FreshRSS

🔒
❌ About FreshRSS
☷
△ 🔃
There are new available articles, click to refresh the page.
Before yesterdayYour RSS feeds

Facebook Introduces New Features for End-to-End Encrypted Messenger App

By Ravie Lakshmanan
Meta Platforms on Monday announced that it has started to expand global testing of end-to-end encryption (E2EE) in Messenger chats by default. "Over the next few months, more people will continue to see some of their chats gradually being upgraded with an extra layer of protection provided by end-to-end encryption," Meta's Melissa Miranda said. The social media behemoth said it intends to notify

Mitigate the LastPass Attack Surface in Your Environment with this Free Tool

By The Hacker News
The latest breach announced by LastPass is a major cause for concern to security stakeholders. As often occurs, we are at a security limbo – on the one hand, as LastPass has noted, users who followed LastPass best practices would be exposed to practically zero to extremely low risk. However, to say that password best practices are not followed is a wild understatement. The reality is that there

Irish Regulators Fine Facebook $414 Million for Forcing Users to Accept Targeted Ads

By Ravie Lakshmanan
The Irish Data Protection Commission (DPC) has fined Meta Platforms €390 million (roughly $414 million) over its handling of user data for serving personalized ads in what could be a major blow to its ad-fueled business model. To that end, the privacy regulator has ordered Meta Ireland to pay two fines – a €210 million ($222.5 million) fine over violations of the E.U. General Data Protection

Facebook to Pay $725 Million to settle Lawsuit Over Cambridge Analytica Data Leak

By Ravie Lakshmanan
Meta Platforms, the parent company of Facebook, Instagram, and WhatsApp, has agreed to pay $725 million to settle a long-running class-action lawsuit filed in 2018. The legal dispute sprang up in response to revelations that the social media giant allowed third-party apps such as those used by Cambridge Analytica to access users' personal information without their consent for political

Facebook Cracks Down on Spyware Vendors from U.S., China, Russia, Israel, and India

By Ravie Lakshmanan
Meta Platforms disclosed that it took down no less than 200 covert influence operations since 2017 spanning roughly 70 countries across 42 languages. The social media conglomerate also took steps to disable accounts and block infrastructure operated by spyware vendors, including in China, Russia, Israel, the U.S. and India, that targeted individuals in about 200 countries. "The global

A New Lawsuit Accuses Meta of Inflaming Civil War in Ethiopia

By Vittoria Elliott, Dell Cameron
The suit claims the company lacks adequate moderation to prevent widespread hate speech that has led to violence and death.

Why is Robust API Security Crucial in eCommerce?

By The Hacker News
API attacks are on the rise. One of their major targets is eCommerce firms like yours.  APIs are a vital part of how eCommerce businesses are accelerating their growth in the digital world.  ECommerce platforms use APIs at all customer touchpoints, from displaying products to handling shipping. Owing to their increased use, APIs are attractive targets for hackers, as the following numbers expose

When Being Attractive Gets Risky - How Does Your Attack Surface Look to an Attacker?

By The Hacker News
In the era of digitization and ever-changing business needs, the production environment has become a living organism. Multiple functions and teams within an organization can ultimately impact the way an attacker sees the organization's assets, or in other words, the external attack surface. This dramatically increases the need to define an exposure management strategy. To keep up with business

Irish Regulator Fines Facebook $277 Million for Leak of Half a Billion Users' Data

By Ravie Lakshmanan
Ireland's Data Protection Commission (DPC) has levied fines of €265 million ($277 million) against Meta Platforms for failing to safeguard the personal data of more than half a billion users of its Facebook service, ramping up privacy enforcement against U.S. tech firms. The fines follow an inquiry initiated by the European regulator on April 14, 2021, close on the heels of a leak of a "collated

Ducktail Malware Operation Evolves with New Malicious Capabilities

By Ravie Lakshmanan
The operators of the Ducktail information stealer have demonstrated a "relentless willingness to persist" and continued to update their malware as part of an ongoing financially driven campaign. "The malware is designed to steal browser cookies and take advantage of authenticated Facebook sessions to steal information from the victim's Facebook account," WithSecure researcher Mohammad Kazem

Meta Takes Down Fake Facebook and Instagram Accounts Linked to Pro-U.S. Influence Operation

By Ravie Lakshmanan
Meta Platforms on Tuesday said it took down a network of accounts and pages across Facebook and Instagram that were operated by people associated with the U.S. military to spread narratives that depicted the country in a favorable light in the Middle East and Central Asia. The network, which originated from the U.S., primarily singled out Afghanistan, Algeria, Iran, Iraq, Kazakhstan, Kyrgyzstan,

How social media scammers buy time to steal your 2FA codes

By Paul Ducklin
The warning is hosted on a real Facebook page; the phishing uses HTTPS via a real Google server... but the content is all fake

ffs-2fa-1200

Meta Reportedly Fires Dozens of Employees for Hijacking Users' Facebook and Instagram Accounts

By Ravie Lakshmanan
Meta Platforms is said to have fired or disciplined over two dozen employees and contractors over the past year for allegedly compromising and taking over user accounts, The Wall Street Journal reported Thursday. Some of these cases involved bribery, the publication said, citing sources and documents. Included among those fired were contractors who worked as security guards at the social media

Top 5 API Security Myths That Are Crushing Your Business

By The Hacker News
There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business.  Why so? Because these myths are widening your security gaps. This is making it easier for attackers to abuse APIs. And API attacks are costly. Of course, you will have to bear financial losses. But there are other consequences too:  Reputational damage  Customer attrition

This Hidden Facebook Tool Lets Users Remove Their Email or Phone Number Shared by Others

By Ravie Lakshmanan
Facebook appears to have silently rolled out a tool that allows users to remove their contact information, such as phone numbers and email addresses, uploaded by others. The existence of the tool, which is buried inside a Help Center page about "Friending," was first reported by Business Insider last week. It's offered as a way for "Non-users" to "exercise their rights under applicable laws." <!

New PHP Version of Ducktail Malware Hijacking Facebook Business Accounts

By Ravie Lakshmanan
A PHP version of an information-stealing malware called Ducktail has been discovered in the wild being distributed in the form of cracked installers for legitimate apps and games, according to the latest findings from Zscaler. "Like older versions (.NetCore), the latest version (PHP) also aims to exfiltrate sensitive information related to saved browser credentials, Facebook account information,

Facebook Detects 400 Android and iOS Apps Stealing Users Log-in Credentials

By Ravie Lakshmanan
Meta Platforms on Friday disclosed that it had identified over 400 malicious apps on Android and iOS that it said targeted online users with the goal of stealing their Facebook login information. "These apps were listed on the Google Play Store and Apple's App Store and disguised as photo editors, games, VPN services, business apps, and other utilities to trick people into downloading them," the

Facebook Shuts Down Covert Political 'Influence Operations' from Russia and China

By Ravie Lakshmanan
Meta Platforms on Tuesday disclosed it took steps to dismantle two covert influence operations originating from China and Russia for engaging in coordinated inauthentic behavior (CIB) so as to manipulate public debate. While the Chinese operation sets its sights on the U.S. and the Czech Republic, the Russian network primarily targeted Germany, France, Italy, Ukraine and the U.K. with themes

6 Top API Security Risks! Favored Targets for Attackers If Left Unmanaged

By The Hacker News
Security threats are always a concern when it comes to APIs. API security can be compared to driving a car. You must be cautious and review everything closely before releasing it into the world. By failing to do so, you're putting yourself and others at risk. API attacks are more dangerous than other breaches. Facebook had a 50M user account affected by an API breach, and an API data breach on

Facebook Testing Default End-to-End Encryption and Encrypted Backups in Messenger

By Ravie Lakshmanan
Social media company Meta said it will begin testing end-to-end encryption (E2EE) on its Messenger platform this week for select users as the default option, as the company continues to slowly add security layers to its various chat services. "If you're in the test group, some of your most frequent chats may be automatically end-to-end encrypted, which means you won't have to opt in to the

The Hacking of Starlink Terminals Has Begun

By Matt Burgess
It cost a researcher only $25 worth of parts to create a tool that allows custom code to run on the satellite dishes.

The Business of Hackers-for-Hire Threat Actors

By The Hacker News
Today's web has made hackers' tasks remarkably easy. For the most part, hackers don't even have to hide in the dark recesses of the web to take advantage of people any longer; they can be found right in plain sight on social media sites or forums, professionally advertised with their websites, and may even approach you anonymously through such channels as Twitter. Cybercrime has entered a new

Meta Cracks Down on Cyber Espionage Operations in South Asia Abusing Facebook

By Ravie Lakshmanan
Facebook parent company Meta disclosed that it took action against two espionage operations in South Asia that leveraged its social media platforms to distribute malware to potential targets. The first set of activities is what the company described as "persistent and well-resourced" and undertaken by a hacking group tracked under the moniker Bitter APT (aka APT-C-08 or T-APT-17) targeting

New Ducktail Infostealer Malware Targeting Facebook Business and Ad Accounts

By Ravie Lakshmanan
Facebook business and advertising accounts are at the receiving end of an ongoing campaign dubbed Ducktail designed to seize control as part of a financially driven cybercriminal operation.  "The threat actor targets individuals and employees that may have access to a Facebook Business account with an information-stealer malware," Finnish cybersecurity company WithSecure (formerly F-Secure

IoT Botnets Fuels DDoS Attacks – Are You Prepared?

By Sponsored Content
The increased proliferation of IoT devices paved the way for the rise of IoT botnets that amplifies DDoS attacks today. This is a dangerous warning that the possibility of a sophisticated DDoS attack and a prolonged service outage will prevent businesses from growing.

IoT Botnets Fuels DDoS Attacks – Are You Prepared?

By Sponsored Content
The increased proliferation of IoT devices paved the way for the rise of IoT botnets that amplifies DDoS attacks today. This is a dangerous warning that the possibility of a sophisticated DDoS attack and a prolonged service outage will prevent businesses from growing.

Facebook 2FA scammers return – this time in just 21 minutes

By Paul Ducklin
Last time they arrived 28 minutes after lighting up their fake domain... this time it was just 21 minutes

Over 10 Million Facebook Users Hacked in Ongoing Phishing Scam

By McAfee

In this digital age, communicating online and through our devices has become the norm. From sharing highlights of last night’s game to sending cute animal videos back and forth, so much of our connectedness happens virtually. It’s become so easy to chat with friends and loved ones through social media that we don’t even have to think about it. We know who’s on the other end of the screen, so why would we worry? We know our friends would never send us a malicious link that would steal our information, so why be cautious? Right? 

Not necessarily. Though a message or link may seem like it’s coming from a friend, it’s also possible that it was sent without their knowledge. There are many ways for hackers to scam people very believably. The latest Facebook Messenger hack is just one of many examples. 

Facebook Frenemies 

According to PIXM, Facebook users have been conned for several months by a phishing scam that tricks them into handing over their account credentials. Users are shown a fake login page that copies Facebook’s user interface, giving it the illusion of being real. When someone enters their credentials, their password and login combo is sent to the hacker who then sends out the same link and fake login to the user’s friends through Facebook Messenger. Any user who clicks the link is asked to fill out their credentials, and the cycle repeats. PIXM estimates that over 10 million Facebook users have been duped by this scam since 2021. 

This hacker was able to utilize a technique to evade Facebook’s security checks. When a user clicks on the link in the Messenger app, the browser redirects to a legitimate app deployment service, then redirects again to the actual phishing pages with advertisements and surveys that accrue revenue for the hacker. Using this legitimate service link prevents Facebook from blocking it without blocking other legitimate apps and links as well. Researchers say that even if Facebook managed to block one of these links, several others are created with new unique IDs every day to replace it. 

Phishing scams like these are harder to detect due to the realistic-looking interface on the login pages and that these malicious links are seemingly coming from friends and family. However, there are always key things to look out for when faced with phishing scams. 

Swim Away From These Phishes 

Scams don’t always come from overtly sketchy emails or text messages from strangers. Sometimes they can (unintentionally) come from people we know personally. This isn’t to say that your friends online can’t be trusted! However, it’s important to always be cautious and keep an eye out for any odd behavior to stay on the safe side. Here are some key things to look out for when faced with potential malicious phishing scams: 

  • Lack of personalization. These types of scams may be coming from online friends you don’t speak to often, if at all. If someone you rarely speak to is sending you links out of the blue, that’s an automatic red flag. But if you’re still unsure or if this is coming from someone you know well, pay close attention to the message, the greeting (if any), and whether it’s personalized or not. If it seems cold or overly general, avoid it!
  • Links don’t look quite right. If you’re receiving a link through email, hover over the URL without clicking on it to see the link preview. If it looks suspicious, delete it altogether. For links being sent through social platforms, check to see if the URL matches the content in the message being sent to you or if there is a preview attached. If these things don’t match or aren’t present, it’s best to play it safe and stay away.
  • Spelling and tone seem off. If the message you’re receiving is riddled with spelling or grammar mistakes, proceed with caution, especially if it’s unlike your friend to have those types of errors in their messages. In that same vein, if the tone of the message doesn’t match the typical vibe of the person you’re receiving it from, it’s best to ignore it and move on!
  • The message is telling you to act. Always be wary of a strange message and link asking you to act. If the message is telling you to download something, don’t click any links or attachments. Simply delete the message and carry on!

When in doubt, just ask! If you’ve received a message and a link from a friend online, simply ask if they meant to send it to you. If they didn’t send it themselves, not only did you dodge a bullet, but your friend is also now aware that they’ve been hacked and can take the necessary precautions to ensure their information is protected. And if they did mean to send it to you, then you can click the link knowing that it’s safe to do so. It’s always best to err on the side of caution when it comes to your online security. 

The post Over 10 Million Facebook Users Hacked in Ongoing Phishing Scam appeared first on McAfee Blog.

Facebook 2FA phish arrives just 28 minutes after scam domain created

By Paul Ducklin
The crooks hit us up with this phishing email less than half an hour after they activated their new scam domain.

❌