Aggregator

微软称全世界有 39.4 万台 Windows 电脑感染了 Lumma 恶意程序

Solidot
9 months ago
微软官方博客宣布与全球执法机构合作，破坏了 Lumma 恶意程序使用的网络基础设施。Lumma 恶意程序被网络罪犯用于窃取机密信息如密码、信用卡、银行账户和加密货币钱包，帮助网络罪犯勒索赎金、清空银行账户以及中断关键服务。在获得法庭命令之后，微软查封了 Lumma 基础设施使用的 2300 个域名，其中逾 1300 个被重定向到微软的 Microsoft sinkholes。微软称，它的调查显示 2025 年 3 月 16 日至 2025 年 5 月 16 日期间全世界有逾 39.4 万台 Windows 计算机感染了 Luma 恶意软件。感染恶意程序的计算机大部分位于北美、南美、欧洲 和南亚，中国大陆也有少数计算机感染。

Russia-linked APT28 targets western logistics entities and technology firms

Security Affairs
9 months ago
CISA warns Russia-linked group APT28 is targeting Western logistics and tech firms aiding Ukraine, posing an elevated threat to supply chains Russia-linked cyberespionage group APT28 intensifies its operations against Western logistics and technology companies moving supplies into Ukraine, US CISA warns. The APT28 group (aka Fancy Bear, Pawn Storm, Sofacy Group, Sednit, BlueDelta, and STRONTIUM) has been active since at least 2007 and it […]
Pierluigi Paganini

Google 搜索关键词历史抓获 2020 年丹佛致命纵火案凶手

Solidot
9 months ago
2020 年 8 月发生在丹佛绿谷农场（Green Valley Ranch）的一起纵火案导致一家五口人丧生，其中包括一名幼儿和一名婴儿。监控录像显示有三名蒙面人，但对于疑凶身份调查人员毫无头绪。传统调查付方法如手机信号塔数据和地理围栏搜查令等都没有找到可用线索。一名调查人员猜测 Google 的搜索历史记录可能保留了纵火案地址的搜索记录。通过获得反向关键词搜索令，警方要求 Google 提供纵火案前 15 天内搜索过 5312 Truckee Street 等相关地址的记录。Google 提供了 61 个匹配的设备。通过交叉对比手机信号塔数据，警方识别了三名青少年嫌疑人 Kevin Bui、 Gavin Seymour 和 Dillon Siebert。他们曾搜索该地址数十次，还在 Zillow 上查找过房屋平面图。起因是 Bui 通过苹果的 Find My 功能跟踪被盗手机到错误的地址，错误将无辜的移民当成目标。

The hidden gaps in your asset inventory, and how to close them

Help Net Security
9 months ago

In this Help Net Security interview, Tim Grieveson, CSO at ThingsRecon, breaks down the first steps security teams should take to regain visibility, the most common blind spots in asset discovery, and why context should drive risk prioritization. What are the first steps a security team should take if they realize their asset inventory is incomplete or outdated? The first step is to openly communicate the issue and alert stakeholders to the potential risks associated … More →

The post The hidden gaps in your asset inventory, and how to close them appeared first on Help Net Security.

Mirko Zorz

Malwaretech-The Hacker Who Stopped WannaCry

网安志异
9 months ago
本公众号网安志异在早些时候介绍《沙虫》一书的时候介绍过MalwareTech，一位匿名安全研究员。这里讲述了他如何意外阻止了WannaCry勒索软件的全球传播。他在分析恶意软件代码时发现了一个未注册的域名，注册并激活该域名后，却无意中触发了代码中的“终止开关”，导致WannaCry停止传播。然而，这一行为让他失去了匿名性，并因为他青少年时期编写的部分Kronos银行恶意软件而被美国联邦调查局（FBI）逮捕。在朋友、律师和黑客社区的帮助下，他最终被判“服刑时间”，避免了牢狱之灾，尽管这段经历给他带来了极大的精神压力。

CVE-2025-5081 | Campcodes Cybercafe Management System 1.0 /adminprofile.php mobilenumber sql injection

VulDB Recent Entries
9 months ago
A vulnerability classified as critical was found in Campcodes Cybercafe Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /adminprofile.php. The manipulation of the argument mobilenumber leads to sql injection. This vulnerability is known as CVE-2025-5081. The attack can be launched remotely. Furthermore, there is an exploit available. Other parameters might be affected as well.
vuldb.com

CVE-2025-5080 | Tenda FH451 1.0.0.9 webExcptypemanFilter page stack-based overflow

VulDB Recent Entries
9 months ago
A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9. Affected is the function webExcptypemanFilter of the file /goform/webExcptypemanFilter. The manipulation of the argument page leads to stack-based buffer overflow. This vulnerability is traded as CVE-2025-5080. It is possible to launch the attack remotely. Furthermore, there is an exploit available.
vuldb.com

CVE-2025-5079 | Campcodes Online Shopping Portal 1.0 /admin/updateorder.php remark sql injection

VulDB Recent Entries
9 months ago
A vulnerability was found in Campcodes Online Shopping Portal 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/updateorder.php. The manipulation of the argument remark leads to sql injection. The identification of this vulnerability is CVE-2025-5079. The attack may be initiated remotely. Furthermore, there is an exploit available.
vuldb.com

CVE-2025-5078 | Campcodes Online Shopping Portal 1.0 /admin/subcategory.php Category sql injection

VulDB Recent Entries
9 months ago
A vulnerability was found in Campcodes Online Shopping Portal 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/subcategory.php. The manipulation of the argument Category leads to sql injection. This vulnerability was named CVE-2025-5078. The attack can be initiated remotely. Furthermore, there is an exploit available.
vuldb.com

CVE-2025-5077 | Campcodes Online Shopping Portal 1.0 edit-subcategory.php Category sql injection

VulDB Recent Entries
9 months ago
A vulnerability was found in Campcodes Online Shopping Portal 1.0. It has been classified as critical. This affects an unknown part of the file /admin/edit-subcategory.php. The manipulation of the argument Category leads to sql injection. This vulnerability is uniquely identified as CVE-2025-5077. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.
vuldb.com

Managed ad