A $320 Million Crypto Hack Sends the DeFi World Reeling

Plus: News Corp gets hacked, UK snacks ransomware, and more of the week's top security news...

A week in security (January 17 – 23)

Last week on Malwarebytes Labs: CISA calls for urgent action against critical threats Red Cross begs attackers to “Do the right thing” after family reunion service compromised Update now! Chrome patches critical RCE vulnerability in Safe Browsing Combatting SMS and phone fraud: UK government issu...

A week in security (January 17 — 23)

Last week on Malwarebytes Labs: CISA calls for urgent action against critical threats Red Cross begs attackers to “Do the right thing” after family reunion service compromised Update now! Chrome patches critical RCE vulnerability in Safe Browsing Combatting SMS and phone fraud: UK government issu...

UK Government to Launch PR Campaign Undermining End-to-End Encryption

Rolling Stone is reporting that the UK government has hired the M&C Saatchi advertising agency to launch an anti-encryption advertising campaign. Presumably theyll lean heavily on the "think of the children!" rhetoric were seeing in this current wave of the crypto wars. The technical eavesdroppin...

rutlanduk.co.uk Cross Site Scripting vulnerability OBB-2326092

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

winncare.uk Cross Site Scripting vulnerability OBB-2324054

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

uk-oak.co.uk Cross Site Scripting vulnerability OBB-2322328

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Mitigating Log4Shell and Other Log4j-Related Vulnerabilities

Summary The Cybersecurity and Infrastructure Security Agency CISA, the Federal Bureau of Investigation FBI, National Security Agency NSA, Australian Cyber Security Centre ACSC, Canadian Centre for Cyber Security CCCS, the Computer Emergency Response Team New Zealand CERT NZ, the New Zealand...

Friday Squid Blogging: UK Recognizes Squid as Sentient Beings

This seems big: The UK government has officially included decapod crustaceans-including crabs, lobsters, and crayfish-and cephalopod mollusks-including octopuses, squid, and cuttlefish-in its Animal Welfare Sentience Bill. This means they are now recognized as "sentient beings" in the UK. As usua...

SquaredUp for SCOM Cross-Site Scripting Vulnerability

Squaredup is a Web service from Squaredup UK that provides data monitoring capabilities for cloud environments. a cross-site scripting vulnerability exists in Image Tile in SquaredUp for SCOM version 5.2.1.6654, which can be exploited by remote attackers to inject arbitrary Web scripts or HTML...

SquaredUp for SCOM file inclusion vulnerability

Squaredup is a Web service from Squaredup UK that provides data monitoring capabilities for cloud environments. a file inclusion vulnerability in the download logging functionality in SquaredUp for SCOM version 5.2.1.6654 System/Maintenance could be exploited to read arbitrary files on the server...

SquaredUp for SCOM SSRF Vulnerability

Squaredup is a Web service from Squaredup UK that provides data monitoring capabilities for cloud environments. SSRF vulnerabilities exist in SquaredUp for SCOM, and no detailed vulnerability details are available...

A masterclass in responding to vulnerability disclosure: The Buddi app and tracker

The Buddi tracker is used for tracking elderly and vulnerable people. It’s a GPS/GSM-based clip-on device that reports wearer position to an app via a platform. It means that the wearer can easily be found by their carer or the emergency services, should they become lost and unable to make their...

uk.touchpoint.dk Cross Site Scripting vulnerability OBB-2286562

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Proposed UK Law Bans Default Passwords

Following Californias lead, a new UK law would ban default passwords in IoT devices...

New law will issue bans, fines for using default passwords on smart devices

The idea of connecting your entire home to the internet was once a mind-blowing concept. Thanks to smart devices, that concept is now a reality. However, this technological advancement aimed at making our lives more convenient—not to mention very cool and futuristic!—has also opened a wide door f...

moodle.windsor-forest.ac.uk Cross Site Scripting vulnerability OBB-2279863

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

SharkBot Android banking Trojan cleans users out

Researchers have discovered and analyzed a new Android banking Trojan that allows attackers to steal sensitive banking information such as user credentials, personal information, current balance, and even to perform gestures on the infected device. According to the researchers, SharkBot...

Airangel Hsmx Gateway Cross-Site Scripting Vulnerability

Airangel Hsmx Gateway is a platform from Airangel UK. It is used to manage authentication and billing in the network.A cross-site scripting vulnerability exists in versions of Airangel Hsmx Gateway prior to 5.2.04, which stems from a lack of data validation filtering of user-supplied data and...

Airangel Hsmx Gateway Credential Disclosure Vulnerability

Airangel Hsmx Gateway is a platform from Airangel UK. Used to manage authentication and billing in the network, a credential disclosure vulnerability exists in versions prior to Airangel Hsmx Gateway 5.2.04, which stems from the presence of weak SSH credentials in Airangel HSMX Gateway devices. A...