Aggregator

HackerNews 编译，转载请注明出处： 加密货币交易所Coinbase（用户超1亿）披露称，与恶意客服人员勾结的网络犯罪团伙窃取了客户数据，并索要2000万美元赎金以阻止公开泄露信息。该公司表示拒绝支付赎金，但将设立2000万美元悬赏基金用于征集攻击者线索。 此次披露源于攻击者在5月11日向Coinbase发送的勒索邮件，其威胁若未收到2000万美元将公开部分客户账户数据及内部文件。据调查，攻击者通过收买海外客服承包商或支持人员非法访问内部系统窃取数据。Coinbase在发现这些内部人员未经授权访问系统后将其解雇，但此时数据已遭窃取。 尽管攻击者窃取了约1%客户（约100万人）的个人身份信息组合，但未能获取用户私钥、密码，也未侵入Coinbase Prime账户以及客户或交易所的热钱包/冷钱包。根据提交给美国证券交易委员会（SEC）的文件，泄露数据包括： 姓名、地址、电话及邮箱； 部分隐藏的社会保险号（仅显示末四位）； 部分隐藏的银行账号及账户标识符； 政府身份证件图像（如驾照、护照）； 账户数据（余额快照与交易记录）； 有限的企业数据（客服可访问的文档、培训材料及通信记录）。 “网络犯罪分子贿赂并招募海外恶意客服人员窃取数据，以实施社会工程攻击。这些内鬼滥用客服系统权限窃取了少量客户账户数据。”Coinbase在周四的博客声明中表示，“所有密码、私钥及资金均未泄露，Coinbase Prime账户未受影响。我们将赔偿因受骗向攻击者转账的客户。” 尽管财务影响仍在评估中，且Coinbase未透露受后续社会工程攻击影响的客户数量，但公司预计事件相关补救及赔偿费用将达1.8亿至4亿美元。为此，Coinbase将在美国新建客服中心，加强内部威胁检测、安全威胁模拟及自动化响应投入，并赔偿因社会工程攻击受骗转账的客户。 Coinbase建议客户警惕冒充其员工的诈骗行为，强调绝不会通过电话索要账户信息或要求转账。用户应启用双因素认证及提款白名单功能以确保交易安全。Coinbase表示：“对于受影响客户，我们对此事件造成的担忧与不便深表歉意。我们将持续解决问题并投资世界级防御体系——这正是我们保护客户、维护加密经济安全的承诺。”       消息来源：bleepingcomputer； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文

朝鲜TA406组织针对乌克兰政府机构传播恶意软件；Marbled Dust 利用 Output Messenger 中的零日漏洞进行间谍活动；APT37伪装成韩国国家安全战略智库进行攻击

A vulnerability was found in vim up to 8.1. It has been classified as critical. This affects an unknown part. The manipulation leads to buffer overflow. This vulnerability is uniquely identified as CVE-2022-1927. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic was found in libssh up to 0.8.8/0.9.3. Affected by this vulnerability is an unknown functionality of the component AES-CTR/DES. The manipulation leads to resource consumption. This vulnerability is known as CVE-2020-1730. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Oracle MySQL Workbench up to 8.0.21. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component MySQL Workbench. The manipulation leads to denial of service. This vulnerability is known as CVE-2020-1730. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical has been found in libssh up to 0.8.7/0.9.2. This affects the function ssh_scp_new of the component scp Client. The manipulation as part of Parameter leads to command injection. This vulnerability is uniquely identified as CVE-2019-14889. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Oracle MySQL Workbench up to 8.0.19. It has been rated as critical. Affected by this issue is some unknown functionality of the component MySQL Workbench. The manipulation leads to injection. This vulnerability is handled as CVE-2019-14889. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

ECOVACSが提供する複数の製品には、複数の脆弱性が存在します。

HackerNews 编译，转载请注明出处： 新斯科舍省电力公司（Nova Scotia Power）确认遭遇数据泄露事件。该事件最初于2025年4月28日被发现，攻击者通过未授权访问侵入其业务网络及服务器。 作为加拿大电力巨头Emera集团子公司，该公司服务新斯科舍省超过50万居民、商业和工业客户，市场占有率达95%，年发电量超1万吉瓦时，运营着总长3.2万公里的输电线网。 尽管电力生产与配送未受影响，但事件响应工作导致内部运营系统中断。2025年5月1日的深入调查显示客户信息可能遭窃，最新更新确认泄露数据包括：全名、电话号码、电子邮箱、邮寄与服务地址、参与公司项目的记录、出生日期、用电历史（含用电量、服务请求、付款记录、账单明细、信用历史及客户通信内容）、驾照号码、社会保险号以及部分客户的银行账号。 调查发现实际入侵时间早于最初判断，攻击始于2025年3月19日，这意味着从漏洞发生到通过邮寄信件通知受影响客户已过去近两个月。该公司表示目前未发现泄露数据遭滥用的迹象，但将为受影响用户提供为期两年的免费信用监控服务（由环联公司TransUnion提供），并在通知信中详细说明相关支持资源。 新斯科舍省电力公司提醒客户警惕钓鱼攻击，包括冒充该公司骗取敏感信息的行为。截至5月15日，尚无勒索软件组织宣称对此事件负责。值得注意的是，虽然电力供应未受波及，但客户服务热线与在线门户在事件响应期间瘫痪长达三周。调查显示攻击者可能利用了未公开漏洞，但具体技术细节尚未披露。       消息来源：bleepingcomputer； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文

Schneider Electricが提供するEcoStruxure Power Build Rapsodyには、スタックベースのバッファオーバーフローの脆弱性が存在します。

A vulnerability, which was classified as problematic, has been found in IBM Navigator Mobile Android 3.4.1.1/3.4.1.2. Affected by this issue is some unknown functionality. The manipulation leads to information disclosure. This vulnerability is handled as CVE-2022-38388. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, was found in OpenCart 3.x. Affected is an unknown function of the file index.php?route=extension/module/so_newletter_custom_popup/newsletter of the component Newsletter Custom Popup. The manipulation of the argument email leads to sql injection. This vulnerability is traded as CVE-2022-41403. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in F-Secure/WithSecure Product. Affected by this issue is some unknown functionality in the library aerdl.dll of the component Unpacker. The manipulation leads to denial of service. This vulnerability is handled as CVE-2022-28887. The attack may be launched remotely. There is no exploit available.

A vulnerability, which was classified as critical, was found in Tenda AC1206 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01. This affects the function formWifiBasicSet. The manipulation leads to stack-based buffer overflow. This vulnerability is uniquely identified as CVE-2022-42079. The attack can only be done within the local network. There is no exploit available.

A vulnerability has been found in Tenda AC1206 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 and classified as critical. This vulnerability affects unknown code. The manipulation of the argument sched_start_time leads to heap-based buffer overflow. This vulnerability was named CVE-2022-42080. The attack can only be initiated within the local network. There is no exploit available.

A vulnerability was found in Dropbear up to 2020.81. It has been classified as critical. Affected is an unknown function of the component Non-RFC-compliant Check. The manipulation leads to improper authentication. This vulnerability is traded as CVE-2021-36369. The attack needs to be initiated within the local network. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in Tenda AC1206 US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 and classified as problematic. This issue affects the function fromSysToolReboot. The manipulation leads to cross-site request forgery. The identification of this vulnerability is CVE-2022-42077. The attack may be initiated remotely. There is no exploit available.

A vulnerability was found in Tenda US_AC1206V1.0RTL_V15.03.06.23_multi_TD01. It has been classified as problematic. Affected is the function fromSysToolRestoreSet. The manipulation leads to cross-site request forgery. This vulnerability is traded as CVE-2022-42078. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability has been found in Boodskap IoT Platform 4.4.9-02 and classified as critical. This vulnerability affects unknown code of the file /api/user/upsert/<uuid> of the component Request Handler. The manipulation leads to improper access controls. This vulnerability was named CVE-2022-35135. The attack can only be done within the local network. There is no exploit available.

A vulnerability was found in Boodskap IoT Platform 4.4.9-02 and classified as critical. This issue affects some unknown processing of the component API Request Handler. The manipulation leads to improper authentication. The identification of this vulnerability is CVE-2022-35136. The attack can only be initiated within the local network. There is no exploit available.