iOS Developer Site at Core of Facebook, Apple Watering Hole Attack

UPDATE – The missing link connecting the attacks against Apple, Facebook and possibly Twitter is a popular iOS mobile developers’ forum called iPhoneDevSDK which was discovered hosting malware in an apparent watering hole attack that has likely snared victims at hundreds of organizations beyond t...

Errors, Outliers Obscure Cybercrime Losses

Estimates of the extent of cyber crime are hopelessly overblown, two computer security researchers argue in an editorial from Sunday’s New York Times. Arguing counter to the prevailing opinion that online crime is a modern day Yukon Gold Rush for entrepreneurial hackers, the two Microsoft...

Ten Years After Gates's Memo, Effects Still Being Felt

Ten years. That’s a really long time. Think about what you were doing 10 years ago. Can you even remember? Maybe you were in college or high school, or cripes, even grade school. Or maybe you were working in security already, trying to figure out why your network kept getting overrun by viruses a...

Mobile Madness

Admit it. It would scarcely break your heart if the legions of slack-jawed smartphone Facebook and FourSquare gawkers were forced to confront their own digital mortality – however briefly – with a few scary exploits made just for them. In 2011, the untethered among us saw several mobile security...

Alex Lanstein on the Rustock Botnet Takedown

Dennis Fisher talks with Alex Lanstein of FireEye about this week’s takedown of the Rustock botnet, the important legal precedent it helped set with Microsoft’s lawsuit and the mechanics behind the operation and dismantling of large-scale botnets. Podcast audio courtesy of sykboy65 Subscribe to t...

Apple Mega Patch Covers 88 Mac OS X Vulnerabilities

Apple Mega Patch Covers 88 Mac OS X Vulnerabilities Apple today released one of its biggest Mac OS X security updates in recent memory, covering a whopping with fixes for 88 documented vulnerabilities. The Mac OS X v10.6.3 update, which is considered “critical,” covers flaws that could lead to...

Gaming, Banking Trojans Dominate Mobile Malware Scene

The number of cyberattacks launched against mobile users was down last year, researchers have found — but don’t pop the champagne just yet. The decline was offset by jacked-up, more sophisticated, more nimble mobile nastiness. In a Monday report, Kaspersky said that its researchers have observed ...

Kill Cloud Risk: Get Everybody to Stop Fighting Over App Security - Podcast

Brought to you by Uptycs. Underwriters of Threatpost podcasts do not assert any editorial control over content. Applications are cybercriminals’ favorite ways to crack open targeted organizations. Yet no single team or process can assure the rollout of safe cloud applications. From code design to...

BotenaGo Botnet Code Leaked to GitHub, Impacting Millions of Devices

The BotenaGo botnet source code has been leaked to GitHub, putting millions of routers and internet-of-things IoT devices at risk, researchers said. In a Wednesday report, AT&T Alien Labs – which first discovered the difficult-to-detect malware in November – said it expects that the ready...

3.8 Billion Users’ Combined Clubhouse, Facebook Data Up for Sale

On its own, the database of 3.8 billion phone numbers leaked from social-media platform Clubhouse didn’t have much value on the underground market. In fact, they were eventually dumped in a hacker forum for free. But an enterprising threat actor has reportedly combined those phone numbers with 53...

Critical Azure Cosmos DB Bug Allows Full Cloud Account Takeover

A critical security vulnerability in Microsoft’s Azure cloud database platform – Cosmos DB – could have allowed full remote takeover of accounts, with admin rights to read, write and delete any information to a database instance. According to researchers at Wiz, any Azure customer could access...

A New Security Paradigm: External Attack Surface Management

Ran Nahmias, Co-founder and CBO, Cyberpion In the past, a web application or online service could be taken at face value by your customers and employees. It was created, developed, and secured by your organization, and every element of the IT infrastructure that supported that service was under...

Linux Kernel Bug Opens Door to Wider Cyberattacks

An information-disclosure security vulnerability has been discovered in the Linux kernel, which can be exploited to expose information in the kernel stack memory of vulnerable devices. Specifically, the bug CVE-2020-28588 exists in the /proc/pid/syscall functionality of 32-bit ARM devices running...

Aliens and UFOs: A Final Frontier for Social Engineers

Buried deep within the most recent round of COVID-19 stimulus legislation was a little provision with potentially explosive consequences: The Pentagon has six months to release a full report on what they know about the existence of what they term Unidentified Aerial Phenomena UAP — or UFOs to the...

The TLS 1.2 Deadline is Looming, Do You Have Your Act Together?

In the pantheon of security configuration duties for organizations running internet assets, maintaining the latest TLS encryption protocols to keep the cryptographic apparatus at full strength is one of the most fundamental. TLS provides cover for the most sensitive personal and financial...

Adobe Discloses Critical Code-Execution Bugs in July Update

Adobe has released its scheduled July 2020 security updates, covering flaws in five different product areas: Creative Cloud Desktop; Media Encoder; Download Manager; Genuine Service; and ColdFusion. Four of the bugs are rated critical in severity, with the others ranked as important. Most of the...

Troves of Zoom Credentials Shared on Hacker Forums

Hackers have a new favorite topic of conversation on underground forums: How to obtain – and leverage – valuable credentials for Zoom, Skype, Webex and other web conferencing platforms increasingly used by remote workers. That’s what Etay Maor, chief security officer at IntSights, has discovered...

Cisco Warns of High-Severity SD-WAN Flaws

Cisco Systems has fixed three high-severity vulnerabilities in its software-defined networking for wide-area network SD-WAN solutions for business users. If exploited, the flaws could enable bad actors to execute commands with root privileges on affected systems. To exploit the vulnerabilities...

Mozilla Firefox 73 Browser Update Fixes High-Severity RCE Bugs

Mozilla has launched the latest version of its Firefox browser, which knocks out high-severity security flaws that leave systems open to attack by a remote adversary. The patched version of Mozilla’s browser, launched on Tuesday, is Firefox 73 and Firefox ESR 68.5. The Firefox ESR browser is its...

Fake Smart Factory Honeypot Highlights New Attack Threats

A honeypot set up to observe the current security landscape in smart manufacturing systems observed numerous threats—including cryptomining malware and ransomware—in just a few months, highlighting the new threats that industrial control systems ICS face with increased exposure to the internet...

Podcast: NSA Reports Major Crypto-Spoofing Bug to Microsoft

A major Microsoft crypto-spoofing bug impacting Windows 10 made waves this Patch Tuesday, particularly as the flaw was found and reported by the U.S. National Security Agency NSA. Microsoft’s January Patch Tuesday security bulletin disclosed the “important”-severity vulnerability, which could all...

Venmo's Public Transactions Policy Stirs Privacy Concerns

Your simple $5 Venmo payment to a friend after splitting a pizza could easily expedite various malicious attacks, from stalking to spear-phishing, according to researcher concerns. Many have weighed in on Venmo’s privacy practices, but the latest are Mozilla Foundation and the Electronic Frontier...

Imperva Firewall Breach Exposes Customer API Keys, SSL Certificates

UPDATE Imperva, the security vendor, has made a security breach public that affects customers using the Cloud Web Application Firewall WAF product. Formerly known as Incapsula, the Cloud WAF analyzes requests coming into applications, and flags or blocks suspicious and malicious activity. Users’...

Gamers Beware: Zero-Day in Steam Client Affects All Windows Users

UPDATE A researcher has dropped a zero-day vulnerability that affects the Steam game client for Windows, after Valve said it wouldn’t fix it. Valve then published a patch, that the same researcher said can be bypassed. The bug is a privilege-escalation vulnerability that can allow an attacker to...

DHS Shortens Deadline For Gov Agencies to Fix Critical Flaws

A Department of Homeland Security DHS order now requires agencies to remediate critical vulnerabilities discovered on their systems in 15 days – cutting in half the previous deadline of 30 days. That’s according to a Tuesday binding directive, which is a compulsory order for federal, executive...

Facial Recognition 'Consent’ Doesn’t Exist, Threatpost Poll Finds

Half of respondents in a recent Threatpost poll said that they don’t believe consent realistically exists when it comes to real-life facial recognition. The recent poll of 170 readers comes as facial recognition applications continue to pop up in the real world – from airports to police forces...

Malware Payloads Hide in Images: Steganography Gets a Reboot

One of the challenges of cybersecurity is that overfocusing on one threat trend means that another one can sneak up on you. This is especially problematic as our networks and the attack surface expands. Beyond threat vectors, though, we also need to pay attention to the entire spectrum of threat...

Vendors Share Patch Updates on Spectre and Meltdown Mitigation Efforts

Intel, Amazon, Microsoft and others are playing down concerns over the impact of the massive Spectre and Meltdown vulnerabilities affecting computers, servers and mobile devices worldwide. The two flaws, Spectre and Meltdown, are far reaching and impact a wide range of microprocessors used in the...

Energy, Nuclear Targeted with Template Injection Attacks

Days after news broke last week that advanced, persistent threat actors penetrated nuclear facilities, researchers are explaining techniques used by adversaries to gain toeholds in similar targets in energy. Cisco Talos reported Friday that email-based attacks, leveraging template injection...

Misunderstanding APT Indicators of Compromise

Threatpost Op-Ed is a regular feature where experts contribute essays and commentary on what’s happening in security and privacy. Today’s contributors are Dave Dittrich and Katherine Carpenter. Reports of APT activities detail compromises spanning multiple organizations, sectors, industry...

Dennis Fisher and Mike Mimoso on the End of the Patch Tuesday Era, Section 215 and More

Dennis Fisher and Mike Mimoso talk about the end of the Patch Tuesday era for most Microsoft customers, the appeals court ruling on Section 215 metadata collection and Dennis’s idea for a security industry commission. Download: digitalunderground201.mp3 Music by Chris Gonsalves...

Critical Vulnerability in Premium WordPress Themes Allows for Site Takeover

A critical privilege escalation flaw found in two themes used by more than 90,000 WordPress sites can allow threat actors to take over the sites completely, researchers have found. WordFence Threat Intelligence Team researcher Ramuel Gall discovered the flaw, one of five vulnerabilities he found...

Apple Fixes 2 Zero-Day Security Bugs, One Exploited in the Wild

Apple on Wednesday released 13 patches for serious security bugs in macOS and 10 for flaws in iOS/iPadOS. They include fixes for two zero-day bugs, one of which may have been exploited by attackers in the wild. The first zero-day CVE-2022-22587 is a memory-corruption issue that could be exploited...

FIN8 Targets US Bank With New ‘Sardonic’ Backdoor

The financially motivated FIN8 cybergang used a brand-new backdoor – dubbed Sardonic by the Bitdender researchers who first spotted it – in attempted but unsuccessful breaches of networks belonging to two unidentified U.S. financial organizations. It’s a nimble newcomer, researchers wrote: “The...

5 Steps to Improving Ransomware Resiliency

The ransomware landscape is evolving, and ransomware is now one of the most popular for cybercriminals and damaging types of malwares. The JBS, Colonial Pipeline and Kaseya attacks are the recent high-profile examples of the impact of ransomware and the monumental consequences it can have: Shifts...

Kaseya Obtains Universal Decryptor for REvil Ransomware

Kaseya has obtained a master decryptor key for the REvil ransomware that locked up the systems of at least 60 of its customers in a spate of worldwide cyberattacks on July 2. The attacks, which exploited now-patched zero-days in the Kaseya Virtual System/Server Administrator VSA platform, affecte...

Google Warns Mac, Windows Users of Chrome Zero-Day Flaw

Google is hurrying out a fix for a vulnerability in its Chrome browser that’s under active attack – its third zero-day flaw so far this year. If exploited, the flaw could allow remote code-execution and denial-of-service attacks on affected systems. The vulnerability exists in Blink, the browser...

Adobe Fixes 7 Critical Flaws, Blocks Flash Player Content

Adobe Systems has patched seven critical vulnerabilities, which impact Windows, macOS and Linux users. The impact of the serious flaws range from arbitrary code execution to sensitive information disclosure. The software company’s regularly scheduled Tuesday security updates impact a slew of its...

Feds: K-12 Cyberattacks Dramatically on the Rise

The feds have warned that cyberattacks on the K-12 education sector are ramping up alarmingly. In an alert from the FBI and the Cybersecurity and Infrastructure Security Agency CISA, officials said that data from the Multi-State Information Sharing and Analysis Center MS-ISAC shows that in August...

Researcher: I Hacked Trump’s Twitter by Guessing Password

Dutch ethical hacker Victor Gevers claims it only took five attempts to guess the password to President Donald Trump’s Twitter account — “maga2020!”. That’s all he needed to hijack the @realdonaldtrump handle, according a report from Dutch newspaper de Volksrant, because it lacked even the most...

Game Titles Watch Dogs: Legion, Albion Both Targeted by Hackers

A ransomware gang that just emerged this month dubbed Egregor claims to have hacked the source code to the upcoming gaming release, Watch Dogs: Legion. And in separate gaming news, a popular fantasy title called Albion — a massive multiplayer online role-playing game MMORPG — has been hacked...

Medical Data Leaked on GitHub Due to Developer Errors

Developer error caused the leak of 150,000 to 200,000 patient health records stored in productivity apps from Microsoft and Google that were recently found on GitHub. Dutch researcher Jelle Ursem discovered nine separate files of highly sensitive personal health information PHI from apps such as...

Twitter Confirms it was Hacked in an Unprecedented Cryptocurrency Scam

Twitter locked down thousands of verified accounts belonging to elite Twitter users and high-profile companies Wednesday afternoon in an effort to prevent hackers from perpetrating a massive cryptocurrency scam. The accounts fell victim to a compromise of the company’s internal systems by a group...

Intel Fixes High-Severity Flaws in NUC, Discontinues Buggy Compute Module

Intel has stomped out high-severity flaws in its Next Unit Computing NUC mini PC firmware, and in its Modular Server MFS2600KISPP Compute Module. Overall, Intel addressed nine vulnerabilities across six products in its April security update – two of those being high-severity, and the rest being...

Critical Bugs in Rockwell, Johnson Controls ICS Gear

Security vulnerabilities that require very little skill to exploit have been discovered in industrial control systems ICS gear from Rockwell Automation and Johnson Controls, which anchor a flurry of bug disclosures impacting critical infrastructure. First, a set of critical vulnerabilities in...

Critical Cisco Bug Opens Software Licencing Manager to Remote Attack

A critical flaw in the High Availability HA service of Cisco Smart Software Manager On-Prem Base has been uncovered, which would open the door to remote attackers thanks to its use of a static, default password, even if the platform isn’t directly connected to the internet. Cisco Smart Software...

500 Malicious Chrome Extensions Impact Millions of Users

Researchers say that 500 Google Chrome browser extensions were discovered secretly uploading private browsing data to attacker-controlled servers, and redirecting victims to malware-laced websites. The browser extensions, all of which have now been removed, were downloaded millions of times from...

CISA Pushing U.S. Agencies to Adopt Vulnerability Disclosure Policies

The U.S. government’s cybersecurity agency has issued a draft directive mandating all agencies to develop vulnerability disclosure policies, which would give ethical hackers clear guidelines for submitting bugs found in government systems. Security experts hope that the directive will light a fir...

Oil and Gas Firms Targeted By New LYCEUM Threat Group

Researchers have identified a never-before-seen threat group targeting Middle East critical infrastructure organizations with novel malware, sent via spearphishing emails. The threat group, LYCEUM, was observed in 2019 sending spear phishing emails harboring malicious Microsoft Excel attachments ...

Tor Browser Issues Update for Critical System Takeover Flaw

Tor Browser has updated to version 8.5.2, to address a critical security flaw in Mozilla’s Firefox browser that is under active exploit in the wild. The critical flaw CVE-2019-11707 is a type confusion vulnerability in the Array.pop, which is an array method that is used in JavaScript objects in...