Chainalysis says attackers exposed usernames, password hashes and live tokens for all of its customers. "While the company locked Chainalysis accounts as a precaution after discovering that some customers' passwords had been exposed and asked users to reset their passwords before signing in again, it has now taken the login portal offline, together with Reactor and Data Solutions, the Know-Your-Transaction (KYT) user interface and API, and address screening products, after discovering further abnormal activity," reports BleepingComputer.
The company says it has no evidence that investigative data or blockchain attribution records were accessed or altered, but all users will be required to reset passwords and rotate API keys before regaining access. BleepingComputer reports: Chainalysis provides blockchain analysis tools to trace cryptocurrency transactions and investigate crimes such as fraud, ransomware, and money laundering. Its customer list includes law enforcement, government agencies, financial institutions, insurance companies, and cryptocurrency businesses worldwide. This follows the company's disclosure last Friday that attackers using AI tools accessed customers' names, email addresses, user IDs, and organizational role labels using what it described as "offensive agentic techniques."
While it initially said the impact was limited and the breach affected only non-sensitive identity metadata, later updates revealed that usernames and password hashes for all customers were exposed in an "on-path attack" (more commonly known as a Man-in-the-Middle or MITM attack). However, the company found no evidence that the attackers accessed investigative graph data or altered its blockchain attribution repositories. [...] To ensure threat actors don't access affected accounts, Chainalysis asked customers to provide trusted IP addresses so they can regain access to the login portal once it is brought back online and reset their credentials.
OpenAI says its new GPT-6 Cyber model helped an automated system identify 1,724 security flaws in the Linux kernel and exploit 948 of them to gain administrator-level access during testing, including at least 10 previously unknown techniques. Axios reports: During testing, the system identified 1,724 security flaws and found ways to use 948 of them to gain administrator-level access to Linux systems for about $1.2 million in API credits. At least 10 of the techniques the model used were previously unknown, according to OpenAI. Human researchers reviewed the Linux findings before reporting vulnerabilities and proposed fixes to maintainers. The model also uncovered 81 previously unknown, high-severity flaws in Mozilla's Firefox browser.
A newly disclosed OpenSSH flaw dubbed "*sshole" can allow attackers to log in to password-disabled accounts on certain musl-based Linux systems simply by submitting a password longer than 256 bytes. "Apparently certain varieties of musl Linux (Alpine, OpenWrt, Buildroot, Yocto, etc.) have had this OpenSSH vulnerability for about a decade," writes longtime Slashdot reader AlteredEgg. "Upgrade now!" BleepingComputer reports: Security researcher Ozgun Kultekin, who discovered and released details on the vulnerability today, says the flaw has existed since 2016 and stems from how OpenSSH handles password verification errors on systems using the musl C library. Linux accounts can be configured to prevent password logins by replacing their password hash with an asterisk (*) in the /etc/shadow file. Because this is not a valid password hash, no password should allow access to those accounts. However, a patch introduced in OpenSSH in 2016 to fix a username enumeration vulnerability tracked as CVE-2016-6210 changed how OpenSSH handled accounts without usable password hashes.
To prevent attackers from identifying valid usernames through different response times, OpenSSH was modified to perform password hashing even when an account had no usable password hash, including accounts configured with * to block password logins. The problem is that the musl C library's crypt() function also returns * when password hashing fails, including when a submitted password exceeds its 256-byte limit. This means an attacker can submit an oversized password and cause OpenSSH to compare the returned * against the account's stored *, resulting in a successful login.
To be clear, the flaw does not allow attackers to bypass passwords on accounts with valid password hashes. [...] Admins who can't immediately install the update can mitigate the issue by turning off SSH password authentication with PasswordAuthentication no in their SSH server configuration and restarting SSH. Kultekin says admins can also check for signs of exploitation by examining SSH authentication logs for password-based logins for accounts that should not allow them.
Longtime Slashdot reader bbsguru shares a report from KrebsOnSecurity: Several staffers at the White House are using computers or mobile devices equipped with residential proxy services that render their internet address available for others to rent, security experts warned today. One of the proxy services is a Russian company whose founder's web hosting business was ground zero for cyberattacks against election systems in Arizona and Illinois in 2016. The security firm Layer3 Intel said it detected multiple residential proxy nodes beaconing out from the internet address network reserved for the Executive Office of the President (AS2650). Layer3 said the proxy activity was relatively persistent between October 5 to November 3, and that a review of the proxies available from AS2650 showed they exited from the White House network 236 times during that period.
The proxy tracking company Synthient said on Twitter/X that the activity it saw coming from AS2650 was related to multiple Windows 11 installations of a service called Infatica, a proxy program that is often integrated into "free" mobile and desktop applications. Infatica's founder Vladimir Fomenko is a Russian man whose hosting firm King Servers was home to six of the eight internet addresses used by Russia's state security services to compromise databases for election systems in Arizona and Illinois in 2016. [...] Layer3 Intel said the proxy exit nodes at the White House came from six internet addresses, on 26 of the 30 days, and that most of the activity happens in the evening, between 5 p.m. and midnight. Incredibly, Infatica was not the only proxy service that reportedly has been reselling access to White House internet addresses: Layer3 Intel said it found 28 separate residential proxy services were able to exit through this network. "This is public access," the Layer3 Intel team wrote. "Anybody can obtain it by signing up to a public residential proxy service, paying a few dollars and sending requests through it. We did not selectively target this network or try to make our probes exit from it. We caught this by chance, simply by requesting global rotating access through these services."
An anonymous reader quotes a report from Reuters: The refrigerators at three regional blood banks in France were hit by a cyberattack overnight between Sunday and Monday, at the same time hackers struck supermarkets from Sweden to Belgium. "Several regional facilities of the French Blood Establishment (EFS) were affected by a cybersecurity incident that impacted certain cold storage room monitoring and control systems," the health ministry said in a statement.
The incident had no impact on blood supplies, EFS spokesperson Charley Dubois said. "We have staff round the clock since blood can be needed at any time. They were warned about the problems by alerts and moved the blood to other refrigerators that were not connected," she said. [...] Investigations are under way into how the attack was carried out, what equipment may have been affected and when systems can safely return to service. The attack followed a similar incident in France last month when police said hackers seized control of cooling units at hundreds of supermarkets, causing fires and food losses.
An anonymous reader quotes a report from The Guardian: Supermarket chains in Sweden, Belgium and Luxembourg have said the temperatures of their refrigerators and freezers in dozens of stores rose overnight, prompting fears of a cyber-attack similar to one that caused millions of euros of food losses in France. Sweden's Coop chain told the daily Aftonbladet on Monday that six of its stores had been affected, while ICA said it was "aware that a limited number of stores were affected by an incident overnight which impacted their refrigeration and freezer systems".
The Dutch retailer Ahold Delhaize, which last month reported a cybersecurity incident to police in the Netherlands, said an "IT incident" had hit fridges and freezers in dozens of its supermarkets in Belgium and Luxembourg. A company spokesperson, Sarah De Meester, said the supermarket chain had established that temperatures in the cooling systems had increased, adding that the incident was being investigated. Belgium's Le Soir newspaper reported that dozens of stores and supermarkets were affected, including five Spar outlets, multiple Shop & Go convenience stores attached to Q8 service stations, and a number of smaller Proxy Delhaize minimarkets. "We started mobilizing technicians at 1am," Stephan Moelans, the chief executive of Sabcobel, which specialises in refrigeration system installations, told the paper. "We spent all night and morning disconnecting the affected installations from the grid."
The Washington Post reports:
Tens of thousands of South Koreans had their financial data exposed online in recent weeks after at least nine major banks there suffered cyberattacks that suggested a dark future for online security. One man, a 26-year-old living in southern China, was allegedly behind the attacks, according to an investigation by cybersecurity company CrowdStrike. Traces left online and failure to secure his own systems allowed investigators to piece together the man's name, age, location and what he allegedly did. The clues revealed that the devastating assault on some of Asia's most sophisticated financial institutions was the work of an amateur. The attacks were launched with help from a few artificial intelligence chatbots, CrowdStrike found, before asking one to help sell the stolen data online and draft a fake résumé touting cybersecurity skills...
The hacker who broke into the South Korean banks had access to Anthropic's Claude, but because the U.S. firm's tools generally refuse to take illegal actions, free Chinese models were also used, including DeepSeek, CrowdStrike found. "The models are interchangeable," said Meyers, the CrowdStrike executive.
The Post calls it "part of a wave of AI-enabled hacking that is advancing across the world, triggering alarm inside national governments as well as multinational companies."
"Basically any pedestrian, non-hacker can take these frameworks and start leveraging them to go after different targets," said Adam Meyers, senior vice president of counter adversary operations at CrowdStrike. The company has tracked an increase in the speed with which cyberattacks can move once inside a target's networks, as seasoned hackers and rank amateurs alike get a boost from AI tools. "Anyone can be a super-hacker now," Meyers said... Many cyber experts still expect the security reckoning to intensify as AI tools that can find and exploit software bugs become more widely distributed and understood.
[Last] Monday, The Post reported that cybersecurity researchers from the start-up Cathedral who set out to test Anthropic's security found that they could access internal messages and meeting transcripts. Cathedral reported its findings to Anthropic, which said it resolved the newly discovered problems... Security experts say it's unlikely that any hacker is forgoing the use of AI tools right now.
Even in America, critical infrastructure like energy and water companies need to be "immediately and comprehensively" tested for exploitable bugs, according to Snehal Antani, chief executive of cybersecurity company Horizon3. He tells the Post the government might need to fund that remediation, and even form "a public and private partnership to accelerate incident response."
An anonymous reader quotes a report from Wired: Trading has resumed on Polymarket's flagship international platform after a hack that drained money from the wallets of some traders. A third-party vendor based in the United Kingdom was breached, not the prediction market's website itself. Law enforcement in the UK have been notified of the incident, the company said. Trading was initially paused while the company investigated for several hours.
On X, prominent traders complained that they had lost money; Blockchain analytics firm Bubblemaps reported that around 700 users appear affected, with approximately $2.7 million stolen. Polymarket declined to comment when WIRED asked how many traders were impacted by the breach and how much money was lost, but said it will refund impacted traders.
The hack did not impact users on Polymarket US, the company's newer platform for people within the United States. Polymarket runs two separate prediction markets; Polymarket US operates as a federally regulated financial exchange within the country, while the flagship Polymarket is a cryptocurrency-based platform that is banned in the United States and a number of other countries. This is not the first time that Polymarket traders have experienced losses like this. "A nearly identical vendor-compromise attack hit the platform in June, draining close to $3 million from at least 11 user wallets through the same kind of injected frontend script," reports StartupFortune.
Hours before Polymarket halted trading, more than $2 billion in cryptocurrency was drained from Binance wallets in just 40 minutes.
The latest version of Firefox fixes 167 security vulnerabilities, most of which are of high severity, while the newest version of Chrome patches 52 flaws, four of which are critical.
The latest version of Firefox fixes 167 security vulnerabilities, most of which are of high severity, while the newest version of Chrome patches 52 flaws, four of which are critical.
Ars Technica's Dan Goodin reports: Defenders across the world face the burden of responding to yet another botched code-execution vulnerability, this time in boot-time firmware used by most of the world's server vendors and data centers. The vulnerability, with a severity rating of 9.5 out of 10, resides in the TianoCore EDK II, an open source codebase that hardware makers and cloud providers use to create the UEFI firmware that runs during the boot-up sequence. Last year, a representative of the UEFI Forum called (PDF) EDK2 the "preeminent solution / implementation of the UEFI specifications." Virtually all UEFI suppliers (sometimes still called IBVs or independent BIOS vendors), including AMI, Insyde, and Phoenix, use the reference code extensively. Project Mu, Microsoft's hardened EDK2 fork, used the code containing the vulnerable component as well.
The vulnerability, tracked as CVE-2026-97631, is a memory-corruption flaw in an ICMP component that attackers can exploit to execute malicious code that runs before the operating system and firmware can implement defenses like Secure Boot, which establishes a chain of trust for all code, including the Trusted Platform Module (TPM), loaded during boot. While final payloads delivered by CVE-2026-97631 have no persistence -- meaning they run only once -- they can give attackers a wide opening to install other payloads that also run each time early in the boot process.
The parties that discovered CVE-2026-97631 -- Alex Matrosov of Anthropic and Dan Holmes of Google -- had arranged for it to stay under wraps until a coordinated disclosure that was scheduled for January. AMI, a maker of motherboards and other hardware, published this pull request last month that detailed the vulnerability and included a code fix. Once the post came to the attention of the discovering parties, TianoCore Project members published a public advisory last week. With publicly available patch code, it will be trivial for advanced hackers to learn how the vulnerability is triggered and to build working exploits. Further compounding the urgency, patching UEFI code vulnerabilities in millions of end devices sold and used by thousands of hardware makers and cloud providers is cumbersome and time-consuming.
An anonymous reader quotes a report from ProPublica: A Florida man who was the subject of a 2019 investigation by ProPublica was indicted last month on federal charges that he defrauded clients of his ransomware data recovery firm. According to the Justice Department, the man, Zohar Pinhasi, told customers he could recover their encrypted files without having to pay hackers, when, in reality, he paid the ransom and charged victims a hefty fee on top. The indictment mirrors the findings from ProPublica's 2019 article "The Trade Secret," which centered on Pinhasi and his scheme.
The outlet found that the ransomware victims were being harmed twice: once by the hackers, who locked their targets' files and demanded ransom, and a second time by MonsterCloud, Pinhasi's Florida-based data recovery firm, which misled its clients about not paying ransoms. "By falsely claiming to decrypt ransomware without paying off the ransomers, the defendant re-victimized his clients while extracting a hefty profit for himself," U.S. Attorney Joseph Nocella said in an Oct. 7 press release. "Our Office will vigorously prosecute ransomware attackers who prey on Americans from across the world and those who cynically profit from their criminal activity." [...] Pinhasi, who went by the alias Zack Green, told ProPublica in 2019 that MonsterCloud never promised clients that their data will be recovered by any particular method. "How we do it, it's our problem," he told ProPublica. "You will get your data back. Sit back, relax and enjoy the ride." He called MonsterCloud's data recovery methods a "trade secret."
[...] Federal investigators found that, over the course of the scheme, Pinhasi allegedly charged clients more than $19 million and paid more than $8 million in ransom payments. In one example, Pinhasi made a ransom payment of about $8,200 but charged the client about $150,000. If convicted, he faces up to 20 years in prison. [...] In 2019, Pinhasi touted MonsterCloud's ties to law enforcement as evidence of its integrity. Pistole, who also headed the Transportation Security Administration under President Barack Obama, was listed on MonsterCloud's website as the only member of its "Cyber Security Advisory Council."
Login
