This Week in Security News: Tracking and Hacking

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, Google revealed a secret deal with Mastercard that allows it to track what users buy offline. Also, Senate and House representatives warn th...

Automotive theft affects shipping security

Cars and ships – there’s not that much in common with two areas that we carry out a lot of research in to. One uses CAN for safety critical controls, the other uses serial and +/- 10V. Yet, security of the two sectors is linked through vehicle theft and fraud: Most modern vehicles have telematic...

CVE-2018-16087

Lack of proper state tracking in Permissions in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page...

Google and MasterCard will track your retail spending under a secret deal

By Waqas Google and MasterCard have jointly cut an ad deal to track your retail transactions. So far, we only knew that Google can track out online shopping preferences as we clicked on ads. However, this is quite surprising that it can now keep track of our retail transactions history from...

Google Secretly Tracks What You Buy Offline Using Mastercard Data

Over a week after Google admitted the company tracks users' location even after they disable location history, it has now been revealed that the tech giant has signed a secret deal with Mastercard that allows it to track what users buy offline. Google has paid Mastercard millions of dollars in...

Google Secretly Tracks What You Buy Offline Using Mastercard Data

Over a week after Google admitted the company tracks users' location even after they disable location history, it has now been revealed that the tech giant has signed a secret deal with Mastercard that allows it to track what users buy offline. Google has paid Mastercard millions of dollars in...

Cryptomining scripts will be blocked in upcoming versions of Firefox browser

By Waqas In all the future versions of the Firefox web browser, cryptojacking malware will be blocked. Mozilla, the company behind Firefox browser, announced on August 30 that it is launching an anti-tracking initiative, which will be implemented broadly over the next few months. Firefox has cite...

Bucking the Norm, Mozilla to Block Tracking Cookies in Firefox

Web tracking has long been in the cross-hairs of privacy advocates, who say that marketers know entirely too much about individuals’ online activities. And to add insult to injury, the ubiquitous cookie system used to enable tracking also presents potential security threats, including cross-site...

Android OS API-Breaking Flaw Offers Useful WiFi Data to Bad Actors

An “API-breaking” vulnerability has been uncovered that potentially exposes Android device systems data to rogue apps — information that could be very useful to bad actors. Researchers from Nightwatch Cybersecurity System said that certain all-points-bulletins sent out by the Android OS expose...

On Becoming a Contributor to the HTTP Archive

The HTTP Archive is an open source project that tracks how the web is built. Twice a month it crawls 1.3 million web pages on desktop and emulated mobile devices, and collects technical information about each of the web pages. That information is then aggregated and made available in curated...

Can search extensions keep your searches private?

One of the most common things most of us do on the Internet is search, whether we are looking up the price of the latest gadget or we need to find the address of that great restaurant recommended by a friend. The dizzying number of Google search queries per second more than 40,000, on average tel...

Apple Forces Facebook VPN App Out of iOS Store for Stealing Users' Data

Facebook yesterday removed its mobile VPN app called Onavo Protect from the iOS App Store after Apple declared the app violated the iPhone maker's App Store guidelines on data collection. For those who are unaware, Onavo Protect is a Facebook-owned Virtual Private Network VPN app that was primari...

Triout Malware Carries Out Extensive, Targeted Android Surveillance

A mobile spyware for Android was disclosed today, with extensive, advanced surveillance capabilities that suggest that a sophisticated actor is pulling the strings. Using a recently discovered malware dubbed Triout, bad actors are tapping into the proliferating footprint of Android-based...

Google Faces Legal Turmoil After Location Tracking Debacle

Google is under fire from both legal teams and activists after reports emerged that the technology giant tracked customers’ movements, even when they opt out. The company has been slapped by a lawsuit, filed in the federal court last week out of California, alleging that Google is violating both...

Google Sued Over Misleading Users About Location Tracking Feature

Google was in the news last week for a misleading claim that "with Location History off, the places you go are no longer stored," which is not true. Now, the search engine giant is once again in the news after a San Diego man has filed the first lawsuit against Google over this issue. Last week,...

Google Sued Over Misleading Users About Location Tracking Feature

Google was in the news last week for a misleading claim that "with Location History off, the places you go are no longer stored," which is not true. Now, the search engine giant is once again in the news after a San Diego man has filed the first lawsuit against Google over this issue. Last week,...

CVE-2018-1000637

zutils version prior to version 1.8-pre2 contains a Buffer Overflow vulnerability in zcat that can result in Potential denial of service or arbitrary code execution. This attack appear to be exploitable via the victim openning a crafted compressed file. This vulnerability appears to have been fix...

MariaDB: SSRF on jira.mariadb.org

Vulnerabilities in our publicly available issue and bug tracking Jira instance have been reported and resolved to the best of our abilities by upgrading to the latest available Jira software from Atlassian. Yes...

Microsoft Windows: Audit Process Creation

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winprocesscreation.nasl 11068 2018-08-21 11:51:41Z emoss $ Check value for Audit Process Creation Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This program is free...

Microsoft Windows: Audit PNP Activity

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winpnpactivity.nasl 11068 2018-08-21 11:51:41Z emoss $ Check value for Audit PNP Activity Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you...