FreshRSS

🔒
☐ ☆ ✇ InfoSec Resources

IoT Security Fundamentals: Intercepting and Manipulating Wireless Communications

By Dimitar Kostadinov — September 29th 2020 at 19:14

Introduction: IoT Manufacturers Favor Convenience over Security Because IoT security is still an afterthought, cybercriminals in general consider smart devices a “low-hanging fruit” – a target easy to compromise and manipulate. Security (and privacy) by design is key for IoT, and probably the only effective way for a smart gadget to protect its communications is […]

The post IoT Security Fundamentals: Intercepting and Manipulating Wireless Communications appeared first on Infosec Resources.


IoT Security Fundamentals: Intercepting and Manipulating Wireless Communications was first posted on September 29, 2020 at 2:14 pm.
©2017 "InfoSec Resources". Use of this feed is for personal non-commercial use only. If you are not reading this article in your feed reader, then the site is guilty of copyright infringement. Please contact me at darren.dalasta@infosecinstitute.com
☐ ☆ ✇ InfoSec Resources

Format String Vulnerabilities Exploitation Case Study

By Srinivas — September 29th 2020 at 19:55

Introduction: In the previous article of this series, we discussed how format string vulnerabilities can be exploited. This article provides a case study of how format string vulnerabilities can be used to exploit serious vulnerabilities such as Buffer Overflows. We will begin by understanding what stack canaries are and then we will exploit a Buffer […]

The post Format String Vulnerabilities Exploitation Case Study appeared first on Infosec Resources.


Format String Vulnerabilities Exploitation Case Study was first posted on September 29, 2020 at 2:55 pm.
©2017 "InfoSec Resources". Use of this feed is for personal non-commercial use only. If you are not reading this article in your feed reader, then the site is guilty of copyright infringement. Please contact me at darren.dalasta@infosecinstitute.com
☐ ☆ ✇ InfoSec Resources

Fuzzing introduction: Definition, types and tools for cybersecurity pros

By Pedro Tavares — September 30th 2020 at 13:01

Fuzzing is a black-box software testing technique and consists of finding implementation flaws and bugs by using malformed/semi-malformed payloads via automation. Fuzzing an application is not a matter of simply exploiting a specific point of an application, but also acquiring knowledge and potential crashes that could be explored in-depth through the implementation of crafted payloads […]

The post Fuzzing introduction: Definition, types and tools for cybersecurity pros appeared first on Infosec Resources.


Fuzzing introduction: Definition, types and tools for cybersecurity pros was first posted on September 30, 2020 at 8:01 am.
©2017 "InfoSec Resources". Use of this feed is for personal non-commercial use only. If you are not reading this article in your feed reader, then the site is guilty of copyright infringement. Please contact me at darren.dalasta@infosecinstitute.com
☐ ☆ ✇ InfoSec Resources

Copy-paste compromises

By Jatin Jain — September 30th 2020 at 13:05

Copy-paste compromises: Introduction and overview Although the concept of copy-paste compromises is not exactly new, there are now several different forms of the attack. In the version of copy-paste compromise that we’ll discuss today, malicious actors use open-source or publicly available exploit code, web shells and other tools to gain information. Recently, Australia has revealed […]

The post Copy-paste compromises appeared first on Infosec Resources.


Copy-paste compromises was first posted on September 30, 2020 at 8:05 am.
©2017 "InfoSec Resources". Use of this feed is for personal non-commercial use only. If you are not reading this article in your feed reader, then the site is guilty of copyright infringement. Please contact me at darren.dalasta@infosecinstitute.com
☐ ☆ ✇ Naked Security

S3 Ep56: Cryptotrading rodent, ransomware hackback, and a Docusign phish [Podcast]

By Paul Ducklin — October 28th 2021 at 18:45
Latest episode - listen now! Serious security explained with personality in plain English.

ns-1200-logo-podcast-with-mic-and-rodent-emoji

☐ ☆ ✇ Naked Security

The self-driving smart suitcase… that the person behind you can hijack!

By Paul Ducklin — November 16th 2021 at 21:09
Apparently, we need a self-driving IoT Bluetooth robot suitcase. Who knew?

☐ ☆ ✇ McAfee Blogs

How To Tell If Your Smartphone Has Been Hacked

By McAfee — December 9th 2021 at 14:00

Something’s not right. Maybe your phone is losing its charge way too quickly. Or one day it suddenly starts turning itself off and on again. Perhaps it’s running hot, so hot it’s hard to hold. Likewise, you might see outgoing calls that you never dialed or strange spikes in your data usage. Signs like these could mean that your smartphone’s been hacked. Learn how to protect your smartphone with McAfee Mobile Security

Several signs of a potential smartphone hack can look like a technical issue, at least on the surface. Yet the fact is that these issues may be a symptom of a deeper problem, such as malware installed on your smartphone. Malware can eat up system resources or conflict with other apps and your operating system, all of which can cause your phone to act sluggish or erratically. 

Yet, in a way, that’s good news. Because malware can run inefficiently on your phone and create hiccups both large and small, it can tip you off to its presence. And with all the important information we carry in the palms of our hands nowadays, that’s good news twice over. Knowing the signs, subtle or otherwise can alert you to an otherwise largely invisible problem. 

Hacking software and their symptoms 

Whether hackers physically sneak it onto your phone or by tricking you into installing it via a phony app, a sketchy website, or a phishing attack, hacking software can create problems for you in a couple of ways: 

  • Keylogging: In the hands of a hacker, keylogging works like a stalker by snooping information as you type, tap, and even talk on your phone.  
  • Trojans: Trojans are types of malware that can be disguised in your phone to extract important data, such as credit card account details or personal information. 
  • Cryptominers: Similar to trojans, this software hides on a device. From there, it harnesses the device’s computing power to “mine” cryptocurrencies. While crypto mining is not illegal, “cryptojacking” a device without the owner’s consent is most certainly illegal. 

Some possible signs of hacking software on your phone include: 

Performance issues 

Maybe you’ve seen some of the signs we mentioned earlier. Is your device operating slower, are web pages and apps harder to load, or does your battery never seem to keep a charge? These are all signs that you could have malware running in the background, zapping your phone’s resources. 

Your phone feels like it’s running hot 

Like the performance issues above, malware or mining apps running in the background can burn extra computing power (and data). Aside from sapping performance, malware and mining apps can cause your phone to run hot or even overheat. 

Mystery apps or data 

If you find apps you haven’t downloaded, or calls, texts, and emails that you didn’t send, that’s a red flag. A hacker may have hijacked your phone to send premium-rate calls or messages or to spread malware to your contacts. Similarly, if you see spikes in your data usage, that could be a sign of a hack as well. 

Pop-ups or changes to your screen 

Malware can also be behind spammy pop-ups, changes to your home screen, or bookmarks to suspicious websites. In fact, if you see any configuration changes you didn’t personally make, this is another big clue that your smartphone has been hacked. 

What to do if you’re worried that your phone has been hacked … 

  • Install and run security software on your smartphone if you haven’t already. From there, delete any apps you didn’t download, delete risky texts, and then run your mobile security software again. 
  • If you still have issues, wiping and restoring your phone is an option. Provided you have your photos, contacts, and other vital info backed up in the cloud, it’s a relatively straightforward process. A quick search online can show how to wipe and restore your model of phone. 
  • Lastly, check your accounts and your credit to see if any unauthorized purchases have been made. If so, you can go through the process of freezing those accounts and getting new cards and credentials issued. Further, update your passwords for your accounts with a password that is strong and unique 

Ten tips to prevent your phone from being hacked 

While there are several ways a hacker can get into your phone and steal personal and critical information, here are a few tips to keep that from happening: 

  1. Use comprehensive online protection software on your phone. Over the years, we’ve gotten into the good habit of using this on our computers and laptops. Our phones? Not so much. Installing online protection on your smartphone gives you the first line of defense against attacks, plus several of the additional security features mentioned below. 
  2. Update your phone and its apps. Aside from installing security software, keeping current with updates is a primary way to keep you and your phone safe. Updates can fix vulnerabilities that cybercriminals rely on to pull off their malware-based attacks. Additionally, those updates can help keep your phone and apps running smoothly while also introducing new, helpful features. 
  3. Stay safer on the go with a VPN. One way that crooks can hack their way into your phone is via public Wi-Fi, such as at airports, hotels, and even libraries. These networks are public, meaning that your activities are exposed to others on the network—your banking, your password usage, all of it. One way to make a public network private is with a VPN, which can keep you and all you do protected from others on that Wi-Fi hotspot.  
  4. Use a password manager. Strong, unique passwords offer another primary line of defense. Yet with all the accounts we have floating around, juggling dozens of strong and unique passwords can feel like a task—thus the temptation to use (and re-use) simpler passwords. Hackers love this because one password can be the key to several accounts. Instead, try a password manager that can create those passwords for you and safely store them as well. Comprehensive security software such as McAfee Total Protection will include one. 
  5. Avoid public charging stations. Charging up at a public station seems so simple and safe. However, some hackers have been known to “juice jack” by installing malware into the charging station. While you “juice up,” they “jack” your passwords and personal info. So what to do about power on the road? You can look into a portable power pack that you can charge up ahead of time or run on AA batteries. They’re pretty inexpensive and easy to track down.  
  6. Keep your eyes on your phone. Preventing the actual theft of your phone is important too, as some hacks happen simply because a phone falls into the wrong hands. This is a good case for password or PIN protecting your phone, as well as turning on device tracking so that you can locate your phone or even wipe it remotely if you need to. Apple provides iOS users with a step-by-step guide for remotely wiping devices, and Google offers up a guide for Android users as well.  
  7. Encrypt your phone. Encrypting your cell phone can save you from being hacked and can protect your calls, messages, and critical information. To check if your iPhone is encrypted can go into Touch ID & Passcode, scroll to the bottom, and see if data protection is enabled (typically this is automatic if you have a passcode enabled). Android users have automatic encryption depending on the type of phone. 
  8. Lock your SIM card. Just as you can lock your phone, you can also lock the SIM card that is used to identify you, the owner, and to connect you to your cellular network. By locking it, that keeps your phone from being used on any other network than yours. If you own an iPhone, you can lock it by following these simple directions. For other platforms, check out the manufacturer’s website. 
  9. Turn off your Wi-Fi and Bluetooth when not in use. Think of it as closing an otherwise open door. There are several attacks that a dedicated and well-equipped hacker can make on devices where the Wi-Fi and Bluetooth are open and discoverable. Likewise, while not a hack, some retailers will track your location in a store using Bluetooth technology for marketing purposes—so switching it off can protect your privacy in some situations as well. You can easily turn off both from your settings and many phones let you do it from a pulldown menu on your home screen as well. 
  10. Steer clear of third-party app stores. Google Play and Apple’s App Store have measures in place to review and vet apps to help ensure that they are safe and secure. Third-party sites may not have that process in place. In fact, some third-party sites may intentionally host malicious apps as part of a broader scam. Granted, cybercriminals have found ways to work around Google and Apple’s review process, yet the chances of downloading a safe app from them are far greater than anywhere else. Furthermore, both Google and Apple are quick to remove malicious apps once discovered, making their stores that much safer. 

The post How To Tell If Your Smartphone Has Been Hacked appeared first on McAfee Blog.

☐ ☆ ✇ Naked Security

S3 Ep62: The S in IoT stands for security (and much more) [Podcast+Transcript]

By Paul Ducklin — December 9th 2021 at 17:40
Listen now or read as an article! (Full transcript inside.)

☐ ☆ ✇ Naked Security

S3 Ep71: VMware escapes, PHP holes, WP plugin woes, and scary scams [Podcast + Transcript]

By Paul Ducklin — February 24th 2022 at 16:51
Latest episode - listen now!

☐ ☆ ✇ Naked Security

Ransomware with a difference: “Derestrict your software, or else!”

By Paul Ducklin — March 2nd 2022 at 16:33
"Change your code to improve cryptomining"... or we'll dump 1TB of stolen secrets.

☐ ☆ ✇ Naked Security

CISA warning: “Russian actors bypassed 2FA” – what happened and how to avoid it

By Paul Ducklin — March 16th 2022 at 01:22
Don't leave old accounts lying around where someone sketchy could reactivate them.

☐ ☆ ✇ Naked Security

UK police arrest 7 hacking suspects – have they bust the LAPSUS$ gang?

By Naked Security writer — March 25th 2022 at 01:48
Seven alleged hackers have been arrested in the UK. But who are they, and which hacking crew are they from?

☐ ☆ ✇ Naked Security

LAPSUS$ hacks continue despite two hacker suspects in court

By Paul Ducklin — April 4th 2022 at 21:36
Do you know where in your company to report security anomalies? If you receive such reports, do you have an efficient way to process them?

☐ ☆ ✇ Naked Security

Pwn2Own hacking schedule released – Windows and Linux are top targets

By Paul Ducklin — May 18th 2022 at 13:04
What's better? Disclose early, patch fast? Or dig deep, disclose in full, patch more slowly?

☐ ☆ ✇ The Hacker News

Cisco Issues Patch for New IOS XR Zero-Day Vulnerability Exploited in the Wild

By Ravie Lakshmanan — May 21st 2022 at 03:57
Cisco on Friday rolled out fixes for a medium-severity vulnerability affecting IOS XR Software that it said has been exploited in real-world attacks. Tracked as CVE-2022-20821 (CVSS score: 6.5), the issue relates to an open port vulnerability that could be abused by an unauthenticated, remote attacker to connect to a Redis instance and achieve code execution. "A successful exploit could allow
☐ ☆ ✇ The Hacker News

Researchers Find Backdoor in School Management Plugin for WordPress

By Ravie Lakshmanan — May 21st 2022 at 05:11
Multiple versions of a WordPress plugin by the name of "School Management Pro" harbored a backdoor that could grant an adversary complete control over vulnerable websites. The issue, spotted in premium versions before 9.9.7, has been assigned the CVE identifier CVE-2022-1609 and is rated 10 out of 10 for severity. The backdoor, which is believed to have existed since version 8.9, enables "an
☐ ☆ ✇ The Hacker News

Chinese "Twisted Panda" Hackers Caught Spying on Russian Defense Institutes

By Ravie Lakshmanan — May 23rd 2022 at 06:12
At least two research institutes located in Russia and a third likely target in Belarus have been at the receiving end of an espionage attack by a Chinese nation-state advanced persistent threat (APT). The attacks, codenamed "Twisted Panda," come in the backdrop of Russia's military invasion of Ukraine, prompting a wide range of threat actors to swiftly adapt their campaigns on the ongoing
☐ ☆ ✇ The Hacker News

New Unpatched Bug Could Let Attackers Steal Money from PayPal Users

By Ravie Lakshmanan — May 23rd 2022 at 09:08
A security researcher claims to have discovered an unpatched vulnerability in PayPal's money transfer service that could allow attackers to trick victims into unknowingly completing attacker-directed transactions with a single click. Clickjacking, also called UI redressing, refers to a technique wherein an unwitting user is tricked into clicking seemingly innocuous webpage elements like buttons
☐ ☆ ✇ The Hacker News

Fronton: Russian IoT Botnet Designed to Run Social Media Disinformation Campaigns

By Ravie Lakshmanan — May 23rd 2022 at 11:01
Fronton, a distributed denial-of-service (DDoS) botnet that came to light in March 2020, is much more powerful than previously thought, per the latest research. "Fronton is a system developed for coordinated inauthentic behavior on a massive scale," threat intelligence firm Nisos said in a report published last week. "This system includes a web-based dashboard known as SANA that enables a user
☐ ☆ ✇ The Hacker News

Conti Ransomware Operation Shut Down After Splitting into Smaller Groups

By Ravie Lakshmanan — May 24th 2022 at 10:25
Even as the operators of Conti threatened to overthrow the Costa Rican government, the notorious cybercrime gang officially took down its attack infrastructure in favor of migrating their malicious cyber activities to other ancillary operations, including Karakurt and BlackByte. "From the negotiations site, chatrooms, messengers to servers and proxy hosts - the Conti brand, not the organization
☐ ☆ ✇ The Hacker News

New Chaos Ransomware Builder Variant "Yashma" Discovered in the Wild

By Ravie Lakshmanan — May 24th 2022 at 12:01
Cybersecurity researchers have disclosed details of the latest version of the Chaos ransomware line, dubbed Yashma. "Though Chaos ransomware builder has only been in the wild for a year, Yashma claims to be the sixth version (v6.0) of this malware," BlackBerry research and intelligence team said in a report shared with The Hacker News. Chaos is a customizable ransomware builder that emerged in
☐ ☆ ✇ The Hacker News

SIM-based Authentication Aims to Transform Device Binding Security to End Phishing

By The Hacker News — May 24th 2022 at 12:02
Let's face it: we all use email, and we all use passwords. Passwords create inherent vulnerability in the system. The success rate of phishing attacks is skyrocketing, and opportunities for the attack have greatly multiplied as lives moved online. All it takes is one password to be compromised for all other users to become victims of a data breach.  To deliver additional security, therefore,
☐ ☆ ✇ The Hacker News

Popular PyPI Package 'ctx' and PHP Library 'phpass' Hijacked to Steal AWS Keys

By Ravie Lakshmanan — May 24th 2022 at 15:31
Two trojanized Python and PHP packages have been uncovered in what's yet another instance of a software supply chain attack targeting the open source ecosystem. One of the packages in question is "ctx," a Python module available in the PyPi repository. The other involves "phpass," a PHP package that's been forked on GitHub to distribute a rogue update. "In both cases the attacker appears to have
☐ ☆ ✇ The Hacker News

New Zoom Flaws Could Let Attackers Hack Victims Just by Sending them a Message

By Ravie Lakshmanan — May 25th 2022 at 04:59
Popular video conferencing service Zoom has resolved as many as four security vulnerabilities, which could be exploited to compromise another user over chat by sending specially crafted Extensible Messaging and Presence Protocol (XMPP) messages and execute malicious code. Tracked from CVE-2022-22784 through CVE-2022-22787, the issues range between 5.9 and 8.1 in severity. Ivan Fratric of Google
☐ ☆ ✇ The Hacker News

Researchers Find New Malware Attacks Targeting Russian Government Entities

By Ravie Lakshmanan — May 25th 2022 at 10:19
An unknown advanced persistent threat (APT) group has been linked to a series of spear-phishing attacks targeting Russian government entities since the onset of the Russo-Ukrainian war in late February 2022. "The campaigns [...] are designed to implant a Remote Access Trojan (RAT) that can be used to surveil the computers it infects, and run commands on them remotely," Malwarebytes said in a
☐ ☆ ✇ The Hacker News

How Secrets Lurking in Source Code Lead to Major Breaches

By The Hacker News — May 25th 2022 at 12:21
If one word could sum up the 2021 infosecurity year (well, actually three), it would be these: "supply chain attack".  A software supply chain attack happens when hackers manipulate the code in third-party software components to compromise the 'downstream' applications that use them. In 2021, we have seen a dramatic rise in such attacks: high profile security incidents like the SolarWinds,
☐ ☆ ✇ The Hacker News

Interpol Arrests Leader of SilverTerrier Cybercrime Gang Behind BEC Attacks

By Ravie Lakshmanan — May 25th 2022 at 14:06
A year-long international investigation has resulted in the arrest of the suspected head of the SilverTerrier cybercrime group by the Nigeria Police Force. "The suspect is alleged to have run a transnational cybercrime syndicate that launched mass phishing campaigns and business email compromise schemes targeting companies and individual victims," Interpol said in a statement. <!--adsense-->
☐ ☆ ✇ The Hacker News

Tails OS Users Advised Not to Use Tor Browser Until Critical Firefox Bugs are Patched

By Ravie Lakshmanan — May 26th 2022 at 09:08
The maintainers of the Tails project have issued a warning that the Tor Browser that's bundled with the operating system is unsafe to use for accessing or entering sensitive information. "We recommend that you stop using Tails until the release of 5.1 (May 31) if you use Tor Browser for sensitive information (passwords, private messages, personal information, etc.)," the project said in an
☐ ☆ ✇ The Hacker News

Hackers Increasingly Using Browser Automation Frameworks for Malicious Activities

By Ravie Lakshmanan — May 26th 2022 at 10:49
Cybersecurity researchers are calling attention to a free-to-use browser automation framework that's being increasingly used by threat actors as part of their attack campaigns. "The framework contains numerous features which we assess may be utilized in the enablement of malicious activities," researchers from Team Cymru said in a new report published Wednesday. "The technical entry bar for the
☐ ☆ ✇ The Hacker News

Experts Warn of Rise in ChromeLoader Malware Hijacking Users' Browsers

By Ravie Lakshmanan — May 26th 2022 at 11:24
A malvertising threat is witnessing a new surge in activity since its emergence earlier this year. Dubbed ChromeLoader, the malware is a "pervasive and persistent browser hijacker that modifies its victims' browser settings and redirects user traffic to advertisement websites," Aedan Russell of Red Canary said in a new report. ChromeLoader is a rogue Chrome browser extension and is typically
☐ ☆ ✇ The Hacker News

Zyxel Issues Patches for 4 New Flaws Affecting AP, API Controller, and Firewall Devices

By Ravie Lakshmanan — May 27th 2022 at 07:28
Zyxel has released patches to address four security flaws affecting its firewall, AP Controller, and AP products to execute arbitrary operating system commands and steal select information. The list of security vulnerabilities is as follows - CVE-2022-0734 - A cross-site scripting (XSS) vulnerability in some firewall versions that could be exploited to access information stored in the user's
☐ ☆ ✇ The Hacker News

Attackers Can Use Electromagnetic Signals to Control Touchscreens Remotely

By Ravie Lakshmanan — May 27th 2022 at 12:15
Researchers have demonstrated what they call the "first active contactless attack against capacitive touchscreens." GhostTouch, as it's called, "uses electromagnetic interference (EMI) to inject fake touch points into a touchscreen without the need to physically touch it," a group of academics from Zhejiang University and Technical University of Darmstadt said in a new research paper. The core
☐ ☆ ✇ The Hacker News

Experts Detail New RCE Vulnerability Affecting Google Chrome Dev Channel

By Ravie Lakshmanan — May 27th 2022 at 16:14
Details have emerged about a recently patched critical remote code execution vulnerability in the V8 JavaScript and WebAssembly engine used in Google Chrome and Chromium-based browsers. The issue relates to a case of use-after-free in the instruction optimization component, successful exploitation of which could "allow an attacker to execute arbitrary code in the context of the browser." The
☐ ☆ ✇ The Hacker News

Microsoft Finds Critical Bugs in Pre-Installed Apps on Millions of Android Devices

By Ravie Lakshmanan — May 28th 2022 at 08:37
Four high severity vulnerabilities have been disclosed in a framework used by pre-installed Android System apps with millions of downloads. The issues, now fixed by its Israeli developer MCE Systems, could have potentially allowed threat actors to stage remote and local attacks or be abused as vectors to obtain sensitive information by taking advantage of their extensive system privileges. "As
☐ ☆ ✇ The Hacker News

New York Man Sentenced to 4 Years in Transnational Cybercrime Scheme

By Ravie Lakshmanan — May 28th 2022 at 14:14
A 37-year-old man from New York has been sentenced to four years in prison for buying stolen credit card information and working in cahoots with a cybercrime cartel known as the Infraud Organization. John Telusma, who went by the alias "Peterelliot," had previously pleaded guilty to one count of racketeering conspiracy on October 13, 2021. He joined the gang in August 2011 and remained a member
☐ ☆ ✇ The Hacker News

FBI Warns About Hackers Selling VPN Credentials for U.S. College Networks

By Ravie Lakshmanan — May 30th 2022 at 05:50
Network credentials and virtual private network (VPN) access for colleges and universities based in the U.S. are being advertised for sale on underground and public criminal marketplaces. "This exposure of sensitive credential and network access information, especially privileged user accounts, could lead to subsequent cyber attacks against individual users or affiliated organizations," the U.S.
☐ ☆ ✇ The Hacker News

New 'GoodWill' Ransomware Forces Victims to Donate Money and Clothes to the Poor

By Ravie Lakshmanan — May 30th 2022 at 06:14
Cybersecurity researchers have disclosed a new ransomware strain called GoodWill that compels victims into donating for social causes and provide financial assistance to people in need. "The ransomware group propagates very unusual demands in exchange for the decryption key," researchers from CloudSEK said in a report published last week. "The Robin Hood-like group claims to be interested in
☐ ☆ ✇ The Hacker News

EnemyBot Linux Botnet Now Exploits Web Server, Android and CMS Vulnerabilities

By Ravie Lakshmanan — May 30th 2022 at 10:30
A nascent Linux-based botnet named Enemybot has expanded its capabilities to include recently disclosed security vulnerabilities in its arsenal to target web servers, Android devices, and content management systems (CMS). "The malware is rapidly adopting one-day vulnerabilities as part of its exploitation capabilities," AT&T Alien Labs said in a technical write-up published last week. "Services
☐ ☆ ✇ The Hacker News

Interpol Nabs 3 Nigerian Scammers Behind Malware-based Attacks

By Ravie Lakshmanan — May 31st 2022 at 06:59
Interpol on Monday announced the arrest of three suspected global scammers in Nigeria for using remote access trojans (RATs) such as Agent Tesla to facilitate malware-enabled cyber fraud. "The men are thought to have used the RAT to reroute financial transactions, stealing confidential online connection details from corporate organizations, including oil and gas companies in South East Asia, the
☐ ☆ ✇ The Hacker News

SideWinder Hackers Launched Over a 1,000 Cyber Attacks Over the Past 2 Years

By Ravie Lakshmanan — May 31st 2022 at 08:30
An "aggressive" advanced persistent threat (APT) group known as SideWinder has been linked to over 1,000 new attacks since April 2020. "Some of the main characteristics of this threat actor that make it stand out among the others, are the sheer number, high frequency and persistence of their attacks and the large collection of encrypted and obfuscated malicious components used in their
☐ ☆ ✇ The Hacker News

New XLoader Botnet Version Using Probability Theory to Hide its C&C Servers

By Ravie Lakshmanan — June 1st 2022 at 10:16
An enhanced version of the XLoader malware has been spotted adopting a probability-based approach to camouflage its command-and-control (C&C) infrastructure, according to the latest research. "Now it is significantly harder to separate the wheat from the chaff and discover the real C&C servers among thousands of legitimate domains used by Xloader as a smokescreen," Israeli cybersecurity company
☐ ☆ ✇ The Hacker News

YODA Tool Found ~47,000 Malicious WordPress Plugins Installed in Over 24,000 Sites

By Ravie Lakshmanan — June 1st 2022 at 13:15
As many as 47,337 malicious plugins have been uncovered on 24,931 unique websites, out of which 3,685 plugins were sold on legitimate marketplaces, netting the attackers $41,500 in illegal revenues. The findings come from a new tool called YODA that aims to detect rogue WordPress plugins and track down their origin, according to an 8-year-long study conducted by a group of researchers from the
☐ ☆ ✇ The Hacker News

FluBot Android Spyware Taken Down in Global Law Enforcement Operation

By Ravie Lakshmanan — June 1st 2022 at 13:34
An international law enforcement operation involving 11 countries has culminated in the takedown of a notorious mobile malware threat called FluBot. "This Android malware has been spreading aggressively through SMS, stealing passwords, online banking details and other sensitive information from infected smartphones across the world," Europol said in a statement. <!--adsense--> The "complex
☐ ☆ ✇ The Hacker News

New Unpatched Horde Webmail Bug Lets Hackers Take Over Server by Sending Email

By Ravie Lakshmanan — June 1st 2022 at 14:56
A new unpatched security vulnerability has been disclosed in the open-source Horde Webmail client that could be exploited to achieve remote code execution on the email server simply by sending a specially crafted email to a victim. "Once the email is viewed, the attacker can silently take over the complete mail server without any further user interaction," SonarSource said in a report shared
☐ ☆ ✇ The Hacker News

DOJ Seizes 3 Web Domains Used to Sell Stolen Data and DDoS Services

By Ravie Lakshmanan — June 2nd 2022 at 06:39
The U.S. Department of Justice (DoJ) on Wednesday announced the seizure of three domains used by cybercriminals to trade stolen personal information and facilitate distributed denial-of-service (DDoS) attacks for hire. This includes weleakinfo[.]to, ipstress[.]in, and ovh-booter[.]com, the first of which allowed its users to traffic hacked personal data and offered a searchable database
☐ ☆ ✇ The Hacker News

SideWinder Hackers Use Fake Android VPN Apps to Target Pakistani Entities

By Ravie Lakshmanan — June 2nd 2022 at 09:09
The threat actor known as SideWinder has added a new custom tool to its arsenal of malware that's being used in phishing attacks against Pakistani public and private sector entities. "Phishing links in emails or posts that mimic legitimate notifications and services of government agencies and organizations in Pakistan are primary attack vectors of the gang," Singapore-headquartered cybersecurity
☐ ☆ ✇ The Hacker News

Critical UNISOC Chip Vulnerability Affects Millions of Android Smartphones

By Ravie Lakshmanan — June 2nd 2022 at 10:09
A critical security flaw has been uncovered in UNISOC's smartphone chipset that could be potentially weaponized to disrupt a smartphone's radio communications through a malformed packet. "Left unpatched, a hacker or a military unit can leverage such a vulnerability to neutralize communications in a specific location," Israeli cybersecurity company Check Point said in a report shared with The
☐ ☆ ✇ The Hacker News

Researchers Demonstrate Ransomware for IoT Devices That Targets IT and OT Networks

By Ravie Lakshmanan — June 2nd 2022 at 12:01
As ransomware infections have evolved from purely encrypting data to schemes such as double and triple extortion, a new attack vector is likely to set the stage for future campaigns. Called Ransomware for IoT or R4IoT by Forescout, it's a "novel, proof-of-concept ransomware that exploits an IoT device to gain access and move laterally in an IT [information technology] network and impact the OT [
☐ ☆ ✇ The Hacker News

Conti Leaks Reveal Ransomware Gang's Interest in Firmware-based Attacks

By Ravie Lakshmanan — June 2nd 2022 at 13:13
An analysis of leaked chats from the notorious Conti ransomware group earlier this year has revealed that the syndicate has been working on a set of firmware attack techniques that could offer a path to accessing privileged code on compromised devices. "Control over firmware gives attackers virtually unmatched powers both to directly cause damage and to enable other long-term strategic goals,"
☐ ☆ ✇ The Hacker News

Threat Detection Software: A Deep Dive

By The Hacker News — June 2nd 2022 at 19:10
As the threat landscape evolves and multiplies with more advanced attacks than ever, defending against these modern cyber threats is a monumental challenge for almost any organization.  Threat detection is about an organization’s ability to accurately identify threats, be it to the network, an endpoint, another asset or an application – including cloud infrastructure and assets. At scale, threat
☐ ☆ ✇ The Hacker News

Researchers Uncover Malware Controlling Thousands of Sites in Parrot TDS Network

By Ravie Lakshmanan — June 3rd 2022 at 10:58
The Parrot traffic direction system (TDS) that came to light earlier this year has had a larger impact than previously thought, according to new research. Sucuri, which has been tracking the same campaign since February 2019 under the name "NDSW/NDSX," said that "the malware was one of the top infections" detected in 2021, accounting for more than 61,000 websites. Parrot TDS was documented in
☐ ☆ ✇ The Hacker News

GitLab Issues Security Patch for Critical Account Takeover Vulnerability

By Ravie Lakshmanan — June 3rd 2022 at 15:01
GitLab has moved to address a critical security flaw in its service that, if successfully exploited, could result in an account takeover. Tracked as CVE-2022-1680, the issue has a CVSS severity score of 9.9 and was discovered internally by the company. The security flaw affects all versions of GitLab Enterprise Edition (EE) starting from 11.10 before 14.9.5, all versions starting from 14.10
☐ ☆ ✇ The Hacker News

Atlassian Releases Patch for Confluence Zero-Day Flaw Exploited in the Wild

By Ravie Lakshmanan — June 4th 2022 at 08:57
Atlassian on Friday rolled out fixes to address a critical security flaw affecting its Confluence Server and Data Center products that have come under active exploitation by threat actors to achieve remote code execution. Tracked as CVE-2022-26134, the issue is similar to CVE-2021-26084 — another security flaw the Australian software company patched in August 2021. Both relate to a case of
☐ ☆ ✇ The Hacker News

Unpatched Critical Flaws Disclosed in U-Boot Bootloader for Embedded Devices

By Ravie Lakshmanan — June 6th 2022 at 14:04
Cybersecurity researchers have disclosed two unpatched security vulnerabilities in the open-source U-Boot boot loader. The issues, which were uncovered in the IP defragmentation algorithm implemented in U-Boot by NCC Group, could be abused to achieve arbitrary out-of-bounds write and denial-of-service (DoS). U-Boot is a boot loader used in Linux-based embedded systems such as ChromeOS as well as
☐ ☆ ✇ The Hacker News

Researchers Warn of Spam Campaign Targeting Victims with SVCReady Malware

By Ravie Lakshmanan — June 7th 2022 at 09:14
A new wave of phishing campaigns has been observed spreading a previously documented malware called SVCReady. "The malware is notable for the unusual way it is delivered to target PCs — using shellcode hidden in the properties of Microsoft Office documents," Patrick Schläpfer, a threat analyst at HP, said in a technical write-up. SVCReady is said to be in its early stage of development, with the
☐ ☆ ✇ The Hacker News

Hacking Scenarios: How Hackers Choose Their Victims

By The Hacker News — June 7th 2022 at 10:18
Enforcing the "double-extortion" technique aka pay-now-or-get-breached emerged as a head-turner last year.  May 6th, 2022 is a recent example. The State Department said the Conti strain of ransomware was the most costly in terms of payments made by victims as of January. Conti, a ransomware-as-a-service (RaaS) program, is one of the most notorious ransomware groups and has been responsible for
☐ ☆ ✇ The Hacker News

Evil Corp Cybercrime Group Shifts to LockBit Ransomware to Evade Sanctions

By Ravie Lakshmanan — June 7th 2022 at 12:51
The threat cluster dubbed UNC2165, which shares numerous overlaps with a Russia-based cybercrime group known as Evil Corp, has been linked to multiple LockBit ransomware intrusions in what's seen as an attempt by the latter to get around sanctions imposed by the U.S. Treasury in December 2019. "These actors have shifted away from using exclusive ransomware variants to LockBit — a well-known
☐ ☆ ✇ The Hacker News

FBI Seizes 'SSNDOB' ID Theft Service for Selling Personal Info of 24 Million People

By Ravie Lakshmanan — June 8th 2022 at 06:45
An illicit online marketplace known as SSNDOB was taken down in operation led by U.S. law enforcement agencies, the Department of Justice (DoJ) announced Tuesday. SSNDOB trafficked in personal information such as names, dates of birth, credit card numbers, and Social Security numbers of about 24 million individuals in the U.S., generating its operators $19 million in sales revenue. The action
❌