Language Selection

English French German Italian Portuguese Spanish

Security Leftovers

Filed under
Security
  • Ready Set & Go!!!

    I added a new “Security Repository” today. What is that? It is unlike the normal security repositories. I added thousands of tools to allow you to do penetration testing. Get this I will be the target. I have spent months closing security holes. Repostorm put me way ahead of Ubuntu as well Kali Linux off the rip. I am working on bringing UNO (Ultimate Network Optimizer) not only to Optimize, but as a security tool. I am still not done, eventually I will drop my IP online and ask you to hack me. Proper term is crack me. Software I am writing is getting off the chain. 93% is where I have been at. Still have internet and still access my network.

  • Ransomware “Paralyzes” Spanish Employment Agency

    Although the payroll system is said not to be affected, face-to-face appointments have had to be cancelled around the country, as the attack has knocked out workstations in 710 SEPE offices and the laptops of remote workers, according to trade union CSIF. It claimed the agency had been “paralyzed” by the attack.

  • Microsoft Exchange Server hacks ‘doubling’ every two hours

    According to Check Point Research (CPR), threat actors are actively exploiting four zero-day vulnerabilities tackled with emergency fixes issued by Microsoft on March 2 -- and attack attempts continue to rise.

    In the past 24 hours, the team has observed "exploitation attempts on organizations doubling every two to three hours."

    The countries feeling the brunt of attack attempts are Turkey, the United States, and Italy, accounting for 19%, 18%, and 10% of all tracked exploit attempts, respectively.

  • Everything you need to know about the Microsoft Exchange Server hack
  • Microsoft Delivers Patches for 89 Vulnerabilities in March Security Release

    The March bundle is 60 percent larger than last month's update Tuesday tally, according to Eric Feldman, a senior product marketing manager at software security solutions company Automox, in a patch Tuesday "Overview" article. The March patches contain 14 CVEs rated "Critical," with five under active exploit.

  • Nim-Based Malware Loader Spreads Via Spear-Phishing Emails

    Spear-phishing emails are spreading the NimzaLoader malware loader, which some say may be used to download Cobalt Strike.

    The TA800 threat group is distributing a malware loader, which researchers call NimzaLoader, via ongoing, highly-targeted spear-phishing emails.

    [...]

    They cited several major differences between NimzaLoader and BazaLoader: For instance, the two samples use different code-flattening obfuscators, different styles of string decryption and different XOR/rotate-based Windows API hashing algorithms, they said. Other tactics that set NimzaLoader apart include the fact that the malware doesn’t use a domain-generation algorithm and that it makes use of JSON in its command-and-control (C2) communications.

  • Third French hospital hit by cyberattack

    A hospital in southwest France has seen some of its IT systems paralysed by a "ransomware" cyberattack, its management said Tuesday, the third such incident in the last month.

    The 320-bed facility in Oloron-Sainte-Marie near the Pyrenees mountains was hit by the attack on Monday, with screens displaying a demand in English for $50,000 in Bitcoin.

    Hospital workers have had to revert to working with pens and paper, since digital patient records are not available.

    The management system, used to monitor medicine stocks and other supplies, has also been affected at a time when the hospital is taking part in vaccination efforts against COVID-19.

  • Cyberattacks against K-12 schools rose 18% in 2020, report finds

    And while the first three months of 2020 were largely a continuation of the trends of 2019 — a year in which ransomware against the education sector surged — the onset of the COVID-19 pandemic create new threats for schools, all while officials’ were scrambling to outfit teachers and students for virtual learning environments.

Microsoft's Exchange Server Security Problem Is Gaining Steam

  • Microsoft's Exchange Server Security Problem Is Gaining Steam

    The handful of Exchange Server zero-day flaws Microsoft announced earlier this month has snowballed into a much broader problem.

    On March 2, Microsoft issued out-of-band security patches to address four zero-day Exchange Server flaws being exploited by an advanced persistent threat group (APT) it dubbed "Hafnium." The Hafnium group is thought to have used the four flaws in combination to carry out a widespread government and industry espionage campaign.

    Microsoft is now warning that unpatched Exchange Servers are getting attacked to install ransomware dubbed "DearCry." This new ransomware apparently was first detected and reported by researcher Michael Gillespie at the ID-Ransomware Web site, per this Friday Kaspersky Threatpost article.

    Since March 2, attacks on Exchange Server implementations worldwide have "tripled every two hours," according to a Thursday announcement by Check Point Software. Notably, the spike in activity seems to be coming from other attackers besides the Hafnium APT group because they aren't completing all of the attack steps.

    "To date, hackers have yet to carry out the full chain of attack successfully," the Check Point researchers noted regarding these more recent Exchange Server attacks.

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

More in Tux Machines

digiKam 7.7.0 is released

After three months of active maintenance and another bug triage, the digiKam team is proud to present version 7.7.0 of its open source digital photo manager. See below the list of most important features coming with this release. Read more

Dilution and Misuse of the "Linux" Brand

Samsung, Red Hat to Work on Linux Drivers for Future Tech

The metaverse is expected to uproot system design as we know it, and Samsung is one of many hardware vendors re-imagining data center infrastructure in preparation for a parallel 3D world. Samsung is working on new memory technologies that provide faster bandwidth inside hardware for data to travel between CPUs, storage and other computing resources. The company also announced it was partnering with Red Hat to ensure these technologies have Linux compatibility. Read more

today's howtos

  • How to install go1.19beta on Ubuntu 22.04 – NextGenTips

    In this tutorial, we are going to explore how to install go on Ubuntu 22.04 Golang is an open-source programming language that is easy to learn and use. It is built-in concurrency and has a robust standard library. It is reliable, builds fast, and efficient software that scales fast. Its concurrency mechanisms make it easy to write programs that get the most out of multicore and networked machines, while its novel-type systems enable flexible and modular program constructions. Go compiles quickly to machine code and has the convenience of garbage collection and the power of run-time reflection. In this guide, we are going to learn how to install golang 1.19beta on Ubuntu 22.04. Go 1.19beta1 is not yet released. There is so much work in progress with all the documentation.

  • molecule test: failed to connect to bus in systemd container - openQA bites

    Ansible Molecule is a project to help you test your ansible roles. I’m using molecule for automatically testing the ansible roles of geekoops.

  • How To Install MongoDB on AlmaLinux 9 - idroot

    In this tutorial, we will show you how to install MongoDB on AlmaLinux 9. For those of you who didn’t know, MongoDB is a high-performance, highly scalable document-oriented NoSQL database. Unlike in SQL databases where data is stored in rows and columns inside tables, in MongoDB, data is structured in JSON-like format inside records which are referred to as documents. The open-source attribute of MongoDB as a database software makes it an ideal candidate for almost any database-related project. This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of the MongoDB NoSQL database on AlmaLinux 9. You can follow the same instructions for CentOS and Rocky Linux.

  • An introduction (and how-to) to Plugin Loader for the Steam Deck. - Invidious
  • Self-host a Ghost Blog With Traefik

    Ghost is a very popular open-source content management system. Started as an alternative to WordPress and it went on to become an alternative to Substack by focusing on membership and newsletter. The creators of Ghost offer managed Pro hosting but it may not fit everyone's budget. Alternatively, you can self-host it on your own cloud servers. On Linux handbook, we already have a guide on deploying Ghost with Docker in a reverse proxy setup. Instead of Ngnix reverse proxy, you can also use another software called Traefik with Docker. It is a popular open-source cloud-native application proxy, API Gateway, Edge-router, and more. I use Traefik to secure my websites using an SSL certificate obtained from Let's Encrypt. Once deployed, Traefik can automatically manage your certificates and their renewals. In this tutorial, I'll share the necessary steps for deploying a Ghost blog with Docker and Traefik.