TangleBot Malware Reaches Deep into Android Device Functions

An Android malware called TangleBot has weaved its way onto the cyber-scene: One that researchers said can perform a bouquet of malicious actions, including stealing personal info and controlling apps and device functions. According to Cloudmark researchers, the newly discovered mobile malware is...

About the security content of macOS Big Sur 11.5

About the security content of macOS Big Sur 11.5 This document describes the security content of macOS Big Sur 11.5. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases...

Bad Apple: App Store Rife with Fraud, Fleeceware

A new analysis from the Washington Post reveals just how widespread fraud is across the Apple App Store, while also offering glimpse into the revenue flowing into Cupertino generated by those malicious activities. The Apple App Store has been under heightened scrutiny for maintaining its iron gri...

Apple macOS Big Sur 输入验证错误漏洞

Apple macOS Big Sur is a mobile application app from Apple Inc. A security vulnerability exists in macOS Big Sur, which arises from incorrect file path validation within the App Store component, allowing malicious applications to bypass implemented security restrictions. Versions affected: macOS:...

About the security content of Security Update 2021-003 Catalina

About the security content of Security Update 2021-003 Catalina This document describes the security content of Security Update 2021-003 Catalina. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has...

How to Avoid App Store Scams

Apple’s and Google’s approval guidelines are notoriously lax—and they won’t keep out apps that are after your money and data. Here’s how to sniff them out...

Apple Exec Calls Level of Mac Malware ‘Unacceptable’

Apple is using the growing threat of malware on its Mac platform as a defense in a lawsuit that could force the company to open up new channels of applications for its mobile iOS platform. In testimony in a California court Wednesday, Apple head of software engineering, Craig Federighi called the...

WebSSH For iOS 14.16.10 Denial Of Service

Exploit Title: WebSSH for iOS 14.16.10 - 'mashREPL' Denial of Service PoC Author: Luis Martinez Discovery Date: 2021-05-18 Vendor Homepage: https://apps.apple.com/mx/app/webssh-ssh-client/id497714887 Software Link: App Store for iOS devices Tested Version: 14.16.10 Vulnerability Type: Denial of...

Pax Technology PAXSTORE 安全漏洞

PAX Technology PAXSTORE is an application from China PAX PAX Inc. An ecosystem that connects 2.5 million endpoints, thousands of application developers and more than 180 marketplaces in more than 80 countries/regions around the world. A security vulnerability exists in Pax Technology PAXSTORE...

A week in security (April 19 – 25)

Last week on Malwarebytes Labs, we interviewed Youssef Sammouda, a 21-year-old bug bounty hunter who is focused on finding vulnerabilities on Facebook. We looked into the CodeCov supply-chain attack, the vulnerabilities in Pulse Secure VPN that are being actively exploited by attackers, and the...

About the security content of iOS 14.5 and iPadOS 14.5

About the security content of iOS 14.5 and iPadOS 14.5 This document describes the security content of iOS 14.5 and iPadOS 14.5. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches ...

Signal's Founder Hacked a Notorious Phone-Cracking Device

Plus: App Store scams, an anti-surveillance bill, and more of the week’s top security news...

iOS Kids Game Morphs into Underground Crypto Casino

A kids’ game called “Jungle Run” that, until recently, was available in the Apple App store, was secretly a cryptocurrency-funded casino set up to scam people out of money. Join experts from Digital Shadows Austin Merritt, Malwarebytes Adam Kujawa and Sift Kevin Lee to find out how cybercrime...

Fake Trezor app steals more than $1 million worth of crypto coins

Several users of Trezor, a small hardware device that acts as a cryptocurrency wallet, have been duped by a fake app with the same name. The app was available on Google Play and Apple’s App Store and also claimed to be from SatoshiLabs, the creators of Trezor. According to the Washington Post, th...

CVE-2021-29271: Improper Neutralization of Input During Web Page Generation

remark42 before 1.6.1 allows XSS, as demonstrated by "Locator: LocatorURL:" followed by an XSS payload. This is related to backend/app/store/comment.go and backend/app/store/service/service.go...

Fleeceware Apps Bank $400M in Revenue

About 204 different “fleeceware” applications with a combined billion+ downloads have raked in more than $400 million in revenue so far, via the Apple App Store and Google Play, analysis has revealed. Fleeceware apps generally offer users a free trial to “test” the app, before commencing automati...

Google Reveals What Personal Data Chrome and Its Apps Collect On You

Privacy-focused search engine DuckDuckGo called out rival Google for "spying" on users after the search giant updated its flagship app to spell out the exact kinds of information it collects for personalization and marketing purposes. "After months of stalling, Google finally revealed how much...

About the security content of macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. Apple security documents reference...

Apple iOS Security Vulnerability

Apple App Store is an application store for downloading software from Apple Inc. in the United States. A security vulnerability exists in the Apple App Store that can be exploited by attackers to run code. The following products and versions are affected: iPhone 6s and later, iPad Air 2 and later...

About the security content of iOS 14.3 and iPadOS 14.3

About the security content of iOS 14.3 and iPadOS 14.3 This document describes the security content of iOS 14.3 and iPadOS 14.3. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches ...