IP2Location Country Blocker < 2.26.5 - Subscriber+ Arbitrary Country Ban

The plugin does not have authorisation and CSRF checks in the ip2locationcountryblockersaverules AJAX action, allowing any authenticated users, such as subscriber to call it and block arbitrary country, or block all of them at once, preventing users from accessing the frontend. v2.26.5 added...

IP2Location Country Blocker < 2.26.5 - Ban Bypass

The plugin bans can be bypassed by using a specific parameter in the URL PoC https://example.com/?admin-ajax=hehe...

Proposed UK Law Bans Default Passwords

Following Californias lead, a new UK law would ban default passwords in IoT devices...

Arrest in ‘Ransom Your Employer’ Email Scheme

In August, KrebsOnSecurity warned that scammers were contacting people and asking them to unleash ransomware inside their employers network, in exchange for a percentage of any ransom amount paid by the victim company. This week, authorities in Nigeria arrested a suspect in connection with the...

US Bans Trade With Pegasus Spyware Maker

NSO Group – the Israeli-based maker of the notorious, military-grade Pegasus spyware that’s been linked to cyberattacks against dissidents, activists and NGOs and murders of journalists at the hands of repressive regimes – has been blacklisted by the United States. NSO Group is one of four spywar...

The European Parliament Voted to Ban Remote Biometric Surveillance

Its not actually banned in the EU yet -- the legislative process is much more complicated than that -- but its a step: a total ban on biometric mass surveillance. To respect "privacy and human dignity," MEPs said that EU lawmakers should pass a permanent ban on the automated recognition of...

Cybersecurity Firm Group-IB's CEO Arrested Over Treason Charges in Russia

Russian authorities on Wednesday arrested and detained Ilya Sachkov, the founder of cybersecurity firm Group-IB, for two months in Moscow on charges of state treason following a search of its office on September 28. The Russian company, which is headquartered in Singapore, confirmed the developme...

A week in security (August 30 – September 5)

Last week on Malwarebytes Labs ProxyToken: another nail-biter from Microsoft Exchange Macs turn on apps signed by Symantec, treat them as malware Google Play sign-ins can be abused to track another person’s movements FTC bans SpyFone and its CEO from continuing to sell stalkerware BrakTooth...

BrakTooth Flaws Affect Billions of Bluetooth Devices

Plus: A spyware ban, a big WhatsApp fine, and more of the week's top security news...

Cross-Site Request Forgery (CSRF) in bigprof-software/online-invoicing-system

💥 BUG CSRF bug to ban a member 💥 IMPACT csrf bug allow to ban any user 💥 STEP TO REPRODUCE 1. First goto http://localhost/online-invoice/app/admin/pageViewMembers.php and lets assume there present a member with username test.\ Now any user send link...

Is crypto’s criminal rollercoaster approaching a terminal dip?

It’s a turbulent time in the cryptomining realm, especially for malware authors. Some big attacks and a lot of publicity has resulted in prolific groups promising to disband, even if potentially only temporarily. Running a tighter ship The mining banhammer continues to swing as China keeps puttin...

Europe Makes the Case to Ban Biometric Surveillance

Companies are racing to track everything about you. It could be a convenient way to reduce fraud—or seriously creepy and discriminatory...

Colonial Pipeline attack expected to trigger imminent hardening of cybersecurity rules for federal agencies

UPDATE 04:23 pm Pacific Time, May 12: On Wednesday, President Joe Biden signed an Executive Order that broadly directs the Commerce Department to create cybersecurity standards for companies that sell software to the federal government. The Order comes in the immediate aftermath of a ransomware...

A week in security (May 3 – 9)

Last week on Malwarebytes Labs, we discussed how Spectre attacks have come back from the dead; why Facebook banned Instragram ads by Signal; we highlighted the differences between the most popular VPN protocols; pointed out that Google is about to start automatically enrolling users in two-step...

Facebook blocks Signal from using ads to show Instagram data collection

By Habiba Rashid Signal attempted to use the Facebook ad program to show how much data is being collected by Instagram to push targeted ads and got banned. This is a post from HackRead.com Read the original post: Facebook blocks Signal from using ads to show Instagram data collection...

A week in security (April 19 – 25)

Last week on Malwarebytes Labs, we interviewed Youssef Sammouda, a 21-year-old bug bounty hunter who is focused on finding vulnerabilities on Facebook. We looked into the CodeCov supply-chain attack, the vulnerabilities in Pulse Secure VPN that are being actively exploited by attackers, and the...

Artificial Intelligence ban slammed for failing to address “vast abuse potential”

A written proposal to ban several uses of artificial intelligence AI and to place new oversight on other “high-risk” AI applications—published by the European Commission this week—met fierce opposition from several digital rights advocates in Europe. Portrayed as a missed opportunity by privacy...

HackerOne: Temporary banned user (from platform) is able to make submissions via embedded submission forms

Summary: Hello team! We have discovered issue which allows temporary banned user to submit new reports using embedded submission forms. The hacker can submit submissions via embedded forms using his/her email address. Once the ban is over the hacker can claim his/her report via invitation link...

SecuPress < 2.0 - Unauthenticated Arbitrary IP Ban

The SecuPress WordPress plugin, both free and pro, versions less than 2.0, were affected by a flaw that allowed unauthenticated users to ban any IP on a site that had the plugin installed, making it impossible for them to visit the site. Effectively causing a Denial of Service DoS to the banned I...

Genisys - Powerful Telegram Members Scraping And Adding Toolkit

Powerful Telegram Members Scraping and Adding Toolkit Features ADDS IN BULKby user id, not by username Scrapes and adds to public groups Works in Windows systems You can run unlimited accounts at the same time in order to add members CSV files auto-distributer based on number of accounts to use...