Threatpost News Wrap Podcast For Feb. 1

Data privacy dominated the week of news ending Feb. 1. News headlines included both Facebook and Google finding themselves in hot water over distributing data-sucking apps on iOS devices. A severe flaw was also found in kid-tracking IoT smartwatches that could expose sensitive information for...

This Week in Security News: Hacker Strategies and Spyware Attacks

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about how hackers are improving their breach strategies. Also, learn about new spyware attacks via URLs, websites, and mobile apps. Re...

Cyber Security Week in Review (Feb. 1)

Welcome to this week's Cyber Security Week in Review, where Cisco Talos runs down all of the news we think you need to know in the security world. For more news delivered to your inbox every week, sign up for our Threat Source newsletter here. Top headlines this week Apple revoked a set of...

Facebook Boots Hundreds of Iran-Linked Accounts For Spreading Misinformation

Facebook has booted hundreds of Iran-linked pages, groups and accounts from its social media platform that it claimed were promoting misinformation. According to Facebook, it removed 783 pages, groups and accounts that engaged in “coordinated inauthentic behavior” that were misleading users about...

Apple pulls Facebook enterprise certificate

It’s been an astonishing few days for Facebook. They've seen both an app and their enterprise certificate removed and revoked with big consequences. What happened? Apple issue enterprise certificates to organizations with which they can create internal apps. Those apps don’t end up released on th...

Google Pulls Data-Chugging App From iOS Devices

Google has found itself in hot water for a research app that may have violated Apple’s policies by collecting user data in exchange for gift cards. The tech giant said it has now disabled Screenwise Meter“audience measurement” app – which voluntarily collects data from users’ phones, browsers and...

Why Facebook’s Banned ‘Research’ App Was So Invasive

Until Apple revoked its privileges Wednesday, Facebook was paying iOS users $20 a month to download and install the data-sucking application...

Facebook Hires Up Three of Its Biggest Privacy Critics

Can a trio of privacy advocates effect change from within Facebook—or will they be stifled by corporate bureaucracy?...

Facebook Paid Teens $20 to Install 'Research' App That Collects Private Data

If you are thinking that Facebook is sitting quietly after being forced to remove its Onavo VPN app from Apple's App Store, then you are mistaken. It turns out that Facebook is paying teenagers around $20 a month to use its VPN app that aggressively monitors their smartphone and web activity and...

Facebook Paid Teens $20 to Install 'Research' App That Collects Private Data

If you are thinking that Facebook is sitting quietly after being forced to remove its Onavo VPN app from Apple's App Store, then you are mistaken. It turns out that Facebook is paying teenagers around $20 a month to use its VPN app that aggressively monitors their smartphone and web activity and...

Rockstar Games: Stealing Facebook OAuth Code Through Screenshot viewer

In this report, the researcher demonstrated a way to combine multiple vulnerabilities to potentially allow an attacker to extract Oauth tokens from a victim's session. This was done by taking advantage of an image injection vulnerability in the Screenshot Viewer utility as well as additional...

RATELIMITED: Missing Protection Mechanism in Mail Servers allows malicious user to use staff.ratelimited.me email could lead to identity theft.

Hello ratelimited, I'm not really sure how your mail servers being configured but i guess there is a mis-configuration or missing protection mechanism that fails to verify if the email that is going to be sent are only made by authorized ratelimited staff only. From this point of view a malicious...

The Pitfalls of Facebook Merging Messenger, Instagram, and WhatsApp Chats

Facebook's effort to combine its major chat platforms could create minefields for users who rely on end-to-end encryption...

Facebook Wangle has an unspecified vulnerability

Facebook Wangle is a library for building protocols, application clients, and application servers from the American company Facebook. An unspecified vulnerability exists in Facebook Wangle. An attacker could exploit this vulnerability to cause a system used to accept TLS 1.3 protocol connections ...

Rockstar Games: Facebook OAuth Code Theft through referer leakage on support.rockstargames.com

In this report, the researcher was able to discover a method to expose and exfiltrate Oauth tokens. This was done by injecting an tag containing a payload pointing to the attacker's own domain into replies of Support Community forum threads. Once this was done, users operating under a particular...

Apple CEO Demands Federal Data Privacy Legislation

Apple CEO Tim Cook is adding his voice to the wave of tech giants, privacy watchdogs, and consumers calling for the government to roll out tightened consumer data privacy regulations. The Apple executive called on Congress to pass “comprehensive federal privacy legislation” that would effectively...

Facebook HHVM Buffer Overflow Vulnerability (CNVD-2019-02528)

Facebook HHVM aka HipHop Virtual Machine is a virtual machine from Facebook that significantly improves the performance of loading dynamic pages in PHP. A buffer overflow vulnerability exists in the 'numberformat' function in Facebook HHVM versions 3.30.1 and earlier and 3.27.5 and earlier, which...

Fortnite Hacked Via Insecure Single Sign-On

Epic Games patched a bug that could have allowed hackers to break into millions of Fortnite accounts and steal virtual currency or resell virtual goods. The vulnerability is tied to an insecure Fortnite application program interface API used by players to log into their accounts using third-party...

Facebook's '10 Year Challenge' Is Just a Harmless Meme—Right?

Opinion: The 2009 vs. 2019 profile picture trend may or may not have been a data collection ruse to train its facial recognition algorithm. But we can't afford to blithely play along...

Fork CMS Cross-Site Scripting Vulnerability (CNVD-2019-01096)

Fork CMS is an open source content management system CMS developed using PHP. The system contains blogs , questions and answers , forms and other modules . A cross-site scripting vulnerability exists in the private/en/settings page in Fork CMS version 5.0.6. A remote attacker can exploit this...