The Hacker News یکشنبه ۱۰ آبان ۱۴۰۵ · ۱۲:۲۱

CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key

A critical flaw in Canonical's LXD and MicroCloud let an attacker log in as a trusted client without holding that client's private key. To do it, the attacker had to reach their HTTPS API over the network and have the trusted client's public certificate. Once in, the attacker would act as that client, with access to the cluster and its virtual machines. If the impersonated account is

Read the full article at The Hacker News Removal request

This page shows only the headline and the short summary. The full text is published by the original source.

Related news

Full archive →

The Hacker News یکشنبه ۱۰ آبان ۱۴۰۵ · ۱۰:۵۵

Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script

Malicious code on the website of prediction market Polymarket sold some signed-in traders' positions and moved their funds to the hackers on October 29. The code had replaced a page-speed script that the site loaded from an outside company. Polymarket says it is refunding about $2.7 million to 726 affected wallets. Blockchain records show crypto worth about $2.64 million reached

Blockchain & Web3

Source

The Hacker News یکشنبه ۱۰ آبان ۱۴۰۵ · ۱۰:۳۲

NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection

Cybersecurity researchers have disclosed details of what has been described as a "highly sophisticated infection chain" targeting government organizations in Asia. The activity, detailed by Kaspersky this week, targeted a custom Windows 10 build used exclusively by government entities in Asia and involves the deployment of a previously undocumented .NET assembly-loading framework codenamed

Malware & Threats Operating Systems

Source

The Hacker News یکشنبه ۱۰ آبان ۱۴۰۵ · ۱۰:۱۴

FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist

The U.S. Federal Bureau of Investigation (FBI) has officially attributed the theft of more than $6 billion in virtual assets to TraderTraitor, a North Korea-aligned elite hacking group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899. The FBI, along with the U.S. Secret Service (USSS) and the Internal Revenue Service Criminal Investigation (IRS-CI), said it

Source

The Hacker News شنبه ۹ آبان ۱۴۰۵ · ۱۵:۳۱

Chainalysis Confirms Intrusion Into Internal Tools and Exposure of Customer Identity Data

American blockchain analysis firm Chainalysis said it was the target of a cybersecurity incident in which an external actor accessed non-sensitive customer data. However, the company noted that the breach did not result in unauthorized access to its investigation content, authentication credentials, or session tokens. "This month, Chainalysis detected an external actor using offensive agentic

Data Breach Blockchain & Web3 Identity & Access Security

Source