Web Security | SC Media

Web Security

Report: Hacking group wipes content from over 12,000 open MongoDB databases

In less than a month’s time, the “Unistellar” hacking group has reportedly accessed over 12,000 unsecured MongoDB databases and stolen their contents, apparently holding them for ransom. Security researcher Sanyam Jain initially discovered the wiped databases late last month using the BinaryEdge scanning service, according to a BleepingComputer report last Friday. The 12,564 sabotaged databases…

Breach of Stack Overflow’s production systems exposes data on roughly 250 users

An unauthorized party accessed Stack Overflow’s production systems earlier this month and executed privileged web requests that exposed information on roughly 250 public network users, the Q&A website for programmers announced last Friday. Stack Overflow Vice President of Engineering Mary Ferguson said in a May 17 blog post that the intruder exploited a bug in…

Microsoft’s May Patch Tuesday covers ZombieLoad, WER vulnerabilities

Microsoft put forth a long list of security updates to cover 79 vulnerabilities, 19 listed as critical, which included four connected to a Microarchitectural Data Sampling (aka ZombieLoad) vulnerability in Intel processors in its May Patch Tuesday release. While CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091 grabbed the headlines yesterday, Microsoft also patched CVE-2019-0863 which has been spotted…

Tor network remains unsure how feds discovered and shut down Silk Road 2.0

Sites infected as open source Alpaca Forms and analytics service Picreel compromised

Hackers have breached two services and modified their JavaScript code to infect more than 4,600 websites with malware, according to security researchers. The attacks were initially discovered by security researcher Willem de Groot. In a series of tweets, he said that Picreel, an analytics service that enables website owners to see what users are doing and…

Flaw in Columbia, S.C., website search tool exposed database, SMPT server passwords

A misconfiguration in the search tool on the city of Columbia, S.C. website had a security flaw that could have exposed database and SMPT server passwords.  Independent Researcher Arif Khan discovered the flaw in the fall and began trying to contact the city to disclose, tweeting in November, “Hi @CityofColumbia, A security issue has been detected…

DNSpionage actors adjust tactics, debut new remote administration tool

The actors responsible for the DNSpionage DNS hijacking campaign have altered some of their tactics, techniques and procedures (TTPs), introducing a new reconnaissance phase as well as a new malicious remote administration tool called Karkoff. Discovered last November, the operation primarily targets Lebanon- and United Arab Emirates-affiliated .gov domains, commandeering the websites’ DNS servers so…

Magecart hackers force turnover, steal data from Atlanta Hawks’ online shop

Cybercriminals using Magecart card-skimming code attacked the online store of the NBA’s Atlanta Hawks, stealing customers names, addresses and payment card numbers. The Sanguine Labs team at Sanguine Security identified the offending code on the store’s checkout page on Saturday April 20, according to a post on the security company’s website. But research from RiskIQ…

Flashpoint: Our site was not dishing malware

Flashpoint came out swinging today against an independent researcher who reported that the security company’s public-facing website was serving malware. In what Flashpoint called an “after action report,” the company denied the website was itself infected with malware, but did admit that on April 12-13 the WordPress Yuzo Related Posts plugin used on the site…

Unauthorized party muscles its way into Bodybuilding.com’s systems

Fitness retailer Bodybuilding.com last Friday disclosed that an unauthorized party used a phishing scam to gain access to systems containing its customer data. According to an FAQ page posted on its website, the Boise, Idaho-based retailer discovered the breach incident in February 2019, roughly seven months after the phishing email was received in July 2018.…

Next post in Security News