#auth

A new Go-based information stealer malware called JaskaGO has emerged as the latest cross-platform threat to infiltrate both Windows and Apple macOS systems. AT&T Alien Labs, which made the discovery, said the malware is "equipped with an extensive array of commands from its command-and-control (C&C) server." Artifacts designed for macOS were first observed in July

By Waqas With cybercriminals continuously evolving their strategies to target sensitive data with sophisticated attacks, data security has become a… This is a post from HackRead.com Read the original post: Biggest Data Security Threats for Businesses: Strategies to Strengthen Your Defense

### Summary A security vulnerability has been identified in navidrome's subsonic endpoint, allowing for authentication bypass. This exploit enables unauthorized access to any known account by utilizing a JSON Web Token (JWT) signed with the key "not so secret". The vulnerability can only be exploited on instances that have never been restarted. ### Details Navidrome supports an extension to the subsonic authentication scheme, where a JWT can be provided using a `jwt` query parameter instead of the traditional password or token and salt (corresponding to resp. the `p` or `t` and `s` query parameters). During the first initialization, navidrome generates a random key that is then used by the authentication module to validate JWTs before extracting the username from the `sub` claim. If for some reason the key cannot be retrieved by the initialization code, a hardcoded value is used instead: "not so secret". A bug in the order of operations during navidrome startup results in the aut...

The FBI, CSA, and ACSC have released a joint cybersecurity advisory about the Play ransomware group and their MO.

In recent malvertising campaigns, threat actors dropped the MetaStealer information stealer, more or less coinciding with a new version release.

Loan and mortgage giant Mr. Cooper reported a data breach in which the personal data of 14.7 million homeowners were stolen.

### Impact In versions of the proxy from `2022-09-05` onwards (since 8c874c2ff3d503ac20c7d32f46e08547fcb9e23f), expired authorisation tokens could be renewed automatically without checking their validity against the original account configuration (i.e., the password that was set up when first configuring the account). An attacker with knowledge of valid account addresses and careful timing (i.e., attempting to log in during a period from 10 minutes prior to the token expiry time, but before a genuine login request is received) could use this issue to gain access to an account. This issue is not a concern if you only use the proxy on a local device. It is also not an issue if you are using the O365 resource owner password credentials grant (ROPCG) flow. If you use the proxy in a publicly-accessible setting (i.e., it is available from the internet or another network), you should upgrade to version [`2023-12-19`](https://github.com/simonrob/email-oauth2-proxy/releases/tag/2023-12-19) i...

By Waqas As you look ahead to 2024, the landscape of physical security is evolving rapidly, with new trends emerging… This is a post from HackRead.com Read the original post: 2024 Trends for Securing Your Business Premises: Essential Strategies and Technologies

By Deeba Ahmed Fake Complaints, Real Malware - Sophos Warns Hotels of Global Malspam Attack! This is a post from HackRead.com Read the original post: Global malspam targets hotels, spreading Redline and Vidar stealers

This improper authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to the Confluence instance administrator. This Metasploit module uses the administrator account to install a malicious .jsp servlet plugin which the user can trigger to gain code execution on the target in the context of the of the user running the confluence server.