blktrace (aka Block IO Tracing) 1.2.0 as used with the Linux kernel and Android has a buffer overflow in the dev_map_read function in btt/devmap.c because the device and devno arrays are too small as demonstrated by an invalid free when using the btt program with a crafted file.

...

NSA Warns Smartphones Leak Location Data

Mobile devices expose location data in more ways than most people know, and turning off services such as Find My Phone, Wi-Fi and Bluetooth can help mitigate tracking, but are no silver bullet that prevents a third party from tracking users. That’s advice shared by U.S. top spy division, the...

CVE-2020-15957

An issue was discovered in DP3T-Backend-SDK before 1.1.1 for Decentralised Privacy-Preserving Proximity Tracing DP3T. When it is configured to check JWT before uploading/publishing keys, it is possible to skip the signature check by providing a JWT token with alg=none...

CVE-2020-15957

An issue was discovered in DP3T-Backend-SDK before 1.1.1 for Decentralised Privacy-Preserving Proximity Tracing DP3T. When it is configured to check JWT before uploading/publishing keys, it is possible to skip the signature check by providing a JWT token with alg=none...

State privacy laws: 2020 highs and lows

2020 is shaping up to be another interesting year for data privacy, especially given that public health agencies, private companies, and states are now working feverishly to create contact tracing apps and programs while still preserving privacy. Being thoughtful and accountable about data privac...

Fake govt COVID-19 contact tracking app spreads Android ransomware

By Sudais Asif Another day, another fake COVID-19 contact tracing app spreading malware... This is a post from HackRead.com Read the original post: Fake govt COVID-19 contact tracking app spreads Android ransomware...

PT-2020-12312 · Jaegertracing · Jaeger

Name of the Vulnerable Software and Affected Versions: jaegertracing/jaeger versions prior to 1.18.1 Description: A sensitive information exposure issue was discovered when the Kafka data store is used, allowing an attacker with access to the container's log file to obtain the Kafka credentials...

A week in security (June 8 – 14)

Last week on Malwarebytes Labs, we looked into nasty search hijackers that worried a lot of Chrome users; a list of considerations for MSPs when looking for an RMM platform; the complaint faced by ParetoLogic, the company that issues SpeedyPC, a product that claims to find and remove various PC...

Fake govt-issued COVID-19 contact tracing apps spread spyware

By Waqas These malicious COVID-19 apps also drop nasty pieces of malware including Anubis and SpyNote. This is a post from HackRead.com Read the original post: Fake govt-issued COVID-19 contact tracing apps spread spyware...

Podcast: Would You Use A Contact-Tracing Coronavirus App?

As a world afflicted by the coronavirus pandemic begins to re-open restaurants, retail stores and more, public-health officials remain concerned about the spread of the virus. Technology for contact-tracing apps, intended to help citizens trace whether they were exposed to someone who has tested...

Windows Registry Denial of Service Vulnerability

A denial of service vulnerability exists when Windows Registry improperly handles filesystem operations. An attacker who successfully exploited the vulnerability could cause a denial of service against a system. To exploit the vulnerability, an attacker who has access to the system could run a...

Singapore’s Contact Tracing Wearable Causes Privacy Backlash

Singapore’s announcement that it is developing a wearable for contact tracing has caused citizens to voice concern for the technology’s impact on their data privacy, with more than 35,000 signing a petition against the devices. On Friday during a parliament session, Vivian Balakrishnan,...

Lock and Code S1Ep8: Securely working from home (WFH) with John Donovan and Adam Kujawa

This week on Lock and Code, we discuss the top security headlines generated right here on Labs and around the Internet. In addition, we talk to John Donovan, head of security at Malwarebytes, and Adam Kujawa, director of Malwarebtyes Labs, about securely working from home WFH. With shelter-in-pla...

How Covid-19 Contact Tracing Works on Your Phone

Developers are working on track-and-trace systems to keep infection levels low. The apps aren't here yet, but here's what they do—and how you can enable them...

This $350 "Anti-5G" Device Is Apparently Just a USB Stick

Plus: A LiveJournal hack, Qatar's contact-tracing privacy failure, and more of the week's top security news...

'[F]Unicorn' Ransomware Impersonates Legit COVID-19 Contact-Tracing App

A fresh ransomware strain known as “FUnicorn” has emerged, first seen this week targeting users by pretending to be an official government COVID-19 contact tracing app. According to an advisory from the Computer Emergency Response Team CERT from the Agency for Digital Italy AgID, the malware fami...

State-Based Contact Tracing Apps Could Be a Mess

With no nationwide Covid-19 notification software in sight, security and interoperability issues loom large...

kernel: use-after-free in __blk_add_trace in kernel/trace/blktrace.c

A use-after-free vulnerability was found in the Linux kernel’s implementation of blktrace in the blkaddtrace function. A local attacker with permissions to run block trace instructions against a device can create a situation where the core blocktrace object is used after it is freed. The attacker...

COVIDSafe app information disclosure vulnerability (CNVD-2020-30664)

COVIDSafe app is an Australian coronavirus contact tracing app. An information disclosure vulnerability exists in the COVIDSafe app. The vulnerability stems from errors such as configuration during operation of a networked system or product. An attacker could exploit the vulnerability to obtain...

News Wrap: Ransomware Extortion Tactics, Contact-Tracing App Security Worries

Threatpost editors discuss the top news stories of the week ended May 15, including: Recent ransomware attacks, including ones targeting healthcare giant Magellan, the IT office that supports Texas appellate courts and judicial agencies, and a popular law firm that works with several A-list...