Towards the end of November, a researcher from Alibaba discovered a fault (CVE-2021-44228) in a well known open-source logging library called Log4j. The researcher responsibly disclosed his finding to Log4j’s Apache Software Foundation. An additional vulnerability (CVE-2021-45105) was also discovered in a patch released to fix the initial vulnerability. This was then followed with yet another
Apple has released a patch for ‘zero-click vulnerability. What is a ‘zero-click’? It is a flaw which lets hackers access devices through the iMessage service even if users do not click on a link or file. One can imagine the power of this loop-whole. In a statement, Ivan Krstić, head of Apple Security Engineering and
This is a very serious leak as VPN (Virtual Private Network) username and passwords could undoubtedly allow the bad actors to access a network to perform all manner of activities including stealing date (data exfiltration), install hidden malware or perform ransomware attacks to extort money. Although the exploit relates to an already patched loop-whole, you should
A report from Citizen Lab about two zero iMessage vulnerabilities/exploit which require zero click, in spyware sold by the cyberweapons NSO Group. iMessage is the the default messaging app of Apple iPhone. It appears these attacks do not require victim to do anything. They neither click on a link or open a file. The victim receives
The white is pushing companies to adopt defensive measure after an unrepresented rise in ransomware attacks so far this year and in April and May in particular. “The bluntly worded open letter followed a string of escalating ransomware attacks that stopped gasoline and jet fuel from flowing up the East Coast and closed off beef
The Cybersecurity and Infrastructure Security Agency (CISA) has released a companion Splunk-based dashboard that helps review post-compromise activity in Microsoft Azure Active Directory (AD), Office 365 (O365), and Microsoft 365 (M365) environments.
