Security Leftovers
-
LWN ☛ Security updates for Monday
Security updates have been issued by AlmaLinux (git-lfs, libsoup, and unbound), Debian (dcmtk, ffmpeg, openjdk-11, pam-u2f, and python-aiohttp), Fedora (buku, chromium, jpegxl, nodejs18, nodejs20, and rust-routinator), Mageia (clamav, kernel, kmod-virtualbox, kmod-xtables-addons & dwarves, and kernel-linus), SUSE (apptainer, bind, buildah, chromedriver, clamav, dovecot24, ignition, kubelogin, libjxl, libQt5Bluetooth5-32bit, orc, owasp-modsecurity-crs, python-pydantic, python311-ipython, and stb), and Ubuntu (linux-azure and netdata).
-
Scoop News Group ☛ From credit card fraud to zero-day exploits: Xe Group expanding cybercriminal efforts
The Vietnam-based group has grown more sophisticated since 2013, new research shows.
-
Security Week ☛ 1 Million Impacted by Data Breach at Connecticut Healthcare Provider
Community Health Center, Inc. says hackers stole the personal and health information of over one million individuals.
-
Security Week ☛ Insurance Company Globe Life Notifying 850,000 People of Data Breach
Insurance firm Globe Life says a threat actor may have compromised the personal information of roughly 850,000 individuals.
-
Security Week ☛ XE Group Cybercrime Gang Moves from Credit Card Skimming to Zero-Day Exploits
Vietnamese cybercrime gang shifts from credit card-skimming to exploiting at least two zero-day vulnerabilities enterprise software product.
-
Security Week ☛ Hundreds of Thousands Hit by Data Breaches at Healthcare Firms in Colorado, North Carolina
Hundreds of thousands have been impacted by data breaches at Asheville Eye Associates and Delta County Memorial Hospital District.
-
Security Week ☛ Casio Website Infected With Skimmer
A threat actor has infected Casio UK’s website with a web skimmer on all pages, except the typical checkout page.
-
Wladimir Palant ☛ Analysis of an advanced malicious Chrome extension
Two weeks ago I published an article on 63 malicious Chrome extensions. In most cases I could only identify the extensions as malicious. With large parts of their logic being downloaded from some web servers, it wasn’t possible to analyze their functionality in detail.
However, for the Download Manager Integration Checklist extension I have all parts of the puzzle now. This article is a technical discussion of its functionality that somebody tried very hard to hide. I was also able to identify a number of related extensions that were missing from my previous article.