North Korea Targets Security Researchers in Elaborate 0-Day Campaign

Hackers linked to North Korea are targeting security researchers with an elaborate social-engineering campaign that sets up trusted relationships with them — and then infects their organizations’ systems with custom backdoor malware. That’s according to Google’s Threat Analysis Group TAG, which...

A week in security (January 11 – January 17)

Last week on Malwarebytes Labs, we looked at IoT problems, Microsoft’s Patch Tuesday, and how cybercriminals want access to your cloud services. We also explored how VPNs can protect your privacy, and asked if MSPs have picked the right PSA. Other cybersecurity news Hot phishing targets: Some...

chewb-server (>=0.0.1, <=0.0.20), video-dash-uploader (>=0.0.1, <=0.0.4) +1 more potentially affected by CVE-2020-28436 via google-cloudstorage-commands (0.0.1)

google-cloudstorage-commands NPM version 0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on google-cloudstorage-commands and may be impacted: - chewb-server =0.0.1, =0.0.1, =0.0.1, =0.0.2 Source cves: CVE-2020-28436 Source advisory:...

Google, YouTube, Gmail service suffered major outage worldwide

By Deeba Ahmed Google states that the problem is fixed now, and all services are back online for most users. Let us know if these services are back in your area. This is a post from HackRead.com Read the original post: Google, YouTube, Gmail service suffered major outage worldwide...

The Christchurch Shooter and YouTube’s Radicalization Trap

The platform has gotten better about stamping out extremist content. But researchers say its policies and algorithms are still too opaque...

Hackers hiding skimming malware behind social media sharing icons

By Sudais Asif According to researchers, the malware hides behind icons from top networks such as Facebook, Instagram, Twitter, Google, YouTube, and Pinterest. This is a post from HackRead.com Read the original post: Hackers hiding skimming malware behind social media sharing icons...

Stripo Inc: Non-revoked API Key Disclosure in a Disclosed API Key Disclosure Report on Stripo

Summary: Can you imagine discovering an API key disclosure vulnerability in a disclosed API key disclosure report? The same thing is what I came across while going through the disclosed reports at Stripo Inc. Plus, the disclosed API key isn't even revoked, and therefore I am still able to use the...

Logitech: One Click Account takeover using Ouath CSRF bypass by adding Null byte %00 in state parameter on www.streamlabs.com

Summary Hello Team I have found a bypass to the this report. 1039749 Steps To Reproduce: 1. Login to attacker's account and go to settings -- account settings. 2. Intercept the request in burp suite and click on merge twitch account. 3. Allow twitch access and once you see a get request in burp...

Data scraping firm leaks 235m Instagram, TikTok, YouTube user records

By Sudais Asif According to researchers, the trove of data was left for public access without any security authentication. This is a post from HackRead.com Read the original post: Data scraping firm leaks 235m Instagram, TikTok, YouTube user records...

YouTube deletes 2 million channels and 51 million videos over scams

By Sudais Asif Previously YouTube was accused of not taking any action again growing malware and cryptocurrency-related scams. This is a post from HackRead.com Read the original post: YouTube deletes 2 million channels and 51 million videos over scams...

Apple co-founder Steve Wozniak sues YouTube over Bitcoin scams on his name

By Zara Khan Steve Wozniak has sued Google and YouTube over Bitcoin giveaway scams. This is a post from HackRead.com Read the original post: Apple co-founder Steve Wozniak sues YouTube over Bitcoin scams on his name...

EFF's 30th Anniversary Livestream

It's the EFF's 30th birthday, and the organization is having a celebratory livestream today from 3:00 to 10:00 pm PDT. There are a lot of interesting discussions and things. I am having a fireside chat at 4:10 pm PDT to talk about the Crypto Wars and more. Stop by. And thank you for supporting EF...

Yout Player suffers from a command execution vulnerability (CNVD-2020-47980)

Yout Player is the new way to watch YouTube playlists on your desktop. No YouTube ads, easy to use, no floating windows. Yout Player suffers from a command execution vulnerability that can be exploited by an attacker to gain server privileges...

Yout Player suffers from a command execution vulnerability (CNVD-2020-47979)

Yout Player is the new way to watch YouTube playlists on your desktop. No YouTube ads, easy to use, no floating windows. Yout Player suffers from a command execution vulnerability that can be exploited by an attacker to gain server privileges...

iPhone Apps Stealing Clipboard Data

iOS apps are repeatedly reading clipboard data, which can include all sorts of sensitive information. While Haj Bakry and Mysk published their research in March, the invasive apps made headlines again this week with the developer beta release of iOS 14. A novel feature Apple added provides a bann...

YouTube scammers impersonated Elon Musk, SpaceX; stole $150k in BTC

By Deeba Ahmed Scammers successfully tricked viewers in to sending a small amount of Bitcoin and get double in return. This is a post from HackRead.com Read the original post: YouTube scammers impersonated Elon Musk, SpaceX; stole $150k in BTC...

Significant increase in demand of stolen YouTube credentials on dark web

By Waqas Here's why there has been an increase in the sale of stolen YouTube credentials on the dark web. This is a post from HackRead.com Read the original post: Significant increase in demand of stolen YouTube credentials on dark web...

macOS/x64 zsh RickRolling Shellcode (198 bytes)

/ Shellcode Title: macOS/x64 - zsh RickRolling Shellcode 198 Bytes Shellcode Author: Bobby Cooke Tested on: macOS Catalina v10.15.4 Shellcode Description: MacOS Catalina Dynamic, No-Null Shellcode that will Unmute the systems Volume, set the Volume to Maximum, and "Rick Roll" the user every time...

‘Hack-For-Hire’ Firms Spoof WHO To Target Google Credentials

“Hack-for-hire” organizations are the latest group of cybercriminals to take advantage of the ongoing coronavirus pandemic, using COVID-19 as a lure in phishing emails bent on stealing victims’ Google credentials. Researchers with Google’s Threat Analysis Group TAG warned that they’ve spotted a...

youtube.fandom.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1176002 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...