1010.TEAM 🇺🇦

CYBERSECURITY / DEFENSE / INTELLIGENCE

  • Wireshark 4.4.0 Released – What’s New!

    ·

    The Wireshark Foundation has announced the release of Wireshark 4.4.0, marking a significant update to the popular open-source network protocol analyzer.

    This latest version introduces a range of new features, improvements, and bug fixes, enhancing the tool’s capabilities in network analysis.

    Enhanced Graphing Capabilities

    One of the standout features of Wireshark 4.4.0 is the comprehensive overhaul of its graphing dialogs.

    The I/O Graphs, Flow Graph/VoIP Calls, and TCP Stream Graphs have all received substantial updates.

    Thanks to these enhancements, users can now enjoy more precise and flexible visualization options.

    The I/O Graphs dialog, in particular, now supports intervals as small as 1 microsecond and can handle up to 33 million graph items.

    Memory utilization has been optimized, and the graph is more intelligent about when to retap, recalculate, or replot data.

    Additionally, users can reorder graphs by drag-and-drop, and the legend can be repositioned to different corners of the graph, providing a more customizable experience.

    Advanced Display Filter Capabilities

    Wireshark 4.4.0 also brings significant enhancements to display filter functionality. These improvements include better handling of comparisons with value strings, support for regular expression matching, and the ability to perform arithmetic operations on date and time values.

    Are You From SOC/DFIR Teams? - Try Advanced Malware and Phishing Analysis With ANY.RUN -14-day free trial

    New functions have been added to test IP address properties and convert unsigned integer types. Display filter functions can now be implemented as libwireshark plugins, allowing for greater extensibility.

    A significant upgrade in this release is the ability to define custom columns using any valid field expression, including display filter functions, arithmetic calculations, packet slices, and logical tests. This provides users with unprecedented flexibility in data presentation and analysis.

    The NTLMSSP dissector crash in Wireshark 4.2.0 to 4.0.6 and 4.0.0 to 4.0.16 allows a denial of service via packet injection or a crafted capture file. The issue is fixed with versions 4.2.7 and 4.0.17.

    Performance Improvements and New Protocol Support

    Wireshark 4.4.0 introduces several performance enhancements that improve the overall user experience.

    The software can now be built with zlib-ng instead of zlib, offering substantially faster compressed file support.

    Capture files can also be saved with LZ4 compression, emphasizing speed and supporting fast random access.

    Additionally, adding interfaces at startup is now about twice as fast, with fewer UAC pop-ups on Windows systems.

    The release also includes support for several new protocols, such as Allied Telesis Resiliency Link, ATN Security Label, and Bit Index Explicit Replication (BIER).

    Numerous existing protocol dissectors have been updated for more accurate and comprehensive analysis.

    Wireshark 4.4.0 represents a significant step forward in network analysis capabilities, offering enhanced visualization, more powerful filtering, and improved performance.

    Users can download the latest version from the official Wireshark website and explore new features and improvements.

    Protect Your Business with Cynet Managed All-in-One Cybersecurity Platform – Try Free Trial

    The post Wireshark 4.4.0 Released – What’s New! appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

    Go to source

    ¶¶¶¶¶

    /

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Critical Vulnerability in Perl Module Installer Let Attackers Intercept Traffic

    ·

    A critical vulnerability has been identified in App::cpanminus (cpanm), a widely used tool for downloading and installing Perl modules.

    This vulnerability, CVE-2024-45321, exposes users to potential cyber threats. It allows attackers to intercept and manipulate traffic during module installation.

    CVE-2024-45321 – Vulnerability Details

    App::cpanminus, known for its lightweight and efficient handling of Perl module installations, is configured by default to use HTTP rather than the more secure HTTPS protocol.

    This oversight results in a CWE-494: Download of Code Without Integrity Check weakness, which network attackers can exploit to execute arbitrary code.

    The lack of encryption in HTTP communications means that attackers could potentially intercept and alter the transmitted data, posing a severe risk to users relying on cpanminus for module installations.

    Mitigations

    Currently, there is no official patch available from the developers of cpanminus.

    However, users can employ several mitigation strategies to safeguard their systems:

    Are You From SOC/DFIR Teams? - Try Advanced Malware and Phishing Analysis With ANY.RUN -14-day free trial

    Option 1: Set a HTTPS Mirror

    Users can configure cpanminus to use a secure HTTPS mirror. This can be done by using the –from command-line argument:

    $ cpanm --from https://www.cpan.org DISTNAME

    Alternatively, users can set the PERL_CPANM_OPT environment variable to ensure all installations use HTTPS:

    $ export PERL_CPANM_OPT="--from https://www.cpan.org"

    It’s important to note that using this option will disable the ability to download older releases from BackPan and development (TRIAL) releases.

    Option 2: Patch the cpanm Executable

    Patching the cpanm executable is an option for users who need to retain support for BackPan and TRIAL releases.

    This can be achieved with the following Perl one-liner:

    $ perl -pi -E 's{http://(www\.cpan\.org|backpan\.perl\.org|cpan\.metacpan\.org|fastapi\.metacpan\.org|cpanmetadb\.plackperl\.org)}{https://$1}g' /path/to/cpanm

    Option 3: Use an Alternative Client

    Users may also consider switching to alternative clients that default to HTTPS, such as CPAN.pm (version 2.35 or later) or App::cpm, which offer secure module installations.

    The Perl community and developers actively discuss the issue on platforms like GitHub.

    Discussions focus on making cpanminus secure by default and exploring long-term solutions to prevent similar vulnerabilities.

     This vulnerability highlights the critical importance of secure communications in software installations. Users are urged to implement these mitigations promptly to protect their systems from potential threats.

    Protect Your Business with Cynet Managed All-in-One Cybersecurity Platform – Try Free Trial

    The post Critical Vulnerability in Perl Module Installer Let Attackers Intercept Traffic appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

    Go to source

    ¶¶¶¶¶

    / / /

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • French Authorities Charge Telegram CEO with Facilitating Criminal Activities on Platform

    ·

    French prosecutors on Wednesday formally charged CEO Pavel Durov with facilitating a litany of criminal activity on the popular messaging platform and placed him under formal investigation following his arrest Saturday. Russian-born Durov, who is also a French citizen, has been charged with being complicit in the spread of child sexual abuse material (CSAM) as well as enabling organized crime,

    Go to source

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Navy wants industry’s help to reduce sustainment costs

    ·

    The Secretary of the Navy explains what his department wants from—and, if necessary, what it will do to—its contractors.

    Go to source

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Trump calls federal workforce ‘crooked,’ vows to hold them ‘accountable’

    ·

    In an interview, the former president appeared to broaden his disdain for political appointees to federal workers in general.

    Go to source

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Fortra Issues Patch for High-Risk FileCatalyst Workflow Security Vulnerability

    ·

    Fortra has addressed a critical security flaw impacting FileCatalyst Workflow that could be abused by a remote attacker to gain administrative access. The vulnerability, tracked as CVE-2024-6633, carries a CVSS score of 9.8, and stems from the use of a static password to connect to a HSQL database. “The default credentials for the setup HSQL database (HSQLDB) for FileCatalyst Workflow are

    Go to source

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The D Brief: Israel’s West Bank raids; Ukraine’s Kursk progress; USAF’s Ukrainian EW; Shipmaker, fined; And a bit more.

    ·

    Go to source

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The D Brief: Israel’s West Bank raids; Ukraine’s Kursk progress; USAF’s Ukrainian EW; Shipmaker, fined; And a bit more.

    ·

    Go to source

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • TDECU MOVEit Data Breach, 500,000+ members’ Personal Data Exposed

    ·

    Texas Dow Employees Credit Union (TDECU) has disclosed that the personal information of over 500,000 members was exposed due to a security compromise involving a third-party vendor, MOVEit.

    The breach, which occurred between May 29 and 31, raised concerns about the safety of sensitive data, prompting TDECU to take immediate action to mitigate potential risks.

    Details of the Breach

    The breach was part of a broader cyberattack on MOVEit, a data transfer service thousands of organizations use worldwide.

    The attack, which affected over 20 million individuals globally, was carried out by a sophisticated bad actor who managed to access specific files containing sensitive personal information of TDECU members.

    The compromised data includes full names, dates of birth, Social Security numbers, bank and financial account numbers, credit and debit card numbers, driver’s licenses, government IDs, and taxpayer identification numbers.

    Upon learning of the breach on July 30, 2024, TDECU launched an immediate investigation with the assistance of external cybersecurity experts.

    The investigation confirmed that while certain data was accessed, TDECU’s broader network security remained uncompromised.

    Are You From SOC/DFIR Teams? - Try Advanced Malware and Phishing Analysis With ANY.RUN -14-day free trial

    Despite the severity of the breach, TDECU has not reported any incidents of identity or financial fraud linked to the exposed data.

    TDECU’s Response and Member Support

    In response to the breach, TDECU has begun notifying affected individuals as of August 23, 2024.

    The credit union offers complimentary credit monitoring services to those whose Social Security numbers were impacted.

    Affected members are advised to take precautionary measures, such as placing fraud alerts or security freezes on their credit files, obtaining free credit reports, and vigilantly monitoring their financial accounts for any signs of fraudulent activity.

    TDECU has also set up a toll-free response line at 866-573-9704, available Monday through Friday from 8:00 a.m. to 8:00 p.m. Central Time, to assist members with inquiries related to the breach.

    The credit union is committed to providing ongoing support and guidance to help members protect themselves from potential identity theft.

    Ongoing Efforts to Enhance Security

    TDECU’s top priority remains the privacy and security of member information. In light of the breach, the credit union is taking significant measures to strengthen its data protection protocols.

    This includes working closely with cybersecurity professionals to enhance security measures and prevent future incidents.

    TDECU has emphasized the importance of transparency and accountability in handling the breach.

    The credit union is committed to keeping members informed about the situation and any developments related to the investigation.

    As the investigation continues, TDECU reassures its members that it is dedicated to safeguarding their personal information and maintaining their trust.

    The credit union’s proactive approach to addressing the breach and supporting affected individuals underscores its commitment to member security and privacy.

    Protect Your Business with Cynet Managed All-in-One Cybersecurity Platform – Try Free Trial

    The post TDECU MOVEit Data Breach, 500,000+ members’ Personal Data Exposed appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

    Go to source

    ¶¶¶¶¶

    / /

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • TDECU MOVEit Data Breach, 500,000+ members’ Personal Data Exposed

    ·

    Texas Dow Employees Credit Union (TDECU) has disclosed that the personal information of over 500,000 members was exposed due to a security compromise involving a third-party vendor, MOVEit.

    The breach, which occurred between May 29 and 31, raised concerns about the safety of sensitive data, prompting TDECU to take immediate action to mitigate potential risks.

    Details of the Breach

    The breach was part of a broader cyberattack on MOVEit, a data transfer service thousands of organizations use worldwide.

    The attack, which affected over 20 million individuals globally, was carried out by a sophisticated bad actor who managed to access specific files containing sensitive personal information of TDECU members.

    The compromised data includes full names, dates of birth, Social Security numbers, bank and financial account numbers, credit and debit card numbers, driver’s licenses, government IDs, and taxpayer identification numbers.

    Upon learning of the breach on July 30, 2024, TDECU launched an immediate investigation with the assistance of external cybersecurity experts.

    The investigation confirmed that while certain data was accessed, TDECU’s broader network security remained uncompromised.

    Are You From SOC/DFIR Teams? - Try Advanced Malware and Phishing Analysis With ANY.RUN -14-day free trial

    Despite the severity of the breach, TDECU has not reported any incidents of identity or financial fraud linked to the exposed data.

    TDECU’s Response and Member Support

    In response to the breach, TDECU has begun notifying affected individuals as of August 23, 2024.

    The credit union offers complimentary credit monitoring services to those whose Social Security numbers were impacted.

    Affected members are advised to take precautionary measures, such as placing fraud alerts or security freezes on their credit files, obtaining free credit reports, and vigilantly monitoring their financial accounts for any signs of fraudulent activity.

    TDECU has also set up a toll-free response line at 866-573-9704, available Monday through Friday from 8:00 a.m. to 8:00 p.m. Central Time, to assist members with inquiries related to the breach.

    The credit union is committed to providing ongoing support and guidance to help members protect themselves from potential identity theft.

    Ongoing Efforts to Enhance Security

    TDECU’s top priority remains the privacy and security of member information. In light of the breach, the credit union is taking significant measures to strengthen its data protection protocols.

    This includes working closely with cybersecurity professionals to enhance security measures and prevent future incidents.

    TDECU has emphasized the importance of transparency and accountability in handling the breach.

    The credit union is committed to keeping members informed about the situation and any developments related to the investigation.

    As the investigation continues, TDECU reassures its members that it is dedicated to safeguarding their personal information and maintaining their trust.

    The credit union’s proactive approach to addressing the breach and supporting affected individuals underscores its commitment to member security and privacy.

    Protect Your Business with Cynet Managed All-in-One Cybersecurity Platform – Try Free Trial

    The post TDECU MOVEit Data Breach, 500,000+ members’ Personal Data Exposed appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

    Go to source

    ¶¶¶¶¶

    / /

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶