Manager is able to use swapData.dexTxData to Perform Reentrancy

Lines of code Vulnerability details Impact Reentrancy here allows a manager to perform multiple operations on a given pool beyond the max limit. Proof of Concept A Manager, using swapData.dexTxData, can reenter MIMO actions performed on the vault he is managing. The manager deploys a FAKE token a...

Malicious callers can replay disputes

Lines of code Vulnerability details Unlike some of the other signature based operations in the Rigor system, dispute signatures do not include a nonce and are vulnerable to replay attacks. This is similar to my finding in 339, but lower severity, since it is more of a spamming/griefing vector...

Hackers Can Exploit US Emergency Alert System Flaws to Fake Warnings

By Deeba Ahmed These alerts include emergency warnings that are displayed or announced by interrupting the TV and radio broadcasts. The… This is a post from HackRead.com Read the original post: Hackers Can Exploit US Emergency Alert System Flaws to Fake Warnings...

Emergency Alert System Flaws Could Let Attackers Transmit Fake Messages

The U.S. Department of Homeland Security DHS has warned of critical security vulnerabilities in Emergency Alert System EAS encoder/decoder devices. If left unpatched, the issues could allow an adversary to issue fraudulent emergency alerts over TV, radio, and cable networks. The August 1 advisory...

Atlantis 安全漏洞

Atlantis is Atlantis open source a self-hosted golang application . It listens to Terraform pull request events via webhook. A security vulnerability exists in Atlantis versions prior to 0.19.7, which stems from a Timing Attack vulnerability in the package...

Ukrainian Radio Stations Hacked to Broadcast Fake News About Zelenskyy's Health

Ukrainian radio operator TAVR Media on Thursday became the latest victim of a cyberattack, resulting in the broadcast of a fake message that President Volodymyr Zelenskyy was seriously ill. "Cybercriminals spread information that the President of Ukraine, Volodymyr Zelenskyy, is allegedly in...

Threat Source newsletter (July 21, 2022) — No topic is safe from being targeted by fake news and disinformation

By Jon Munshaw. Welcome to this week’s edition of the Threat Source newsletter. I could spend time in this newsletter every week talking about fake news. There are always so many ridiculous memes, headlines, misleading stories, viral Facebook posts and manipulated media that I see come across my...

Massive Losses Define Epidemic of ‘Pig Butchering’

U.S. state and federal investigators are being inundated with reports from people whove lost hundreds of thousands or millions of dollars in connection with a complex investment scam known as "pig butchering," wherein people are lured by flirtatious strangers online into investing in cryptocurren...

Grafana -- Unauthorized file disclosure

Grafana Labs reports: On July 21, an internal security review identified an unauthorized file disclosure vulnerability in the Grafana Image Renderer plugin when HTTP remote rendering is used. The Chromium browser embedded in the Grafana Image Renderer allows for “printing” of unauthorized files i...

Russia Creates Malware False-Flag App

The Russian hacking group Turla released an Android app that seems to aid Ukrainian hackers in their attacks against Russian networks. Its actually malware, and provides information back to the Russians: The hackers pretended to be a "community of free people around the world who are fighting...

Instagram Slow to Tackle Bots Targeting Iranian Women’s Groups

Despite alerting Meta months ago, feminist groups say tens of thousands of fake accounts continue to bombard them on the platform...

FBI Warns Fake Crypto Apps are Bilking Investors of Millions

Threat actors have defrauded 244 U.S. investors of about $42 million through fake cryptocurrency apps that exploit people’s legitimate investments in digital currency, the FBI has revealed. The agency observed a number of cybercriminal campaigns that duped people into downloading malicious apps...

FBI Warns of Fake Cryptocurrency Apps Stealing Millions from Investors

The U.S. Federal Bureau of Investigation FBI has warned of cyber criminals building rogue cryptocurrency-themed apps to defraud investors in the virtual assets space. "The FBI has observed cyber criminals contacting U.S. investors, fraudulently claiming to offer legitimate cryptocurrency investme...

A week in security (July 11 – July 17)

Last week on Malwarebytes Labs: Elden Ring maker Bandai Namco hit by ransomware and data leaks Predatory Sparrow massively disrupts steel factories while keeping workers safe New variant of Android SpyJoker malware removed from Play Store after 3 million+ installs China’s Tonto Team increases...

Uniswap V3 LPs Lose Millions in Fake Token Phishing Attack

By Deeba Ahmed Binance CEO Changpeng Zhao CZ said in a Tweet that their intel unit identified an exploit on Uniswap… This is a post from HackRead.com Read the original post: Uniswap V3 LPs Lose Millions in Fake Token Phishing Attack...

WhatsApp warns users: Fake versions of WhatsApp are trying to steal your personal info

WhatsApp boss Will Cathcart is warning users of the popular messaging app to be on their guard after the WhatsApp Security Team discovered bogus apps packing a hidden punch in the form of malware. Outside the safety of the walled garden App stores do whatever they can to try and prevent bogus...

HavanaCrypt ransomware spreads through fake google updates

Threat Level Attack Report For a detailed advisory, download the pdf file here Summary HavanaCrypt is a new ransomware that distinguishes itself as a Google software update. It evades detection using a Microsoft web hosting service IP address as the command and control C&C server...

The vulnerability of the Apple Game Center authentication adapter allows a hacker to bypass the authentication process. This vulnerability is due to syntactic analysis by the Parse Server.

The vulnerability of the Apple Game Center authentication adapter relates to the lack of certificate verification. Exploiting this vulnerability allows a malicious actor to bypass the authentication process using a fake certificate...

Fake streamed cricket matches knocks victims for six

An incredible scam which resembles hidden camera prank shows has been shut down by police. Four men were arrested last week in connection with the con-job involving fake cricket and online betting. It begins in Russia, takes a trip to India, and ends up back in Russia. Heres how it unfolded:...

Hackers Used Fake Job Offer to Hack and Steal $540 Million from Axie Infinity

The $540 million hack of Axie Infinity's Ronin Bridge in late March 2022 was the consequence of one of its former employees getting tricked by a fraudulent job offer on LinkedIn, it has emerged. According to a report from The Block published last week citing two people familiar with the matter, a...