Facebook, GDPR and the Right to Privacy: Three’s a Crowd?

Back in 2016 the European Union voted to pass the mother of all security laws, aimed at further extending the rights of its citizens to control how their data is used. The General Data Protection Regulation GDPR guards users against having their information shared without their explicit consent,...

This Week in Security News: Hackers and Cyber Attackers

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, Chili’s parent company – Brinker International – announced that consumer credit and debit card information had been compromised at some...

NodAPS 4.0 Cross Site Request Forgery / SQL Injection

Exploit Title: Online Booking system - NodAPS 4.0 - 'search' SQL injection / Cross-Site Request Forgery Date: 2018-05-16 Exploit Author: Borna nematzadeh L0RD Vendor Homepage: https://codecanyon.net/item/appointment-management-system-nodaps/16197805?srank=1535 Version: 4.0 Tested on: windows...

Malicious Package

Overview Version 0.4.8 of s3asy contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 0.4.8 of this module is found installed you...

Indian Cricket Board Exposes Personal Data of Thousands of Players

By Waqas The IT security researchers at Kromtech Security Center discovered a trove This is a post from HackRead.com Read the original post: Indian Cricket Board Exposes Personal Data of Thousands of Players...

Sensitive myPersonality App Data of Millions of Facebook Users Exposed

By Carolina According to a startling new report, the University of Cambridge has This is a post from HackRead.com Read the original post: Sensitive myPersonality App Data of Millions of Facebook Users Exposed...

Chili’s Doesn’t Leave Data Breach on the Back Burner

Southwestern/Texas-themed restaurant chain Chili’s has become the latest victim of a data breach involving the heist of point-of-sale information from payment cards — and the alacrity with which it has admitted the incident is notable. Hackers had unauthorized access to payment-card data between...

Vega Stealer malware steals passwords & card data from Chrome & Firefox

By Waqas The IT security researchers at Proofpoint have discovered a new This is a post from HackRead.com Read the original post: Vega Stealer malware steals passwords & card data from Chrome & Firefox...

This Week in Security News: Exposure and Susceptibility

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, a new report revealed that the Equifax breach had a larger impact than previously thought. In addition, The Senate Intelligence Committee...

“Equi-Facts”: Equifax Clarifies the Numbers for Its Massive Breach

As companies continue to install the vulnerable version of Apache Struts behind the breach, Equifax has filed a clarification statement. The number of impacted U.S. consumers from the infamous 2017 Equifax data breach now totals about 147.9 million, and the breach has touched almost every adult i...

HackerOne: Timing attack towards endpoints on the web without CSRF

Summary: When logged in user on HackerOne visits another web page, remote web page could get conclusion regarding this data: - logged in user - number of triaged reports in the last month - number of new reports at the moment - number of closed reports ... This conclusions are only from one...

FBI Releases IC3 2017 Internet Crime Report

FBI has released the Internet Crime Complaint Center IC3 2017 Internet Crime Report, which highlights scams trending online. The top three crime types reported by victims in 2017 were non-payment/non-delivery, personal data breach, and phishing. Hot topics for 2017 include ransomware, business...

Man hacked 200 firms & sold data of millions of users on dark web

By Waqas Grant West, a cunning hacker who goes by the online This is a post from HackRead.com Read the original post: Man hacked 200 firms & sold data of millions of users on dark web...

This Week in Security News: Zippy’s and Flynn

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, Hawaii-based restaurant Zippy’s suffered a POS data breach. In addition, Uber executive John Flynn argued that user expectations on data...

Man Who Hacked Jail Systems to Release His Friend Early Gets 7-Years in Prison

Remember a young hacker who hacked jail systems in an attempt to release his prison inmate early? Well, that hacker will now be joining his inmate behind bars. Konrads Voits of Ypsilanti, Michigan, has been sentenced to seven years and three months in prison for attempting to hack the Washtenaw...

KRACK Vulnerability Puts Medical Devices At Risk

A slew of devices from medical technology company Becton, Dickinson and Company BD are vulnerable to the infamous KRACK key-reinstallation attack, potentially enabling hackers to change and exfiltrate patient records. The KRACK vulnerability, discovered last October, is an industry-wide glitch in...

Uber: Cleartext password exposure allows access to the desafio5estrelas.com admin panel

Vendor created and managed site desafio5estrelas.com exposes an administrator login password through the javascript source. This site was used by Uber in Portugal to encourage low-rated drivers to raise their ratings.This password allowed remote users access to the administrator panel of the site...

Uber Tightens Bug Bounty Extortion Policies

Uber is tightening policies around its bug-bounty program after a 2016 data breach exposed deep flaws in its policies around handling extortion. The ride-sharing company has updated its program to include clarity around the boundaries between research versus blackmail. The changes come after a 20...

Oracle Retail Returns Management Component Remote Vulnerability

Oracle Retail Applications is a set of retail applications store solutions from Oracle Corporation. Retail Returns Management is one of the components of the retail merchandise returns control system. A security vulnerability exists in the Security subcomponent of the Retail Returns Management...

Bezop Cryptocurrency Server Spills 25K in Private Investor, Promoter Data

A leaky Mongo database exposed personal information, including scanned passports and driver’s licenses, of 25,000 investors and potential investors tied to the Bezop cryptocurrency, according to researchers. Kromtech Security said that it found the unprotected data on March 30, adding that it...