Nearly 1,900 Signal Messenger Accounts Potentially Compromised in Twilio Hack

Popular end-to-end encrypted messaging service Signal on Monday disclosed the cyberattack aimed at Twilio earlier this month may have exposed the phone numbers of roughly 1,900 users. "For about 1,900 users, an attacker could have attempted to re-register their number to another device or learned...

The vulnerability of the Data Memory-Dependent Prefetcher (DMP) mechanism in Apple M1 and A14 processors allows a hacker to gain unauthorized access to protected information.

The vulnerability of the Data Memory-Dependent Prefetcher DMP mechanism in Apple M1 and A14 processors is related to pointer swapping errors. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

_harvest() performs market swaps without slippage control and is a subject to sandwich attacks

Lines of code Vulnerability details As a result trades happen at a manipulated price and end up receiving fewer tokens than current market price dictates. Placing severity to medium as impact here is a partial fund loss conditional only on big enough asset amount to be swapped: sandwich attacks a...

Lack of safeApprove(0) may prevent deposits and swapping of token

Lines of code Vulnerability details Impact OpenZeppelin’s safeApprove will revert if the account already is approved and the new safeApprove is done with a non-zero value. Users may be prevented from swapping tokens to Backd LPTokens a second time Proof of Concept There are multiple places...

T-Mobile Admits Lapsus$ Hackers Gained Access to its Internal Tools and Source Code

Telecom company T-Mobile on Friday confirmed that it was the victim of a security breach in March after the LAPSUS$ mercenary gang managed to gain access to its networks. The acknowledgment came after investigative journalist Brian Krebs shared internal chats belonging to the core members of the...

The vulnerability of the nvlddmkm.sys component of the NVIDIA GPU Display Driver allows a hacker to trigger a service failure.

The vulnerability of the nvlddmkm.sys component of the NVIDIA GPU Display Driver is related to pointer swapping errors. Exploiting this vulnerability allows an attacker to cause a system failure...

All swapping functions lack checks for returned tokens

Lines of code Vulnerability details Impact Every function that stems from the GenericSwapFacet lacks checks to ensure that some tokens have been returned via the swaps. In LibSwap.sol in the swap function, the swap call is sent to the target DEX. A return of success is required, otherwise the...

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise packages, related to pointer swapping errors, allows a perpetrator to execute arbitrary code.

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise packages is related to errors in pointer assignment during the execution of the EMRCOMMENTEMFPLUS field in EMF files. Exploiting this vulnerability can allow an attacker to execute arbitrary code by opening a malicious pa...

Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting

Vulnerability Type Stored Cross Site-Scripting XSS Affected URL https://localhost/openemr-6.0.0/ /interface/super/rules/index.php?action=edit!submitsummary Affected Parameters “fldtitle” Authentication Required? Yes Issue Summary Non-privilege users accounting, front-office can create new rule an...

Spanish Police Arrest SIM Swappers Who Stole Money from Victims Bank Accounts

Spain's National Police Agency, the Policía Nacional, said last week it dismantled an unnamed cybercriminal organization and arrested eight individuals in connection with a series of SIM swapping attacks that were carried out with the goal of financial fraud. The suspects of the crime ring...

Sharp SIM-Swapping Spike Causes $68M in Losses

SIM-swapping – the practice of duping mobile carriers into switching a target’s phone services to an attacker-controlled phone – is on the rise, the Feds are warning – leading to millions in losses for consumers who found their bank accounts drained and other accounts taken over. Subscriber...

The vulnerability of the `ntfs_extent inode_open` function in the NTFS file system driver for the FUSE NTFS-3G module, related to pointer swapping errors, allows a perpetrator to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the ntfsextent inodeopen function in the NTFS file system driver for the FUSE NTFS-3G module is related to pointer swapping errors. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures through th...

The vulnerability in the open-source development environment for UEFI edk2, related to pointer swapping errors, allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability in the open-source development environment for UEFI edk2 is related to pointer swapping errors. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures...

T-Mobile’s latest data breach exposed users to SIM swapping attacks

By Waqas T-Mobile is the only telecom giant to suffer at least three known data breaches in 2021. This is a post from HackRead.com Read the original post: T-Mobiles latest data breach exposed users to SIM swapping attacks...

No slippage tolerance checks during swap functions opens up flashloan attacks and price manipulation

Handle jayjonah8 Vulnerability details Impact With functions like joinTokenSingle in SingleTokenJoin.sol that handle swapping with uniswapV2 like exchanges there are no slippage tolerance checks in place to prevent flashloan attacks and price manipulation. Proof of Concept Tools Used Manual code...

no protection from sandwich attacks

Handle certora Vulnerability details the function joinTokenSingle has no protection from slippage and sandwich attacks. the balance after the swaps is not checked to have a minimum and the min amount in the swaps is set to zero: Impact malicious actors can front-run joinTokenSingle and perform a...

Hacker Jailed for Stealing Millions of Dollars in Cryptocurrencies by SIM Hijacking

A sixth member associated with an international hacking group known as The Community has been sentenced in connection with a multimillion-dollar SIM swapping conspiracy, the U.S. Department of Justice DoJ said. Garrett Endicott, 22, from the U.S. state of Missouri, who pleaded guilty to charges o...

User can bypass Recovery Mode via UniswapHandler to buy Malt

Handle gzeon Vulnerability details Impact One of the innovative feature of Malt is to block buying while under peg. The buy block can be bypassed by swapping to the whitelisted UniswapHandler, and then extract the token by abusing the add and remove liquidity function. This is considered a high...

Threat from Organized Cybercrime Syndicates Is Rising

From encrypting communications to fencing ill-gotten gains on underground sites, organized crime is cashing in on the digital revolution. The latest organized crime threat assessment from Europol issues a dire warning about the corrosive effect the rising influence of criminal syndicates is havin...

Twitter hacker charged in sim swapping, cryptocurrency scheme

By Waqas The 22-year-old British national Joseph James O’Connor, aka PlugwalkJoe, was one of the hackers behind 2020's massive Twitter hack. This is a post from HackRead.com Read the original post: Twitter hacker charged in sim swapping, cryptocurrency scheme...