WhatsApp hit with €225 million fine for GDPR violations

WhatsApp was hit with a €225 million fine for violating the General Data Protection Regulation GDPR, the European Union’s sweeping data protection law that has been in effect for more than three years. The fine represents the highest ever penalty levied by the Irish Data Protection Commission,...

WhatsApp Photo Filter Bug Could Have Exposed Your Data to Remote Attackers

A now-patched high-severity security vulnerability in WhatApp's image filter feature could have been abused to send a malicious image over the messaging app to read sensitive information from the app's memory. Tracked as CVE-2020-1910 CVSS score: 7.8, the flaw concerns an out-of-bounds read/write...

FisherMan - CLI Program That Collects Information From Facebook User Profiles Via Selenium

Search for public profile information on Facebook Installation clone the repo $ git clone https://github.com/Godofcoffe/FisherMan change the working directory to FisherMan $ cd FisherMan install the requirements $ python3 -m pip install -r requirements.txt Pre-requisites Make sure you have the...

Facebook Oculus Desktop 安全漏洞

Facebook Oculus Desktop is a virtual desktop application from Facebook Inc. that supports the operation of computers in VR. Facebook Oculus Desktop suffers from a security vulnerability that stems from a handle management error in OVRServiceLauncher.exe, which can be exploited by an attacker to...

Facebook Adds End-to-End Encryption for Audio and Video Calls in Messenger

Facebook on Friday said it's extending end-to-end encryption E2EE for voice and video calls in Messenger, along with testing a new opt-in setting that will turn on end-to-end encryption for Instagram DMs. "The content of your messages and calls in an end-to-end encrypted conversation is protected...

Facebook For Android Friend Acceptance

Author - Sivanesh Ashok | @sivaneshashok | stazot.com Date : 2021-08-03 Vendor : https://facebook.com/ Version : Tested on : Version 329.0.0.29.120, Android 10 Last Modified : 2021-08-10 -- Bug Description Facebook for Android is vulnerable to a permission issue which allows anyone with physical...

Android Malware ‘FlyTrap’ Hijacks Facebook Accounts

Researchers have uncovered a new Android trojan, dubbed FlyTrap, that’s spread to more than 10,000 victims via rigged apps on third-party app stores, sideloaded apps and hijacked Facebook accounts. In a report posted on Monday, Zimperium’s zLabs mobile threat research teams wrote that FlyTrap has...

Beware! New Android Malware Hacks Thousands of Facebook Accounts

A new Android trojan has been found to compromise Facebook accounts of over 10,000 users in at least 144 countries since March 2021 via fraudulent apps distributed through Google Play Store and other third-party app marketplaces. Dubbed "FlyTrap," the previously undocumented malware is believed t...

A week in security (August 2 – August 8)

Last week on Malwarebytes Labs: RDP brute force attacks explained The 3 biggest threats reaching for your antivirus software’s off switch Zoom and gloom? Video comms org agrees to settle for $85m COVID-19 vaccine appointment system attacked in Italy Chrome casts away the padlock - is it good...

WordPress Facebook Page Feed Timeline plugin <= 1.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by iohex and WPScanTeam in WordPress Facebook Page Feed Timeline plugin versions = 1.0. Solution This plugin has been closed as of July 15, 2019 and is not available for download. This closure is permanent. Reason: Author Request...

Microsoft Edge’s ‘Super Duper Secure Mode’ Does What It Says

Plus: Facebook account hacks, Instagram-ban scammers, and more of the week’s top security news...

Messaging Apps Have an Eavesdropping Problem

Vulnerabilities in Signal, Facebook Messenger, Google Duo, and more all point to a pervasive privacy issue...

Experts Uncover Several C&C Servers Linked to WellMess Malware

Cybersecurity researchers on Friday unmasked new command-and-control C2 infrastructure belonging to the Russian threat actor tracked as APT29, aka Cozy Bear, that has been spotted actively serving WellMess malware as part of an ongoing attack campaign. More than 30 C2 servers operated by the...

Hackers Posed as Aerobics Instructors for Years to Target Aerospace Employees

An Iranian cyberespionage group masqueraded as an aerobics instructor on Facebook in an attempt to infect the machine of an employee of an aerospace defense contractor with malware as part of a years-long social engineering and targeted malware campaign. Enterprise security firm Proofpoint...

Facebook HHVM Buffer Overflow Vulnerability (CNVD-2021-55183)

Facebook HHVM aka HipHop Virtual Machine is a virtual machine from Facebook that significantly improves the performance of PHP loading dynamic pages. Facebook HHVM is vulnerable to a buffer overflow vulnerability that can be exploited by attackers to perform out-of-bounds writes on the heap,...

Facebook HHVM 输入验证错误漏洞

Facebook HHVM aka HipHop Virtual Machine is a virtual machine from Facebook that significantly improves the performance of PHP loading dynamic pages. Facebook HHVM is vulnerable to a buffer overflow vulnerability that can be exploited by attackers to perform out-of-bounds writes on the heap,...

MosaicLoader Malware Delivers Facebook Stealers, RATs

A never-before-documented Windows malware strain dubbed MosaicLoader is spreading worldwide, acting as a full-service malware-delivery platform that’s being used to infect victims with remote-access trojans RATs, Facebook cookie stealers and other threats. That’s according to Bitdefender...

Facebook Suspends Accounts Used by Iranian Hackers to Target US Military Personnel

Facebook on Thursday disclosed it dismantled a "sophisticated" online cyber espionage campaign conducted by Iranian hackers targeting about 200 military personnel and companies in the defense and aerospace sectors in the U.S., U.K., and Europe using fake online personas on its platform. The socia...

Facebook Catches Iranian Spies Catfishing US Military Targets

The hackers posed as recruiters, journalists, and hospitality workers to lure their victims...

Android Apps in Google Play Harvest Facebook Credentials

A set of nine malicious Android apps that steal Facebook credentials were found on Google Play, which racked up a collective 5.9 million installations before Google removed them. According to Dr. Web’s malware analysts, the applications were fully functional, so that victims remained in the dark...