Popular Techniques Used by Cybercriminals Amid COVID-19

Editor's Note: Gary Stevens, a technology writer, is posting as a guest author to carbonblack.com. Cybercriminals constantly leverage fear and confusion by launching cyberattacks during major world events. Such attacks are mostly carried out with social engineering campaigns using malicious email...

CVE-2018-18499

A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv="refresh" on a page to cause a redirection to another site using performance.getEntries. This is a same-origin policy violation and could allow for data theft. This vulnerability affects...

Unspecified Vulnerability in J2 Global ThreatTrack VIPRE Password Vault app

J2 Global ThreatTrack VIPRE Password Vault app is a password manager from J2 Global USA. A security vulnerability exists in J2 Global ThreatTrack VIPRE Password Vault app 1.100.1090 and earlier versions iOS, which stems from the program's lack of SSL certificate validation. The vulnerability is...

Web skimming with Google Analytics

Web skimming is a common class of attacks generally aimed at online shoppers. The principle is quite simple: malicious code is injected into the compromised site, which collects and sends user-entered data to a cybercriminal resource. If the attack is successful, the cybercriminals gain access to...

Beijing Tianying Jiuzhou Network Technology Co., Ltd. flipping novels APP there are logic flaws vulnerability

Flip Novel App is a reading app that allows you to read original novels. Beijing Tianying Jiuzhou Network Technology Co., Ltd Flip Novel APP has a logic flaw vulnerability. Attackers can use the vulnerability to arbitrarily bind other people's cell phone numbers that are not bound to the APP and...

Google Yanks 106 ‘Malicious’ Chrome Extensions

Google removed 106 Chrome browser extensions Thursday from its Chrome Web Store in response to a report that they were being used to siphon sensitive user data. In the research, also published Thursday, Awake Security alleged millions of Chrome users have been targeted by threat actors. The...

Claire's Customers Targeted with Magecart Payment-Card Skimmer

A Magecart credit-card skimmer was used to attack online customers of the retailer Claire’s for a month and a half, according to researchers. Claire’s – a purveyor of jewelry and accessories – closed its 3,000 physical retail locations worldwide on March 20, in the wake of the COVID-19 pandemic. ...

Imperva Takes on its Largest Recorded Account Takeover Attack on a Single Company

Imperva recently detected and mitigated the largest - and most concentrated - series of brute force ATO account takeover attacks in its history. Over the course of 60 hours from midnight on October 28, our ATO team’s monitoring systems detected more than 44 million ATO attempts on the login page ...

Florence, Ala. Hit By Ransomware 12 Days After Being Alerted by KrebsOnSecurity

In late May, KrebsOnSecurity alerted numerous officials in Florence, Ala. that their information technology systems had been infiltrated by hackers who specialize in deploying ransomware. Nevertheless, on Friday, June 5, the intruders sprang their attack, deploying ransomware and demanding nearly...

Scammers using voicemail email phishing scam to steal data

By Waqas Scammers are taking advantage of COVID-19 pandemic to spread a voicemail email phishing scam. This is a post from HackRead.com Read the original post: Scammers using voicemail email phishing scam to steal data...

JAVA Deserialization Remote Command Execution Vulnerability in UFIDA NC

UFIDA NC products are world-class high-end management software for group enterprises, with a market share that has reached the first in Asia Pacific among similar products, and have been applied in 8,000 group enterprises, with domestic users covering most critical infrastructure operating units....

CVE-2020-6472

Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.61 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory or disk via a crafted Chrome Extension...

Ransomware Gang Arrested for Spreading Locky to Hospitals

A cybercriminal gang have been arrested for spreading the Locky ransomware among hospitals, among other crimes. In an operation spearheaded by Romania’s law enforcement department, four people have been taken into custody after their houses were raided – three in Romania and one in neighboring...

CVE-2019-20802

An issue was discovered in the Readdle Documents app before 6.9.7 for iOS. The application's file-transfer web server improperly displays directory names, leading to Stored XSS, which may be used to steal a user's data. This requires user interaction because there is no known direct way for an...

Interchange Cross-Site Scripting Vulnerability

Interchange is an e-commerce system. The system supports online ordering, real-time payment processing, product categorization and customer relationship management. A cross-site scripting vulnerability exists in the admin/help.html and admin/quicklinks.html pages of the admin help system in...

Design/Logic Flaw

XSS in the admin help system admin/help.html and admin/quicklinks.html in Interchange 4.7.0 through 5.11.x allows remote attackers to steal credentials or data via browser JavaScript...

Sodinokibi drops greatest hits collection, and crime is the secret ingredient

When a group of celebrities ask to speak with their lawyer, they usually don’t have to call in a bunch of other people to go speak with their lawyer. However, in this case it may well be a thing a little down the line. A huge array of musicians including Bruce Springsteen, Lady Gaga, Madonna, Run...

New malware Ramsay can steal data from air-gapped computers

By Sudais Asif We've seen the use of air-gapped computers rise... This is a post from HackRead.com Read the original post: New malware Ramsay can steal data from air-gapped computers...

From Bugs to Zoombombing: How to Stay Safe in Online Meetings

The COVID-19 pandemic, along with social distancing, has done many things to alter our lives. But in one respect it has merely accelerated a process begun many years ago. We were all spending more and more time online before the virus struck. But now, forced to work, study and socialize at home,...

CVE-2020-12427

The Western Digital WD Discovery application before 3.8.229 for MyCloud Home on Windows and macOS is vulnerable to CSRF, with impacts such as stealing data, modifying disk contents, or exhausting disk space...