Content by Mathew J. Schwartz

Fortinet Users See Active Zero-Day Warnings Past and Present

Mathew J. Schwartz  •  January 17, 2025

Fortinet has released patches to fix a zero-day vulnerability being actively exploited by attackers. Separately, researchers are warning customers to review their infrastructure after attackers leaked configuration details - including firewall rules and plaintext VPN passwords - for 15,000 devices.

Researchers Spot Serious UEFI Secure Boot Bypass Flaw

Mathew J. Schwartz  •  January 16, 2025

Researchers are warning Microsoft Windows as well as many Linux distribution users to install updates that revoke permissions for a vulnerable driver that attackers can use to target most systems, allowing them to bypass UEFI Secure Boot and install a bootkit to take full control of a system.

Ransomware Leak Sites Suggest Attacks Reached Record High

Mathew J. Schwartz  •  January 15, 2025

While ransomware groups' data-leak sites regularly lie, if taken at face value, in December 2024 they collectively listed the largest number of victims ever seen in a one-month period, dominated by RansomHub, Play and Akira operations, plus a bevy of newcomers, researchers report.

Under Discussion: UK Mandatory Ransomware Incident Reporting

Mathew J. Schwartz  •  January 14, 2025

Banning ransom payments by public sector and critical infrastructure entities, notifying the government of any intent to pay a ransom, and reporting incidents to authorities comprise three counter-ransomware initiatives proposed by the British government. Which ones will pass muster?

Microsoft Sues Harmful Fake AI Image Crime Ring

Mathew J. Schwartz  •  January 13, 2025

Microsoft filed a lawsuit targeting a cybercrime service used to generate "thousands of harmful images" by subverting the guardrails built into its Azure generative artificial intelligence tools. The company said attackers built a tool that reverse-engineered the guardrails in its AI platform.

PowerSchool's Breach Fallacy: Paying Criminals for Promises

Mathew J. Schwartz  •  January 10, 2025

Data breach victim PowerSchool, maker of a widely used K-12 student information system platform, has been attempting to assure schools, and parents and guardians, by saying its attacker has promised to delete the stolen data. What's the old saying about those who fail to learn from history?

Zero-Day Patch Alert: Ivanti Connect Secure Under Attack

Mathew J. Schwartz  •  January 9, 2025

VPN appliance maker Ivanti has begun releasing updates to patch a zero-day vulnerability being actively exploited by suspected nation-state attackers. Experts are warning users to immediately update their devices, after factory resetting them, to flush any malware attackers may have installed.

Abandoned Backdoors: How Malicious Infrastructure Lives On

Mathew J. Schwartz  •  January 8, 2025

How many servers are infected by web shells designed to give attackers remote access to systems, but now "phone home" to malicious infrastructure that's now abandoned or expired? Security researchers who posed that question have counted 4,000 such systems, including in government and education.

T-Mobile Sued by Washington State Over 2021 Data Breach

Mathew J. Schwartz  •  January 7, 2025

Washington state's attorney general filed a consumer protection lawsuit against T-Mobile over a massive 2021 data breach that exposed personally identifiable information for more than 79 million consumers, alleging in part the telecom failed to correctly notify victims.

China's Hacking of US Telecoms: Officials Name More Victims

Mathew J. Schwartz  •  January 6, 2025

The nine known victims of a "broad and significant cyberespionage campaign" the White House has tied to China reportedly include Charter Communications, Consolidated Communications and Windstream, as officials said the hackers' earliest known telecom network penetration began in mid-2023.

Patch Alert: Remotely Exploitable LDAP Flaws in Windows

Mathew J. Schwartz  •  January 6, 2025

Security experts are urging all organizations that use Microsoft Windows to ensure they install patches, released last month, to fix Lightweight Directory Access Protocol denial-of-service and remote code execution flaws. Researchers have released a proof-of-concept exploit for the latter flaw.

36 Chrome Extensions Compromised in Supply Chain Attack

Mathew J. Schwartz  •  January 3, 2025

A supply chain attack that subverted legitimate Google Chrome browser extensions to inject data-stealing malware is more widespread than security researchers first suspected. So far researchers have identified 36 subverted extensions collectively used by 2.6 million people.

Recapping 2024's Top Attacks: Cybercrime, Espionage and More

Mathew J. Schwartz  •  January 2, 2025

What a year 2024 has been on the cybersecurity front, showing that data breaches aren't in decline, and how attackers will exploit built-in backdoors, when they aren't simply hacking edge devices. Even so, promising efforts to boost the collective defense continue.

Arrest of US Army Soldier Tied to AT&T and Verizon Extortion

Mathew J. Schwartz  •  December 31, 2024

A serving member of the U.S. Army has been arrested on a two-count indictment tied to the theft and sale of "confidential phone records," reportedly tied to the theft of terabytes of data from AT&T, Verizon and other customers of cloud data warehousing platform Snowflake.

AT&T and Verizon Say Chinese Hackers Ejected From Networks

Mathew J. Schwartz  •  December 31, 2024

U.S. telecommunications giants AT&T and Verizon Communications believe they have finally ejected Chinese cyber espionage hackers from their networks. The White House said the "Salt Typhoon" nation-state hackers infiltrated at least nine U.S. telecoms' infrastructure, and have been hard to eject.