ZeroHour

Search: “software-update”

2 stories in the last 30d

LG TV flaws could let attackers listen in, even in standby mode

Researchers found LG smart TVs collect network data and ACR viewing profiles, and demonstrated microphone audio capture plus undisclosed RCE vulnerabilities.

An investigation by Gamers Nexus with Level1Techs and independent researchers found LG TVs performing network discovery, collecting nearby Wi-Fi names and device identifiers, and conducting Automated Content Recognition (ACR) tracking. They demonstrated microphone audio capture even when the TV appeared off, and audio buffering while the TV was unplugged from the internet. Remote-code-execution vulnerabilities were reported to LG under ongoing responsible disclosure, with full details not yet public.

Malwarebytes Labs · 8d agoVulnerability

BGP hijack infecting networks caused by a comedy of errors that’s not funny at all

Attackers BGP-hijacked Softaculous IP space via Hetzner routing lapses to push malicious Virtualizor updates to hosting servers.

Unknown attackers hijacked the 162.55.80.0/24 prefix used by Softaculous' Virtualizor update service by abusing lax routing security at hosting provider Hetzner Online, announcing the range through AS6204, AS62390, and AS24940 with a forged but RPKI-valid origin. The hijack pulsed intermittently over roughly 33 hours, delivering modified update packages to Virtualizor servers, which lacked cryptographic code signing for updates. Softaculous says only a small number of servers were likely affected but cannot produce a definitive list, urging administrators to treat every Virtualizor server as in scope for checks.

Ars Technica · Security · 13d agoExploit / PoC in the wild1