Week in security (February 26 – March 4)

Last week on Malwarebytes Labs, we explained how to protect your computer from malicious cryptomining, we gave an encryption 101 lesson using ShiOne ransomware as a case study, and we offered an explanation about SQL injection. We also released a report on the state of malicious cryptomining from...

US Air Force Hacked for Good at HackerOne’s Bug Bounty Event

By Uzair Amir 106 Security Flaws Identified in Operationally Significant DoD Websites under This is a post from HackRead.com Read the original post: US Air Force Hacked for Good at HackerOne's Bug Bounty Event...

Red Hat Releases Security Guidance for Memcached

Red Hat has released security recommendations to address potential Distributed Denial of Service attacks using Memcached. This misconfiguration could allow an attacker to exploit Memcached services as a reflection and amplification vector, causing unexpected volumes of traffic to be sent to...

National Consumer Protection Week

March 4–10 is National Consumer Protection Week NCPW, an event to encourage people and businesses to learn more about avoiding scams and understanding consumer rights. During NCPW, the Federal Trade Commission FTC and its partners highlight free resources to help protect consumers. NCCIC/US-CERT...

Personal Data of 21,426 US Marine Force Reserve Personnel Leaked

By Waqas The United States Marine Corps Force Reserve has become a This is a post from HackRead.com Read the original post: Personal Data of 21,426 US Marine Force Reserve Personnel Leaked...

ISC Releases Security Advisories for DHCP, BIND

The Internet Systems Consortium ISC has released updates or workarounds that address vulnerabilities in versions of ISC Dynamic Host Configuration Protocol DHCP and Berkeley Internet Name Domain BIND. A remote attacker could exploit these vulnerabilities to cause a denial-of-service condition...

Cellebrite Unlocks iPhones for the US Government

Forbes reports that the Israeli company Cellebrite can probably unlock all iPhone models: Cellebrite, a Petah Tikva, Israel-based vendor that's become the U.S. government's company of choice when it comes to unlocking mobile devices, is this month telling customers its engineers currently have th...

scimetrica.com XSS vulnerability

Open Bug Bounty ID: OBB-569470 Description| Value ---|--- Affected Website:| scimetrica.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Developer of NanoCore RAT that targeted Canada, US & Steam jailed

By Waqas The developer of NanoCore RAT remote access Trojan has been sentenced This is a post from HackRead.com Read the original post: Developer of NanoCore RAT that targeted Canada, US & Steam jailed...

merriam-webster.com XSS vulnerability

Open Bug Bounty ID: OBB-566650 Description| Value ---|--- Affected Website:| merriam-webster.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

HackerOne: Program profile_metrics.json contains time to triage for deptofdefense even it's turned off

Hello Hackerone Security Team, Summary 1 Well, in your previous report, it was revealing about Time to Triage for WordPress which you fixed it. 2 However, the program US dept of defense doesn't have profile metrics which we can't display any certain info. But, still profilemetrics.json leaks the...

FTC Releases Article on Choosing VPN Apps for Mobile Phones

The Federal Trade Commission FTC has issued guidance to consumers considering using a Virtual Private Network VPN for their mobile phones. Some mobile phone users choose to use VPNs to shield the information on their phones when using public Wi-Fi networks. NCCIC/US-CERT encourages consumers to...

Cisco Releases Security Updates for Multiple Products

Cisco has released several updates to address vulnerabilities affecting multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. NCCIC/US-CERT encourages users and administrators to review the following Cisco Security Advisories and...

IC3 Issues Alert on Increase in W-2 Phishing Campaigns

The Internet Crime Complaint Center IC3 has issued an alert on the increase in W-2-related phishing campaigns. Fraudsters often use tax-related phishing emails to get victims to provide personally identifiable information, click on a malicious link, or pay a ransom. NCCIC/US-CERT encourages...

Browsealoud plugin hacked to mine Monero on 4,000 Govt websites

By Waqas There were thousands of UK and US government websites mining Monero This is a post from HackRead.com Read the original post: Browsealoud plugin hacked to mine Monero on 4,000 Govt websites...

Microsoft Releases February 2018 Security Updates

Microsoft has released updates to address vulnerabilities in Microsoft software. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. NCCIC/US-CERT encourages users and administrators to review Microsoft's February 2018 Security Update Summary and...

Adobe Releases Security Updates

Adobe has released security updates to address vulnerabilities in Adobe Experience Manager, Acrobat, and Reader. A remote attacker could exploit these vulnerabilities to take control of an affected system. NCCIC/US-CERT encourages users and administrators to review Adobe Security Bulletin APSB18-...

U.S. Arrests 13, Charges 36 in ‘Infraud’ Cybercrime Forum Bust

The U.S. Justice Department announced charges on Wednesday against three dozen individuals thought to be key members of 'Infraud," a long-running cybercrime forum that federal prosecutors say cost consumers more than a half billion dollars. In conjunction with the forum takedown, 13 alleged Infra...

Cisco Releases Security Updates for Multiple Products

Cisco has released several updates to address vulnerabilities affecting multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. NCCIC/US-CERT encourages users and administrators to review the following Cisco Security Advisories and...

Poor Security at the UK National Health Service

The Guardian is reporting that "every NHS trust assessed for cyber security vulnerabilities has failed to meet the standard required." This is the same NHS that was debilitated by WannaCry. EDITED TO ADD 2/13: More news. And don't think that US hospitals are much better...