BleepingComputer reports that 29,968 QNAP network-attached storage devices could be compromised with potential attacks leveraging a critical SQL injection flaw, tracked as CVE-2022-27596, which has been patched by QNAP on Monday.
While not a stark enterprise threat, security experts warn that if an unenrolled Chromebook at a school district or a retailer does not get detected, a hacker could potentially install malware on the network.
Attempts to exploit the Realtek Jungle SDK vulnerability, CVE-2021-35394, was observed by Palo Alto’s Unit 42 researchers an eye-popping 134 million times as of December 2022 and is still ongoing.
Paul and Scott break down the Root of Trust (RoT) and other highlights from the August 2022 Below The Surface Threat Report: https://eclypsium.com/2022/08/31/august-firmware-threat-report/ This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them!
Paul Asadoorian and Scott Scheferman sit down to discuss this month's firmware and supply chain threat report. We cover some of the history and latest developments regarding Secure Boot security research, the threats we face securing the firmware supply chain, and some insights into threat actors targeting firmware. View the full report here: https...
Widespread malvertising campaign VASTFLUX, which involved the impersonation of more than 1,700 apps and impacted nearly 11 million devices, has been taken down by fraud prevention company HUMAN, The Hacker News reports.
ThreatFabric researchers have discovered the emergence of the new Hook Android malware created by BlackRock and ERMAC Android banking trojan DukeEugene, which has mostly been targeting financial apps in the U.S., Canada, France, Spain, Italy, Australia, and the U.K., reports The Hacker News.
Fast Five
Selected by the SC Media Editorial team every Tuesday.
Sign up now for the top five issues cybersecurity pros need to know this week.
