Alternatives to Government-Mandated Encryption Backdoors

Policy essay: "Encryption Substitutes," by Andrew Keane Woods: In this short essay, I make a few simple assumptions that bear mentioning at the outset. First, I assume that governments have good and legitimate reasons for getting access to personal data. These include things like controlling crim...

British Hacker Admits Using Mirai Botnet to DDoS Deutsche Telekom

An unnamed 29-year-old man, named by authorities as "Daniel K.," pleaded guilty in a German court on Friday to charges related to the hijacking of more than one Million Deutsche Telekom routers. According to reports in the German press, the British man, who was using online monikers "Peter Parker...

macOS Fruitfly Backdoor Analysis Renders New Spying Capabilities

LAS VEGAS—The FruitFly backdoor became a known entity in January, but it’s a good bet that for years it had been in the wild, undetected by analysts and security software. The macOS and OS X malware has a number of insidious spying capabilities that would make anyone uneasy, and a variant recentl...

Decompiled SLocker Android Ransomware Source Code Published Online

Bad news for Android users — Decompiled source code of for one of the oldest mobile and popular Android ransomware families has been published online, making it available for cyber criminals who can use it to develop more customised and advanced variants of Android ransomware. Decompiled source...

US, European Law Enforcement Shutter Massive AlphaBay Market

U.S. authorities along with law enforcement agencies in Europe and Asia announced today the takedown of the dark web’s largest illicit market. AlphaBay sold malware and hacking tools along with drugs, fraudulent documents, guns, counterfeit goods and even toxic chemicals, the Justice Department...

OrientDB Arbitrary Command Execution Vulnerability

OrientDB is a British company Orient a set of open source NoSQL database management system . The system supports ACID transactions , fast indexes and SQL queries and other features . OrientDB 2.22 and previous versions of a security vulnerability , the vulnerability stems from the program fails t...

CoinDash Hacked During its ICO

Hackers hijacked CoinDash’s initial coin offering Monday, stealing $7.7 million in cryptocurrency from the nascent trading platform. The attack occurred during a 15-minute period for “whitelist contributors” prior to the public ICO. During that time, the hackers were able to compromise the CoinDa...

Australia Considering New Law Weakening Encryption

News from Australia: Under the law, internet companies would have the same obligations telephone companies do to help law enforcement agencies, Prime Minister Malcolm Turnbull said. Law enforcement agencies would need warrants to access the communications. "We've got a real problem in that the la...

Legal Robot: Password complexity not evenly enforced

A security researcher discovered that our password complexity requirements were not properly enforced during account registration, as they were during password reset. Minor issue but i appreciate the response time, It's really nice working with @danrubins , his very good and humble attitude is mu...

CVE-2017-4055

Exploitation of Authentication vulnerability in the web interface in McAfee Advanced Threat Defense ATD 3.10, 3.8, 3.6, 3.4 allows remote unauthenticated users / remote attackers to bypass ATD detection via loose enforcement of authentication and authorization...

Exploit Kit Attacks on the Rise as Astrum Emerges

While the cyber security industry noticed a reduction in exploit kit attacks during 2016 as well as early into 2017, these are still veritable threats that organizations must be aware of. Exploit kits typically follow a four-stage attack scenario, resulting in dangerous infections such as...

Reliance Jio Customers' Data Allegedly Hacked – Company Denies Breach

Personal details of some 120 Million customers have been allegedly exposed on the Internet in probably the biggest breach of personal data ever in India. Last night, an independent website named Magicapk.com went online, offering Reliance Jio customers to search for their identification data Know...

Bitscout – The Free Remote Digital Forensics Tool Builder

Being a malware researcher means you are always busy with the struggle against mountains of malware and cyberattacks around the world. Over the past decade, the number of daily new malware findings raised up to unimaginable heights: with hundreds of thousands of malware samples per day! However,...

Moderate: Red Hat Security Advisory: rh-postgresql95-postgresql security update

An update for rh-postgresql95-postgresql is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Design/Logic Flaw

NetApp Clustered Data ONTAP allows man-in-the-middle attackers to obtain sensitive information, gain privileges, or cause a denial of service by leveraging failure to enable SMB signing enforcement in its default state...

CVE-2016-3997

NetApp CVE-2016-3997 affects Clustered Data ONTAP (N series) where SMB signing is not enforced by default, enabling MITM attacks that can disclose data, escalate privileges, or cause DoS. Root cause: SMB implementation fails to require signing by default. Impact: information disclosure, privilege...

Is it Time to Can the CAN-SPAM Act?

Regulators at the U.S. Federal Trade Commission FTC are asking for public comment on the effectiveness of the CAN-SPAM Act, a 14-year-old federal law that seeks to crack down on unsolicited commercial email. Judging from an unscientific survey by this author, the FTC is bound to get an earful...

NetApp Clustered Data ONTAP Man-in-the-Middle Attack Vulnerability

NetApp Clustered Data ONTAP is a set of storage operating system for clustered mode from American NetApp. The system supports users to enhance the performance of enterprise applications and improve data center flexibility and so on. A man-in-the-middle attack vulnerability exists in the default...

FBI: Extortion, CEO Fraud Among Top Online Fraud Complaints in 2016

Online extortion, tech support scams and phishing attacks that spoof the boss were among the most costly cyber scams reported by consumers and businesses last year, according to new figures from the FBI's Internet Crime Complaint Center IC3. The IC3 report released Thursday correctly identifies...

Few Victims Reporting Ransomware Attacks to FBI

Ransomware may have been the most prevalent internet threat of 2016, and WannaCry certainly made it a mainstream conversation, but that doesn’t mean people are reporting incidents to law enforcement. The FBI’s Internet Crime Complaint Center’s annual report published this week counted only 2,673...