Over 90,000 LG Smart TVs may be exposed to remote attacks
Security researchers at Bitdefender have discovered four vulnerabilities impacting multiple versions of WebOS, the operating system used in LG smart TVs. The flaws enable varying degrees of unauthorized access and control over affected models, including authorization bypasses, privilege escalation, and command injection. Security researchers at Bitdefender have discovered four vulnerabilities impacting multiple versions of WebOS, the operating system used in LG smart TVs. The flaws enable varying degrees of unauthorized access and control over affected models, including authorization bypasses, privilege escalation, and command injection.
Microsoft employees exposed internal passwords in security lapse
Microsoft has resolved a security lapse that exposed internal company files and credentials to the open internet. Security researchers Can Yoleri, Murat Özfidan and Egemen Koçhisarlı with SOCRadar, a cybersecurity company that helps organizations find security weaknesses, discovered an open and public storage server hosted on Microsoft’s Azure cloud service that was storing internal information relating to Microsoft’s Bing search engine. The Azure storage server housed code, scripts and configuration files containing passwords, keys and credentials used by the Microsoft employees for accessing other internal databases and systems.
The ‘Vote for My Team’ Scam Is One Way to Lose Your Steam Account to Criminals
Voting for your team sounds like something gamers would typically do, right? Unfortunately, this is a common tactic used by criminals looking to steal login credentials, particularly for Steam. Your Steam username and password are precious commodities on the black market. If criminals compromise a Steam account, they might ransom it back to the owner, but in some cases, they might sell it to someone else willing to pay for a stolen account. While gamers tend to be more technically savvy, the sheer number of people using Steam and other similar platforms ensures that criminals always have victims willing to click on a malicious link or open a dangerous file.
Twitter’s Clumsy Pivot to X.com Is a Gift to Phishers
On April 9, Twitter/X began automatically modifying links that mention “twitter.com” to read “x.com” instead. But over the past 48 hours, dozens of new domain names have been registered that demonstrate how this change could be used to craft convincing phishing links — such as fedetwitter[.]com, which until very recently rendered as fedex.com in tweets. A search at DomainTools.com shows at least 60 domain names have been registered over the past two days for domains ending in “twitter.com,” although research so far shows the majority of these domains have been registered “defensively” by private individuals to prevent the domains from being purchased by scammers.
Microsoft plugs a record-breaking 147 security holes on Patch Tuesday
On Patch Tuesday on April 9, 2024, Microsoft provided several security updates to fix 147 vulnerabilities. Microsoft classifies three vulnerabilities in Microsoft Defender for IoT as critical and classifies all but two of the other vulnerabilities as high risk. According to Microsoft, none of the vulnerabilities have been exploited for attacks to date. However, this could change at any time. Trend Micro has also spotted ZDI exploit code in the wild. Microsoft offers sparse details on the vulnerabilities for self-searching in its . Dustin Childs presents the topic of Update Tuesday much more clearly in the – always with an eye on admins who manage corporate networks. According to Dustin Childs, he doesn’t remember Microsoft ever patching as many security vulnerabilities in one month as it did this April.
