Use an 8-char Windows NTLM password? Don’t. Every single one can be cracked in under 2.5hrs

In a Twitter post on Wednesday, those behind the software project said a hand-tuned build of the version 6.0.0 HashCat beta, utilizing eight Nvidia GTX 2080Ti GPUs in an offline attack, exceeded the NTLM cracking speed benchmark of 100GH/s (gigahashes per second). “Current password cracking benchmarks show that the minimum eight character password, no matter Read more about Use an 8-char Windows NTLM password? Don’t. Every single one can be cracked in under 2.5hrs[…]

QNAP NAS user? You’d better check your hosts file for mystery anti-antivirus entries

Network attached storage maker QNAP’s customers have reported being hit by a mystery issue that disables software updates by hijacking entries in host machines’ hosts file. The full effects are, as yet, unknown – but users have reported that the most visible symptom is that some 700 entries are added to the /etc/hosts file that Read more about QNAP NAS user? You’d better check your hosts file for mystery anti-antivirus entries[…]

Android phones can be hacked remotely by viewing malicious PNG image

Your Android could be pwned by simply viewing an innocent-looking image – be it from browsing the internet or an image received via text – according to the Android Security Bulletin issued this month. While this certainly doesn’t apply to all images, Google discovered that a maliciously crafted PNG image could be used to hijack Read more about Android phones can be hacked remotely by viewing malicious PNG image[…]

Unsecured MongoDB databases expose Kremlin’s single username / password backdoor into Russian businesses

A Dutch security researcher has stumbled upon the Kremlin’s backdoor account that the government had been using to access the servers of local and foreign businesses operating in Russia. The backdoor account was found inside thousands of MongoDB databases that had been left exposed online without a password. Any hacker who noticed the account could Read more about Unsecured MongoDB databases expose Kremlin’s single username / password backdoor into Russian businesses[…]

European Commission orders mass recall of creepy, leaky child-tracking Enox smartwatch

The latest weekly report includes German firm Enox’s Safe-KID-One watch, which is marketed to parents as a way of keeping tabs on their little ones – ostensibly to keep them safe – and comes with one-click buttons for speed-dialling family members. However, the commission said the device does not comply with the Radio Equipment Directive Read more about European Commission orders mass recall of creepy, leaky child-tracking Enox smartwatch[…]

Hi, Jack’d: A little PSA for anyone using this dating-hook-up app… Anyone can slurp your private, public snaps • The Register

Dating-slash-hook-up app Jack’d is exposing to the public internet intimate snaps privately swapped between its users, allowing miscreants to download countless X-rated selfies without permission. The phone application, installed more than 110,000 times on Android devices and also available for iOS, lets primarily gay and bi men chat each other up, exchange private and public Read more about Hi, Jack’d: A little PSA for anyone using this dating-hook-up app… Anyone can slurp your private, public snaps • The Register[…]

UAE used cyber super-weapon to spy on iPhones of foes

The cyber tool allowed the small Gulf country to monitor hundreds of targets beginning in 2016, from the Emir of Qatar and a senior Turkish official to a Nobel Peace laureate human-rights activist in Yemen, according to five former operatives and program documents reviewed by Reuters. The sources interviewed by Reuters were not Emirati citizens. Read more about UAE used cyber super-weapon to spy on iPhones of foes[…]

Defanged SystemD exploit code for security holes now out in the wild

In mid-January, Qualys, another security firm, released details about three flaws affecting systemd-journald, a systemd component that handles the collection and storage of log data. Patches for the vulnerabilities – CVE-2018-16864, CVE-2018-16865, and CVE-2018-16866 – have been issued by various Linux distributions. Exploitation of these code flaws allows an attacker to alter system memory in Read more about Defanged SystemD exploit code for security holes now out in the wild[…]

Criminals Are Tapping into the Phone Network Backbone using known insecure SS7 to Empty Bank Accounts

Sophisticated hackers have long exploited flaws in SS7, a protocol used by telecom companies to coordinate how they route texts and calls around the world. Those who exploit SS7 can potentially track phones across the other side of the planet, and intercept text messages and phone calls without hacking the phone itself. This activity was Read more about Criminals Are Tapping into the Phone Network Backbone using known insecure SS7 to Empty Bank Accounts[…]

Don’t Toss That Bulb, It Knows Your Password

As it turns out, giving every gadget you own access to your personal information and Internet connection can lead to unintended consequences. Who knew, right? But if you need yet another example of why trusting your home appliances with your secrets is potentially a bad idea, [Limited Results] is here to make sure you spend Read more about Don’t Toss That Bulb, It Knows Your Password[…]

Data Leak in Singapore Exposes HIV Status of 14,000 Locals and Foreign Visitors

Medical records and contact information belonging to thousands of HIV-positive Singaporeans and foreign visitors to the southeast Asian city state have been leaked online, according to an alert issued by the country’s Ministry of Health (MOH). In a statement on its website, the ministry said the confidential health information of some 14,200 individuals diagnosed with Read more about Data Leak in Singapore Exposes HIV Status of 14,000 Locals and Foreign Visitors[…]

Apple temporarily disables group FaceTime to fix a bug that lets you eavesdrop on your contacts

There was chaos on the internet late last night after 9to5Mac discovered a bug in Apple’s FaceTime video calling app that let you hear other person’s voice even before they answered your call. According to the report, a user running iOS 12.1 could potentially exploit the vulnerability to eavesdrop on others through a group FaceTime call. Read more about Apple temporarily disables group FaceTime to fix a bug that lets you eavesdrop on your contacts[…]

Tikkie: IBAN-numbers users exposed (Dutch)

De populaire betaal-app Tikkie biedt de mogelijkheid om geld over te boeken naar andere Tikkie-gebruikers op basis van hun 06-nummer. Daardoor was het mogelijk om de IBAN-nummers van vele nietsvermoedende Tikkie-gebruikers te achterhalen, met het gevaar voor identiteitsfraude en phishing. Dat blijkt uit onderzoek van RTL Nieuws. ABN Amro bevestigt de kwetsbaarheid en heeft de Read more about Tikkie: IBAN-numbers users exposed (Dutch)[…]

Heads up: Debian’s package manager is APT for root-level malware injection… Fix out now to thwart MITM hijacks

The Debian Project has patched a security flaw in its software manager Apt that can be exploited by network snoops to execute commands as root on victims’ boxes as they update or install packages. The Linux distro’s curators have pushed out an fix to address CVE-2019-3462, a vulnerability uncovered and reported by researcher Max Justicz. Read more about Heads up: Debian’s package manager is APT for root-level malware injection… Fix out now to thwart MITM hijacks[…]

Massive Oklahoma Government Data Leak Exposes 7 Years of FBI Investigations – unsecured rsync

Last December, a whopping 3 terabytes of unprotected data from the Oklahoma Securities Commission was uncovered by Greg Pollock, a researcher with cybersecurity firm UpGuard. It amounted to millions of files, many on sensitive FBI investigations, all of which were left wide open on a server with no password, accessible to anyone with an internet Read more about Massive Oklahoma Government Data Leak Exposes 7 Years of FBI Investigations – unsecured rsync[…]

Let’s Encrypt ends TLS-SNI-01 validation support

Let’s Encrypt allows subscribers to validate domain control using any one of a few different validation methods. For much of the time Let’s Encrypt has been operating, the options were “DNS-01”, “HTTP-01”, and “TLS-SNI-01”. We recently introduced the “TLS-ALPN-01” method. Today we are announcing that we will end all support for the TLS-SNI-01 validation method Read more about Let’s Encrypt ends TLS-SNI-01 validation support[…]

Online casino group leaks information on 108 million bets, including winner personal details

An online casino group has leaked information on over 108 million bets, including details about customers’ personal information, deposits, and withdrawals, ZDNet has learned. The data leaked from an ElasticSearch server that was left exposed online without a password, Justin Paine, the security researcher who discovered the server, told ZDNet. ElasticSearch is a portable, high-grade Read more about Online casino group leaks information on 108 million bets, including winner personal details[…]

Yes, you can remotely hack factory, building site cranes more easily than a garage door

Did you know that the manufacturing and construction industries use radio-frequency remote controllers to operate cranes, drilling rigs, and other heavy machinery? Doesn’t matter: they’re alarmingly vulnerable to being hacked, according to Trend Micro. Available attack vectors for mischief-makers include the ability to inject commands, malicious re-pairing and even the ability to create one’s own Read more about Yes, you can remotely hack factory, building site cranes more easily than a garage door[…]

Amazon’s Ring Security Cameras Allow Anyone to Watch Easily – And They Do!

But for some who’ve welcomed in Amazon’s Ring security cameras, there have been more than just algorithms watching through the lens, according to sources alarmed by Ring’s dismal privacy practices. Ring has a history of lax, sloppy oversight when it comes to deciding who has access to some of the most precious, intimate data belonging Read more about Amazon’s Ring Security Cameras Allow Anyone to Watch Easily – And They Do![…]

Welcome to 2019: Your Exchange server can be pwned by an email (and other bugs need fixing)

Among the 49 bug fixes were patches for remote code execution flaws in DHCP (CVE-2019-0547) and an Exchange memory corruption flaw (CVE-2019-0586) that Trend Micro ZDI researcher Dustin Childs warns is particularly dangerous as it can be exploited simply by sending an email to a vulnerable server. “That’s a bit of a problem, as receiving Read more about Welcome to 2019: Your Exchange server can be pwned by an email (and other bugs need fixing)[…]

At Blind – a whistleblower site -, a security lapse revealed private complaints from Silicon Valley employees. Turns out it’s not very safe to blow your whistle there after all.

Thousands of people trusted Blind, an app-based “anonymous social network,” as a safe way to reveal malfeasance, wrongdoing and improper conduct at their companies.But Blind left one of its database servers exposed without a password, making it possible (for anyone who knew where to look) to access each user’s account information and identify would-be whistleblowers. Read more about At Blind – a whistleblower site -, a security lapse revealed private complaints from Silicon Valley employees. Turns out it’s not very safe to blow your whistle there after all.[…]

EU Diplomatic Comms Network, Which the NSA Reportedly Warned Could Be Easily Hacked, Was Hacked. But contents were boring.

The European Union’s network used for diplomatic communications, COREU, was infiltrated “for years” by hackers, the New York Times reported on Tuesday, with the unknown rogues behind the attack reportedly reposting the stolen communiqués to an “open internet site.” The network in question connects EU leadership with other EU organizations, as well as the foreign Read more about EU Diplomatic Comms Network, Which the NSA Reportedly Warned Could Be Easily Hacked, Was Hacked. But contents were boring.[…]

NASA fears internal server hacked, staff personal info swiped by miscreants

A server containing personal information, including social security numbers, of current and former NASA workers may have been hacked, and its data stolen, it emerged today. According to an internal memo circulated among staff on Tuesday, in mid-October the US space agency investigated whether or not two of its machines holding employee records had been Read more about NASA fears internal server hacked, staff personal info swiped by miscreants[…]

Lenovo tells Asia-Pacific staff: Work lappy with your unencrypted data on it has been nicked

A corporate-issued laptop lifted from a Lenovo employee in Singapore contained a cornucopia of unencrypted payroll data on staff based in the Asia Pacific region, The Register can exclusively reveal. Details of the massive screw-up reached us from Lenovo staffers, who are simply bewildered at the monumental mistake. Lenovo has sent letters of shame to Read more about Lenovo tells Asia-Pacific staff: Work lappy with your unencrypted data on it has been nicked[…]

US Border Agents Keep Personal Data of 29000 Travelers on USBs, fail to delete them.

Last year, U.S. Customs and Border Protection (CBP) searched through the electronic devices of more than 29,000 travelers coming into the country. CBP officers sometimes upload personal data from those devices to Homeland Security servers by first transferring that data onto USB drives—drives that are supposed to be deleted after every use. But a new Read more about US Border Agents Keep Personal Data of 29000 Travelers on USBs, fail to delete them.[…]