FreshRSS

🔒
☐ ☆ ✇ InfoSec Resources

IoT Security Fundamentals: Intercepting and Manipulating Wireless Communications

By Dimitar Kostadinov — September 29th 2020 at 19:14

Introduction: IoT Manufacturers Favor Convenience over Security Because IoT security is still an afterthought, cybercriminals in general consider smart devices a “low-hanging fruit” – a target easy to compromise and manipulate. Security (and privacy) by design is key for IoT, and probably the only effective way for a smart gadget to protect its communications is […]

The post IoT Security Fundamentals: Intercepting and Manipulating Wireless Communications appeared first on Infosec Resources.


IoT Security Fundamentals: Intercepting and Manipulating Wireless Communications was first posted on September 29, 2020 at 2:14 pm.
©2017 "InfoSec Resources". Use of this feed is for personal non-commercial use only. If you are not reading this article in your feed reader, then the site is guilty of copyright infringement. Please contact me at darren.dalasta@infosecinstitute.com
☐ ☆ ✇ InfoSec Resources

Format String Vulnerabilities Exploitation Case Study

By Srinivas — September 29th 2020 at 19:55

Introduction: In the previous article of this series, we discussed how format string vulnerabilities can be exploited. This article provides a case study of how format string vulnerabilities can be used to exploit serious vulnerabilities such as Buffer Overflows. We will begin by understanding what stack canaries are and then we will exploit a Buffer […]

The post Format String Vulnerabilities Exploitation Case Study appeared first on Infosec Resources.


Format String Vulnerabilities Exploitation Case Study was first posted on September 29, 2020 at 2:55 pm.
©2017 "InfoSec Resources". Use of this feed is for personal non-commercial use only. If you are not reading this article in your feed reader, then the site is guilty of copyright infringement. Please contact me at darren.dalasta@infosecinstitute.com
☐ ☆ ✇ InfoSec Resources

Fuzzing introduction: Definition, types and tools for cybersecurity pros

By Pedro Tavares — September 30th 2020 at 13:01

Fuzzing is a black-box software testing technique and consists of finding implementation flaws and bugs by using malformed/semi-malformed payloads via automation. Fuzzing an application is not a matter of simply exploiting a specific point of an application, but also acquiring knowledge and potential crashes that could be explored in-depth through the implementation of crafted payloads […]

The post Fuzzing introduction: Definition, types and tools for cybersecurity pros appeared first on Infosec Resources.


Fuzzing introduction: Definition, types and tools for cybersecurity pros was first posted on September 30, 2020 at 8:01 am.
©2017 "InfoSec Resources". Use of this feed is for personal non-commercial use only. If you are not reading this article in your feed reader, then the site is guilty of copyright infringement. Please contact me at darren.dalasta@infosecinstitute.com
☐ ☆ ✇ InfoSec Resources

Copy-paste compromises

By Jatin Jain — September 30th 2020 at 13:05

Copy-paste compromises: Introduction and overview Although the concept of copy-paste compromises is not exactly new, there are now several different forms of the attack. In the version of copy-paste compromise that we’ll discuss today, malicious actors use open-source or publicly available exploit code, web shells and other tools to gain information. Recently, Australia has revealed […]

The post Copy-paste compromises appeared first on Infosec Resources.


Copy-paste compromises was first posted on September 30, 2020 at 8:05 am.
©2017 "InfoSec Resources". Use of this feed is for personal non-commercial use only. If you are not reading this article in your feed reader, then the site is guilty of copyright infringement. Please contact me at darren.dalasta@infosecinstitute.com
☐ ☆ ✇ Naked Security

S3 Ep56: Cryptotrading rodent, ransomware hackback, and a Docusign phish [Podcast]

By Paul Ducklin — October 28th 2021 at 18:45
Latest episode - listen now! Serious security explained with personality in plain English.

ns-1200-logo-podcast-with-mic-and-rodent-emoji

☐ ☆ ✇ Naked Security

The self-driving smart suitcase… that the person behind you can hijack!

By Paul Ducklin — November 16th 2021 at 21:09
Apparently, we need a self-driving IoT Bluetooth robot suitcase. Who knew?

☐ ☆ ✇ McAfee Blogs

How To Tell If Your Smartphone Has Been Hacked

By McAfee — December 9th 2021 at 14:00

Something’s not right. Maybe your phone is losing its charge way too quickly. Or one day it suddenly starts turning itself off and on again. Perhaps it’s running hot, so hot it’s hard to hold. Likewise, you might see outgoing calls that you never dialed or strange spikes in your data usage. Signs like these could mean that your smartphone’s been hacked. Learn how to protect your smartphone with McAfee Mobile Security

Several signs of a potential smartphone hack can look like a technical issue, at least on the surface. Yet the fact is that these issues may be a symptom of a deeper problem, such as malware installed on your smartphone. Malware can eat up system resources or conflict with other apps and your operating system, all of which can cause your phone to act sluggish or erratically. 

Yet, in a way, that’s good news. Because malware can run inefficiently on your phone and create hiccups both large and small, it can tip you off to its presence. And with all the important information we carry in the palms of our hands nowadays, that’s good news twice over. Knowing the signs, subtle or otherwise can alert you to an otherwise largely invisible problem. 

Hacking software and their symptoms 

Whether hackers physically sneak it onto your phone or by tricking you into installing it via a phony app, a sketchy website, or a phishing attack, hacking software can create problems for you in a couple of ways: 

  • Keylogging: In the hands of a hacker, keylogging works like a stalker by snooping information as you type, tap, and even talk on your phone.  
  • Trojans: Trojans are types of malware that can be disguised in your phone to extract important data, such as credit card account details or personal information. 
  • Cryptominers: Similar to trojans, this software hides on a device. From there, it harnesses the device’s computing power to “mine” cryptocurrencies. While crypto mining is not illegal, “cryptojacking” a device without the owner’s consent is most certainly illegal. 

Some possible signs of hacking software on your phone include: 

Performance issues 

Maybe you’ve seen some of the signs we mentioned earlier. Is your device operating slower, are web pages and apps harder to load, or does your battery never seem to keep a charge? These are all signs that you could have malware running in the background, zapping your phone’s resources. 

Your phone feels like it’s running hot 

Like the performance issues above, malware or mining apps running in the background can burn extra computing power (and data). Aside from sapping performance, malware and mining apps can cause your phone to run hot or even overheat. 

Mystery apps or data 

If you find apps you haven’t downloaded, or calls, texts, and emails that you didn’t send, that’s a red flag. A hacker may have hijacked your phone to send premium-rate calls or messages or to spread malware to your contacts. Similarly, if you see spikes in your data usage, that could be a sign of a hack as well. 

Pop-ups or changes to your screen 

Malware can also be behind spammy pop-ups, changes to your home screen, or bookmarks to suspicious websites. In fact, if you see any configuration changes you didn’t personally make, this is another big clue that your smartphone has been hacked. 

What to do if you’re worried that your phone has been hacked … 

  • Install and run security software on your smartphone if you haven’t already. From there, delete any apps you didn’t download, delete risky texts, and then run your mobile security software again. 
  • If you still have issues, wiping and restoring your phone is an option. Provided you have your photos, contacts, and other vital info backed up in the cloud, it’s a relatively straightforward process. A quick search online can show how to wipe and restore your model of phone. 
  • Lastly, check your accounts and your credit to see if any unauthorized purchases have been made. If so, you can go through the process of freezing those accounts and getting new cards and credentials issued. Further, update your passwords for your accounts with a password that is strong and unique 

Ten tips to prevent your phone from being hacked 

While there are several ways a hacker can get into your phone and steal personal and critical information, here are a few tips to keep that from happening: 

  1. Use comprehensive online protection software on your phone. Over the years, we’ve gotten into the good habit of using this on our computers and laptops. Our phones? Not so much. Installing online protection on your smartphone gives you the first line of defense against attacks, plus several of the additional security features mentioned below. 
  2. Update your phone and its apps. Aside from installing security software, keeping current with updates is a primary way to keep you and your phone safe. Updates can fix vulnerabilities that cybercriminals rely on to pull off their malware-based attacks. Additionally, those updates can help keep your phone and apps running smoothly while also introducing new, helpful features. 
  3. Stay safer on the go with a VPN. One way that crooks can hack their way into your phone is via public Wi-Fi, such as at airports, hotels, and even libraries. These networks are public, meaning that your activities are exposed to others on the network—your banking, your password usage, all of it. One way to make a public network private is with a VPN, which can keep you and all you do protected from others on that Wi-Fi hotspot.  
  4. Use a password manager. Strong, unique passwords offer another primary line of defense. Yet with all the accounts we have floating around, juggling dozens of strong and unique passwords can feel like a task—thus the temptation to use (and re-use) simpler passwords. Hackers love this because one password can be the key to several accounts. Instead, try a password manager that can create those passwords for you and safely store them as well. Comprehensive security software such as McAfee Total Protection will include one. 
  5. Avoid public charging stations. Charging up at a public station seems so simple and safe. However, some hackers have been known to “juice jack” by installing malware into the charging station. While you “juice up,” they “jack” your passwords and personal info. So what to do about power on the road? You can look into a portable power pack that you can charge up ahead of time or run on AA batteries. They’re pretty inexpensive and easy to track down.  
  6. Keep your eyes on your phone. Preventing the actual theft of your phone is important too, as some hacks happen simply because a phone falls into the wrong hands. This is a good case for password or PIN protecting your phone, as well as turning on device tracking so that you can locate your phone or even wipe it remotely if you need to. Apple provides iOS users with a step-by-step guide for remotely wiping devices, and Google offers up a guide for Android users as well.  
  7. Encrypt your phone. Encrypting your cell phone can save you from being hacked and can protect your calls, messages, and critical information. To check if your iPhone is encrypted can go into Touch ID & Passcode, scroll to the bottom, and see if data protection is enabled (typically this is automatic if you have a passcode enabled). Android users have automatic encryption depending on the type of phone. 
  8. Lock your SIM card. Just as you can lock your phone, you can also lock the SIM card that is used to identify you, the owner, and to connect you to your cellular network. By locking it, that keeps your phone from being used on any other network than yours. If you own an iPhone, you can lock it by following these simple directions. For other platforms, check out the manufacturer’s website. 
  9. Turn off your Wi-Fi and Bluetooth when not in use. Think of it as closing an otherwise open door. There are several attacks that a dedicated and well-equipped hacker can make on devices where the Wi-Fi and Bluetooth are open and discoverable. Likewise, while not a hack, some retailers will track your location in a store using Bluetooth technology for marketing purposes—so switching it off can protect your privacy in some situations as well. You can easily turn off both from your settings and many phones let you do it from a pulldown menu on your home screen as well. 
  10. Steer clear of third-party app stores. Google Play and Apple’s App Store have measures in place to review and vet apps to help ensure that they are safe and secure. Third-party sites may not have that process in place. In fact, some third-party sites may intentionally host malicious apps as part of a broader scam. Granted, cybercriminals have found ways to work around Google and Apple’s review process, yet the chances of downloading a safe app from them are far greater than anywhere else. Furthermore, both Google and Apple are quick to remove malicious apps once discovered, making their stores that much safer. 

The post How To Tell If Your Smartphone Has Been Hacked appeared first on McAfee Blog.

☐ ☆ ✇ Naked Security

S3 Ep62: The S in IoT stands for security (and much more) [Podcast+Transcript]

By Paul Ducklin — December 9th 2021 at 17:40
Listen now or read as an article! (Full transcript inside.)

☐ ☆ ✇ Naked Security

S3 Ep71: VMware escapes, PHP holes, WP plugin woes, and scary scams [Podcast + Transcript]

By Paul Ducklin — February 24th 2022 at 16:51
Latest episode - listen now!

☐ ☆ ✇ Naked Security

Ransomware with a difference: “Derestrict your software, or else!”

By Paul Ducklin — March 2nd 2022 at 16:33
"Change your code to improve cryptomining"... or we'll dump 1TB of stolen secrets.

☐ ☆ ✇ Naked Security

CISA warning: “Russian actors bypassed 2FA” – what happened and how to avoid it

By Paul Ducklin — March 16th 2022 at 01:22
Don't leave old accounts lying around where someone sketchy could reactivate them.

☐ ☆ ✇ Naked Security

UK police arrest 7 hacking suspects – have they bust the LAPSUS$ gang?

By Naked Security writer — March 25th 2022 at 01:48
Seven alleged hackers have been arrested in the UK. But who are they, and which hacking crew are they from?

☐ ☆ ✇ Naked Security

LAPSUS$ hacks continue despite two hacker suspects in court

By Paul Ducklin — April 4th 2022 at 21:36
Do you know where in your company to report security anomalies? If you receive such reports, do you have an efficient way to process them?

☐ ☆ ✇ Naked Security

Pwn2Own hacking schedule released – Windows and Linux are top targets

By Paul Ducklin — May 18th 2022 at 13:04
What's better? Disclose early, patch fast? Or dig deep, disclose in full, patch more slowly?

☐ ☆ ✇ The Hacker News

Microsoft Finds Critical Bugs in Pre-Installed Apps on Millions of Android Devices

By Ravie Lakshmanan — May 28th 2022 at 08:37
Four high severity vulnerabilities have been disclosed in a framework used by pre-installed Android System apps with millions of downloads. The issues, now fixed by its Israeli developer MCE Systems, could have potentially allowed threat actors to stage remote and local attacks or be abused as vectors to obtain sensitive information by taking advantage of their extensive system privileges. "As
☐ ☆ ✇ The Hacker News

New York Man Sentenced to 4 Years in Transnational Cybercrime Scheme

By Ravie Lakshmanan — May 28th 2022 at 14:14
A 37-year-old man from New York has been sentenced to four years in prison for buying stolen credit card information and working in cahoots with a cybercrime cartel known as the Infraud Organization. John Telusma, who went by the alias "Peterelliot," had previously pleaded guilty to one count of racketeering conspiracy on October 13, 2021. He joined the gang in August 2011 and remained a member
☐ ☆ ✇ The Hacker News

FBI Warns About Hackers Selling VPN Credentials for U.S. College Networks

By Ravie Lakshmanan — May 30th 2022 at 05:50
Network credentials and virtual private network (VPN) access for colleges and universities based in the U.S. are being advertised for sale on underground and public criminal marketplaces. "This exposure of sensitive credential and network access information, especially privileged user accounts, could lead to subsequent cyber attacks against individual users or affiliated organizations," the U.S.
☐ ☆ ✇ The Hacker News

New 'GoodWill' Ransomware Forces Victims to Donate Money and Clothes to the Poor

By Ravie Lakshmanan — May 30th 2022 at 06:14
Cybersecurity researchers have disclosed a new ransomware strain called GoodWill that compels victims into donating for social causes and provide financial assistance to people in need. "The ransomware group propagates very unusual demands in exchange for the decryption key," researchers from CloudSEK said in a report published last week. "The Robin Hood-like group claims to be interested in
☐ ☆ ✇ The Hacker News

EnemyBot Linux Botnet Now Exploits Web Server, Android and CMS Vulnerabilities

By Ravie Lakshmanan — May 30th 2022 at 10:30
A nascent Linux-based botnet named Enemybot has expanded its capabilities to include recently disclosed security vulnerabilities in its arsenal to target web servers, Android devices, and content management systems (CMS). "The malware is rapidly adopting one-day vulnerabilities as part of its exploitation capabilities," AT&T Alien Labs said in a technical write-up published last week. "Services
☐ ☆ ✇ The Hacker News

Interpol Nabs 3 Nigerian Scammers Behind Malware-based Attacks

By Ravie Lakshmanan — May 31st 2022 at 06:59
Interpol on Monday announced the arrest of three suspected global scammers in Nigeria for using remote access trojans (RATs) such as Agent Tesla to facilitate malware-enabled cyber fraud. "The men are thought to have used the RAT to reroute financial transactions, stealing confidential online connection details from corporate organizations, including oil and gas companies in South East Asia, the
☐ ☆ ✇ The Hacker News

SideWinder Hackers Launched Over a 1,000 Cyber Attacks Over the Past 2 Years

By Ravie Lakshmanan — May 31st 2022 at 08:30
An "aggressive" advanced persistent threat (APT) group known as SideWinder has been linked to over 1,000 new attacks since April 2020. "Some of the main characteristics of this threat actor that make it stand out among the others, are the sheer number, high frequency and persistence of their attacks and the large collection of encrypted and obfuscated malicious components used in their
☐ ☆ ✇ The Hacker News

New XLoader Botnet Version Using Probability Theory to Hide its C&C Servers

By Ravie Lakshmanan — June 1st 2022 at 10:16
An enhanced version of the XLoader malware has been spotted adopting a probability-based approach to camouflage its command-and-control (C&C) infrastructure, according to the latest research. "Now it is significantly harder to separate the wheat from the chaff and discover the real C&C servers among thousands of legitimate domains used by Xloader as a smokescreen," Israeli cybersecurity company
☐ ☆ ✇ The Hacker News

YODA Tool Found ~47,000 Malicious WordPress Plugins Installed in Over 24,000 Sites

By Ravie Lakshmanan — June 1st 2022 at 13:15
As many as 47,337 malicious plugins have been uncovered on 24,931 unique websites, out of which 3,685 plugins were sold on legitimate marketplaces, netting the attackers $41,500 in illegal revenues. The findings come from a new tool called YODA that aims to detect rogue WordPress plugins and track down their origin, according to an 8-year-long study conducted by a group of researchers from the
☐ ☆ ✇ The Hacker News

FluBot Android Spyware Taken Down in Global Law Enforcement Operation

By Ravie Lakshmanan — June 1st 2022 at 13:34
An international law enforcement operation involving 11 countries has culminated in the takedown of a notorious mobile malware threat called FluBot. "This Android malware has been spreading aggressively through SMS, stealing passwords, online banking details and other sensitive information from infected smartphones across the world," Europol said in a statement. <!--adsense--> The "complex
☐ ☆ ✇ The Hacker News

New Unpatched Horde Webmail Bug Lets Hackers Take Over Server by Sending Email

By Ravie Lakshmanan — June 1st 2022 at 14:56
A new unpatched security vulnerability has been disclosed in the open-source Horde Webmail client that could be exploited to achieve remote code execution on the email server simply by sending a specially crafted email to a victim. "Once the email is viewed, the attacker can silently take over the complete mail server without any further user interaction," SonarSource said in a report shared
☐ ☆ ✇ The Hacker News

DOJ Seizes 3 Web Domains Used to Sell Stolen Data and DDoS Services

By Ravie Lakshmanan — June 2nd 2022 at 06:39
The U.S. Department of Justice (DoJ) on Wednesday announced the seizure of three domains used by cybercriminals to trade stolen personal information and facilitate distributed denial-of-service (DDoS) attacks for hire. This includes weleakinfo[.]to, ipstress[.]in, and ovh-booter[.]com, the first of which allowed its users to traffic hacked personal data and offered a searchable database
☐ ☆ ✇ The Hacker News

SideWinder Hackers Use Fake Android VPN Apps to Target Pakistani Entities

By Ravie Lakshmanan — June 2nd 2022 at 09:09
The threat actor known as SideWinder has added a new custom tool to its arsenal of malware that's being used in phishing attacks against Pakistani public and private sector entities. "Phishing links in emails or posts that mimic legitimate notifications and services of government agencies and organizations in Pakistan are primary attack vectors of the gang," Singapore-headquartered cybersecurity
☐ ☆ ✇ The Hacker News

Critical UNISOC Chip Vulnerability Affects Millions of Android Smartphones

By Ravie Lakshmanan — June 2nd 2022 at 10:09
A critical security flaw has been uncovered in UNISOC's smartphone chipset that could be potentially weaponized to disrupt a smartphone's radio communications through a malformed packet. "Left unpatched, a hacker or a military unit can leverage such a vulnerability to neutralize communications in a specific location," Israeli cybersecurity company Check Point said in a report shared with The
☐ ☆ ✇ The Hacker News

Researchers Demonstrate Ransomware for IoT Devices That Targets IT and OT Networks

By Ravie Lakshmanan — June 2nd 2022 at 12:01
As ransomware infections have evolved from purely encrypting data to schemes such as double and triple extortion, a new attack vector is likely to set the stage for future campaigns. Called Ransomware for IoT or R4IoT by Forescout, it's a "novel, proof-of-concept ransomware that exploits an IoT device to gain access and move laterally in an IT [information technology] network and impact the OT [
☐ ☆ ✇ The Hacker News

Conti Leaks Reveal Ransomware Gang's Interest in Firmware-based Attacks

By Ravie Lakshmanan — June 2nd 2022 at 13:13
An analysis of leaked chats from the notorious Conti ransomware group earlier this year has revealed that the syndicate has been working on a set of firmware attack techniques that could offer a path to accessing privileged code on compromised devices. "Control over firmware gives attackers virtually unmatched powers both to directly cause damage and to enable other long-term strategic goals,"
☐ ☆ ✇ The Hacker News

Threat Detection Software: A Deep Dive

By The Hacker News — June 2nd 2022 at 19:10
As the threat landscape evolves and multiplies with more advanced attacks than ever, defending against these modern cyber threats is a monumental challenge for almost any organization.  Threat detection is about an organization’s ability to accurately identify threats, be it to the network, an endpoint, another asset or an application – including cloud infrastructure and assets. At scale, threat
☐ ☆ ✇ The Hacker News

Researchers Uncover Malware Controlling Thousands of Sites in Parrot TDS Network

By Ravie Lakshmanan — June 3rd 2022 at 10:58
The Parrot traffic direction system (TDS) that came to light earlier this year has had a larger impact than previously thought, according to new research. Sucuri, which has been tracking the same campaign since February 2019 under the name "NDSW/NDSX," said that "the malware was one of the top infections" detected in 2021, accounting for more than 61,000 websites. Parrot TDS was documented in
☐ ☆ ✇ The Hacker News

GitLab Issues Security Patch for Critical Account Takeover Vulnerability

By Ravie Lakshmanan — June 3rd 2022 at 15:01
GitLab has moved to address a critical security flaw in its service that, if successfully exploited, could result in an account takeover. Tracked as CVE-2022-1680, the issue has a CVSS severity score of 9.9 and was discovered internally by the company. The security flaw affects all versions of GitLab Enterprise Edition (EE) starting from 11.10 before 14.9.5, all versions starting from 14.10
☐ ☆ ✇ The Hacker News

Atlassian Releases Patch for Confluence Zero-Day Flaw Exploited in the Wild

By Ravie Lakshmanan — June 4th 2022 at 08:57
Atlassian on Friday rolled out fixes to address a critical security flaw affecting its Confluence Server and Data Center products that have come under active exploitation by threat actors to achieve remote code execution. Tracked as CVE-2022-26134, the issue is similar to CVE-2021-26084 — another security flaw the Australian software company patched in August 2021. Both relate to a case of
☐ ☆ ✇ The Hacker News

Unpatched Critical Flaws Disclosed in U-Boot Bootloader for Embedded Devices

By Ravie Lakshmanan — June 6th 2022 at 14:04
Cybersecurity researchers have disclosed two unpatched security vulnerabilities in the open-source U-Boot boot loader. The issues, which were uncovered in the IP defragmentation algorithm implemented in U-Boot by NCC Group, could be abused to achieve arbitrary out-of-bounds write and denial-of-service (DoS). U-Boot is a boot loader used in Linux-based embedded systems such as ChromeOS as well as
☐ ☆ ✇ The Hacker News

Researchers Warn of Spam Campaign Targeting Victims with SVCReady Malware

By Ravie Lakshmanan — June 7th 2022 at 09:14
A new wave of phishing campaigns has been observed spreading a previously documented malware called SVCReady. "The malware is notable for the unusual way it is delivered to target PCs — using shellcode hidden in the properties of Microsoft Office documents," Patrick Schläpfer, a threat analyst at HP, said in a technical write-up. SVCReady is said to be in its early stage of development, with the
☐ ☆ ✇ The Hacker News

Hacking Scenarios: How Hackers Choose Their Victims

By The Hacker News — June 7th 2022 at 10:18
Enforcing the "double-extortion" technique aka pay-now-or-get-breached emerged as a head-turner last year.  May 6th, 2022 is a recent example. The State Department said the Conti strain of ransomware was the most costly in terms of payments made by victims as of January. Conti, a ransomware-as-a-service (RaaS) program, is one of the most notorious ransomware groups and has been responsible for
☐ ☆ ✇ The Hacker News

Evil Corp Cybercrime Group Shifts to LockBit Ransomware to Evade Sanctions

By Ravie Lakshmanan — June 7th 2022 at 12:51
The threat cluster dubbed UNC2165, which shares numerous overlaps with a Russia-based cybercrime group known as Evil Corp, has been linked to multiple LockBit ransomware intrusions in what's seen as an attempt by the latter to get around sanctions imposed by the U.S. Treasury in December 2019. "These actors have shifted away from using exclusive ransomware variants to LockBit — a well-known
☐ ☆ ✇ The Hacker News

FBI Seizes 'SSNDOB' ID Theft Service for Selling Personal Info of 24 Million People

By Ravie Lakshmanan — June 8th 2022 at 06:45
An illicit online marketplace known as SSNDOB was taken down in operation led by U.S. law enforcement agencies, the Department of Justice (DoJ) announced Tuesday. SSNDOB trafficked in personal information such as names, dates of birth, credit card numbers, and Social Security numbers of about 24 million individuals in the U.S., generating its operators $19 million in sales revenue. The action
☐ ☆ ✇ The Hacker News

U.S. Agencies Warn About Chinese Hackers Targeting Telecoms and Network Service Providers

By Ravie Lakshmanan — June 8th 2022 at 08:20
U.S. cybersecurity and intelligence agencies have warned about China-based state-sponsored cyber actors leveraging network vulnerabilities to exploit public and private sector organizations since at least 2020. The widespread intrusion campaigns aim to exploit publicly identified security flaws in network devices such as Small Office/Home Office (SOHO) routers and Network Attached Storage (NAS)
☐ ☆ ✇ The Hacker News

New Emotet Variant Stealing Users' Credit Card Information from Google Chrome

By Ravie Lakshmanan — June 9th 2022 at 06:22
Image Source: Toptal The notorious Emotet malware has turned to deploy a new module designed to siphon credit card information stored in the Chrome web browser. The credit card stealer, which exclusively singles out Chrome, has the ability to exfiltrate the collected information to different remote command-and-control (C2) servers, according to enterprise security company Proofpoint, which
☐ ☆ ✇ The Hacker News

A Decade-Long Chinese Espionage Campaign Targets Southeast Asia and Australia

By Ravie Lakshmanan — June 9th 2022 at 11:00
A previously undocumented Chinese-speaking advanced persistent threat (APT) actor dubbed Aoqin Dragon has been linked to a string of espionage-oriented attacks aimed at government, education, and telecom entities chiefly in Southeast Asia and Australia dating as far back as 2013. "Aoqin Dragon seeks initial access primarily through document exploits and the use of fake removable devices,"
☐ ☆ ✇ The Hacker News

Symbiote: A Stealthy Linux Malware Targeting Latin American Financial Sector

By Ravie Lakshmanan — June 9th 2022 at 12:08
Cybersecurity researchers have taken the wraps off what they call a "nearly-impossible-to-detect" Linux malware that could be weaponized to backdoor infected systems. Dubbed Symbiote by threat intelligence firms BlackBerry and Intezer, the stealthy malware is so named for its ability to conceal itself within running processes and network traffic and drain a victim's resources like a parasite.
☐ ☆ ✇ The Hacker News

Researchers Disclose Critical Flaws in Industrial Access Control System from Carrier

By Ravie Lakshmanan — June 10th 2022 at 07:03
As many as eight zero-day vulnerabilities have been disclosed in Carrier's LenelS2 HID Mercury access control system that's used widely in healthcare, education, transportation, and government facilities. "The vulnerabilities uncovered allowed us to demonstrate the ability to remotely unlock and lock doors, subvert alarms and undermine logging and notification systems," Trellix security
☐ ☆ ✇ The Hacker News

Researchers Detail How Cyber Criminals Targeting Cryptocurrency Users

By Ravie Lakshmanan — June 10th 2022 at 09:10
Cybercriminals are impersonating popular crypto platforms such as Binance, Celo, and Trust Wallet with spoofed emails and fake login pages in an attempt to steal login details and deceptively transfer virtual funds. "As cryptocurrency and non-fungible tokens (NFTs) become more mainstream, and capture headlines for their volatility, there is a greater likelihood of more individuals falling victim
☐ ☆ ✇ The Hacker News

MIT Researchers Discover New Flaw in Apple M1 CPUs That Can't Be Patched

By Ravie Lakshmanan — June 11th 2022 at 08:31
A novel hardware attack dubbed PACMAN has been demonstrated against Apple's M1 processor chipsets, potentially arming a malicious actor with the capability to gain arbitrary code execution on macOS systems. It leverages "speculative execution attacks to bypass an important memory protection mechanism, ARM Pointer Authentication, a security feature that is used to enforce pointer integrity," MIT
☐ ☆ ✇ The Hacker News

Iranian Hackers Spotted Using a new DNS Hijacking Malware in Recent Attacks

By Ravie Lakshmanan — June 13th 2022 at 03:39
The Iranian state-sponsored threat actor tracked under the moniker Lyceum has turned to using a new custom .NET-based backdoor in recent campaigns directed against the Middle East. "The new malware is a .NET based DNS Backdoor which is a customized version of the open source tool 'DIG.net,'" Zscaler ThreatLabz researchers Niraj Shivtarkar and Avinash Kumar said in a report published last week. "
☐ ☆ ✇ The Hacker News

HelloXD Ransomware Installing Backdoor on Targeted Windows and Linux Systems

By Ravie Lakshmanan — June 13th 2022 at 08:55
Windows and Linux systems are being targeted by a ransomware variant called HelloXD, with the infections also involving the deployment of a backdoor to facilitate persistent remote access to infected hosts. "Unlike other ransomware groups, this ransomware family doesn't have an active leak site; instead it prefers to direct the impacted victim to negotiations through Tox chat and onion-based
☐ ☆ ✇ The Hacker News

Chinese 'Gallium' Hackers Using New PingPull Malware in Cyberespionage Attacks

By Ravie Lakshmanan — June 13th 2022 at 13:26
A Chinese advanced persistent threat (APT) known as Gallium has been observed using a previously undocumented remote access trojan in its espionage attacks targeting companies operating in Southeast Asia, Europe, and Africa. Called PingPull, the "difficult-to-detect" backdoor is notable for its use of the Internet Control Message Protocol (ICMP) for command-and-control (C2) communications,
☐ ☆ ✇ The Hacker News

Researchers Detail PureCrypter Loader Cyber Criminals Using to Distribute Malware

By Ravie Lakshmanan — June 14th 2022 at 08:02
Cybersecurity researchers have detailed the workings of a fully-featured malware loader dubbed PureCrypter that's being purchased by cyber criminals to deliver remote access trojans (RATs) and information stealers. "The loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption, and obfuscation to evade antivirus software products," Zscaler's Romain Dumont
☐ ☆ ✇ The Hacker News

New Syslogk Linux Rootkit Lets Attackers Remotely Command It Using "Magic Packets"

By Ravie Lakshmanan — June 14th 2022 at 08:54
A new covert Linux kernel rootkit named Syslogk has been spotted under development in the wild and cloaking a malicious payload that can be remotely commandeered by an adversary using a magic network traffic packet. "The Syslogk rootkit is heavily based on Adore-Ng but incorporates new functionalities making the user-mode application and the kernel rootkit hard to detect," Avast security
☐ ☆ ✇ The Hacker News

Unpatched Travis CI API Bug Exposes Thousands of Secret User Access Tokens

By Ravie Lakshmanan — June 14th 2022 at 09:30
An unpatched security issue in the Travis CI API has left tens of thousands of developers' user tokens exposed to potential attacks, effectively allowing threat actors to breach cloud infrastructures, make unauthorized code changes, and initiate supply chain attacks. "More than 770 million logs of free tier users are available, from which you can easily extract tokens, secrets, and other
☐ ☆ ✇ The Hacker News

New Zimbra Email Vulnerability Could Let Attackers Steal Your Login Credentials

By Ravie Lakshmanan — June 14th 2022 at 15:13
A new high-severity vulnerability has been disclosed in the Zimbra email suite that, if successfully exploited, enables an unauthenticated attacker to steal cleartext passwords of users sans any user interaction. "With the consequent access to the victims' mailboxes, attackers can potentially escalate their access to targeted organizations and gain access to various internal services and steal
☐ ☆ ✇ The Hacker News

New Hertzbleed Side Channel Attack Affects All Modern AMD and Intel CPUs

By Ravie Lakshmanan — June 15th 2022 at 09:45
A newly discovered security vulnerability in modern Intel and AMD processors could let remote attackers steal encryption keys via a power side channel attack. Dubbed Hertzbleed by a group of researchers from the University of Texas, the University of Illinois Urbana-Champaign, and the University of Washington, the issue is rooted in dynamic voltage and frequency scaling (DVFS), a power and
☐ ☆ ✇ The Hacker News

Critical Flaw in Cisco Secure Email and Web Manager Lets Attackers Bypass Authentication

By Ravie Lakshmanan — June 16th 2022 at 03:28
Cisco on Wednesday rolled out fixes to address a critical security flaw affecting Email Security Appliance (ESA) and Secure Email and Web Manager that could be exploited by an unauthenticated, remote attacker to sidestep authentication. Assigned the CVE identifier CVE-2022-20798, the bypass vulnerability is rated 9.8 out of a maximum of 10 on the CVSS scoring system and stems from improper
☐ ☆ ✇ The Hacker News

A Microsoft Office 365 Feature Could Help Ransomware Hackers Hold Cloud Files Hostage

By Ravie Lakshmanan — June 16th 2022 at 11:05
A "dangerous piece of functionality" has been discovered in Microsoft 365 suite that could be potentially abused by a malicious actor to mount attacks on cloud infrastructure and ransom files stored on SharePoint and OneDrive. The cloud ransomware attack makes it possible to launch file-encrypting malware to "encrypt files stored on SharePoint and OneDrive in a way that makes them unrecoverable
☐ ☆ ✇ The Hacker News

BlackCat Ransomware Gang Targeting Unpatched Microsoft Exchange Servers

By Ravie Lakshmanan — June 16th 2022 at 13:23
Microsoft is warning that the BlackCat ransomware crew is leveraging exploits for unpatched Exchange server vulnerabilities to gain access to targeted networks. Upon gaining an entry point, the attackers swiftly moved to gather information about the compromised machines, followed by carrying out credential theft and lateral movement activities, before harvesting intellectual property and
☐ ☆ ✇ The Hacker News

Over a Million WordPress Sites Forcibly Updated to Patch a Critical Plugin Vulnerability

By Ravie Lakshmanan — June 17th 2022 at 09:10
WordPress websites using a widely used plugin named Ninja Forms have been updated automatically to remediate a critical security vulnerability that's suspected of having been actively exploited in the wild. The issue, which relates to a case of code injection, is rated 9.8 out of 10 for severity and affects multiple versions starting from 3.0. It has been fixed in 3.0.34.2, 3.1.10, 3.2.28,
❌