Mobile malware analysis for the BBC

This is a version of our report referenced in the Helping a mobile malware fraud victim blog post, with all sensitive information removed. Summary One malicious application was identified on the device, and evidence identified during the examination strong suggests though this cannot be confirmed...

Malicious code in bbc-iplayer-sounds-chatbot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2d586de5a3bb31f4049fd207aa2c3ffc23d175a74c56bc0a75c52fd116f5291a The OpenSSF Package Analysis project identified 'bbc-iplayer-sounds-chatbot' @ 5.2.3 npm as malicious. It is considered malicious because: - The...

Cl0p ransomware gang claims first victims of the MOVEit vulnerability

On Friday June 2, 2023 we reported about a MOVEit Transfer vulnerability that was actively being exploited. If your organization uses MOVEit Transfer and you havent patched yet, it really is time to move it. Excuse the bad pun, but yesterday we saw the first victims of this vulnerability come...

Malicious code in trint-bbc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f755e08a2f5b395630482a2784cdf65bd712c263238d4df7302e087c47be52e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-902 Malicious code in trint-bbc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f755e08a2f5b395630482a2784cdf65bd712c263238d4df7302e087c47be52e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Sponsored Twitter post uses fake BBC News site to boost slippery oil trading app

A sponsored post on Twitter promises to offer the benefits of obtaining citizenship, but really just wants to lure you into some form of Forex trading AI scheme. This tangled web also includes faked BBC web pages and suspicious-looking website reviews to round the whole thing off. Shall we take a...

PT-2022-30969

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.18.3 Description A refcount leak was discovered in the bbc beep probe function of the sparcspkr module. The issue was introduced in version v2.6.26 and is fixed in version v5.18.3. The actual impact and attack...

PT-2022-31838

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 2.6.26 through 5.10.120 Description A refcount leak was discovered in the bbc beep probe function of the sparcspkr module. The issue was introduced in version v2.6.26 and fixed in version v5.10.121. The actual impact and...

PT-2022-32265

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.283 Description The issue is related to a refcount leak in the bbc beep probe function. It was introduced in version v2.6.26 and fixed in version v4.14.283. The actual impact and attack plausibility have no...

PT-2022-31298

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.17.14 Description A refcount leak was discovered in the bbc beep probe function of the sparcspkr module. The issue was introduced in version v2.6.26 and is fixed in version v5.17.14. The actual impact and atta...

PT-2022-32331

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.318 Description A refcount leak was discovered in the bbc beep probe function of the sparcspkr module. The issue was introduced in version v2.6.26 and is fixed in version v4.9.318. The actual impact and atta...

PT-2022-31592

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 2.6.26 through 5.15.45 Description A refcount leak was discovered in the bbc beep probe function of the sparcspkr module. The issue was introduced in version v2.6.26 and fixed in version v5.15.46. The actual impact and...

PT-2022-32020

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.198 Description A refcount leak was discovered in the bbc beep probe function of the sparcspkr module. The issue was introduced in version v2.6.26 and is fixed in version v5.4.198. The actual impact and atta...

awards.bbcgoodfoodme.com Cross Site Scripting vulnerability OBB-2146508

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

China Aims Its Propaganda Firehose at the BBC

The alleged digital operation has deployed hundreds of websites and social media accounts to attack the broadcaster's reporting...

Smart Watches and Cheating on Tests

The Independent Commission on Examination Malpractice in the UK has recommended that all watches be banned from exam rooms, basically because it's becoming very difficult to tell regular watches from smart watches...

shop.bbc.com XSS vulnerability

Open Bug Bounty ID: OBB-684782 Description| Value ---|--- Affected Website:| shop.bbc.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidden unt...

bbc.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-684763 Description| Value ---|--- Affected Website:| bbc.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

bbcamerica.com Improper Access Control vulnerability

Open Bug Bounty ID: OBB-625397 Description| Value ---|--- Affected Website:| bbcamerica.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Wordpress Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| 6.5...

bbc-cromwell.org Improper Access Control vulnerability

Open Bug Bounty ID: OBB-616825 Description| Value ---|--- Affected Website:| bbc-cromwell.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| 6.5...