Labs report: summer ushers in unprecedented season of breaches

In this edition of the Malwarebytes Cybercrime Tactics and Techniques report for the third quarter of 2017, we saw a number of high profile breaches targeting the personal information of hundreds of millions of people. While the Equifax breach may have dominated the news cycle, notable attacks...

CVE-2017-0826

An elevation of privilege vulnerability in the HTC bootloader. Product: Android. Versions: Android kernel. Android ID: A-34949781...

A week in security (September 25 – October 01)

Recently, we talked about the hacking incident at Deloitte, one of the 'big four' global accounting firms. It was reported that client email addresses, usernames, and passwords were exposed. This also brought to light weaknesses in their policies and lack of threat intelligence to recover leaked...

Vastal I-Tech Dating Zone 0.9.9 SQL Injection Vulnerability

Vastal I-Tech Dating Zone version 0.9.9 suffers from a remote SQL injection vulnerability. Exploit Title: Vastal I-Tech Dating Zone 0.9.9 - 'productid' Parameter SQL Injection Dork: N/A Date: 29.09.2017 Vendor Homepage: http://vastal.com/ Software...

Vastal I-Tech Dating Zone 0.9.9 SQL Injection

Exploit Title: Vastal I-Tech Dating Zone 0.9.9 - 'productid' Parameter SQL Injection Dork: N/A Date: 29.09.2017 Vendor Homepage: http://vastal.com/ Software http://vastal.com/dating-zone-the-dating-software.html Demo: http://datingzone.vastal.com/demo/ Version: 0.9.9 Category: Webapps Tested on:...

Tech support scammers abuse native ad and content provider Taboola to serve malvertising (updated)

A large number of publishers - big and small - are monetizing their sites by selling space for companies that provide so-called native advertising, cited as more effective and engaging than traditional banner ads. Indeed, on a news or entertainment site, users are more inclined to click on links...

A week in security (September 18 – September 24)

Last week, we kept you updated on our blog about the infected versions of CCleaner that were offered as downloads on the official servers. We also warned you against a fake IRS notice that delivers a customized spying tool, some of the threats currently facing gamers, and a Netflix scam that has...

September 25, 2017 – Morning Cyber Coffee Headlines – “William Faulkner” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! September 25, 2017 - Headlines Carbon Black in the News: Nuclear war isn't Nort...

CCleaner Malware Infects Big Tech Companies With Second Backdoor

The group of unknown hackers who hijacked CCleaner's download server to distribute a malicious version of the popular system optimization software targeted at least 20 major international technology companies with a second-stage payload. Earlier this week, when the CCleaner hack was reported,...

FTC providing partial refunds for Advanced Tech Support victims

Last month, the FTC announced the recovery of 10 million dollars from Advanced Tech Support, one of the most successful US-based tech support scammers ever. This money will be put towards partial refunds for victims of ATS who purchased products or services from them between April 2012 and Novemb...

PT-2017-13260

Name of the Vulnerable Software and Affected Versions Arris NVG599 device with AT&T U-verse 9.2.2h0d83 firmware Description The issue allows remote attackers to obtain root privileges by establishing a session on port 49955 and then installing new software. This is possible because the device...

'HoeflerText' Popups Target Browsers With RAT and Locky Ransomware

A malware campaign utilizing bogus popups that alert users to a missing web-font is targeting Google Chrome and Firefox browser users. The popups contain a malicious JavaScript file that initiates the download of either the NetSupport Manager remote access tool RAT or Locky ransomware. The...

Fraudulent Donations Lead to Disbanding of Hutchins Legal Defense Fund

A legal defense fund established to ease Marcus Hutchins’ attorney costs has been disbanded after a sizable number of fraudulent donations were discovered. Hutchins, known as Malware Tech, is facing six counts for his alleged involvement in creating and distributing the Kronos banking malware. Th...

Week 6 of Girls Who Code: Artificial Intelligence and Human Expertise at Watson Health

Week 6 of the Girls Who Code summer-immersion program at Akamai featured a field trip to IBM's Watson Health, where the girls learned about the concept of "cognitive computing," and how this technology is being used by IBM to help doctors help their patients. The girls met some of the women at IB...

Do the Police Need a Search Warrant to Access Cell Phone Location Data?

The US Supreme Court is deciding a case that will establish whether the police need a warrant to access cell phone location data. This week I signed on to an amicus brief from a wide array of security technologists outlining the technical arguments as why the answer should be yes. Susan Landau...

Tiandy IP Cameras 5.56.17.120 - Sensitive Information Disclosure

Vulnerability Summary The following advisory describes sensitive information Disclosure found in Tiandy IP cameras version 5.56.17.120 Tianjin Tiandy Digital Technology Co., Ltd Tiandy Tech is “one of top 10 leading CCTV manufacturer in China and a global supplier of advanced video surveillance...

si-tech.co.jp XSS vulnerability

Open Bug Bounty ID: OBB-273239 Description| Value ---|--- Affected Website:| si-tech.co.jp Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Promoting Online Safety in Canada: Trend Micro Launches Video Contest for Local Kids

At Trend Micro we always strive to be a responsible corporate citizen. Right from the beginning the company has devoted significant time and resources to a variety of projects: from house building in the Philippines, to our Give and Match programs around the world designed to support vital...

Smart Vacuum Cleaners Making Map Of Your Home — And Wants to Sell It

What if I say that your cute, smart robotic vacuum cleaner is collecting data than just dirt? During an interview with Reuters, the CEO of iRobot, the company which manufactured Roomba device, has revealed that the robotic vacuum cleaner also builds a map of your home while cleaning — and is now...

How a Citadel Trojan Developer Got Busted

A U.S. District Court judge in Atlanta last week handed a five year prison sentence to Mark Vartanyan, a Russian hacker who helped develop and sell the once infamous and widespread Citadel banking trojan. This fact has been reported by countless media outlets, but far less well known is the...