cybersecurity issue" on Wednesday morning. Source: Bleeping Computer

The U.S. Federal Bureau of Investigation (FBI) asked students not to make hoax threats via social media, emails, or text messages, in a warning published as part of its 'Think Before You Post' campaign. "The FBI takes these threats very seriously whether they come in the form of text messages, social media posts, or emails," said the FBI. "Law enforcement – whether the FBI or our local and state partners – will respond to each...

Server lacked password protection and included multiple databases with records from the U.S., U.K. and Vietnam. Phone numbers linked to the Facebook accounts of hundreds of millions of users has been found online on an insecure server in the latest privacy gaffe for the social media giant. The server, which lacked password protection, contained more than 419 million records over several databases of Facebook users across multiple geographies—including 133 million records of U.S.-based users–according to a...

The cost of breaches will rise by two-thirds over the next five years, exceeding an estimated $5 trillion in 2024, primarily driven by higher fines as more jurisdictions punish companies for lax security. Equifax, $700 million. British Airways, $221 million. Marriott, $120 million. Companies are seeing much heftier fines in 2019, and the near future holds little respite, according to experts. Source: Dark Reading