286 matches found
Pegasus Spyware Uses iPhone Zero-Click iMessage Zero-Day
A never-before-seen, zero-click iMessaging exploit has been allegedly used to illegally spy on Bahraini activists with NSO Group’s Pegasus spyware, according to cybersecurity watchdog Citizen Lab. The digital researchers are calling the new iMessaging exploit FORCEDENTRY. In a report published on...
Citizen's New Service Helps Paying Users Summon the Cops
The crime-tracking app is charging $20 per month to give subscribers access to their own virtual security service...
NSO Group Hacked
NSO Group, the Israeli cyberweapons arms manufacturer behind the Pegasus spyware -- used by authoritarian regimes around the world to spy on dissidents, journalists, human rights workers, and others -- was hacked. Or, at least, an enormous trove of documents was leaked to journalists. Theres a lo...
Israeli Firm Helped Governments Target Journalists, Activists with 0-Days and Spyware
Two of the zero-day Windows flaws rectified by Microsoft as part of its Patch Tuesday update earlier this week were weaponized by an Israel-based company called Candiru in a series of "precision attacks" to hack more than 100 journalists, academics, activists, and political dissidents globally. T...
Protecting customers from a private-sector offensive actor using 0-day exploits and DevilsTongue malware
The Microsoft Threat Intelligence Center MSTIC alongside the Microsoft Security Response Center MSRC has uncovered a private-sector offensive actor, or PSOA, that we are calling SOURGUM in possession of now-patched, Windows 0-day exploits CVE-2021-31979 and CVE-2021-33771. Private-sector offensiv...
Protecting customers from a private-sector offensive actor using 0-day exploits and DevilsTongue malware
The Microsoft Threat Intelligence Center MSTIC alongside the Microsoft Security Response Center MSRC has uncovered a private-sector offensive actor, or PSOA, that we are calling SOURGUM in possession of now-patched, Windows 0-day exploits CVE-2021-31979 and CVE-2021-33771. Private-sector offensiv...
Accela Civic Platform Cross-Site Scripting Vulnerability (CNVD-2021-61770)
Accela Civic Platform is a cloud-based solution for Accela's applications to modernize city systems for land management and code enforcement, increased citizen engagement and mobile information access. The vulnerability stems from the lack of proper validation of client-side data by the WEB...
Accela Civic Platform Information Disclosure Vulnerability
Accela Civic Platform is a cloud-based solution for Accela's application software to modernize city systems for land management and code enforcement, increased citizen engagement and mobile information access. information disclosure vulnerabilities exist in versions of Accela Civic Platform prior...
Accela Civic Platform 跨站脚本漏洞
Accela Civic Platform is a cloud-based solution for Accela's applications to modernize city systems for land management and code enforcement, increased citizen engagement and mobile information access. The vulnerability stems from the lack of proper validation of client-side data by the WEB...
US Soldiers Exposed Nuclear Secrets on Digital Flash Ccards
Plus: A major hack in Japan, Citizen app run amok, and more of the week’s top security news...
Russian admin of cybercrime marketplace Deer.io jailed in US
By Deeba Ahmed Kirill Victorovich Firsov, a Russian Citizen has been jailed for 30 months in US prison for running popular cybercrime marketplace Deer.io. This is a post from HackRead.com Read the original post: Russian admin of cybercrime marketplace Deer.io jailed in US...
Google Argentina domain bought by a random citizen for $5
By Deeba Ahmed A random Argentinian bought the official Google Argentina domain for just $5 and as a result, the site was offline in the country for hours. This is a post from HackRead.com Read the original post: Google Argentina domain bought by a random citizen for $5...
Google uncovers new iOS security feature Apple quietly added after zero-day attacks
Google Project Zero on Thursday disclosed details of a new security mechanism that Apple quietly added to iOS 14 as a countermeasure to prevent attacks that were recently found to leverage zero-days in its messaging app. Dubbed "BlastDoor," the improved sandbox system for iMessage data was...
A week in security (December 21- December 27)
Last week on Malwarebytes Labs we warned our readers about not so festive social media scams, how Emotet returned just in time for Christmas, we tried out some free online games your kids are playing and here’s what happened, and our VideoBytes episode talked about what penetration testing tools...
Zero-Click Apple Zero-Day Uncovered in Pegasus Spy Attack
Four nation-state-backed advanced persistent threats APTs hacked Al Jazeera journalists, producers, anchors and executives, in an espionage attack leveraging a zero-day exploit for Apple iPhone, researchers said. The attack, carried out in July and August, compromised 36 personal phones belonging...
FFEM: A Simple Device to Crowdsource Water Quality Data
Akamai has been a strong advocate for water conservation by supporting early-stage innovations. This World Water Monitoring Day September 18, we present the inspiring work of one of our innovators -- Foundation For Environmental Monitoring FFEM, based in Bangalore, India -- that is working on...
citizen.com.hk Cross Site Scripting vulnerability OBB-1299756
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
citizen.com.hk Cross Site Scripting vulnerability OBB-1225428
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
citizen.com.hk Cross Site Scripting vulnerability OBB-1217253
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
New Hacking-for-Hire Company in India
Citizen Lab has a new report on Dark Basin, a large hacking-for-hire company in India. Key Findings: Dark Basin is a hack-for-hire group that has targeted thousands of individuals and hundreds of institutions on six continents. Targets include advocacy groups and journalists, elected and senior...