Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks

In March 2016, a financially motivated threat actor launched several tailored spear phishing campaigns primarily targeting the retail, restaurant, and hospitality industries. The emails contained variations of Microsoft Word documents with embedded macros that, when enabled, downloaded and execut...

Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks

In March 2016, a financially motivated threat actor launched several tailored spear phishing campaigns primarily targeting the retail, restaurant, and hospitality industries. The emails contained variations of Microsoft Word documents with embedded macros that, when enabled, downloaded and execut...

FireEye Details Microsoft Zero Day Attack on 100 Companies

More than 100 North American companies were attacked by crooks exploiting a Windows zero day vulnerability. The attacks began in early March and involved the zero day vulnerability CVE-2016-0167 reported and partially fixed in April’s Patch Tuesday security bulletins by Microsoft. The zero day wa...

MS16-054: Description of the security update for Office 2013: May 10, 2016

MS16-054: Description of the security update for Office 2013: May 10, 2016 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft...

May 10, 2016 — KB3156421 (OS Build 10586.318)

None None...

APSB16-16 Security update available for ColdFusion

Adobe has released security hotfixes for ColdFusion versions 10, 11 and the 2016 release. These hotfixes resolve an input validation issue CVE-2016-1113, a host name verification problem with wild card certificates CVE-2016-1115 and include an updated version of Apache Commons Collections library...

Cisco IOS XR Software BVI Routed Packet Denial of Service Vulnerability (cisco-sa-20150415-iosxr)

A vulnerability in the packet-processing code of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers ASR could allow an unauthenticated, remote attacker to cause a lockup and eventual reload of a network processor chip and the line card that is processing traffic. Only...

Exide Industries Limited - External URLs, SD-card access, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application Exide Industries Limited published at the 'play' market has multiple vulnerabilities...

Maverick: GPS Navigation - Base64 encoded String, External URLs, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application Maverick: GPS Navigation published at the 'play' market has multiple vulnerabilities...

Android Ransomware Attacks Using Towelroot, Hacking Team Exploits

A menacing wave of ransomware that locks up Android devices and demands victims pay $200 in Apple iTunes gift card codes is raising concern among security researchers. The ransomware attacks, they say, open a new chapter for Android vulnerabilities similar to Microsoft’s obsolete, unpatched and...

PoS Attack Net Crooks 20 Million Bank Cards, Up to $400 Million

In a storyline that rivals an episode of The Sopranos, researchers at FireEye documented the heist of bank card data from 20 million individuals that involved a complex web of crooks that may have netted hackers more than $100 million since 2014. In conjunction with recently acquired Isight...

AlpineQuest GPS Hiking (Lite) - Certificates or keys found, External URLs, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application AlpineQuest GPS Hiking Lite published at the 'play' market has multiple vulnerabilities...

Follow The Money: Dissecting the Operations of the Cyber Crime Group FIN6

Cybercrime operations can be intricate and elaborate, with careful planning needed to navigate the various obstacles separating an attacker from a payout. Yet reports on these operations are often fragmentary, as the full scope of attacker activity typically occurs beyond the view of any one grou...

Kitchen Radio (Music player) - External URLs, SD-card access, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Kitchen Radio Music player published at the 'play' market has multiple vulnerabilities...

MULTIGRAIN – Point of Sale Attackers Make an Unhealthy Addition to the Pantry

FireEye recently discovered a new variant of a point of sale POS malware family known as NewPosThings. This variant, which we call “MULTIGRAIN”, consists largely of a subset of slightly modified code from NewPosThings. The variant is highly targeted, digitally signed, and exfiltrates stolen payme...

MULTIGRAIN – Point of Sale Attackers Make an Unhealthy Addition to the Pantry

FireEye recently discovered a new variant of a point of sale POS malware family known as NewPosThings. This variant, which we call “MULTIGRAIN”, consists largely of a subset of slightly modified code from NewPosThings. The variant is highly targeted, digitally signed, and exfiltrates stolen payme...

TTS Test App - SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application TTS Test App published at the 'play' market has multiple vulnerabilities...

MyFreeZoo Mobile - Dynamic Code Loading, External URLs, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application MyFreeZoo Mobile published at the 'play' market has multiple vulnerabilities...

ADAC Auslandshelfer - Customized SSL, External URLs, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application ADAC Auslandshelfer published at the 'play' market has multiple vulnerabilities...

Waterfall Photo Frames - Dynamic Code Loading, External URLs, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application Waterfall Photo Frames published at the 'play' market has multiple vulnerabilities...