OnePlus Site’s Payment System Reportedly Hacked to Steal Credit Card Details

This year's first bad news for OnePlus users—a large number of OnePlus customers are reporting of fraudulent credit card transactions after buying products from the Chinese smartphone manufacturer's official online store. The claim initially surfaced on the OnePlus support forum over the weekend...

Interview with CTO Michael Viscuso – Ransomware: The Problem That Won’t Go Away

Editor's Note: This article originally appeared on BankInfoSecurity.com Click here to listen to the full podcast Dealing with ransomware is a lot like dealing with mosquitos: The best approach is to anticipate getting bit and take steps to try to fend off attacks. But the growth of ransomware int...

Website Glitch Let Me Overstock My Coinbase

Coinbase and Overstock.com just fixed a serious glitch that allowed Overstock customers to buy any item at a tiny fraction of the listed price. Potentially more punishing, the flaw let anyone paying with bitcoin reap many times the authorized bitcoin refund amount on any canceled Overstock orders...

Forever 21 Says PoS Systems Exposed Customer Data for 8 Months

Fashion retailer Forever 21 confirmed a breach made public in November resulted in the theft of credit card data belonging to an undisclosed number of customers. The company had stated that a lack of encryption used on some of its point-of-sales payment terminals could have resulted in unauthoriz...

4 Years After Target, the Little Guy is the Target

Dec. 18 marked the fourth anniversary of this site breaking the news about a breach at Target involving some 40 million customer credit and debit cards. It has been fascinating in the years since that epic intrusion to see how organized cyber thieves have shifted from targeting big box retailers ...

CVE-2015-7666

Multiple cross-site scripting XSS vulnerabilities in the 1 cpupdateMessageItem and 2 cpdeleteMessageItem functions in cppppadminintmessagelist.inc.php in the Payment Form for PayPal Pro plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the cal...

New Spider Ransomware Comes With 96-Hour Deadline

A new ransomware strain called Spider is targeting victims located in the Balkans in what is called a “mid-scale” campaign. The Spider ransomware is unique in that attackers are given a 96-hour deadline to pay. Attackers also attempt to calm victims, assuring them the ransom payment and file...

Multiple Vulnerabilities in the EnjoyShop App

Enjoy a purchase app is an online shopping application. There are vulnerabilities in arbitrary user password change, arbitrary account login, arbitrary user payment password reset and payment design of Enjoy a purchase app. An attacker can reset any user, login to any account, reset any payment...

PayPal Subsidiary Data Breach Hits Up to 1.6 Million Customers

Global e-commerce business PayPal has disclosed a data breach that may have compromised personally identifiable information for roughly 1.6 million customers at a payment processing company PayPal acquired earlier this year. PayPal Holdings Inc. said Friday that a review of its recently acquired...

Threat Outbreak Alert RuleID31440: Email Messages Distributing Malicious Software on November 24, 2017

Medium Alert ID: 56046 First Published: 2017 November 27 13:16 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31440 may contain the following files: Name |...

Wise Ride Android App Has Logic Design Flaws

Smart Ride Ride Le app is a smart city public bike rental app. There is a logic design loophole in the Zhixing Jiale Android app. After logging into the system, an attacker can modify the amount of payment arbitrarily by clicking on the "Alipay Payment Credit Deposit" option and intercepting it...

Uber Reveals 2016 Breach of 57 Million User Accounts

Ride-hailing service Uber Technologies revealed Tuesday that the company suffered a breach of 57 million Uber user accounts in 2016. According to reports, Uber then attempted to cover up the incident by paying $100,000 to attackers to keep the hack a secret and delete the data. Dara Khosrowshahi,...

Threat Outbreak Alert RuleID31367: Email Messages Distributing Malicious Software on November 20, 2017

Medium Alert ID: 55987 First Published: 2017 November 20 15:02 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31367 may contain the following files: Name |...

Logic design flaws in Vogelmaster's Android app

Wojia General Manager Android APP is a home control software. There is a logic design vulnerability in Wojia General Management Android APP. An attacker can exploit the vulnerability to modify arbitrary payment amount...

Threat Outbreak Alert RuleID31347: Email Messages Distributing Malicious Software on November 16, 2017

Medium Alert ID: 55961 First Published: 2017 November 16 14:54 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31347 may contain the following files: Name |...

Forever 21 Warns Shoppers of Payment Card Breach at Some Stores

Another day, another data breach. This time a fast-fashion retailer has fallen victim to payment card breach. American clothes retailer Forever 21 announced on Tuesday that the company had suffered a security breach that allowed unknown hackers to gain unauthorized access to data from payment car...

payment.internshala.com XSS vulnerability

Vulnerable URL: https://payment.internshala.com/trainings/process.php​ Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Coordinated Disclosure Timeline: Description...

Threat Outbreak Alert RuleID31201: Email Messages Distributing Malicious Software on November 8, 2017

Medium Alert ID: 55806 First Published: 2017 November 8 14:52 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31201 may contain the following files: Name |...

Threat Outbreak Alert RuleID31217: Email Messages Distributing Malicious Software on November 7, 2017

Medium Alert ID: 55794 First Published: 2017 November 7 13:57 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31217 may contain the following files: Name |...

Cybercriminals Infiltrating E-Mail Networks to Divert Large Customer Payments

There's a new criminal tactic involving hacking an e-mail account of a company that handles high-value transactions and diverting payments. Here it is in real estate: The scam generally works like this: Hackers find an opening into a title company's or realty agent's email account, track upcoming...