Apple iOS Patch Blunder Opens Updated iPhones to Jailbreaks

Apple’s most recent operating system update, iOS 12.4, accidentally unpatched a fix that had been issued in a previous update — leaving devices vulnerable to code execution and privilege-escalation attacks. The flaw also allows phones to be jailbroken — and a public jailbreak has just been releas...

Unique Monokle Android Spyware Self-Signs Certificates

A never-before-publicized mobile spy tool, a mobile surveillanceware remote access trojan RAT for Android called Monokle, has been spotted using novel techniques to exfiltrate data. According to the Lookout researchers who discovered Monokle in the wild, the malware has the ability to self-sign...

Protecting Against Ransomware Attacks: A Checklist

Sometimes all it takes is a malicious email to infect an entire municipality with ransomware, freezing important city systems from water utilities or websites. That was the case with the Florida city of Riviera Beach, which paid hackers $600,000 after being hit by a ransomware attack that downed...

The Future is Female: A Key to the Cybersecurity Workforce Challenge

By 2022, 2 million cybersecurity positions globally are projected to be open, even as the threat landscape accelerates and becomes more complex. To meet this growing workforce shortage, women are a crucial, largely untapped reservoir of talent that businesses should be courting. In this Threatpos...

Tor Browser Issues Update for Critical System Takeover Flaw

Tor Browser has updated to version 8.5.2, to address a critical security flaw in Mozilla’s Firefox browser that is under active exploit in the wild. The critical flaw CVE-2019-11707 is a type confusion vulnerability in the Array.pop, which is an array method that is used in JavaScript objects in...

Top 5 Configuration Mistakes That Create Field Days for Hackers

Sometimes it’s the little things that lead to big consequences. When it comes to cybersecurity, hacks more often than not stem from minor missteps – or even completely preventable, obvious mistakes. Common security mistakes and overlooked misconfigurations can open the door for attackers to drop...

Ever-Changing Emotet Evolves Again with Fresh Evasion Tactic

The Emotet trojan has seen a spike in activity in the last month, with a campaign that once again showcases its ability to evolve quickly: It’s now employing a different delivery mechanism than has previously been seen, in what appears to be an effective tactic for evasion. Emotet, which has beco...

Coffee Meets Bagel Dating App Warns Users of Breach

Popular dating app Coffee Meets Bagel has sent its users an email notifying them that their data may have been “acquired by an unauthorized party.” The news comes days after a massive database containing the information of around 6.2 million Coffee Meets Bagel users showed up on the Dark Web. Use...

Attackers Completely Destroy VFEmail's Secure Mail Infrastructure

A catastrophic, smash-and-destroy cyberattack has eliminated the U.S. infrastructure for secure email service VFEmail. It’s a rare example of a purely destructive offensive, apparently unmotivated by financial gain or espionage goals. An attacker wiped out the company’s U.S. servers on Monday...

APT28 Using EternalBlue to Attack Hotels in Europe, Middle East

Russian-speaking cyberespionage group APT28, also known as Sofacy, is believed to be behind a series of attacks last month against travelers staying in hotels in Europe and the Middle East. APT28 notably used the NSA hacking tool EternalBlue as part of its scheme to steal credentials from busines...

New Bug in Internet Explorer Used in Targeted Attacks

There’s a new flaw in all of the current versions of Internet Explorer that is being used in some targeted attacks right now. Microsoft has confirmed the bug and said it is working on a fix, but has no timeline for the patch release yet. The company did not rule out an emergency out-of-band patch...

Firewall Bug Under Active Attack Triggers CISA Warning

Software running Palo Alto Networks’ firewalls is under attack, prompting U.S. Cybersecurity and Infrastructure Security Agency CISA to issue a warning to public and federal IT security teams to apply available fixes. Federal agencies urged to patch the bug by September 9. Earlier this month, Pal...

Mitel VoIP Bug Exploited in Ransomware Attacks

Ransomware groups are abusing unpatched versions of a Linux-based Mitel VoIP Voice over Internet Protocol application and using it as a springboard plant malware on targeted systems. The critical remote code execution RCE flaw, tracked as CVE-2022-29499, was first report by Crowdstrike in April a...

Auditors: Feds’ Cybersecurity Gets the Dunce Cap

Out of eight U.S. federal agencies identified two years ago with critical cybersecurity failures, seven still don’t meet basic standards, a new audit report found. The Federal government’s overall posture was given just a C-. Audited agencies included the Departments of State, Homeland Security,...

HPE Fixes Critical Zero-Day in SIM

Hewlett Packard Enterprise HPE has fixed a critical zero-day remote code execution RCE flaw in its HPE Systems Insight Manager SIM software for Windows that it originally disclosed in December. HPE SIM is a tool that enables remote support automation and management for a variety of HPE servers,...

DarkSide Getting Taken to ‘Hackers’ Court’ For Not Paying Affiliates

Cybercriminals who have worked as affiliates with ransomware group DarkSide, responsible for the Colonial Pipeline attack, are having a tough time getting paid for their work now that the group has had its operations interrupted; so, they’re turning to admins of the group’s Dark Web criminal foru...

Nvidia Warns: Severe Security Bugs in GPU Driver, vGPU Software

Nvidia has disclosed a group of security vulnerabilities in the Nvidia graphics processing unit GPU display driver, which could subject gamers and others to privilege-escalation attacks, arbitrary code execution, denial of service DoS and information disclosure. Meanwhile, the Nvidia virtual GPU...

Animal Jam Hacked, 46M Records Roam the Dark Web

The company behind the wildly popular kids’ game Animal Jam has announced that hackers stole a menagerie of account records during a breach of a third-party vendor’s server in October — more than 46 million of them, in fact. The company, WildWorks, said that it was unaware that the data had been...

WhatsApp Discloses 6 Bugs via Dedicated Security Site

Facebook-owned WhatsApp has fixed six previously undisclosed vulnerabilities in its chat platform, revealing the move on a new dedicated security advisory site aimed at informing its more than 2 million users about bugs and keeping them updated on app security. The site is part of an effort by...

First-Ever Russian BEC Gang, Cosmic Lynx, Uncovered

Researchers say they have discovered the first-ever reported Russian business email compromise BEC cybercriminal ring, showing that sophisticated attackers beyond the usual Nigerian scammers are setting their sights on the email-based attack vector. The BEC gang is called Cosmic Lynx, and has bee...

Oracle Tackles a Massive 405 Bugs for Its April Quarterly Patch Update

Oracle admins are staring down the barrel of a massive quarterly Critical Patch Update that includes 405 patches. Business software giant Oracle Corp. revealed 286 of those vulnerabilities are remotely exploitable across nearly two dozen product lines. Impacted with multiple critical flaws, rated...

FIN6 and TrickBot Combine Forces in 'Anchor' Attacks

Researchers say, two cybercriminal groups, FIN6 and the operators of the TrickBot malware, have paired up together to target several organizations with TrickBot’s malware framework called “Anchor.” The two threat groups joining forces is a “new and dangerous twist” in an existing trend of...

Small Tax-Preparation Firms at Higher Risk this Tax Season, Report

This tax season crooks are targeting users with a new crop of scams that include leveraging remote desktop software and compromising small tax-prep company websites. “If you have the word ‘tax’ in your domain name; you’re a target this year,” warns Sherrod DeGrippo, senior director of threat...

News Wrap: PoC Exploits, Cable Haunt and Joker Malware

This week’s news wrap podcast breaks down the biggest Threatpost security stories of the week, including: Various proof-of-concept exploits being released for serious vulnerabilities this week – including for the recently-patched crypto-spoofing vulnerability found by the National Security Agency...

Hackers Deface U.S. Gov Website With Pro-Iran Messages

UPDATE A U.S. government website was vandalized late Saturday by hackers who posted images of a bloodied President Donald Trump being punched in the face and pro-Iran messages. The defaced website was the Federal Depository Library Program FDLP website, which makes U.S. federal government...

15 Years Later, Metasploit Still Manages to be a Menace

The popular penetration testing and hacking framework Metasploit may be getting long in the tooth, but it hasn’t lost its bite in the hands of bad actors. According to researchers, hackers are still using the tool and a highly effective technique called Shikata Ga Nai Japanese for “nothing can be...

Gustuff Android Banker Switches Up Technical Approach

An Instagram-initiated campaign using the Gustuff Android mobile banking trojan has rolled out in October, featuring an updated version of the malware that lowers its detection profile. How the cybercriminals are rolling out the campaign is the same as a previous offensive seen in June, according...

Docker Containers Riddled with Graboid Crypto-Worm

The Docker cloud containerization technology is the target for a just-discovered cryptojacking worm dubbed Graboid. According to researchers at Palo Alto’s Unit 42, the worm, which looks to mine the Monero cryptocurrency, has infected more than 2,000 unsecured Docker Engine Community Edition host...

Alabama Hospitals Pay Up in Ransomware Attack

An Alabama hospital system has paid its attackers in a ransomware attack that knocked its systems offline on Oct. 1. Officials at the DCH Health System didn’t say how much the hospitals paid for the decryption key, but noted that they have started a “methodical” process of system restoration. “We...

CISOs: Support vendor security ops for best cloud results

Data from McKinsey Insights suggests that many CISOs are uneasy about increasing dependence on SaaS applications and the security risks – real or perceived – the cloud represents. Their apprehension isn’t slowing down cloud adoption. As McKinsey put it, “Most companies … will eventually confront...

Forcepoint VPN Client is Vulnerable to Privilege Escalation Attacks

A vulnerability has been discovered in the Forcepoint VPN Client software for Windows. The flaw could enable an attacker – with an existing foothold on a system – to achieve an escalation of privilege, persistence and in some cases defense evasion. The vulnerability CVE-2019-6145 stems from an...

Venmo's Public Transactions Policy Stirs Privacy Concerns

Your simple $5 Venmo payment to a friend after splitting a pizza could easily expedite various malicious attacks, from stalking to spear-phishing, according to researcher concerns. Many have weighed in on Venmo’s privacy practices, but the latest are Mozilla Foundation and the Electronic Frontier...

Lenovo High-Severity Bug Found in Pre-Installed Software

Another flaw has been found in Lenovo’s decommissioned Lenovo Solution Centre software, preinstalled on millions of older-model PCs made by the world’s leading computer maker. The vulnerability is a privilege escalation flaw that can be used to execute arbitrary code on a targeted system, giving ...

VLC Media Player Allows Desktop Takeover Via Malicious Video Files

Two high-risk vulnerabilities in the VLC media player could allow an adversary to craft a malicious .MKV video file that could be used in an attack to gain control of the victim’s PC. The flaws were made public Monday by the developer of the open-source VLC media player, VideoLAN project, who als...

How to Guide Users to Better Passwords by Learning from Attackers

If you’re human, you’ve probably re-used a password or two. In fact, the majority of internet users between the ages of 18-65 have done so, and the younger you are, the more likely it is that you use just one password for all of your accounts. Article written by: Chris LaConte, Chief Strategy...

TikTok Scammers Cash In On Adult Dating, Impersonation Tricks

As social media platform TikTok becomes the top App Store download in 2019 – and the number three app download on Google Play and on platforms overall – scammers are looking to cash in on the troves of younger users of the popular platform. Tenable researcher Satnam Narang, who has been tracking...

Salesforce Woes Linger as Admins Clean Up After Service Outage

After a massive service outage on Friday, software-as-a-service giant Salesforce restored partial access to its affected customers over the weekend, while admins continued with cleanup into Monday. The outage was brought on by a scripting error that affected all Pardot marketing automation softwa...

Twitter Leaks Apple iOS Users' Location Data to Ad Partner

Twitter has disclosed a security bug in its platform that it said inadvertently leaked iOS users’ location data. The Twitter for iOS bug leaked location data at the ZIP code or city level, according to the social media company’s announcement on Monday. Twitter stressed that it has fixed the bug,...

Privacy Regulations Needed for Next-Gen Cars

Driverless automobiles, long-haul trucks and military transport vehicles are on a fast track for wide deployment over the next five to 10 years. That much is clear. Vehicle manufacturers are all in, and innovation is racing forward. Meanwhile, captains of industry and political leaders are eager ...

Swagger Vulnerability Leads to Arbitrary Code Injection

An unexpected behavior in a relatively new and popular open source API framework called Swagger could lead to code execution, researchers at Rapid7 said. The company today disclosed some details on the vulnerability, and released a Metasploit exploit module and a proposed patch written by...

April Patch Tuesday Fixes 11 Vulnerabilities, Last Updates for XP

As expected, Microsoft issued its final epitaph for Windows XP today, pushing out four security bulletins for 11 vulnerabilities, including the last updates for the oft-maligned, thirteen-year-old operating system. Despite it being XP’s last gasp from a security standpoint, it’s actually a...

Attackers Can Use 'Self-Destruct' Feature to Kill Flame

The attackers behind Flame can easily clean up compromised computers, according to research by security firm Symantec who found that some attackers have been able to use command-and-control C&C servers to completely remove the malware from certain machines. According to a post on Symantec’s...

Serious new flaw found in IIS 6.0

A new remotely-exploitable vulnerability has been found in the Microsoft IIS 6.0 Web server. The flaw is quite similar to one that was discovered eight years ago in earlier versions of IIS, and exploitation of the weakness could enable an attacker to upload content to the vulnerable server. The...

Facebook’s In-app Browser on iOS Tracks ‘Anything You Do on Any Website’

Users of Apple’s Instagram and Facebook iOS apps are being warned that both use an in-app browser that allows parent company Meta to track ‘every single tap’ users make with external websites accessed via the software. Researcher Felix Krause, who outlined how Meta tracks users in a blog posted...

Sysrv-K Botnet Targets Windows, Linux

Unpatched vulnerabilities in the Spring Framework and WordPress plugins are being exploited by cybercriminals behind the Sysrv botnet to target Linux and Windows systems. The goal, according to researchers, is to infect systems with cryptomining malware. The botnet variant is being called Sysrv-K...

The Uncertain Future of IT Automation

The majority of today’s cybersecurity breaches stem from unpatched vulnerabilities and outdated systems, which means that many cyberattacks are preventable. Unfortunately, it can be challenging for IT teams to keep up with the pace of new patches every month, especially when employee devices are...

BotenaGo Botnet Code Leaked to GitHub, Impacting Millions of Devices

The BotenaGo botnet source code has been leaked to GitHub, putting millions of routers and internet-of-things IoT devices at risk, researchers said. In a Wednesday report, AT&T Alien Labs – which first discovered the difficult-to-detect malware in November – said it expects that the ready...

Apple Patches 3 More Zero-Days Under Active Attack

Apple has patched three actively exploited zero-day security vulnerabilities in updates to iOS and macOS, one of which can allow an attacker to execute arbitrary code with kernel privileges. Apple released two updates on Thursday: iOS 12.5.5, which patches three zero-days that affect older versio...

WeSteal: A Cryptocurrency-Stealing Tool That Does Just That

Some cybercriminals try, at least, to cover their dirty work with a threadbare “this will throw off the lawsuits” blanket of legitimacy. For example, phone-tracking tools that silently install and operate and which are supposedly meant for parents to legally watch out for their kids in actuality,...

TrickBot Takes Over, After Cops Kneecap Emotet

A massive malicious spam campaign, along with the global takedown of Emotet, has vaulted the TrickBot trojan to the top of the Check Point’s list of the most popular malware among cybercriminals for February. In January, TrickBot was ranked third on Check Point’s list, and it was fourth overall f...