Latest Cybersecurity News and Articles

---

DC Board of Elections Discloses Data Breach

The District of Columbia Board of Elections says voter records were compromised in a data breach at hosting provider DataNet. The post DC Board of Elections Discloses Data Breach appeared first on SecurityWeek.

---

High-Severity Flaws in ConnectedIO's 3G/4G Routers Raise Concerns for IoT Security

Multiple high-severity security vulnerabilities have been disclosed in ConnectedIO's ER2000 edge routers and the cloud-based management platform that could be exploited by malicious actors to execute malicious code and access sensitive data. "An attacker could have leveraged these flaws to fully compromise the cloud infrastructure, remotely execute code, and leak all customer and device

---

Exposing Infection Techniques Across Supply Chains and Codebases

Threat actors use sophisticated attack techniques like exec smuggling to implant malicious code within seemingly legitimate applications, compromising the security of systems.

---

Google Expands Bug Bounty Program With Chrome, Cloud CTF Events

Google is hosting capture the flag (CTF) events focused on Chrome’s V8 engine and on Kernel-based Virtual Machine (KVM). The post Google Expands Bug Bounty Program With Chrome, Cloud CTF Events appeared first on SecurityWeek.

---

Security Patch for Two New Flaws in Curl Library Arriving on October 11

The maintainers of the Curl library have released an advisory warning of two forthcoming security vulnerabilities that are expected to be addressed as part of updates released on October 11, 2023. This includes a high severity and a low-severity flaw tracked under the identifiers CVE-2023-38545 and CVE-2023-38546, respectively. Additional details about the issues and the exact version ranges

---

Ukraine, Israel, South Korea Top List of Most-Targeted Countries for Cyberattacks

Nation-state hackers, particularly Russia and China, have shifted their focus towards espionage campaigns aimed at stealing information and manipulating communications, according to a new Microsoft report.

---

NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations

The National Security Agency (NSA) and Cybersecurity and Infrastructure Security Agency (CISA) have released a joint cybersecurity advisory highlighting the most common misconfigurations in large organizations.

---

Hackers Join In on Israel-Hamas War With Disruptive Cyberattacks 

Several hacker groups have joined in on the Israel-Hamas war that started over the weekend after the militant group launched a major attack. The post Hackers Join In on Israel-Hamas War With Disruptive Cyberattacks  appeared first on SecurityWeek.

---

Snap AI Chatbot Scrutinized by UK Watchdog Over How It Processes Kids’ Data

The British data privacy authority has issued a preliminary enforcement notice against Snap Inc. for potentially failing to adequately assess the privacy risks associated with its generative AI chatbot.

---

New CISA, NSA Guidance Highlights Pain Points in Identity and Security Management

The Enduring Security Framework, a public-private working panel led by CISA and the NSA, identified developer and vendor issues that hinder the implementation of MFA and SSO, such as confusing definitions, unclear policies, and technical gaps.

---

GitHub's Secret Scanning Feature Now Covers AWS, Microsoft, Google, and Slack

GitHub has improved its secret scanning feature to include validity checks for popular services like Amazon Web Services, Microsoft, Google, and Slack, enhancing the ability to identify and remediate exposed tokens.

---

Estes Express Lines Reports Cyberattack Caused Ongoing Tech Outage

The cyberattack highlights the vulnerability of transportation firms to cyber threats, disrupting their visibility into operations and posing risks to employee and customer data.

---

Account Takeover From Student Emails

Taking over legitimate email accounts, whether belonging to employees or students, is an effective tactic for sending out phishing emails as the sender appears to be trustworthy.

---

US Police Recover $3M Stolen by Pakistani Crypto Scammers

Although arrests are unlikely, the stolen crypto was recovered, which is a significant achievement considering the difficulty of tracking and recovering cryptocurrencies.

---

Update: MGM Resorts’ Las Vegas Area Operations to Take $100M Hit From Cyberattack

MGM Resorts said the previously disclosed cyberattack in September will impact the company’s third-quarter financial results by about $100 million, mainly related to the impact on its Las Vegas operations, according to its SEC filing.

---

Victims Reported $2.7 Billion in Social Media Scam Losses Since 2021: FTC

Shopping scams are the most common type of social media fraud, with undelivered goods being the primary issue, while investment scams, particularly involving cryptocurrency, pose the highest financial risk to victims.

---

Gaza-Linked Cyber Threat Actor Targets Israeli Energy and Defense Sectors

A Gaza-based threat actor has been linked to a series of cyber attacks aimed at Israeli private-sector energy, defense, and telecommunications organizations. Microsoft, which revealed details of the activity in its fourth annual Digital Defense Report, is tracking the campaign under the name Storm-1133. "We assess this group works to further the interests of Hamas, a Sunni militant group that is

---

Taiwan Probes Firms Suspected of Selling Chip Equipment to China’s Huawei Despite US Sanctions

Taiwan authorities are investigating four Taiwan-based companies suspected of helping China’s Huawei Technologies to build semiconductor facilities. The post Taiwan Probes Firms Suspected of Selling Chip Equipment to China’s Huawei Despite US Sanctions appeared first on SecurityWeek.

---

Rhysida Ransomware Gang Claims Attacks on Governments in Portugal, Dominican Republic

The city of Gondomar in Portugal and the Dominican Republic's Migration Agency have been targeted by the Rhysida ransomware gang, causing disruptions in services and potential data theft.

---

D.C. Board of Elections Confirms Voter Data Stolen in Site Hack

The stolen voter records include personal details such as names, registration IDs, partial Social Security numbers, driver's license numbers, and contact information, raising concerns about potential identity theft and privacy risks.