Over 800,000 internet-accessible SonicWall VPN appliances are vulnerable to CVE-2020-5135, a critical bug with a rating of 9.4 out of 10. It is assumed to happen under active exploitation once proof-of-concept code is made publicly available.
Barnes & Noble is advising that it has been hacked, possibly exposing personal data for customers. The company did offer condolences in what’s become a response to data breaches. They also announced that the company possibly was hacked over not updated Pulse Secure VPN service.
Google project zero research center notice of a new set of zero-click vulnerabilities in the Linux Bluetooth software stack that can allow a nearby unauthenticated, remote attacker to execute arbitrary code with kernel privileges on vulnerable devices. An attacker can send a malicious Bluetooth packet which gains access to the device to the victim.
On October 2020 Patch Tuesday, Microsoft published the patches for 87 newly discovered security vulnerabilities, including two critical remote code execution (RCE) flaws in Windows TCP/IP stack and Microsoft Outlook. The flaws, 11 of which are categorized as Critical, 75 are ranked Important, and one is classified Moderate in severity, affect Windows, Office and Office Services, and Web Apps, Visual Studio, Azure Functions, .NET Framework, Microsoft Dynamics, Open Source Software, Exchange Server, and the Windows Codecs Library.
One of the most popular financially motivated cybercrime groups FIN11 jumps into the ransomware money-making scheme. A group of researchers published an overview of the FIN11 activity and its transition to the ransomware scene. The researchers treat the group as a separate threat actor, noting its significant overlap in tactics, techniques. Based on their investigation, the researchers have moderate confidence that FIN11 works from the Commonwealth of Independent States (CIS – former Soviet Union countries).
Enter your email address to subscribe to Hacken Reseach and receive notifications of new posts by email.