A recent investigation by Bitsight TRACE has uncovered several critical 0-day vulnerabilities in six Automatic Tank Gauge (ATG) systems from five different vendors. These vulnerabilities are substantial real-world threats, with the potential for exploitation by malicious actors, leading to severe consequences such as physical damage, environmental harm, and financial losses. Even more alarming is that, despite repeated warnings, thousands of ATGs remain online and directly accessible via the internet, making them highly vulnerable to cyberattacks, particularly in sabotage or cyberwarfare contexts. Industrial Control Systems (ICS) form the backbone of modern critical infrastructure, with ATG systems playing a key role in…
Author: ISB Staff Reporter
The U.S. Department of Justice (DOJ) has indicted three Iranian nationals linked to the Islamic Revolutionary Guard Corps (IRGC) for orchestrating a cyberattack aimed at influencing the 2024 US presidential election. The indictment, unsealed today, charges Masoud Jalili, Seyyed Ali Aghamiri, and Yaser Balaghi with a conspiracy to hack into the accounts of US political figures, media members, and campaign officials in a coordinated “hack-and-leak” operation. The aim of the campaign was to stoke discord, erode confidence in the electoral process, and acquire sensitive information for the IRGC’s benefit. According to the DOJ, the three hackers targeted officials and individuals…
Cybersecurity researchers identified critical vulnerabilities in Kia vehicles, revealing that attackers could remotely control cars using only a license plate number. The vulnerabilities were first identified in June this year and have since been patched, but the potential impact has raised serious concerns about vehicle security. Hacked in 30 Seconds On 11 June 2024, a team of hackers Neiko Rivera, Sam Curry, Justin Rhinehart, and Ian Carroll) uncovered flaws in Kia’s vehicle systems that allowed them to execute commands on a car by entering its license plate. Within 30 seconds, they could control various vehicle functions, including unlocking doors, disabling…
The Cybersecurity and Infrastructure Security Agency (CISA) has once again raised alarms about the ongoing exploitation of operational technology (OT) and industrial control systems (ICS) across critical infrastructure sectors. The warning comes amid an active investigation into a cybersecurity incident at the City of Arkansas’s Water Treatment Facility, which was targeted early Sunday on 22 September, 2024. While the City of Arkansas City has reassured residents that its water supply remains safe and operations continue uninterrupted, the incident shines a light on the fact that malicious actors are targeting vital OT/ICS systems using relatively unsophisticated methods. Unsophisticated Attacks Still a…
Non-profit privacy watchdog noyb (None of Your Business) has filed a formal complaint against Mozilla, accusing the tech company of enabling a controversial tracking feature in its Firefox browser without user consent. The feature, dubbed “Privacy Preserving Attribution” (PPA), was introduced in a recent update and has sparked concern over the browser’s handling of user privacy. Despite its name, the feature allows Firefox to track user behavior across websites—taking control of tracking from individual websites and shifting it to the browser itself. While Mozilla claims this approach is less invasive than traditional cookie tracking, noyb argues that users were not…
Hackers have allegedly carried out a second Dell data breach within a week, compromising sensitive internal files via Atlassian tools. Allegedly, data from Jira, Jenkins, and Confluence has been exposed. Dell is currently investigating the initial breach. On 19 September 2024, Hackread.com published a report claiming a Dell data breach involving sensitive information on 10,863 employees. Hot on the heels of that incident, the same hacker responsible for the first breach now alleges that Dell has been breached again. The hacker, using the alias “grep” on the notorious Breach Forums platform, made these claims on 22 September. In the post,…
The PECB Conference 2024 is set to take place from 30 September to 3 October at the Van der Valk Hotel Breukelen in Amsterdam. This annual event will gather global experts, thought leaders, and professionals to explore the latest trends and challenges in cybersecurity, data protection, AI, and regulatory developments such as the EU AI Act. The conference will feature over 25 international speakers and more than 20 interactive sessions, with participants expected from over 100 countries. The agenda will cover a wide range of topics crucial for today’s rapidly evolving digital landscape, providing attendees with valuable insights and practical…
Recognizing that cyber criminals increasingly exploit software vulnerabilities, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has taken the lead with a new resource for software customers—the “Secure by Demand Guide.” The Guide is part of CISA’s ongoing effort to strengthen the cybersecurity resilience of businesses, organizations, and government agencies nationwide. The guide aims to help software customers actively strengthen the security of the software products they acquire. Key Recommendations for Software Customers CISA’s Guide offers software customers several ways to enhance their security through more thoughtful procurement practices. Here are the core takeaways: 1. Prioritize Security as a Key…
Attackers are employing AI-generated scripts, leveraging malvertising to distribute rogue PDF tools, and embedding malware in image files. These developments mark a significant shift in the threat landscape, accelerating the frequency and complexity of cyberattacks. This was revealed by HP’s latest Threat Insights Report, based on data from April to June 2024, which offers valuable information to help businesses stay ahead of cybercriminals’ evolving methods. Key Findings: AI Lowers the Barrier for Cybercriminals HP’s threat research identified that AI-assisted malware development is no longer speculative. A recent campaign targeting French speakers used VBScript and JavaScript scripts, which analysts believe were…
In a troubling development, the Necro Trojan has resurfaced on Google Play, infecting popular applications and reaching millions of Android devices worldwide. Kaspersky’s cybersecurity researchers discovered the Necro malware in various apps, including some available on official app stores like Google Play and others distributed through unofficial websites. This is not the first time Necro has exploited official channels—its previous attack in 2019 impacted over 100 million users. This new wave of infections is similarly alarming, with affected apps reaching over 11 million devices. Malware Hidden in Popular Apps The latest version of the Necro Trojan has been found in…
