Krebs on Security

NOVEMBER 5, 2024

At the end of 2023, malicious hackers learned that many large companies had uploaded huge volumes of sensitive customer data to Snowflake accounts that were protected with little more than a username and password (no multi-factor authentication required).

Cybercrime 280

Cybercrime Mobile Media Hacking 280

Security Affairs

OCTOBER 20, 2021

A China-linked hacking group, tracked as LightBasin (aka UNC1945 ), hacked mobile telephone networks around the globe and used specialized tools to access calling records and text messages from telecommunications companies. CrowdStrike researchers reported that at least 13 telecommunication companies were compromised by since 2019.

Telecommunications 136

Telecommunications Mobile Hacking Architecture 136

Digital Shadows

MARCH 17, 2025

In one example, the Chinese group APT5, operating from the most active nation state targeting VPN devices, maintained access to compromised VPN infrastructure in the telecommunications sector for months. CVE-2022-40684 is a critical authentication bypass vulnerability in Fortinet FortiOS, FortiProxy, and FortiManager network edge appliances.

VPN 133

VPN Authentication Ransomware Risk 133

Krebs on Security

APRIL 11, 2024

New York City based Sisense has more than 1,000 customers across a range of industry verticals, including financial services, telecommunications, healthcare and higher education. ” “We are taking this matter seriously and promptly commenced an investigation,” Dash continued.

CISO 316

CISO Encryption Telecommunications Financial Services 316

Security Affairs

SEPTEMBER 26, 2022

A previously undetected hacking group, tracked as Metador, has been targeting telecommunications, internet services providers (ISPs), and universities for about two years. Both malware authenticates themselves to Cryshell through a port-knocking and handshake procedure. ” reads the analysis published by the researchers.

Telecommunications 145

Telecommunications Authentication Malware Internet 145

Cisco Security

OCTOBER 3, 2022

In November 2020, the Telecommunications (Security) Bill was formally introduced to the UK’s House of Commons by the department for Digital, Culture, Media & Sport. What is the Telecommunications (Security) Act? Why has the Telecommunications (Security) Act been introduced?

Telecommunications 138

Telecommunications Data breaches Risk Government 138

Krebs on Security

FEBRUARY 28, 2023

Countless websites and online services use SMS text messages for both password resets and multi-factor authentication. T-Mobile declined to answer questions about what it may be doing to beef up employee authentication. “And we are constantly working to fight against it,” the statement reads. ” TMO UP!

Mobile 344

Mobile Phishing Authentication Advertising 344

Security Affairs

MARCH 12, 2025

Its primary focus is on defense, technology, and telecommunications sectors in the US and Asia. Mandiant observed the threat actor targeting network authentication services, including the Terminal Access Controller Access-Control System (TACACS+), and terminal servers with access to the routers to gain privileged initial access.”

Telecommunications 65

Telecommunications Malware DDOS Technology 65

Cisco Security

DECEMBER 13, 2022

In our last blog , we gave a rundown of what the Telecommunications (Security) Act (TSA) is, why it’s been introduced, who it affects, when it starts, and how firms can prepare. But what if the TSA had some ‘carrot’-based business benefits that are much less discussed?

Telecommunications 145

Telecommunications Authentication Risk Cyber Risk 145

Security Affairs

FEBRUARY 23, 2024

Australian telecommunications provider Tangerine disclosed a data breach that impacted roughly 230,000 individuals. The telecommunications provider pointed out that no financial information (credit or debit card numbers, banking details) has been compromised.

Data breaches 131

Data breaches Telecommunications Banking Mobile 131

Krebs on Security

AUGUST 19, 2020

For now at least, they appear to be focusing primarily on companies in the financial, telecommunications and social media industries. And over the past six months, the criminals responsible have created dozens if not hundreds of phishing pages targeting some of the world’s biggest corporations.

Phishing 363

Phishing VPN Social Engineering Media 363

Security Affairs

FEBRUARY 21, 2020

VMware has addressed serious vulnerabilities in vRealize Operations for Horizon Adapter, including remote code execution and authentication bypass flaws. “vRealize Operations for Horizon Adapter has an improper trust store configuration leading to authentication bypass. ” reads an advisory published by VMware.

Authentication 144

Authentication Telecommunications Advertising Hacking 144

Krebs on Security

AUGUST 12, 2020

Adding multi-factor authentication (MFA) at these various providers (where available) and/or establishing a customer-specific personal identification number (PIN) also can help secure online access. Your best option is to reduce your overall reliance on your phone number for added authentication at any online service.

Accountability 359

Accountability Mobile Banking Passwords 359

Security Affairs

JULY 31, 2022

. “We’re publishing the details of a new vulnerability (tracked under CVE-2022-30563) affecting the implementation of the Open Network Video Interface Forum (ONVIF) WS-UsernameToken authentication mechanism in some IP cameras developed by Dahua, a very popular manufacturer of IP-based surveillance solutions.”

Surveillance 145

Surveillance Authentication Telecommunications Manufacturing 145

Security Affairs

MAY 6, 2020

The dump was discovered by a Dubai-based cybersecurity firm Rewterz ( @rewterz ) that confirmed its authenticity and the Pakistan Telecommunication Authority (PTA) is investigating the matter. Last month, a hacker offered for sale a dump containing 115 Million Pakistani mobile user records for over $2 million worth of bitcoin.

Mobile 135

Mobile Telecommunications Data breaches Advertising 135

Security Affairs

JUNE 8, 2022

China-linked threat actors have breached telecommunications companies and network service providers to spy on the traffic and steal data. US NSA, CISA, and the FBI published a joint cybersecurity advisory to warn that China-linked threat actors have breached telecommunications companies and network service providers.

Telecommunications 100

Telecommunications Authentication Passwords Accountability 100

Schneier on Security

JANUARY 14, 2020

To be sure, there are significant security improvements in 5G over 4G­in encryption, authentication, integrity protection, privacy, and network availability. But the enhancements aren't enough. The 5G security problems are threefold. First, the standards are simply too complex to implement securely.

Data collection 279

Data collection Software Marketing Government 279

Security Affairs

MARCH 30, 2024

In August 2021, the group asked $1 million for the entire database, or $200,000 for access, according to the RestorePrivacy website that examined a sample that appears authentic. ” reads a statement published by the telecommunication giant. reads the RestorePrivacy website. million former account holders.”

Data breaches 144

Data breaches Telecommunications Cybercrime Hacking 144

Security Affairs

MAY 1, 2024

A new malware named Cuttlefish targets enterprise-grade and small office/home office (SOHO) routers to harvest public cloud authentication data. Cuttlefish has a modular structure, it was designed to primarily steal authentication data from web requests passing through the router from the local area network (LAN).

Malware 129

Malware DNS Authentication Telecommunications 129

Security Affairs

APRIL 10, 2024

In August 2021, the group asked $1 million for the entire database, or $200,000 for access, according to the RestorePrivacy website that examined a sample that appears authentic. While we cannot yet confirm the data is from AT&T customers, everything we examined appears to be valid.” reads the RestorePrivacy website.

Data breaches 125

Data breaches Telecommunications Identity Theft Hacking 125

Security Affairs

AUGUST 25, 2022

NOBELIUM focuses on government organizations, non-government organizations (NGOs), think tanks, military, IT service providers, health technology and research, and telecommunications providers. “Like domain controllers, AD FS servers can authenticate users and should therefore be treated with the same high level of security.

Malware 134

Malware Authentication Telecommunications Government 134

Cisco Security

NOVEMBER 18, 2022

Often security researchers and security teams focus on threats to software and the risks associated with authenticating and managing users. The telecommunications infrastructure that carries internet traffic between countries and continents is often provided by submarine cables. Physical infrastructure can not be taken for granted.

Risk 145

Risk Telecommunications Internet Internet 145

Malwarebytes

MARCH 19, 2024

A 42-year-old manager at an unnamed telecommunications company has admitted SIM swapping customers at his store. For that reason, SIM swapping can be used to get around two-factor authentication (2FA) codes sent by SMS message.

Social Engineering 141

Social Engineering Computers and Electronics Mobile Identity Theft 141

Security Affairs

MARCH 4, 2024

LightBasin targeted and compromised mobile telephone networks around the globe and used specialized tools to access calling records and text messages from telecommunications companies. CrowdStrike researchers reported that at least 13 telecommunication companies were compromised by since 2019.

Telecommunications 145

Telecommunications Firewall Mobile Malware 145

Security Affairs

AUGUST 31, 2021

Authentication is not required to exploit this vulnerability.” “The specific flaw exists within the authentication of requests to web services within the ecp web application. By issuing a crafted request, an attacker can bypass authentication. ” reads the advisory published Zero-Day Initiative (ZDI).

Authentication 112

Authentication Accountability Telecommunications Information Security 112

The Last Watchdog

FEBRUARY 27, 2023

The best all-around metric for SASE/ZT testing is QoE, as it reflects multiple underlying factors, including performance, error detection, encryption variability, overall transaction latency, and (for ZT) concurrent authentication rate. Security controls that impede important business activities, will motivate users to try to bypass them.

Risk 208

Risk Architecture Firewall Telecommunications 208

Security Affairs

FEBRUARY 3, 2021

Italy also joins the security bug research, with the Red Team Research laboratory of TIM, an important Italian telecommunications company. The first one, Improper Restriction of Excessive Authentication Attempts (CWE-307), identified as CVE-2020-35590 , has a CVSS3 score of 9.8. The other one is an unauthenticated reflected XSS.

Telecommunications 102

Telecommunications Cyber Attacks Authentication Hacking 102

The Last Watchdog

APRIL 13, 2022

The Russian government, military, and intelligence service may wish to achieve some operational effect, for example, disrupting the power grid or interfering with telecommunications infrastructure, which may be part of a larger war plan. Each of these organizations performs cyber operations for various reasons.

Cybersecurity 214

Cybersecurity Cybercrime Education Government 214

Security Affairs

FEBRUARY 4, 2019

Attackers exploited the flaw in the SS7 protocol to defeat the 2FA authentication used by Metro Bank to protect its customers. We have supported telecommunication companies and law enforcement authorities with an industry-wide investigation and understand that steps have been taken to resolve the issue.”

Banking 111

Banking Telecommunications Authentication Advertising 111

Security Affairs

JANUARY 16, 2024

is an Authentication Bypass issue that resides in the web component of Ivanti ICS 9.x, An authenticated administrator can exploit the issue by sending specially crafted requests and execute arbitrary commands on the appliance. The flaw CVE-2023-46805 (CVSS score 8.2) x and Ivanti Policy Secure. x) and Ivanti Policy Secure.

VPN 127

VPN Authentication Small Business Telecommunications 127

Thales Cloud Protection & Licensing

DECEMBER 21, 2022

Thales collaborates with Hewlett Packard Enterprise (HPE) to provide enhanced privacy and secure authentication for global 5G users, further extending its partner ecosystem. The multi-vendor landscape, complex infrastructure and distributed nature of 5G networks has historically made subscriber authentication and privacy a challenge.

Architecture 126

Architecture Authentication Telecommunications IoT 126

Security Affairs

JANUARY 31, 2024

is an Authentication Bypass issue that resides in the web component of Ivanti ICS 9.x, An authenticated administrator can exploit the issue by sending specially crafted requests and execute arbitrary commands on the appliance. The flaw CVE-2023-46805 (CVSS score 8.2) x and Ivanti Policy Secure. x) and Ivanti Policy Secure.

VPN 126

VPN Malware Authentication Small Business 126

Security Affairs

DECEMBER 14, 2022

While the default security settings have improved over the review period, some popular brands either offer default passwords or no authentication, meaning anyone can spy on the spies. It is worrying that all analyzed brands have at least some models that allow users to keep default passwords or have no authentication setup whatsoever.

Surveillance 145

Surveillance Manufacturing Internet Internet 145

The Last Watchdog

AUGUST 8, 2023

Other planned features will allow users to create smaller sandwiches to access fundamental cryptographic primitives, or larger sandwiches to access functionalities like authentication, virtual private networks (VPNs), or key management services (KMS). Air Force, the Defense Information Systems Agency (DISA), the U.S.

Encryption 188

Encryption Telecommunications Government Technology 188

Security Affairs

FEBRUARY 15, 2025

Sorry, It’s Windows Malware Malware Mobile Indian Cyber Heist: FatBoyPanel And His Massive Data Breach Google Tag Manager Skimmer Steals Credit Card Info From Magento Site From South America to Southeast Asia: The Fragile Web of REF7707 Deep Learning-Driven Malware Classification with API Call Sequence Analysis and Concept Drift Handling Hacking (..)

Spyware 68

Spyware Firewall Artificial Intelligence Malware 68

SecureWorld News

NOVEMBER 20, 2023

These fraudulent activities not only compromise wireless account access but also pose significant risks to financial accounts, social media profiles, and other online services utilizing phone numbers for multi-factor authentication (MFA).

Mobile 108

Mobile Wireless Artificial Intelligence Accountability 108

SecureList

DECEMBER 22, 2022

The threat actors used certificates from Nvidia and Kuwait Telecommunications Company to sign their malware; the former was already leaked, but we’re not sure how they got their hands on the latter. The ransomware – use of Kuwait Telecommunications Company signing certificate. Kuwait Telecommunications company certificate. [1]

Ransomware 132

Ransomware Telecommunications Malware Encryption 132