Tag Archive for: Bug’

Exclusive: Suspected Chinese hackers used SolarWinds bug to spy on U.S. payroll agency

/in


By Christopher Bing, Jack Stubbs, Raphael Satter and Joseph Menn



a group of people sitting in front of a building: FILE PHOTO: SolarWinds Corp. banner hangs on the company's IPO at the NYSE in New York

© Reuters/Brendan McDermid
FILE PHOTO: SolarWinds Corp. banner hangs on the company’s IPO at the NYSE in New York

WASHINGTON (Reuters) – Suspected Chinese hackers exploited a flaw in software made by SolarWinds Corp to help break into U.S. government computers last year, five people familiar with the matter told Reuters, marking a new twist in a sprawling cybersecurity breach that U.S. lawmakers have labeled a national security emergency.



a sign on the side of a building: FILE PHOTO: Exterior view of SolarWinds headquarters in Austin

© Reuters/SERGIO FLORES
FILE PHOTO: Exterior view of SolarWinds headquarters in Austin

Two people briefed on the case said FBI investigators recently found that the National Finance Center, a federal payroll agency inside the U.S. Department of Agriculture, was among the affected organizations, raising fears that data on thousands of government employees may have been compromised.

Loading...

Load Error

The software flaw exploited by the suspected Chinese group is separate from the one the United States has accused Russian government operatives of using to compromise up to 18,000 SolarWinds customers, including sensitive federal agencies, by hijacking the company’s Orion network monitoring software.

Security researchers have previously said a second group of hackers was abusing SolarWinds’ software at the same time as the alleged Russian hack, but the suspected connection to China and ensuing U.S. government breach have not been previously reported.

Reuters was not able to establish how many organizations were compromised by the suspected Chinese operation. The sources, who spoke on condition of anonymity to discuss ongoing investigations, said the attackers used computer infrastructure and hacking tools previously deployed by state-backed Chinese cyberspies.

The Chinese foreign ministry said attributing cyberattacks was a “complex technical issue” and any allegations should be supported with evidence. “China resolutely opposes and combats any form of cyberattacks and cyber theft,” it said in a statement.

SolarWinds said it was aware of a single customer that was compromised by the second set of hackers but that it had “not found anything…

Source…

Cisco DNA Center Bug Opens Enterprises to Remote Attack – Threatpost

/in



Cisco DNA Center Bug Opens Enterprises to Remote Attack  Threatpost

Source…

Google Warns of Critical Android Remote Code Execution Bug – Threatpost

/in



Google Warns of Critical Android Remote Code Execution Bug  Threatpost

Source…

Millions of Android users at security risk due to Google Play Store bug: Report

/in


Some of the popular dating, travel and video calling apps on Google Play Store are vulnerable to a known bug CVE-2020-8913, which can be exploited by threat actors to inject malicious codes into them and steal personal information or spy on users, researchers at Check Point found.

Check Point believes that hundreds of millions of Android users are still at significant security risk because of it.

Though Google had patched the bug in April and had rated it 8.8 out of 10 for its severity, many of the app developers are still using the outdated version of Google Core Library (GPC), which is where the bug was found. GPC enables developers to roll out in-app updates and new feature modules in their apps.

In September, researchers at Check Point randomly tested some of the popular Google Play Store apps and found that 13% of them were using GPC and 8% of them were still using the vulnerable version.

Bumble, OkCupid, Grindr, Microsoft Edge, Cisco Teams, Viber and Booking are some of the popular apps, which were red flagged by Check Point.

Check Point had notified the app developers about the vulnerability before making their findings public. Viber and Booking were among the first to update to the patched version, they claim.

“This described issue has been identified by our security team a month ago and it was fixed in Viber’s new version,” the company said in a statement to Mint.

“We’re estimating that hundreds of millions of Android users are at security risk. Although Google implemented a patch, many apps are still using outdated Play Core libraries,” Aviran Hazum, manager of Mobile Research, Check Point said in a statement.

Hazum warns, the vulnerability is highly dangerous and a malicious application can exploit it to steal two-factor authentication codes or inject code into banking applications to steal credentials. They could also inject malicious codes into social media apps and spy on users or in messaging apps to intercept messages.

Though Google Play Store is considered one of the most trusted app stores in the Android ecosystem, it is far from being fully secure. Bugs and apps with hidden malwares have been frequently detected and…

Source…