The vulnerability of Microsoft Excel’s spreadsheet editor, related to errors in memory object handling, allows a hacker to execute arbitrary code.

The vulnerability of Microsoft Excel editors is related to errors in memory object handling. Exploiting this vulnerability can allow an attacker to execute arbitrary code using a specially crafted document...

'Among Us' Mobile Game Under Siege by Attackers

The meteoric rise of the game Among Us appears to be outpacing its developer’s ability to keep up with malicious actors. On Sunday night, a specific ongoing attack forced InnerSloth, the company behind the game, to hastily roll out an update designed to kick bad actors off the game’s servers —...

Hacker steal $24M, returnes $2.5M to DeFi protocol Harvest Finance

By Deeba Ahmed Harvest Finance is now offering $100,000 as a bug bounty program to identify the hacker. This is a post from HackRead.com Read the original post: Hacker steal $24M, returnes $2.5M to DeFi protocol Harvest Finance...

The Unsinkable Maddie Stone, Google’s Bug-Hunting Badass

The Project Zero reverse engineer shuts down some of the world's most dangerous exploits—along with antiquated hacker stereotypes...

Microsoft Teams Phishing Attack Targets Office 365 Users

Researchers are warning of a phishing campaign that pretends to be an automated message from Microsoft Teams. In reality, the attack aims to steal Office 365 recipients’ login credentials. Teams is Microsoft’s popular collaboration tool, which has particularly risen in popularity among remote...

Windows GravityRAT Malware Now Also Targets macOS and Android Devices

A Windows-based remote access Trojan believed to be designed by Pakistani hacker groups to infiltrate computers and steal users' data has resurfaced after a two-year span with retooled capabilities to target Android and macOS devices. According to cybersecurity firm Kaspersky, the malware — dubbe...

Never Leave Your Cloud Database Publicly Accessible

Introduction In cybersecurity, we often hear about best practices, one of the most important of which is never to open services that should be for internal use to public access. These are best practices for a good reason - when you don’t follow them, you might be hacked! Research we conducted in...

Uber: RCE via npm misconfig -- installing internal libraries from the public registry

The hacker spotted some orphaned references to Uber-branded Node.js library packages and claimed them on the public NPM registry to run their own proof-of-concept code. Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies...

Facebook Debuts Bug Bounty ‘Loyalty Program’

Facebook has lifted the curtain on what it claims is an industry first: A loyalty program as part of its bug-bounty offering, which aims to further incentivize researchers to find vulnerabilities in its platform. The loyalty program, called “Hacker Plus,” offers bonuses on top of bounty awards,...

A China-Linked Group Repurposed Hacking Team’s Stealthy Spyware

The tool attacks a device’s UEFI firmware—which makes it especially hard to detect and destroy...

Russian Who Hacked LinkedIn, Dropbox Sentenced to 7 Years in Prison

A Russian hacker who was found guilty of hacking LinkedIn, Dropbox, and Formspring over eight years ago has finally been sentenced to 88 months in United States prison, that's more than seven years by a federal court in San Francisco this week. Yevgeniy Aleksandrovich Nikulin, 32, of Moscow hacke...

Russian Who Hacked LinkedIn, Dropbox Sentenced to 7 Years in Prison

A Russian hacker who was found guilty of hacking LinkedIn, Dropbox, and Formspring over eight years ago has finally been sentenced to 88 months in United States prison, that's more than seven years by a federal court in San Francisco this week. Yevgeniy Aleksandrovich Nikulin , 32, of Moscow hack...

White hat hacker infects smart coffee machine with ransowmare

By Waqas Avast security researcher reverse-engineered an IoT coffee machine to upload ransomware and mine Monero coin. Smart appliances have always remained a risky option for consumers, specifically when it comes to coffee machines. Back in 2015, Pen Test Partners researchers discovered security...

Ukraine National Police website down after hacker intrusion

By Waqas The cyberattack on the Ukraine National Police website carried out around 11:45 Wednesday, 23 September 2020 EEST. This is a post from HackRead.com Read the original post: Ukraine National Police website down after hacker intrusion...

British Hacker Sentenced to 5 Years for Blackmailing U.S. Companies

A UK man who threatened to publicly release stolen confidential information unless the victims agreed to fulfill his digital extortion demands has finally pleaded guilty on Monday at U.S. federal district court in St. Louis, Missouri. Nathan Francis Wyatt , 39, who is a key member of the infamous...

Whitehat hacker bypasses SQL injection filter for Cloudflare

By Sudais Asif This was then subsequently reported to Cloudflare who fixed it in a few days. This is a post from HackRead.com Read the original post: Whitehat hacker bypasses SQL injection filter for Cloudflare...

Exploit for CVE-2020-1472

CVE-2020-1472 POC The vulnerability can be exploited in a Wi...

Cloud Leak Exposes 320M Dating-Site Records

Users of 70 different adult dating and e-commerce websites have had their personal information exposed, thanks to a misconfigured, publicly accessible Elasticsearch cloud server. In all, 320 million individual records were leaked online, researchers said. All of the impacted websites have one thi...

HackerOne: Hacker can bypass minimum bounty amount restrictions in "invitation preferences" setting via UpdateInvitationPreferencesMutation GraphQL operation

Summary: Hacker can bypass minimum bounty amount restrictions in invitation preferences due to trusted client-side input to UpdateInvitationPreferencesMutation GraphQL operation Description: The new "Bounty Preferences" feature at https://hackerone.com/settings/preferences allows the hacker to se...

Pioneer Kitten APT Sells Corporate Network Access

An APT group known as Pioneer Kitten, linked to Iran, has been spotted selling corporate-network credentials on hacker forums. The credentials would let other cybercriminal groups and APTs perform cyberespionage and other nefarious cyber-activity. Pioneer Kitten is a hacker group that specializes...