Web skimmers compete in Umbro Brasil hack

Umbro, the popular sportswear brand has had their Umbro Brasil website hacked and injected with not one but two web skimmers part of the Magecart group. Magecart has become a household name in recent months due to high profile attacks on various merchant websites. Criminals can seamlessly steal...

Beware Black Friday Scams Lurking Among the Holiday Deals

Cybercriminals are always looking to steal your credit card or even your identity. But it pays to be on extra high alert come Black Friday...

Two TalkTalk hackers jailed for 2015 data breach that cost it £77 million

Two hackers have been sent to prison for their roles in hacking TalkTalk, one of the biggest UK-based telecommunications company, in 2015 and stealing personal information, banking, and credit card details belonging to more than 156,000 customers. Matthew Hanley, 23, and Connor Allsopp, 21, both...

Chip Cards Fail to Reduce Credit Card Fraud in the US

A new study finds that credit card fraud has not declined since the introduction of chip cards in the US. The majority of stolen card information comes from hacked point-of-sale terminals. The reasons seem to be twofold. One, the US uses chip-and-signature instead of chip-and-PIN, obviating the...

That Domain You Forgot to Renew? Yeah, it’s Now Stealing Credit Cards

If you own a domain name that gets decent traffic and you fail to pay its annual renewal fee, chances are this mistake will be costly for you and for others. Lately, neglected domains have been getting scooped up by crooks who use them to set up fake e-commerce sites that steal credit card detail...

Debian DSA-4338-1 : qemu - security update

Integer overflows in the processing of packets in network cards emulated by QEMU, a fast processor emulator, could result in denial of service. In addition this update backports support to passthrough the new CPU features added in the intel-microcode update shipped in DSA 4273 to x86-based guests...

Open Source IPS: Suricata

Suricata is a free and open source, mature, fast and robust network threat detection engine. The Suricata engine is capable of real time intrusion detection IDS, inline intrusion prevention IPS, network security monitoring NSM and offline pcap processing. Suricata inspects the network traffic usi...

U.S. Chip Cards Are Being Compromised in the Millions

Chip-and-PIN technology has become the de-facto standard for in-person credit- and debit-card transactions in the U.S. – but a lack of merchant compliance means that cards are still being compromised in the millions. Chip cards, which contain an embedded microprocessor that encrypts the card data...

Security update for opensc (moderate)

This update for opensc fixes the following issues: - CVE-2018-16391: Fixed a denial of service when handling responses from a Muscle Card bsc1106998 - CVE-2018-16392: Fixed a denial of service when handling responses from a TCOS Card bsc1106999 - CVE-2018-16393: Fixed buffer overflows when handli...

openSUSE: Security Advisory for opensc (openSUSE-SU-2018:3716-1)

The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Unpatched VirtualBox Zero-Day Vulnerability and Exploit Released Online

An independent exploit developer and vulnerability researcher has publicly disclosed a zero-day vulnerability in VirtualBox—a popular open source virtualization software developed by Oracle—that could allow a malicious program to escape virtual machine guest OS and execute code on the operating...

U.S. Secret Service Warns ID Thieves are Abusing USPS’s Mail Scanning Service

A year ago, KrebsOnSecurity warned that "Informed Delivery," a new offering from the U.S. Postal Service USPS that lets residents view scanned images of all incoming mail, was likely to be abused by identity thieves and other fraudsters unless the USPS beefed up security around the program and ma...

Citrix ADC MPX/SDX with SSL Coleto Card Installed Fails

Customer may report that their: SVM and VPX eventually become unresponsive GUI access is unavailable for SVM and VPX SSH access only SVM reporting both the instances as Yellow Instance state-YellowOut of service message This issue can be validated by reviewing the following counters getting...

Yi Home Camera Code Execution Vulnerability (CNVD-2018-22808)

Yi Home Camera is an IoT home camera sold worldwide. A code execution vulnerability exists in the firmware update feature of the Yi Home Camera 27US 1.8.7.0D. An attacker can exploit the vulnerability by inserting an SD card and exploiting the vulnerability via a specially crafted file to cause a...

Yi Home Camera Firmware Downgrade Vulnerability (CNVD-2018-22809)

Yi Home Camera is an IoT home camera sold worldwide. A firmware downgrade vulnerability exists in the firmware update feature of the Yi Home Camera 27US 1.8.7.0D. An attacker can cause a logic flaw by inserting an SD card and exploiting the vulnerability via a specially crafted file, from which a...

Yi Home Camera Code Execution Vulnerability (CNVD-2018-22813)

Yi Home Camera is an IoT home camera sold worldwide. A code execution vulnerability exists in the firmware update function of the Yi Home Camera 27US 1.8.7.0D. An attacker can cause a CRC conflict by inserting an SD card and exploiting the vulnerability via a specially crafted 7-Zip file, which c...

Who’s In Your Online Shopping Cart?

Crooks who hack online merchants to steal payment card data are constantly coming up with crafty ways to hide their malicious code on Web sites. In Internet ages past, this often meant obfuscating it as giant blobs of gibberish text that was obvious even to the untrained eye. These days, a...

Design/Logic Flaw

An exploitable firmware downgrade vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted file can cause a logic flaw, resulting in a firmware downgrade. An attacker can insert an SD card to trigger this vulnerability...

CVE-2018-3890

An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted file can cause a logic flaw and command injection, resulting in code execution. An attacker can insert an SD card to trigger this vulnerability...

CVE-2018-3890

An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted file can cause a logic flaw and command injection, resulting in code execution. An attacker can insert an SD card to trigger this vulnerability...