Microsoft Issues Patch for aCropalypse Privacy Flaw in Windows Screenshot Tools

Microsoft Issues Patch for aCropalypse Privacy Flaw in Windows Screenshot Tools,

Microsoft has released an out-of-band update to address a privacy-defeating flaw in its screenshot editing tool for Windows 10 and Windows 11.
The issue, dubbed aCropalypse, could enable malicious actors to recover edited portions of screenshots, potentially revealing sensitive information that may have been cropped out.
Tracked as CVE-2023-28303, the vulnerability is rated 3.3 on the CVSS

,

Microsoft has released an out-of-band update to address a privacy-defeating flaw in its screenshot editing tool for Windows 10 and Windows 11.
The issue, dubbed aCropalypse, could enable malicious actors to recover edited portions of screenshots, potentially revealing sensitive information that may have been cropped out.
Tracked as CVE-2023-28303, the vulnerability is rated 3.3 on the CVSS

, ,
https://thehackernews.com/2023/03/microsoft-issues-patch-for-acropalypse.html

U.K. National Crime Agency Sets Up Fake DDoS-For-Hire Sites to Catch Cybercriminals

U.K. National Crime Agency Sets Up Fake DDoS-For-Hire Sites to Catch Cybercriminals,

In what’s a case of setting a thief to catch a thief, the U.K. National Crime Agency (NCA) revealed that it has created a network of fake DDoS-for-hire websites to infiltrate the online criminal underground.
« All of the NCA-run sites, which have so far been accessed by around several thousand people, have been created to look like they offer the tools and services that enable cyber criminals to

,

In what’s a case of setting a thief to catch a thief, the U.K. National Crime Agency (NCA) revealed that it has created a network of fake DDoS-for-hire websites to infiltrate the online criminal underground.
« All of the NCA-run sites, which have so far been accessed by around several thousand people, have been created to look like they offer the tools and services that enable cyber criminals to

, ,
https://thehackernews.com/2023/03/uk-national-crime-agency-sets-up-fake.html

Microsoft Warns of Stealthy Outlook Vulnerability Exploited by Russian Hackers

Microsoft Warns of Stealthy Outlook Vulnerability Exploited by Russian Hackers,

Microsoft on Friday shared guidance to help customers discover indicators of compromise (IoCs) associated with a recently patched Outlook vulnerability.
Tracked as CVE-2023-23397 (CVSS score: 9.8), the critical flaw relates to a case of privilege escalation that could be exploited to steal NT Lan Manager (NTLM) hashes and stage a relay attack without requiring any user interaction.
« External

,

Microsoft on Friday shared guidance to help customers discover indicators of compromise (IoCs) associated with a recently patched Outlook vulnerability.
Tracked as CVE-2023-23397 (CVSS score: 9.8), the critical flaw relates to a case of privilege escalation that could be exploited to steal NT Lan Manager (NTLM) hashes and stage a relay attack without requiring any user interaction.
« External

, ,
https://thehackernews.com/2023/03/microsoft-warns-of-stealthy-outlook.html

OpenAI Reveals Redis Bug Behind ChatGPT User Data Exposure Incident

OpenAI Reveals Redis Bug Behind ChatGPT User Data Exposure Incident,

OpenAI on Friday disclosed that a bug in the Redis open source library was responsible for the exposure of other users’ personal information and chat titles in the upstart’s ChatGPT service earlier this week.
The glitch, which came to light on March 20, 2023, enabled certain users to view brief descriptions of other users’ conversations from the chat history sidebar, prompting the company to

,

OpenAI on Friday disclosed that a bug in the Redis open source library was responsible for the exposure of other users’ personal information and chat titles in the upstart’s ChatGPT service earlier this week.
The glitch, which came to light on March 20, 2023, enabled certain users to view brief descriptions of other users’ conversations from the chat history sidebar, prompting the company to

, ,
https://thehackernews.com/2023/03/openai-reveals-redis-bug-behind-chatgpt.html

Malicious Python Package Uses Unicode Trickery to Evade Detection and Steal Data

Malicious Python Package Uses Unicode Trickery to Evade Detection and Steal Data,

A malicious Python package on the Python Package Index (PyPI) repository has been found to use Unicode as a trick to evade detection and deploy an info-stealing malware.
The package in question, named onyxproxy, was uploaded to PyPI on March 15, 2023, and comes with capabilities to harvest and exfiltrate credentials and other valuable data. It has since been taken down, but not before attracting

,

A malicious Python package on the Python Package Index (PyPI) repository has been found to use Unicode as a trick to evade detection and deploy an info-stealing malware.
The package in question, named onyxproxy, was uploaded to PyPI on March 15, 2023, and comes with capabilities to harvest and exfiltrate credentials and other valuable data. It has since been taken down, but not before attracting

, ,
https://thehackernews.com/2023/03/malicious-python-package-uses-unicode.html

THN Webinar: Inside the High Risk of 3rd-Party SaaS Apps

THN Webinar: Inside the High Risk of 3rd-Party SaaS Apps,

Any app that can improve business operations is quickly added to the SaaS stack. However, employees don’t realize that this SaaS-to-SaaS connectivity, which typically takes place outside the view of the security team, significantly increases risk.
Whether employees connect through Microsoft 365, Google Workspace, Slack, Salesforce, or any other app, security teams have no way to quantify their

,

Any app that can improve business operations is quickly added to the SaaS stack. However, employees don’t realize that this SaaS-to-SaaS connectivity, which typically takes place outside the view of the security team, significantly increases risk.
Whether employees connect through Microsoft 365, Google Workspace, Slack, Salesforce, or any other app, security teams have no way to quantify their

, ,
https://thehackernews.com/2023/03/thn-webinar-inside-high-risk-of-3rd.html

GitHub Swiftly Replaces Exposed RSA SSH Key to Protect Git Operations

GitHub Swiftly Replaces Exposed RSA SSH Key to Protect Git Operations,

Cloud-based repository hosting service GitHub said it took the step of replacing its RSA SSH host key used to secure Git operations « out of an abundance of caution » after it was briefly exposed in a public repository.
The activity, which was carried out at 05:00 UTC on March 24, 2023, is said to have been undertaken as a measure to prevent any bad actor from impersonating the service or

,

Cloud-based repository hosting service GitHub said it took the step of replacing its RSA SSH host key used to secure Git operations « out of an abundance of caution » after it was briefly exposed in a public repository.
The activity, which was carried out at 05:00 UTC on March 24, 2023, is said to have been undertaken as a measure to prevent any bad actor from impersonating the service or

, ,
https://thehackernews.com/2023/03/github-swiftly-replaces-exposed-rsa-ssh.html

Researchers Uncover Chinese Nation State Hackers’ Deceptive Attack Strategies

Researchers Uncover Chinese Nation State Hackers’ Deceptive Attack Strategies

,

A recent campaign undertaken by Earth Preta indicates that nation-state groups aligned with China are getting increasingly proficient at bypassing security solutions.
The threat actor, active since at least 2012, is tracked by the broader cybersecurity community under Bronze President, HoneyMyte, Mustang Panda, RedDelta, and Red Lich.
Attack chains mounted by the group commence with a

,

A recent campaign undertaken by Earth Preta indicates that nation-state groups aligned with China are getting increasingly proficient at bypassing security solutions.
The threat actor, active since at least 2012, is tracked by the broader cybersecurity community under Bronze President, HoneyMyte, Mustang Panda, RedDelta, and Red Lich.
Attack chains mounted by the group commence with a

, ,
https://thehackernews.com/2023/03/researchers-uncover-chinese-nation.html

Critical WooCommerce Payments Plugin Flaw Patched for 500,000+ WordPress Sites

Critical WooCommerce Payments Plugin Flaw Patched for 500,000+ WordPress Sites,

Patches have been released for a critical security flaw impacting the WooCommerce Payments plugin for WordPress, which is installed on over 500,000 websites.
The flaw, if left unresolved, could enable a bad actor to gain unauthorized admin access to impacted stores, the company said in an advisory on March 23, 2023. It impacts versions 4.8.0 through 5.6.1.
Put differently, the issue could permit

,

Patches have been released for a critical security flaw impacting the WooCommerce Payments plugin for WordPress, which is installed on over 500,000 websites.
The flaw, if left unresolved, could enable a bad actor to gain unauthorized admin access to impacted stores, the company said in an advisory on March 23, 2023. It impacts versions 4.8.0 through 5.6.1.
Put differently, the issue could permit

, ,
https://thehackernews.com/2023/03/critical-woocommerce-payments-plugin.html

Comment la police a utilisé un AirTag pour piéger des trafiquants de drogue

Comment la police a utilisé un AirTag pour piéger des trafiquants de drogue,

Les AirTags, d'Apple.

N’en déplaise à Apple, la police fédérale américaine s’est servie d’un AirTag pour enquêter sur un trafic de drogues.

,

Les AirTags, d'Apple.

N’en déplaise à Apple, la police fédérale américaine s’est servie d’un AirTag pour enquêter sur un trafic de drogues.

, ,
https://www.01net.com/actualites/comment-police-utilise-airtag-pieger-trafiquants-drogues.html