Is API Security on Your Radar?

Is API Security on Your Radar?,

With the growth in digital transformation, the API management market is set to grow by more than 30%  by the year 2025 as more businesses build web APIs and consumers grow to rely on them for everything from mobile apps to customized digital services.
As part of strategic business planning, an API helps generate revenue by allowing customers access to the functionality of a website or computer

,

With the growth in digital transformation, the API management market is set to grow by more than 30%  by the year 2025 as more businesses build web APIs and consumers grow to rely on them for everything from mobile apps to customized digital services.
As part of strategic business planning, an API helps generate revenue by allowing customers access to the functionality of a website or computer

, ,
https://thehackernews.com/2022/04/is-api-security-on-your-radar.html

Hackers Breach Mailchimp Email Marketing Firm to Launch Crypto Phishing Scams

Hackers Breach Mailchimp Email Marketing Firm to Launch Crypto Phishing Scams,

Email marketing service Mailchimp on Monday revealed a data breach that resulted in the compromise of an internal tool to gain unauthorized access to customer accounts and stage phishing attacks. 
The development was first reported by Bleeping Computer.
The company, which was acquired by financial software firm Intuit in September 2021, told the publication that it became aware of the incident

,

Email marketing service Mailchimp on Monday revealed a data breach that resulted in the compromise of an internal tool to gain unauthorized access to customer accounts and stage phishing attacks. 
The development was first reported by Bleeping Computer.
The company, which was acquired by financial software firm Intuit in September 2021, told the publication that it became aware of the incident

, ,
https://thehackernews.com/2022/04/hackers-breach-mailchimp-email.html

CISA Warns of Active Exploitation of Critical Spring4Shell Vulnerability

CISA Warns of Active Exploitation of Critical Spring4Shell Vulnerability,

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added the recently disclosed remote code execution (RCE) vulnerability affecting the Spring Framework, to its Known Exploited Vulnerabilities Catalog based on « evidence of active exploitation. »
The critical severity flaw, assigned the identifier CVE-2022-22965 (CVSS score: 9.8) and dubbed « Spring4Shell », impacts Spring

,

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added the recently disclosed remote code execution (RCE) vulnerability affecting the Spring Framework, to its Known Exploited Vulnerabilities Catalog based on « evidence of active exploitation. »
The critical severity flaw, assigned the identifier CVE-2022-22965 (CVSS score: 9.8) and dubbed « Spring4Shell », impacts Spring

, ,
https://thehackernews.com/2022/04/cisa-warns-of-active-exploitation-of.html

Researchers Uncover New Android Spyware With C2 Server Linked to Turla Hackers

Researchers Uncover New Android Spyware With C2 Server Linked to Turla Hackers,

An Android spyware application has been spotted masquerading as a « Process Manager » service to stealthily siphon sensitive information stored in the infected devices.
Interestingly, the app — that has the package name « com.remote.app » — establishes contact with a remote command-and-control server, 82.146.35[.]240, which has been previously identified as infrastructure belonging to the

,

An Android spyware application has been spotted masquerading as a « Process Manager » service to stealthily siphon sensitive information stored in the infected devices.
Interestingly, the app — that has the package name « com.remote.app » — establishes contact with a remote command-and-control server, 82.146.35[.]240, which has been previously identified as infrastructure belonging to the

, ,
https://thehackernews.com/2022/04/researchers-uncover-new-android-spyware.html

Multiple Hacker Groups Capitalizing on Ukraine Conflict for Distributing Malware

Multiple Hacker Groups Capitalizing on Ukraine Conflict for Distributing Malware,

At least three different advanced persistent threat (APT) groups from across the world have launched spear-phishing campaigns in mid-March 2022 using the ongoing Russo-Ukrainian war as a lure to distribute malware and steal sensitive information.
The campaigns, undertaken by El Machete, Lyceum, and SideWinder, have targeted a variety of sectors, including energy, financial, and governmental

,

At least three different advanced persistent threat (APT) groups from across the world have launched spear-phishing campaigns in mid-March 2022 using the ongoing Russo-Ukrainian war as a lure to distribute malware and steal sensitive information.
The campaigns, undertaken by El Machete, Lyceum, and SideWinder, have targeted a variety of sectors, including energy, financial, and governmental

, ,
https://thehackernews.com/2022/04/multiple-hacker-groups-capitalizing-on.html

Apple corrige en urgence deux failles zero-day dans iOS et macOS

Apple corrige en urgence deux failles zero-day dans iOS et macOS,

Les mises à jour colmatent des vulnérabilités qui permettent aux pirates d’exécuter du code arbitraire dans le kernel, ou d’y lire des données sensibles.

,

Les mises à jour colmatent des vulnérabilités qui permettent aux pirates d’exécuter du code arbitraire dans le kernel, ou d’y lire des données sensibles.

, ,
https://www.01net.com/actualites/apple-corrige-en-urgence-deux-failles-zero-day-dans-ios-et-macos-2055753.html

Brokenwire Hack Could Let Remote Attackers Disrupt Charging for Electric Vehicles

Brokenwire Hack Could Let Remote Attackers Disrupt Charging for Electric Vehicles,

A group of academics from the University of Oxford and Armasuisse S+T has disclosed details of a new attack technique against the popular Combined Charging System (CCS) that could potentially disrupt the ability to charge electric vehicles at scale.
Dubbed « Brokenwire, » the method interferes with the control communications that transpire between the vehicle and charger to wirelessly abort the

,

A group of academics from the University of Oxford and Armasuisse S+T has disclosed details of a new attack technique against the popular Combined Charging System (CCS) that could potentially disrupt the ability to charge electric vehicles at scale.
Dubbed « Brokenwire, » the method interferes with the control communications that transpire between the vehicle and charger to wirelessly abort the

, ,
https://thehackernews.com/2022/04/brokenwire-hack-could-let-remote.html

Experts Shed Light on BlackGuard Infostealer Malware Sold on Russian Hacking Forums

Experts Shed Light on BlackGuard Infostealer Malware Sold on Russian Hacking Forums,

A previously undocumented « sophisticated » information-stealing malware named BlackGuard is being advertised for sale on Russian underground forums for a monthly subscription of $200.
« BlackGuard has the capability to steal all types of information related to Crypto wallets, VPN, Messengers, FTP credentials, saved browser credentials, and email clients, » Zscaler ThreatLabz researchers Mitesh Wani

,

A previously undocumented « sophisticated » information-stealing malware named BlackGuard is being advertised for sale on Russian underground forums for a monthly subscription of $200.
« BlackGuard has the capability to steal all types of information related to Crypto wallets, VPN, Messengers, FTP credentials, saved browser credentials, and email clients, » Zscaler ThreatLabz researchers Mitesh Wani

, ,
https://thehackernews.com/2022/04/experts-shed-light-on-blackguard.html

Beastmode DDoS Botnet Exploiting New TOTOLINK Bugs to Enslave More Routers

Beastmode DDoS Botnet Exploiting New TOTOLINK Bugs to Enslave More Routers,

A variant of the Mirai botnet called Beastmode has been observed adopting newly disclosed vulnerabilities in TOTOLINK routers between February and March 2022 to infect unpatched devices and expand its reach potentially.
« The Beastmode (aka B3astmode) Mirai-based DDoS campaign has aggressively updated its arsenal of exploits, » Fortinet’s FortiGuard Labs Research team said. « Five new exploits were

,

A variant of the Mirai botnet called Beastmode has been observed adopting newly disclosed vulnerabilities in TOTOLINK routers between February and March 2022 to infect unpatched devices and expand its reach potentially.
« The Beastmode (aka B3astmode) Mirai-based DDoS campaign has aggressively updated its arsenal of exploits, » Fortinet’s FortiGuard Labs Research team said. « Five new exploits were

, ,
https://thehackernews.com/2022/04/beastmode-ddos-botnet-exploiting-new.html

15-Year-Old Bug in PEAR PHP Repository Could’ve Enabled Supply Chain Attacks

15-Year-Old Bug in PEAR PHP Repository Could’ve Enabled Supply Chain Attacks

,

A 15-year-old security vulnerability has been disclosed in the PEAR PHP repository that could permit an attacker to carry out a supply chain attack, including obtaining unauthorized access to publish rogue packages and execute arbitrary code.
« An attacker exploiting the first one could take over any developer account and publish malicious releases, while the second bug would allow the attacker

,

A 15-year-old security vulnerability has been disclosed in the PEAR PHP repository that could permit an attacker to carry out a supply chain attack, including obtaining unauthorized access to publish rogue packages and execute arbitrary code.
« An attacker exploiting the first one could take over any developer account and publish malicious releases, while the second bug would allow the attacker

, ,
https://thehackernews.com/2022/04/15-year-old-bug-in-pear-php-repository.html