OpenJDK: weak protection of key stores against brute forcing (Security, 8181692)

It was discovered that the Security component of OpenJDK generated weak password-based encryption keys used to protect private keys stored in key stores. This made it easier to perform password guessing attacks to decrypt stored keys if an attacker could gain access to a key store...

Breach at Sonic Drive-In May Have Impacted Millions of Credit, Debit Cards

Sonic Drive-In, a fast-food chain with nearly 3,600 locations across 45 U.S. states, has acknowledged a breach affecting an unknown number of store payment systems. The ongoing breach may have led to a fire sale on millions of stolen credit and debit card accounts that are now being peddled in...

Apps Infected With SonicSpy Spyware Removed From Google Play

Three messaging apps in the Google Play store contained spyware called SonicSpy. According to researchers, the spyware also infected more than 1,000 additional apps hosted at third-party Android app stores. Researchers at Lookout traced the spyware-infected apps to an Iraqi developer identified a...

Mobile Menace Monday: Malicious clicker with extra maliciousness included

A new malicious clicker has emerged onto third-party app stores. Chinese in origin, the malicious app uses heavy obfuscation and poses as a battery optimizer app. We classify is as Android/Trojan.Clicker.hyj. Click to view slideshow. Hide what’s inside To obfuscate its code, Clicker.hyj uses an A...

Shopify: Removed staff members who had "Manage shops" permission can still create development stores

Details: It's been found that staff members of an organization in partners.shopify.com can have a permission to manage shops and those with that permission can create development stores that will be associated with the organization. When a staff member tries to create a development store, a POST...

Credit Card Breach at Buckle Stores

The Buckle Inc., a clothier that operates more than 450 stores in 44 U.S. states, disclosed Friday that its retail locations were hit by malicious software designed to steal customer credit card data. The disclosure came hours after KrebsOnSecurity contacted the company regarding reports from...

CVE-2016-5960

IBM Security Privileged Identity Manager 2.0.2 and 2.1.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 116171...

Hundreds of Apps Using Ultrasonic Signals to Silently Track Smartphone Users

Your smartphone may have some apps that are continuously listening inaudible, high-frequency ultrasonic sounds from your surroundings and they know where you go, what you like and dislike — all without your knowledge. Ultrasonic Cross-Device Tracking is a new technology that some marketers and...

CVE-2016-5051

OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 stores a PSK in cleartext under /private/var/mobile/Containers/Data/Application...

SpyNote RAT Now Disguised As Netflix App

A new version of the SpyNote Trojan is designed to trick Android users into thinking it’s a legitimate Netflix application. Once installed, the remote access Trojan RAT essentially hands control of the device over to the hacker, enabling them to copy files, view contacts, and eavesdrop on the...

stores.ikks.com XSS vulnerability

Vulnerable URL: http://stores.ikks.com/fr-fr/boutiques/%22%3E%3Cimg%20src=x%20onerror=prompt'OPENBUGBOUNTY'%3Ex/41.0889169,23.549329299999954/25 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed...

Gooligan Malware Breaches 1 Million Google Accounts

Android malware called Gooligan is being blamed for 1 million breached Google accounts. The malware is still active, according Check Point Software Technologies, and is responsible for an additional 13,000 new breaches of Android devices daily. “We believe that it is the largest Google account...

NUUO NVRmini 2 3.0.8 - Cross-Site Request Forgery (Add Admin)

NUUO NVRmini 2 3.0.8 - Cross-Site Request Forgery Add Admin input type="hidden" name="password2" value=...

stores-discount.com XSS vulnerability

Vulnerable URL: https://www.stores-discount.com/moteurrecherche/result.php?mot=%22%3E%3Cimg%20src=x%20onerror=prompt/OPENBUGBOUNTY/%3E%3C%22 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alex...

This Android Hacking Group is making $500,000 per day

Own an Android smartphone? Hackers can secretly install malicious apps, games, and pop-up adverts on your smartphone remotely in order to make large sums of money. Security researchers at Cheetah Mobile have uncovered one of the world's largest and most prolific Trojan families, infecting million...

Authentication flaw

ABB PCM600 before 2.7 improperly stores PCM600 authentication credentials, which allows local users to obtain sensitive information via unspecified vectors...

Banking Trojan Outwits Google Play Malware Scanner

Google Play’s first line of defense against malware was circumvented by attackers who managed to sneak a malicious app called “Black Jack Free” into the official app store. The app was discovered by Lookout Security and removed by Google last week. Lookout estimates that 5,000 people downloaded t...

6 Charged for Hacking Lottery Terminals to Produce More Winning Tickets

Police have arrested and charged six people with crimes linked to hacking Connecticut state lottery terminals in order to produce more winning tickets than usual. Prosecutors say all the six suspects are either owners or employees of retail stores that produced a much higher number of winning...

davidccook.ca XSS vulnerability

Vulnerable URL: http://davidccook.ca/stores.php?let=" Details: Description| Value ---|--- Patched:| Yes, at 26.01.2016 Latest check for patch:| 26.01.2016 03:42 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 6993054 Google Pagerank| 0 VIP website status:| No...

Duplicate App Icons on Receiver for Windows

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Affected users see multiple stores configured CCA4-UK, CCA4-UK1, CCA4-UK2 and so on. Receiver was...