CVE-2018-13516

The mintToken function of a smart contract implementation for Super Cool Awesome Money SCAM, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value...

CVE-2018-13516

CVE-2018-13516 involves the mintToken function in the Super Cool Awesome Money (SCAM) Ethereum token, where an integer overflow enables the contract owner to set any user’s balance to an arbitrary value. Multiple connected documents (CNVD-2018-13191, CNVD-derived reports, PRION/CVE, NVD entry) de...

DimonCoin(FUD), ERC20 token, allows attackers to steal all victim’s balances (CVE-2018–11411)

Abstract I found a vulnerability of a smart contract for DimonCoinFUD, an Ethereum ERC20 token CVE-2018–114111. This vulnerability is exactly same with the UselessEthereumToken’s vulnerability2, 3. DimonCoin token also has the same vulnerable function which is transferFrom in UET token. Therefore...

Threat Outbreak Alert RuleID33112: Email Messages Distributing Malicious Software on July 4, 2018

Medium Alert ID: 58352 First Published: 2018 July 5 15:43 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID33112 may contain the following files: Name | Size...

A week in security (June 18 – June 24)

Last week, we took a deep dive into SamSam ransomware, looked at ways how to identify and delete malicious emails, recognized that there are now risks affecting job recruitment portals, analyzed a malicious Android app banking on the popularity of Fortnite, and identified causes and solutions for...

Fortnite Fraudsters Infest the Web with Fake Apps, Scams

Fortnite, the sandbox video game, has become so popular that its maker, Epic Games, is ponying up $100 to $300 million to supply prize money for eSports tournaments. What it hasn’t ponied up for – at least not yet – is an Android version. Which means the bad guys are having a field day. We report...

Malicious App Infects 60,000 Android Devices – But Still Saves Their Batteries

UPDATE A battery-saving app that also allows attackers to snatch text messages and read sensitive log data has been downloaded by more than 60,000 Android devices so far. But what’s unique about the attack, according to the researchers at RiskIQ who discovered it, is that it holds true to its...

Threat Outbreak Alert RuleID32822: Email Messages Distributing Malicious Software on June 21, 2018

Medium Alert ID: 58247 First Published: 2018 June 21 14:12 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32822 may contain the following files: Name | Siz...

New Phishing Scam Reels in Netflix Users to TLS-Certified Sites

Researchers are warning of a new Netflix phishing scam that leads victims to sites with valid Transport Layer Security TLS certificates. Johannes Ullrich, dean of research at the SANS Technology Institute, said Wednesday that there’s been an uptick in Netflix phishing mails using TLS-certified...

FBI’s BEC Crackdown Leads To 74 Arrests Globally

The FBI announced Monday the results of a major crackdown on scammers behind business email compromise BEC campaigns that resulted in 74 arrests and the retrieval of millions of dollars. Several U.S. federal authorities and police from other countries were involved in Operation WireWire, a...

This Week in Security News: HR and Heritage Hacks

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, the details of 92 million accounts for MyHertitage were discovered on a private server outside of the company. Also, companies using service...

Instagram story spam claims free Apple Watch

I have to admit, I'm not 100 percent sure who Elton Castee is. "Who's that?" you ask? Digging around revealed that he's big on YouTube, has done some films, and raises money for dogs, which is very cool. He's also popular on Instagram, with 400k+ followers. With that in mind, we've seen a few...

New transferFlaw Bug Used For Possible Scam Token Listed In A Top Exchange(CVE-2018-10468)

Our automated scanning system at PeckShield discovered a new vulnerability named transferFlaw CVE-2018–10468. This particular vulnerability affects a publicly traded ERC20 token listed in a top exchange. Different from batchOverflow 1 and proxyOverflow 2 we identified before, this vulnerability...

2018 Fraud World Cup

There are only two weeks to go before the start of the massive soccer event — FIFA World Cup. This championship has already attracted the attention of millions worldwide, including a fair few cybercriminals. Long before kick-off, email accounts began bulging with soccer-related spam, and scammers...

Threat Outbreak Alert RuleID32836: Email Messages Distributing Malicious Software on May 25, 2018

Medium Alert ID: 57971 First Published: 2018 May 25 19:32 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32836 may contain the following files: Name | Size...

Happy anniversary to Dreamcast…and its scams

This month marks 20 years since the legendary SEGA Dreamcast console was first announced. Looked on fondly by gamers, it revolutionised many aspects of gaming and brought cheapish online console gaming to the masses. Click to enlarge SEGA has endured many, many calls for it to come back as...

IRS Warns Tax Professionals of Phishing Scam

The Internal Revenue Service IRS has issued a news release warning tax professionals to beware of a new phishing email scam. Cyber criminals posing as state accounting and professional associations have been sending emails to entice their targets to reveal login credentials. Tax practitioners...

A week in security (May 14 – May 20)

Last week, we looked at the deluge of incoming policies caused by GDPR, tackled Adobe Reader zero days, and ran through some iPhone security tips. We also caught some helpline scammers in the act, explored advergaming, got our Senate Bill game face on, and deep dived into Drupal vulnerabilities...

T-Mobile Employee Made Unauthorized ‘SIM Swap’ to Steal Instagram Account

T-Mobile is investigating a retail store employee who allegedly made unauthorized changes to a subscriber's account in an elaborate scheme to steal the customer's three-letter Instagram username. The modifications, which could have let the rogue employee empty bank accounts associated with the...

Fake Fortnite Apps for Android Spread Spyware, Cryptominers

An array of malicious Android apps purporting to be the popular game known as Fortnite are accessing cameras, harvesting and wiping device data, and recording audio on victims’ phones. Researchers at Zscaler’s ThreatLabZ said that bad actors are taking advantage of Fortnite owner Epic Games’s...