Amitabh Bachchan’s Twitter hacked with photo of Pakistani PM Imran Khan

By Uzair Amir Turkish hackers left a message protesting against Ireland on a Twitter account owned by India actor. The official Twitter account of Bollywood's legend Amitabh Bachchan has apparently been hacked by Turkish hacking group calling itself "Ayyildiz Tim." The verified Twitter account wi...

A week in security (June 3 – 9)

Last week on Malwarebytes Labs, we rounded up some leaks and breaches, reported about Magecart skimmers found on Amazon CloudFront CDN, proudly announced we were awarded as Best Cybersecurity Vendor Blog at the annual EU Security Blogger Awards, discussed how Maine inches closer to shutting down...

Malicious Package

grunt-radic contains malicious code. The code when executed in the browser would capture password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl=...

CIS Releases 2018 Year in Review

The Center for Internet Security CIS has released its 2018 Year in Review. CIS is home to the Multi-State Information Sharing & Analysis Center MS-ISAC, a Cybersecurity and Infrastructure Security Agency CISA partner focused on cyber threat prevention, protection, response, and recovery for U.S...

CVE-2019-12763

CVE-2019-12763 affects the Security Camera CZ Android app up to version 1.6.8. The vulnerability is due to recorded video being stored in external storage, which is readable by any other app, enabling potential information disclosure. The connected sources (NVD/Red Hat/CVE records) confirm the st...

CVE-2018-9839

An issue was discovered in MantisBT through 1.3.14, and 2.0.0. Using a crafted request on bugreportpage.php modifying the 'mid' parameter, any user with REPORTER access or above is able to view any private issue's details summary, description, steps to reproduce, additional information when cloni...

Hyperlink auditing: where has my option to disable it gone?

There is a relatively old method that might be gaining traction to follow users around on the world wide web. Most Internet users are aware of the fact that they are being tracked in several ways. And awareness is a good start. In a state of awareness, you can adjust your behavior accordingly, an...

VMware Releases Security Updates for Tools and Workstation

VMware has released security updates to address vulnerabilities affecting Tools 10 and Workstation 15. An attacker could exploit one of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to...

GHSA-83RX-C8CR-6J8Q Insecure Default Configuration in tesseract.js

Versions of tesseract.js prior to 1.0.19 default to using a third-party proxy. Requests may be proxied through crossorigin.me which clearly states is not suitable for production use. This may lead to instability and privacy violations. Recommendation Upgrade to version 1.0.19 or later...

Mozilla and Google Browsers Get Security, Anti-Tracking Boosts

Browsers Firefox and Chrome received updates this week, both adding security and privacy tools that help with password management and help block sites that track users. Mozilla’s Firefox browser introduced an “Enhanced Tracking Protection” feature that blocks over 1,000 third-party companies that...

Apple's 'Find My' Feature Uses Some Very Clever Cryptography

Apple says an elaborate rotating key scheme will soon let you track down your stolen laptop, but not let anyone track you. Not even Apple...

Maine inches closer to shutting down ISP pay-for-privacy schemes

Maine residents are one step closer to being protected from the unapproved use, sharing, and sale of their data by Internet service providers ISPs. A new state bill, already approved by the state House of Representatives and Senate, awaits the governor’s signature. If signed, the bill would provi...

Cisco Releases Security Updates for Multiple Products

Cisco has released security updates to address vulnerabilities in multiple Cisco products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to review t...

Apple and New York Are Changing the Privacy Game, and More News

Catch up on the most important news from today in two minutes or less...

Is 'Sign in with Apple' Marketing Spin or Privacy Magic? Experts Weigh In

Apple’s “Sign in with Apple” feature promises to protect user privacy – and while many are looking at that claim as more of a marketing move than anything else, authentication experts say it has the potential to have an enormous impact on the data privacy ecosystem. The giant from Cupertino took...

Firefox Web Browser Now Blocks Third-Party Tracking Cookies By Default

As promised, Mozilla has finally enabled "Enhanced Tracking Protection" feature on its Firefox browser by default, which from now onwards would automatically block all third-party tracking cookies that allow advertisers and websites to track you across the web. Tracking cookies, also known as...

Firefox Web Browser Now Blocks Third-Party Tracking Cookies By Default

As promised, Mozilla has finally enabled "Enhanced Tracking Protection" feature on its Firefox browser by default, which from now onwards would automatically block all third-party tracking cookies that allow advertisers and websites to track you across the web. Tracking cookies, also known as...

Google Releases Security Update for Chrome

Google has released Chrome version 75.0.3770.80 for Windows, Mac, and Linux. This version addresses multiple vulnerabilities that an attacker could exploit to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to revie...

NSA Releases Advisory on BlueKeep Vulnerability

The National Security Agency NSA has released a cybersecurity advisory for CVE-2019-0708—a vulnerability dubbed BlueKeep. Although Microsoft has issued a patch, potentially millions of machines are still unpatched and remain vulnerable. The Cybersecurity and Infrastructure Security Agency CISA...

Apple Launches Privacy-Focused 'Sign in with Apple ID' Feature at WWDC 2019

Just like 'login with Google,' 'login with Facebook,' Twitter, LinkedIn or any other social media site, you would now be able to quickly sign-up and log into third-party websites and apps using your Apple ID. What's the difference? Well, Apple claims that signing-in with Apple ID would protect...