Yesterday, Leakbase, a website with a data breach notification, reported that someone allegedly hacked the Swachhata platform in India and stole 16 million user records. Cloudsek’s security researchers broke the news when they found a report that sample data containing personal information (PII), including email addresses, hashed passwords and user IDs, had been leaked. Earlier this week, Cloudsek’s consultants reported on an initiative in which 6 GB of compromised data from the Swachhata platform – India’s Ministry of Housing and Urban Affairs – was distributed through the popular file hosting platform. “Previously, [Leakbase] was known to provide reliable leaks of information and data from companies around the world,” CloudSEK wrote. “[Threat actors on the platform] often act for financial gain and sell on the Sunday Leakbase forums.” The platform was at the center of a massive data leak on Taringa, a Reddit-like social networking site for Spanish users, in 2017. In addition, CloudSEK said October that leakbase users often gain access to the admin panels and servers of various content management systems (CMS), which are allegedly taken without permission and sold for monetary gain. “This information can be combined for further sales as potential customers on cybercrime forums,” the company wrote. In October, security experts said the data could be harvested by threat actors to carry out phishing, smishing attacks and social engineering attacks.

The Trellix Advanced Threat Research team has detected a 15-year-old Python bug found in the Python tarfile module, which is monitored as CVE-6.8-2007 with CVSS:4559 evaluation. The vulnerability is a path bypass attack on the extract and extractall functions in the tarfile module that allows an attacker to overwrite arbitrary files. ”. It is sorted by file names in the tar archive,” says Trellix security researcher Casimir Schultz. After successfully exploiting the vulnerability, the attacker may have had access to write the execution code of the file. Tarfile vulnerability reports state that tarfile files are a collection of many different files and metadata that are then used to open the tarfile file. In this case, attackers can take advantage of the error by downloading a malicious tarfile that allows it to exit the folder from which you want to extract the file and execute the code. The Tarfile module allows users to add a filter that they can use to parse and modify a file’s metadata before adding it to the TAR archive. This makes it easier for attackers to build their exploits with small lines of code. “The security code could not be written to clear the participants’ files before the tarfile was called. () extract the tarfile file. extractall (), leads to a vulnerability that allows the attacker to bypass access to the file system directory– – Trellix security vulnerability researcher Charles McFarland, Python tarfil the eject function of the module is based on the information in the object passed to the function explicitly trust and extraction TarInfo joins the road, and a bypass that allows the attacker to execute the attack tarinfo object in a directory name. The path that joins the filename Also depends on the extractall function extraction function, experts say that the extractall function is also vulnerable to a directory bypass attack.

This is a fascinating look into the future of automated fraud detection in sports: Maybe you’ve heard the really crazy discussions about fraud in athletics? Philadelphia Eagles forward Devon Allen was disqualified from the 110-meter hurdles at the World Athletics Championships a few weeks ago for a false start. Here’s the problem: you can’t see a false start. No one can see a false start. When he sees Allen, he definitely can’t reach for the gun. But here’s the thing: World Athletics has determined that someone cannot be pushed out of a block in a tenth of a second from a pistol without a false start. They have a science that shows that it is beyond human capabilities to react so quickly. Of course, there are people who tell you that this is nonsense (I am one of them), this is pseudoscience, in no way they can restrict human abilities in this way. There is a science that shows that it is humanly impossible to hit a fastball. Once upon a time, science proved that people could not pass a kilometer in four minutes. By the way, do you know what Devon Allen’s reaction time is? Dec. This took 0.99 seconds. According to world athletics science, one thousandth of a second is faster than necessary. They certainly know that. 01 seconds – and definitely .