A week in security (January 10 – 16)

Last week on Malwarebytes Labs: Ransomware cyberattack forces New Mexico jail to lock down Some Android users can disable 2G now and why that is a good thing Phishers on the prowl with fake parking meter QR codes Update now: Microsoft patches 97 bugs including 6 zero-days and a wormable one...

Design/Logic Flaw

Hacker one bug ID: 1343975Product: AndroidVersions: Android SoCAndroid ID: A-204256722...

Apache Kylin permission permission and access control issues vulnerability

Apache Kylin is an open source distributed analytic data warehouse from the Apache Foundation. The product mainly provides SQL query interface and multidimensional analysis OLAP on top of Hadoop/Spark. Apache Kylin is vulnerable to permission and access control issues, which stem from the fact th...

The vulnerability of Google Chrome’s web storage mechanism, which allows a hacker to circumvent existing security restrictions

The vulnerability of Google Chrome browser-based web storage is caused by synchronization errors when using a common resource. Exploiting this vulnerability can allow an attacker to bypass existing security restrictions remotely...

ASB-A-204256722

Hacker one bug ID: 1343975...

Log4Shell Makes Its Appearance in Hacker Chatter: 4 Observations

It's been a long few days as organizations' security teams have worked to map, quantify, and mitigate the immense risk presented by the Log4Shell vulnerability within Log4j. As can be imagined, cybercriminals are working overtime as well, as they seek out ways to exploit this vulnerability. Need...

Smart Contract Bug Results in $31 Million Loss

A hacker stole $31 million from the blockchain company MonoX Finance , by exploiting a bug in software the service uses to draft smart contracts. Specifically, the hack used the same token as both the tokenIn and tokenOut, which are methods for exchanging the value of one token for another. MonoX...

The Matrix Is the Best Hacker Movie

Most people point to Sneakers or WarGames. They’re all wrong. The Wachowskis actually invented the ultimate cyber superhero...

Facebook Bans Pakistani and Syrian Hacker Groups for Abusing its Platform

Meta, the company formerly known as Facebook, announced Tuesday that it took action against four separate malicious cyber groups from Pakistan and Syria who were found targeting people in Afghanistan, as well as journalists, humanitarian organizations, and anti-regime military forces in the West...

Hacker accessed FBI server to send fake email threats

By Waqas The FBI has categorically denied sending spam emails from its server, which according to reports, hit 100,000 inboxes. This is a post from HackRead.com Read the original post: Hacker accessed FBI server to send fake email threats...

U.S. Charges Ukrainian Hacker for Kaseya Attack; Seizes $6 Million from REvil Gang

The U.S. government on Monday charged a Ukrainian suspect, arrested in Poland last month, with deploying REvil ransomware to target multiple businesses and government entities in the country, including perpetrating the attack against software company Kaseya, marking the latest action to crack dow...

The Biggest Ransomware Bust Yet Might Actually Make an Impact

By arresting one alleged hacker associated with REVil and seizing millions from another, the US has made it clear that ransomware comes with a cost...

Hacker stole $55M worth of crypto from DeFi lender bZx via phishing

By Waqas The hack took place after one of the bZx's employees was sent a phishing email embedded with a malicious macro hidden in an MS word document, This is a post from HackRead.com Read the original post: Hacker stole $55M worth of crypto from DeFi lender bZx via phishing...

HackerOne: HackerOne Staging uses Production data for testing

Summary: Today I received an email related to smart rewards from HackerOne. This included staging environment details, such as: sender: [email protected] Privacy / Terms links pointing to domain: https://www.enorekcah.com/... This basically tells us that HackerOne is using hacker dat...

Twitter hacker charged in sim swapping, cryptocurrency scheme

By Waqas The 22-year-old British national Joseph James O’Connor, aka PlugwalkJoe, was one of the hackers behind 2020's massive Twitter hack. This is a post from HackRead.com Read the original post: Twitter hacker charged in sim swapping, cryptocurrency scheme...

This Week in Security News - November 5th, 2021

This week, learn about what the future of cybercrime could potentially look like by the start of the next decade, according to Trend Micro’s Project 2030. Also, read on how a hacker stole $784k in crypto through SIM swaps...

Google details cookie stealer malware campaign targeting YouTubers

By Waqas Google attributed the malware campaign to a group of attackers recruited via a Russian-language hacker forum. This is a post from HackRead.com Read the original post: Google details cookie stealer malware campaign targeting YouTubers...

'Lone Wolf' Hacker Group Targeting Afghanistan and India with Commodity RATs

A new malware campaign targeting Afghanistan and India is exploiting a now-patched, 20-year-old flaw affecting Microsoft Office to deploy an array of commodity remote access trojans RATs that allow the adversary to gain complete control over the compromised endpoints. Cisco Talos attributed the...

Hacker steals govt database with info of entire Argentine population

By Deeba Ahmed Reportedly, the database also contains personal information of Argentinian President Alberto Fernández, football superstars Sergio Aguero and Lionel Messi. This is a post from HackRead.com Read the original post: Hacker steals govt database with info of entire Argentine population...

A week in security (Oct 11 – Oct 17)

Last week on Malwarebytes Labs Google warns some users that FancyBear’s been prowling around Inside Apple: How macOS attacks are evolving The joy of phishing your employees ExpressVPN made a choice, and so did I: Lock and Code S02E19 Update now! Apple patches another privilege escalation bug in i...