Debian DLA-2813-1 : ckeditor - LTS security update

The remote Debian 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-2813 advisory. CKEditor, an open source WYSIWYG HTML editor with rich content support, which can be embedded into web pages, had two vulnerabilites as follows: CVE-2021-33829 A...

CVE-2021-43412

An issue was discovered in GNU Hurd before 0.9 20210404-9. libports accepts fake notification messages from any client on any port, which can lead to port use-after-free. This can be exploited for local privilege escalation to get full root access...

Free Discord Nitro Offer Used to Steal Steam Credentials

There’s a new scam making the rounds on Discord, through which cybercriminals can harvest Steam account information and make off with any value it contains. Gamer-aimed Discord scams are just about everywhere. But researchers flagged a new approach as noteworthy because it crosses over between...

Using Fake Student Accounts to Shill Brands

It turns out that its surprisingly easy to create a fake Harvard student and get a harvard.edu email account. Scammers are using that prestigious domain name to shill brands: Basically, it appears that anyone with $300 to spare can ­- or could, depending on whether Harvard successfully shuts down...

New malware lures fake Chrome update to attack Windows PCs

By Deeba Ahmed The prime target of this malware campaign is unsuspecting users on Windows 10. This is a post from HackRead.com Read the original post: New malware lures fake Chrome update to attack Windows PCs...

Office 365 Phishing Campaign Abuses Stolen Amazon SES Token

A surge in spearphishing emails designed to steal Office 365 credentials include some that were rigged to look like they came from major brands, including Kaspersky. According to a Kaspersky security bulletin posted Monday, two phishing kits identified as “Iamtheboss” and “MIRCBOOT’ are being use...

Millions of Android Users Scammed in SMS Fraud Driven by Tik-Tok Ads

Threat actors are using malicious Android apps to scam users into signing up for a bogus premium SMS subscription service, which results in big charges accruing on their phone bills. Jakub Vavra from the threat operations team of security firm Avast uncovered the campaign, which he dubbed UltimaS...

fake-taxi.com Cross Site Scripting vulnerability OBB-2206500

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Google Crushes YouTube Cookie-Stealing Channel Hijackers

Google has caught and brushed off a bunch of cookie-stealing YouTube channel hijackers who were running cryptocurrency scams on the ripped-off channels. In a Wednesday post, Ashley Shen, with Google’s Threat Analysis Group TAG, said that TAG attributes the assaults to a group of attackers recruit...

Limelighter - A Tool For Generating Fake Code Signing Certificates Or Signing Real Ones

A tool which creates a spoof code signing certificates and sign binaries and DLL files to help evade EDR products and avoid MSS and sock scruitney. LimeLighter can also use valid code signing certificates to sign files. Limelighter can use a fully qualified domain name such as acme.com...

Steal tokens from TempusController

Handle gpersoon Vulnerability details Impact The function depositAndProvideLiquidity can be used go retrieve arbitrary ERC20 tokens from the TempusController.sol contract. As the test contract of TempusController.sol shows, it has indeed ERC20 tokens. The problem is due to the fact that you suppl...

Attackers Behind Trickbot Expanding Malware Distribution Channels

The operators behind the pernicious TrickBot malware have resurfaced with new tricks that aim to increase its foothold by expanding its distribution channels, ultimately leading to the deployment of ransomware such as Conti. The threat actor, tracked under the monikers ITG23 and Wizard Spider, ha...

A week in security (Oct 4 – Oct 10)

Last week on Malwarebytes Labs Does Cybersecurity Awareness Month actually improve security? Police take a piece out of a ransomware gang, but won’t say which one Neiman Marcus data breach affects millions Windows 11 is out. Is it any good for security? Criminals were inside Syniverse for 5 years...

CVE-2021-41130

Extensible Service Proxy, a.k.a. ESP is a proxy which enables API management capabilities for JSON/REST or gRPC API services. ESPv1 can be configured to authenticate a JWT token. Its verified JWT claim is passed to the application by HTTP header "X-Endpoint-API-UserInfo", the application can use ...

Android flubot malware installs itself by faking security update

By Deeba Ahmed The warning is obviously phony but looks authentic that can deceive users into installing Flubot malware on their devices. This is a post from HackRead.com Read the original post: Android flubot malware installs itself by faking security update...

Beware of Fake Amnesty International Antivirus for Pegasus that Hacks PCs with Malware

In yet another indicator of how hacking groups are quick to capitalize on world events and improvise their attack campaigns for maximum impact, threat actors have been discovered impersonating Amnesty International to distribute malware that purports to be security software designed to safeguard...

Mac Users Targeted by Trojanized iTerm2 App

We go into more detail about a fake version of the iTerm2 app that downloads and runs malware, detected by Trend Micro as TrojanSpy.Python.ZURU.A, which collects private data from a victim’s machine...

A week in security (Sept 20 – Sept 26)

Last week on Malwarebytes Labs Freedom Hosting operator gets 27 years for hosting dark web abuse sites Microsoft makes a bold move towards a password-less future New Mac malware masquerades as iTerm2, remote desktop and other apps Internet safety tips for kids and teens: a comprehensive guide for...

Fake Installers Drop Malware and Open Doors for Opportunistic Attackers

We recently spotted fake installers of popular software being used to deliver bundles of malware onto victims’ devices. These installers are widely used lures that trick users into opening malicious documents or installing unwanted applications...

Uber security alert scam spoofs real Uber number—Watch out!

This morning Malwarebytes Labs received a scam masquerading as a security alert from Uber. The alert was pretty convincing and used the kind of language were used to seeing in genuine security emails and SMS messages. It read: Your Uber account was recently logged into from iPhone in London. If...