15946 matches found
IcedID Banking Trojan Surges: The New Emotet?
The banking trojan known as IcedID appears to be taking the place of the recently disrupted Emotet trojan, according to researchers. IcedID a.k.a. BokBot, bears similarities to Emotet in that it’s a modular malware that started life as a banking trojan used to steal financial information...
QNAP High-Severity Flaws Plague NAS Systems
QNAP Systems is warning of high-severity flaws that plague its top-selling network attached storage NAS devices. If exploited, the most severe of the flaws could allow attackers to remotely take over NAS devices. NAS devices are systems that consist of one or more hard drives that are constantly...
DeathStalker APT Spices Things Up with PowerPepper Malware
The DeathStalker advanced persistent threat APT group has a hot new weapon: A highly stealthy backdoor that researchers have dubbed PowerPepper, used to spy on targeted systems. DeathStalker offers mercenary, espionage-for-hire services targeting the financial and legal sectors, according to...
Animal Jam Hacked, 46M Records Roam the Dark Web
The company behind the wildly popular kids’ game Animal Jam has announced that hackers stole a menagerie of account records during a breach of a third-party vendor’s server in October — more than 46 million of them, in fact. The company, WildWorks, said that it was unaware that the data had been...
Maze Ransomware Adopts Ragnar Locker Virtual-Machine Approach
The operators of the Maze ransomware have added a fresh trick to their bag of badness: Distributing ransomware payloads via virtual machines VM. It’s a “radical” approach, according to researchers, meant to help the ransomware get around endpoint defense. That’s according to researchers with Soph...
Google Squashes Critical Android Media Framework Bug
Google patched a critical vulnerability in the Media Framework of its Android operating system, which if exploited could lead to remote code execution attacks on vulnerable devices. Overall, Google fixed flaws tied to 53 CVEs as part of its September security updates for the Android operating...
Facebook Privacy Glitch Gave 5K Developers Access to ‘Expired’ Data
Facebook is facing yet another privacy faux pas in how its users’ data is collected and used by third-party apps. The social media giant said that it recently discovered that 5,000 developers received data from Facebook users — long after their access to that data should have expired. In 2018, on...
Beyond Zoom: How Safe Are Slack and Other Collaboration Apps?
As the coronavirus pandemic continues to worsen, remote-collaboration platforms – now fixtures in many workers’ “new normal” – are facing more scrutiny. Popular video-conferencing app Zoom may currently be in the cybersecurity hot seat, but other collaboration tools, such as Slack, Trello, WebEx...
Have I Been Pwned No Longer For Sale
After announcing last year that he was looking to sell Have I Been Pwned HIPB, Troy Hunt said this week that the popular service has been pulled off the market and will instead continue to be run independently. HIBP offers a free service for consumers to check if their usernames and passwords hav...
Active Exploits Hit Vulnerable WordPress ThemeGrill Plugin
Researchers are urging users of a vulnerable WordPress plugin, ThemeGrill Demo Importer, to update as soon as possible after discovering attackers are actively exploiting a flaw in the plugin. The ThemeGrill Demo Importer plugin is owned by ThemeGrill, which offers various templates for website...
FBI Plans to Inform States of Election Breaches
The FBI has changed its policy around election cybersecurity and said it will now notify state officials in the event that local election systems are hacked. The move—revealed in a media briefing Thursday and then published online later that day—extends the number of election officials who are...
SDKs Misused to Scrape Twitter, Facebook Account Info
Twitter and Facebook are warning of software development kits SDKs that could be embedded within a mobile application and used to harvest personal user information. The SDKs, which the tech giants said are maintained by oneAudience and MobiBurn, could be used by mobile app developers to craft...
D-Link Adds More Buggy Router Models to ‘Won’t Fix’ List
D-Link has warned that more of its routers are vulnerable to critical flaws that allow remote hackers to take control of hardware and steal data. The routers won’t be fixed, said D-Link, explaining that the hardware has reached its end-of-life and will no longer receive security updates. The...
Threat Actor Impersonates USPS to Deliver Backdoor Malware
A new threat actor has been found impersonating the U.S. Postal Service USPS and other government agencies to deliver and install backdoor malware to various organizations in Germany, Italy and the United States, according to new research. The campaigns, which researchers from cybersecurity firm...
Forcepoint VPN Client is Vulnerable to Privilege Escalation Attacks
A vulnerability has been discovered in the Forcepoint VPN Client software for Windows. The flaw could enable an attacker – with an existing foothold on a system – to achieve an escalation of privilege, persistence and in some cases defense evasion. The vulnerability CVE-2019-6145 stems from an...
200k Personal Records Exposed by Events Planning Firm
A database belonging to Australian event planning startup, Amazingco, was found leaking more than 200,000 records with personal details tied to children’s entertainment, wine tour events and more. Amazingco, which is based in Austrailia but offers services in New Zealand and the U.S., connects...
Joomla and WordPress Found Harboring Malicious Redirect Code
Security researchers are warning owners of Joomla and WordPress websites of a malicious redirect script that is pushing visitors to malicious websites. On Thursday, Eugene Wozniak, a security researcher with Sucuri, published a report outlining a rogue hypertext access .htaccess injector found on...
Mozilla Tackles Two Critical Flaws with Firefox 67 Release
Mozilla patched several critical vulnerabilities with the release of its Firefox 67 browser on Tuesday. The worst of the bugs patched are two memory safety flaws that could allow attackers to exploit the vulnerabilities to take control of an affected system, according to a security bulletin issue...
Researchers in the Dark on Powerful LightNeuron Malware for Years
LightNeuron, a backdoor specifically designed to target Microsoft Exchange mail servers, has flown under the radar since at least 2014, despite being the malware linchpin at the center of several targeted campaigns. A fresh analysis of the recently uncovered code shows that it’s the first publicl...
ThreatList: Half of All Attacks Aim at Supply Chain
Increasingly sophisticated attacks that target supply chains, counter-incident response and lateral movement within a network are quickly becoming the new normal in the corporate security threat landscape. That’s according to Carbon Black’s latest quarterly Global Incident Response Threat Report,...
Zero-Day Bug Lays Open TP-Link Smart Home Router
A zero-day bug has been uncovered in the TP-Link SR20 smart hub and home router, which would allow a local adversary to execute arbitrary commands on the device without authentication and establish a persistent backdoor for remote access. The SR20 is an all-in-one router that can also work as an...
Oracle Patches Apache Struts, Reminds Users to Update Equifax Bug
Oracle released fixes for a handful of recently patched Apache Struts 2 vulnerabilities, including a critical remote code execution vulnerability CVE-2017-9805 that could let an attacker take control of an affected system, late last week. The Apache Software Foundation patched the RCE...
Cody Pierce on the Future of Exploit Development
Mike Mimoso talks to Cody Pierce, director of vulnerability research and prevention with Endgame, at RSA Conference 2017 about how attackers are changing their techniques in the face of mitigations and continuing to base exploits around legitimate APIs and functions to thwart detection. Download:...
Complete Microsoft EMET Bypass Developed
SAN FRANCISCO — Researchers at Bromium Labs are expected to announce today they have developed an exploit that bypasses all of the mitigations in Microsoft’s Enhanced Mitigation Experience Toolkit EMET. Principal security researcher Jared DeMott is scheduled to deliver a presentation this morning...
February 2014 Microsoft Patch Tuesday Security Bulletins
The expected continued respite from deploying Internet Explorer patches was apparently a mirage as Microsoft changed course from last Thursday’s advance notification and added two more bulletins to the February 2014 Patch Tuesday security updates, including the first IE rollup of 2014. IE had...
Microsoft Reveals Blue Hat Prize Finalists
Microsoft has announced the three finalists for its $200,000 Blue Hat Prize contest and all three of the researchers in the running for the win submitted technologies designed to defeat ROP return-oriented programming exploits. Each of the entrants takes a different tack with his ROP defense and ...
Microsoft to Pay $200,000 for Innovative Defense Technology in Blue Hat Prize Program
LAS VEGAS–In the face of mounting external pressure to begin paying bug bounties, Microsoft is instead launching a new program that will pay a $200,000 top prize to a security researcher who develops the most innovative defensive security technology. The program is designed to “inspire researcher...
Inside a Malicious PDF Attack
PDFs are widely used business file format, which makes them a common target for malware attacks. On the surface, PDFs are secure, but because they have so many “features,” hackers have learned how to hide attacks deep under the surface. By using a number of utilities, we are able to reverse...
New Flaw Found in Microsoft SharePoint
There is a cross-site scripting flaw in SharePoint 2007, Microsoft’s collaboration product, which could give an attacker the ability to execute arbitrary JavaScript code on a machine through a browser. High-Tech Bridge, a Swiss security firm, published an advisory about the vulnerability on...
Millions of Java Apps Remain Vulnerable to Log4Shell
Four months after the discovery of the zero-day Log4Shell critical flaw, millions of Java applications still remain vulnerable to compromise, researchers have found. Rezilion expected that due to the “massive amount of media coverage” the bug unsurprisingly received, the majority of applications...
Ukrainian DDoS Attacks Should Put US on Notice–Researchers
On Tuesday, institutions central to Ukraine’s military and economy were hit with a wave of denial-of-service DoS attacks, which sparked an avalanche of headlines around the world. The strike itself had limited impact — but the larger implications for critical infrastructure beyond the Ukraine are...
BillQuick Billing App Rigged to Inflict Ransomware
Threat actors have been caught exploiting a now-patched zero-day critical vulnerability in a popular timeclock and billing system, to take over vulnerable servers and inflict companies’ networks with ransomware. Discovered by Huntress Labs earlier this month, the ongoing attacks focus on an...
Cisco BPA, WSA Bugs Allow Remote Cyberattacks
A set of high-severity privilege-escalation vulnerabilities affecting Business Process Automation BPA application and Cisco’s Web Security Appliance WSA and could allow authenticated, remote attackers to access sensitive data or take over a targeted system. The first two bugs CVE-2021-1574 and...
TrickBot Takes Over, After Cops Kneecap Emotet
A massive malicious spam campaign, along with the global takedown of Emotet, has vaulted the TrickBot trojan to the top of the Check Point’s list of the most popular malware among cybercriminals for February. In January, TrickBot was ranked third on Check Point’s list, and it was fourth overall f...
Record Levels of Software Bugs Plague Short-Staffed IT Teams in 2020
2020 is shaping up to be a banner year for software vulnerabilities, leaving security professionals drowning in a veritable sea of patching, reporting and looming attacks, many of which they can’t even see. A trio of recent reports tracking software vulnerabilities over the past year underscore t...
Google Chrome 87 Closes High-Severity 'NAT Slipstreaming' Hole
Google has released patches for several high-severity vulnerabilities in its Chrome browser with the rollout of Chrome 87 for Windows, Mac and Linux users. Overall, Google fixed 33 vulnerabilities in its latest version, Chrome 87.0.4280.66, which is being rolled out over the coming days. This...
Researchers Warn of Flaw Affecting Millions of IoT Devices
Researchers are urging connected-device manufacturers to ensure they have applied patches addressing a flaw in a module used by millions of Internet-of-Things IoT devices. If exploited, researchers speculated that the flaw could allow attackers to knock out a city’s electricity or even overdose a...
UPDATED: Garmin Suffers Reported Ransomware Attack
Garmin, maker of fitness trackers, smartwatches and GPS-related products, has reportedly suffered a widespread ransomware attack — though the facts around the cause remain unconfirmed for now. The manufacturer tweeted on Thursday that its Garmin Connect service is down; Garmin is a free app for...
Adobe Patches 18 Critical Flaws in Out-Of-Band Update
Adobe patched 18 critical vulnerabilities Tuesday impacting key products Adobe After Effects, Illustrator, Premiere Pro, Premiere Rush and Audition. The out-of-band fixes address vulnerabilities allowing an attacker to execute arbitrary code, if bugs are exploited. In its security bulletin Adobe...
Zeus Sphinx Banking Trojan Arises Amid COVID-19
The Zeus Sphinx banking trojan is back after being off the scene for nearly three years. According to researchers Amir Gandler and Limor Kessem at IBM X-Force, Sphinx a.k.a. Zloader or Terdot began resurfacing in December. However, the researchers observed a significant increase in volume in Marc...
Microsoft Warns of Critical Windows Zero-Day Flaws
Microsoft is warning of critical zero-day flaws in its Windows operating system that could enable remote code execution. The unpatched flaws are being exploited by attackers in “limited, targeted” attacks, the company said. According to Microsoft, two remote code execution vulnerabilities exist i...
Next-Gen Ransomware Packs a 'Human' Punch, Microsoft Warns
Researchers are warning that “human operated” ransomware campaigns are growing more sophisticated, adopting new infection tactics and lateral movement techniques that traditional defense teams aren’t equipped to handle. Researchers said that “auto-spreading” ransomware – like WannaCry and NotPety...
Walgreens Mobile App Leaks Prescription Data
Popular pharmacy chain Walgreens is warning that a bug in its official mobile app may have exposed sensitive data, including customers’ full names and information on prescriptions for medications they are taking. The security issue stemmed from an “error” in the personal secure messaging feature ...
Top Zero Days, Data Breaches and Security Stories of 2019: News Wrap
From data breaches and the ransomware epidemic to new regulation and an outcry around data privacy, 2019 has been a wild ride for the infosec community. Threatpost breaks down the top news stories, trends and topics for this year. Listen to the full podcast or download direct. For a lightly-edite...
NSO Group President Defends Controversial Tactics
In a rare public appearance by Shiri Dolev, the president of the secretive NSO Group Technologies, the company leader vented over what she called “false myths” about the firm. Dolev also took indirect aim at secure messaging platforms, offered by the likes of Facebook, explaining surveillance...
Hacking Back? BriansClub Dark Web Attack a Boon for Banks
UPDATE A Dark Web “carding store” called BriansClub, which specializes in selling stolen payment card information, has itself become a victim, with thieves making off with 26 million credit- and debit-card records. The site appears to be a target of roundabout “hacking back” by a competitor , who...
FunkyBot Malware Intercepts Android Texts, 2FA Codes
An Android malware dubbed “FunkyBot” has started making the scene in Japan, operated by the same attackers responsible for the FakeSpy malware. It intercepts SMS messages sent to and from infected devices. According to FortiGuard Labs, the malware named after logging strings found in the...
CEO 'Deep Fake' Swindles Company Out of $243K
In the first known case of successful financial scamming via audio deep fakes, cybercrooks were able to create a near-perfect impersonation of a chief executive’s voice – and then used the audio to fool his company into transferring $243,000 to their bank account. A deep fake is a plausible video...
Black Hat: LeapFrog Tablet Flaws Let Attackers Track, Message Kids
LAS VEGAS – Serious vulnerabilities have been disclosed in LeapFrog’s tablet for kids, the LeapPad Ultimate, once again throwing child data privacy into the spotlight. The LeapPad Ultimate is a rugged tablet made by LeapFrog that targets children with an array of education, game and eBook apps...
Why Cities Are a Low-Hanging Fruit For Ransomware
Ransomware attacks against local governments and cities are repeatedly making headlines, with crippling results on city operations and budgets. Last month, the Florida city of Riviera Beach paid hackers $600,000 after being hit by a ransomware attack that downed its computer systems for three...