A new Plundervolt attack is impacting Intel CPUs, an expert from KnowBe4 offers perspective. “Modern processors are being pushed to perform faster than ever before – and with this comes increases in heat and power consumption. To manage this, many chip manufacturers allow frequency and voltage to be adjusted as and when needed. But more than that, they offer the user the opportunity to modify the frequency and voltage through priviledged software interfaces. With Plundervolt we showed that these software interfaces can be exploited to undermine the system’s security. We were able to corrupt the integrity of Intel SGX on…
ISBuzz Team
A recently discovered phishing campaign uses a novel approach to infiltrating Office365 accounts: through the Microsoft OAuth API. This continues a trend of hackers exploiting recognizable software companies in order to convince users to accept malware, including another Microsoft vulnerability that compromised account tokens.
Scammers are masquerading as The Elder Scrolls Online developers and sending Playstation private messages that state your account will be banned if you do not provide your login credentials within 15 minutes The full text of this phishing scam can be read below: We have noticed some unusual activity involving this Account. To be sure you are the rightful owner, we require you to response to this alert with the following Account information so that you may be verified, – Email Address – Password – Date of Birth on the Account In response to a violation of these Terms of…
With the UK general election just days away and the attempted labour data breach still fresh on everyone’s minds, I thought it might be topical for an angle around election security. Disinformation and fake news campaigns continue to hit the headlines, especially given Boris Johnson is under increasing pressure to release a report on Russian meddling in Brexit vote before the general election. The type of threats around election security and how they might influence the outcome of an election State sponsored attacks Technical cyber attacks Data leaks Mis-Information campaigns Ransomware attacks
The FBI has warned that “hackers can use those innocent devices to do a virtual drive-by of your digital life.” The issue is the smart digital technologies encroaching into all aspects of our lives: “Unsecured devices can allow hackers a path into your router, giving the bad guy access to everything else on your home network that you thought was secure. Are private pictures and passwords safely stored on your computer? Don’t be so sure.” The FBI suggests that to secure home networks, “your fridge and your laptop should not be on the same network—keep private, sensitive data on a separate system from…
A series of spoofed emails enabled a Hong Kong-based hacker to make off with a million dollars Researchers at leading cyber-security company Check Point have revealed how Chinese hackers were able to steal $1 million from a Chinese venture capital firm through a simple but convincing business email compromise (BEC) scam. The $1M was seed funding that was intended for an Israeli start-up company. Neither the VC nor the start-up suspected anything was wrong, until the start-up realized they hadn’t received the funding. Both sides then got on the phone and quickly realised that the money had been stolen. The…
Microsoft’s threat research team has scanned all Microsoft user accounts and found that 44 million were using usernames and passwords that have been leaked online following security breaches at other online services. https://twitter.com/Jorgenhauge/status/1202924427937140738
Cybercriminals are now perfecting deepfakes to impersonate people to steal money and anything that might be valuable. The technology has been improved to reach a higher level where it becomes difficult tell the difference between a fraud or friend. https://twitter.com/gabrielwilder/status/1202500978785705984
It has been reported that OpenBSD has patched four vulnerabilities including privilege escalation flaws and a remotely exploitable authentication bypass.
CyrusOne, one of the biggest data centre providers in the US, has suffered a ransomware attack, ZDNet has learned. CyrusOne is currently working with law enforcement and forensics firms to investigate the attack and is also helping customers restore lost data from backups. The incident took place yesterday and was caused by a version of the REvil (Sodinokibi) ransomware. This is the same ransomware family that hit several managed service providers in June, over 20 Texas local governments in early August, and 400+ US dentist offices in late August. https://twitter.com/JinsonCyberSec/status/1202522273883680768