Chinese Surveillance, Facebook Tracking, and More Security News This Week

3-D printed rifles, Iran missile hacking, and more of the week's top security news...

Critical OkCupid Flaw Exposed Daters to App Takeovers

A critical flaw in the OkCupid app has been found that could allow a bad actor to steal credentials, launch man-in-the-middle attacks or completely compromise the victim’s application. This is separate from the OKCupid account-takeover incident reported earlier in the week, but it does fit the...

CVE-2019-0615

creationtimestamp| type| source ---|---|--- 2019-02-13 14:35:53+00:00| seen| MISP/5c642a56-2440-4af0-8bfd-6e4a0a021402...

CVE-2019-0613

creationtimestamp| type| source ---|---|--- 2019-02-13 14:35:53+00:00| seen| MISP/5c642a56-2440-4af0-8bfd-6e4a0a021402...

CVE-2019-0655

creationtimestamp| type| source ---|---|--- 2019-02-13 14:35:52+00:00| seen| MISP/5c642a56-2440-4af0-8bfd-6e4a0a021402...

CVE-2019-0604

creationtimestamp| type| source ---|---|--- 2019-02-13 14:35:52+00:00| seen| MISP/5c642a56-2440-4af0-8bfd-6e4a0a021402 2019-03-23 18:43:00+00:00| published-proof-of-concept| https://t.me/antichat/4119 2019-03-23 19:42:30+00:00| seen| https://t.me/canyoupwnme/5306 2019-03-24 15:21:55+00:00| seen|...

Traq Cross-Site Request Forgery Vulnerability

Traq is a PHP-based project management and issue tracking system. Traq suffers from a cross-site request forgery vulnerability that arises from a WEB application that does not adequately validate that a request is coming from a trusted user. An attacker could use this vulnerability to send...

Process Hacker - A Free, Powerful, Multi-Purpose Tool That Helps You Monitor System Resources, Debug Software And Detect Malware

A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. System requirements Windows 7 or higher, 32-bit or 64-bit. Features A detailed overview of system activity with highlighting. Graphs and statistics allow you quickly to track down...

CVE-2018-20174

creationtimestamp| type| source ---|---|--- 2019-02-06 15:04:30+00:00| seen| MISP/5c5af499-e890-49e9-b1ff-26ba0a021402...

A week in security (January 28 – February 3)

Last week, we ran another in our interview with a malware hunter series, explained a FaceTime vulnerability, and took a deep dive into a new stealer. We also threw some light on a Houzz data breach, and what exactly happened between Apple and Facebook. Other cybersecurity news Kwik Fit hit by...

Open Positioner: my new project for tracking IT and security jobs

The idea of my new project is to retrieve the data from job-searching websites and provide better filtering, searching and visualization. I think for the most people who read this, searching for a job in Internet is a pretty common activity. Even if you are not going to change job right now, it...

Security Flaws in Children's Smart Watches

A year ago, the Norwegian Consumer Council published an excellent security analysis of children's GPS-connected smart watches. The security was terrible. Not only could parents track the children, anyone else could also track the children. A recent analysis checked if anything had improved after...

Apple Blasts Facebook Over Data-Sucking 'Research' App

Apple has revoked Facebook’s enterprise iOS developer certificate on the heels of a “Facebook Research” VPN app that was being distributed to consumers; the app paid teens and Millennial users in exchange for being able to track their phone and web activity, and has been available since 2016. App...

Mozilla Firefox 65 Ups the Ante on Privacy with Anti-Tracking Efforts

Mozilla has unveiled new anti-tracking policies and redesigned privacy controls in tandem with the release of Firefox 65 on Tuesday. The company announced a new set of redesigned controls for the Content Blocking section, where users can choose their desired level of privacy protection. These are...

GPS watch issues… AGAIN

Over the last year of looking at kids GPS tracking watches we have found some staggering issues. With these devices it almost seems that having multiple security issues is the new normal. While parents and guardians may get a feeling of security from using these devices, our testing and research...

Detecting bots using Content Security Policy (CSP) headers

Bots are noisy, like really. And dangerous as well, especially if they can do crawling and increase usage by legitimate operations like items catalog retrieve in the case of e-commerce. I mean, we have a lot of reasons to do not like bots and count this problem as a cybersecurity threat, which...

Active Scans Target Vulnerable Cisco Routers for Remote Code-Execution

UPDATE Malicious scanning activity targeting Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN routers is underway, with a swell of opportunistic probes looking for vulnerable devices ramping up since Friday. According to Bad Packets Report’s honeypot data, cyberattackers are targeting a...

What does ‘consent to tracking’ really mean?

Thanks to Jerome Boursier for contributions. Post GDPR, many social media platforms will ask end users to consent to some form of tracking as a condition of using the service. It's easy to make assumptions as to what that means, especially when the actual terms of service or data policy for the...

CVE-2019-6225

creationtimestamp| type| source ---|---|--- 2019-01-24 16:28:00+00:00| seen| MISP/5c49e6e0-a794-4c2f-afe2-4c8e0a021402 2019-01-25 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/46248 2019-01-28 15:10:00+00:00| seen| MISP/5c4f1a2e-1300-4391-87cf-19c50a021402 2020-10-09...

How GPS Tracking Technology Can Curb Domestic Violence

Opinion: GPS-monitored violent offenders are 95 percent less likely to commit a new crime. We need to implement an integrated, nationwide domestic violence program that tracks domestic abusers...