iHash

News and How to's

Allowed

Microsoft Bug Allowed Hackers to Breach Over Two Dozen Organizations via Forged Azure AD Tokens

by Leave a Comment

Jul 15, 2023THNCyber Attack / Enterprise Security Microsoft on Friday said a validation error in its source code allowed for Azure Active Directory (Azure AD) tokens to be forged by a malicious actor known as Storm-0558 using a Microsoft account (MSA) consumer signing key to breach two dozen organizations. "Storm-0558 acquired an inactive MSA consumer signing key and used it … [Read more...] about Microsoft Bug Allowed Hackers to Breach Over Two Dozen Organizations via Forged Azure AD Tokens

Researchers Detail Azure SFX Flaw That Could’ve Allowed Attackers to Gain Admin Access

by Leave a Comment

Cybersecurity researchers have shared more details about a now-patched security flaw in Azure Service Fabric Explorer (SFX) that could potentially enable an attacker to gain administrator privileges on the cluster. The vulnerability, tracked as CVE-2022-35829, carries a CVSS severity rating of 6.2 and was addressed by Microsoft as part of its Patch Tuesday updates last … [Read more...] about Researchers Detail Azure SFX Flaw That Could’ve Allowed Attackers to Gain Admin Access

Apple Removes macOS Feature That Allowed Apps to Bypass Firewall Security

by Leave a Comment

Apple has removed a controversial feature from its macOS operating system that allowed the company's own first-party apps to bypass content filters, VPNs, and third-party firewalls. Called "ContentFilterExclusionList," it included a list of as many as 50 Apple apps like iCloud, Maps, Music, FaceTime, HomeKit, the App Store, and its software update service that were routed … [Read more...] about Apple Removes macOS Feature That Allowed Apps to Bypass Firewall Security

A Google Docs Bug Could Have Allowed Hackers See Your Private Documents

by Leave a Comment

Google has patched a bug in its feedback tool incorporated across its services that could be exploited by an attacker to potentially steal screenshots of sensitive Google Docs documents simply by embedding them in a malicious website. The flaw was discovered on July 9 by security researcher Sreeram KL, for which he was awarded $3133.70 as part of Google's Vulnerability Reward … [Read more...] about A Google Docs Bug Could Have Allowed Hackers See Your Private Documents

Amazon Alexa Bugs Allowed Hackers to Install Malicious Skills Remotely

by Leave a Comment

Attention! If you use Amazon's voice assistant Alexa in you smart speakers, just opening an innocent-looking web-link could let attackers install hacking skills on it and spy on your activities remotely.Cybersecurity researchers today disclosed severe security vulnerabilities in Amazon's Alexa virtual assistant that could render it vulnerable to a number of malicious … [Read more...] about Amazon Alexa Bugs Allowed Hackers to Install Malicious Skills Remotely

Zoom Bug Allowed Snoopers Crack Private Meeting Passwords in Minutes

by Leave a Comment

Popular video conferencing app Zoom recently fixed a new security flaw that could have allowed potential attackers to crack the numeric passcode used to secure private meetings on the platform and snoop on participants.Zoom meetings are by default protected by a six-digit numeric password, but according to Tom Anthony, VP Product at SearchPilot who identified the issue, the … [Read more...] about Zoom Bug Allowed Snoopers Crack Private Meeting Passwords in Minutes