Password woes apparently aren’t limited to endpoints. US-CERT issued an advisory Tuesday warning users of Samsung printers, including some Dell printers manufactured by Samsung, that a hardcoded password could enable remote code execution.“Samsung printers contain a hardcoded SNMP full read-write community string that remains active even when SNMP is disabled in the printer management utility,” the CERT advisory said.
A new cross-site scripting exploit that enables attackers to steal cookies and access Yahoo email accounts is for sale in an exclusive underground market for $700, less than half of market value according to the hacker.The attack steals session cookies for Yahoo email and could allow an attacker to access the account and read or send messages, said Krebs on Security which reported the vulnerability to Yahoo.
The saga of the latest zero-day vulnerability and exploit for the Google Chrome browser took another mysterious turn over the weekend. The 19-year-old Georgian security researcher who found the vulnerability in the browser was called up for compulsory military duty in his country and was unable to deliver his presentation Saturday at the Malcon security conference in India.
Attackers had two months of unfettered access to South Carolina’s Department of Revenue systems in a classic targeted attack that began with a phishing email and ended with the loss of electronic tax return data, and payment card and personal information on 3.8 million filers, possibly dating back to 1998.
The French government has accused the United States of using Flame malware to break into the computer networks inside France’s presidential palace, the Elysee.
The criminals behind Operation High Roller, a complex wire-fraud scheme that has scammed high-end banking customers out of millions, have added a new dimension of automation to their attacks and expanded their efforts beyond Europe and have targeted a major U.S. bank.
Don’t expect any relief from the current assault on Java. A new sandbox-escape exploit targeting a vulnerability in the Java Runtime Environment has been integrated into both the Black Hole and Gong Da exploit kits, setting the stage for additional attacks, researchers said.
Try to dampen your innate cynicism for one second, forget the source of this next comment, and absorb it: “We need resilient defenses.” Dr. Steve King uttered those words at a small security event in Boston last week. Four simple words you’ve heard before that today make so much sense.
Adobe has addressed a denial-of-service vulnerability in the ColdFusion platform and an update is available.ColdFusion is Adobe’s platform and application server used by developers to build Web applications.
FreeBSD is warning users of the open source UNIX-like operating system about a compromise of a pair of servers used to build third-party software. The organization said attackers had sufficient access to affect third-party packages distributed by the project and suggests that any software installed between Sept. 19 and Nov. 11 be updated.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
