Latest Cybersecurity News and Articles

---

Attribute-Based Encryption Could Spell the End of Data Compromise

Attribute-based encryption (ABE) offers fine-grained access to data, revolutionizing data protection and access control. ABE has diverse real-world applications, from privacy protection in surveillance videos to securing electronic medical records.

---

TensorFlow CI/CD Flaw Exposed Supply Chain to Poisoning Attacks

Continuous integration and continuous delivery (CI/CD) misconfigurations discovered in the open-source TensorFlow machine learning framework could have been exploited to orchestrate supply chain attacks. The misconfigurations could be abused by an attacker to "conduct a supply chain compromise of TensorFlow releases on GitHub and PyPi by compromising TensorFlow's build agents via

---

Buggy API on Insurance Firm TTIBI's Website Leaked Over 650,000 Email Messages

A security researcher Eaton Zveare discovered a misconfigured server belonging to Toyota Tsusho Insurance Broker India (TTIBI), which exposed over 650,000 Microsoft-hosted email messages.

---

Chinese Drones Pose Threat to US Infrastructure, CISA Warns

The U.S. Cybersecurity and Infrastructure Security Agency and the FBI are warning critical infrastructure owners about the potential security risks posed by Chinese-manufactured unmanned aircraft systems (UAS).

---

iShutdown Method Allows to Discover Spyware Infections on iPhones

The presence of spyware, such as Pegasus, Predator, and Reign, can be identified by examining the Shutdown.log file for anomalous log entries related to processes delaying the reboot.

---

MFA Spamming and Fatigue: When Security Measures Go Wrong

In today's digital landscape, traditional password-only authentication systems have proven to be vulnerable to a wide range of cyberattacks. To safeguard critical business resources, organizations are increasingly turning to multi-factor authentication (MFA) as a more robust security measure. MFA requires users to provide multiple authentication factors to verify their identity, providing an

---

Researcher Uncovers Massive Password Dump Containing 71 Million Unique Credentials

A massive data tranch containing nearly 71 million unique credentials, including 25 million previously unseen passwords, has been circulating on the internet for at least four months.

---

Bigpanzi Botnet Infects 170,000 Android TV Boxes With Malware

The malware tools used by Bigpanzi, including 'pandoraspear' and 'pcdn,' enable the cybercriminals to hijack DNS settings, establish C2 communication, build a peer-to-peer CDN, and execute DDoS attacks on infected devices.

---

Cooper Aerobics Data Security Incident Raises Concerns of Personal Information Exposure

The breach involved sensitive data such as financial details, SSNs, and health-related information. While there is no evidence of identity theft or financial fraud, the firm is taking precautionary measures and offering support to affected people.

---

FTC Joins Global Data Security and Privacy Investigative Consortium

This nonbinding consortium aims to assist privacy investigators worldwide and facilitate seamless collaboration in law enforcement investigations and actions involving privacy and data security.

---

Iranian Hackers Masquerade as Journalists to Spy on Israel-Hamas War Experts

The group's latest intrusion set involves using lures related to the Israel-Hamas war, sending malicious links disguised as innocuous emails, and utilizing breached accounts to build trust with targets.

---

PixieFail UEFI Flaws Expose Millions of Computers to RCE, DoS, and Data Theft

Multiple security vulnerabilities have been disclosed in the TCP/IP network protocol stack of an open-source reference implementation of the Unified Extensible Firmware Interface (UEFI) specification used widely in modern computers. Collectively dubbed PixieFail by Quarkslab, the nine issues reside in the TianoCore EFI Development Kit II (EDK II) and could be exploited to

---

Vendor Email Attacks Surged by 137% in Financial Sector in 2023

The financial services industry has seen a significant increase in Vendor Email Compromise (VEC) and Business Email Compromise (BEC) attacks, with VEC attacks causing millions of dollars in losses.

---

Indian Air Force Potentially Targeted With Info-Stealing Malware

The malware used in the campaign, a variant of Go Stealer, targets browsers like Firefox, Chrome, Edge, and Brave, and uses Slack for data exfiltration to blend in with regular business traffic.

---

National Bank of Angola Says it Mitigated Cyberattack

The National Bank of Angola is trying to reassure the country that its financial system is secure following a cyberattack on January 6. No hacking group has taken credit for the incident.

---

Clearview Resources Ltd Hit by Cyberattack, Suffers $1.5 Million in Damages

A cyberattack on the Canadian energy producer Clearview Resources Ltd resulted in a US$1.5 million financial loss. The attack involved the compromise of an internal email address, leading to the redirection of company funds to a third-party account.

---

Iranian Hackers Masquerade as Journalists to Spy on Israel-Hamas War Experts

High-profile individuals working on Middle Eastern affairs at universities and research organizations in Belgium, France, Gaza, Israel, the U.K., and the U.S. have been targeted by an Iranian cyber espionage group called Mind Sandstorm since November 2023. The threat actor "used bespoke phishing lures in an attempt to socially engineer targets into downloading malicious files," the

---

Vulnerabilities Discovered in Android-based POS Terminals From PAX Technology

The PoS terminals from PAX Technology, based on Android, are found to have several vulnerabilities that can be exploited to execute arbitrary code or commands, according to a report by STM Cyber.

---

E-Crime Rapper ‘Punchmade Dev’ Debuts Card Shop

The rapper and social media personality Punchmade Dev is perhaps best known for his flashy videos singing the praises of a cybercrime lifestyle. With memorable hits such as "Internet Swiping" and "Million Dollar Criminal" earning millions of views, Punchmade has leveraged his considerable following to peddle tutorials on how to commit financial crimes online. But until recently, there wasn't much to support a conclusion that Punchmade was actually doing the cybercrime things he promotes in his songs.

---

Detained Russian Student Allegedly Helped Ukrainian Hackers With Cyberattacks

A Russian tech student faces treason charges for allegedly helping Ukrainian hackers carry out cyberattacks against Russia, revealing the ongoing cyberwar between the two countries.