Adobe Patches Flash Zero Day Under Attack

Adobe today released an emergency Flash Player update that includes a patch for a vulnerability being exploited in targeted attacks. The vulnerability, CVE-2016-7855, was privately disclosed by Neel Mehta and Billy Leonard of the Google Threat Analysis Group. Mehta was one of four researchers...

Google Plugs 21 Security Holes in Chrome Browser

Google on Wednesday patched 21 security vulnerabilities in Chrome, including a half dozen rated high severity that were reported by external researchers and were eligible for a bounty. Bug hunters earned a total of $30,000 in bounties, with a top payout of $7,500 to an unnamed researcher for a...

Cerber Ransomware On The Rise, Fueled By Dridex Botnet

Starting in April security experts at FireEye spotted a massive uptick in Cerber ransomware attacks delivered via a rolling wave of spam. Researchers there link the Cerber outbreaks to the fact that attackers are now leveraging the same spam infrastructure credited for making the potent Dridex...

AirDroid Patches Vulnerability Exposing Android Data

A critical vulnerability impacting 50 million Android users running the popular AirDroid application has been patched. AirDroid, an app that allows you link an Android device to a computer and send SMS messages, run apps and add contacts via a Wi-Fi connected web browser, released the patch Jan...

Ubuntu Patches Privilege-Escalation Bug

There is a privilege-escalation vulnerability in several versions of Ubuntu that results from the fact that the operating system fails to check permissions when users are creating files in some specific circumstances. Security researcher Philip Pettersson discovered the vulnerability and reported...

OPM Warned About Vulnerabilities, Governance Weaknesses

It’s hardly a surprise that the U.S. Office of Personnel Management OPM was targeted by nation-state hackers, given the sensitivity of the personal information the office stored. It’s also no shocker that OPM has been successfully infiltrated more than once given the state of its information...

Google Fixes Sandbox Escape in Chrome

Google has patched a high-risk vulnerability in its Chrome browser that allows an attacker to escape the Chrome sandbox. That vulnerability is one of 37 bugs fixed in version 43 of Chrome. Six of those flaws are rated as high risks and Google paid out more than $38,000 in rewards to researchers w...

June 2014 Microsoft Patch Tuesday security updates

As expected, Microsoft delivered a patch today for a zero-day vulnerability in Internet Explorer 8 that was disclosed by HP’s Zero Day Initiative three weeks ago, six months after it was reported to the ZDI. The IE8 patch, MS14-035, is included in a cumulative Internet Explorer rollup that patche...

SSL Vulnerabilities Found in Critical Non-Browser Software Packages

The death knell for SSL is getting louder. Researchers at the University of Texas at Austin and Stanford University have discovered that poorly designed APIs used in SSL implementations are to blame for vulnerabilities in many critical non-browser software packages. Serious security vulnerabiliti...

New PDF Attack Targets Aviation Defense Industry

FireEye reported today it had detected a new critical PDF attack targeting the aviation defense industry. Malware Page exploits a stack-based buffer overflow vulnerability in Adobe Acrobat and Adobe Reader. An attacker would be able to execute code remotely via a crafted argument to the getIcon...

Computer Virus Blacks Out Qatari Gas Producer

An “unknown virus” has shutdown the entire computer network of the world’s second largest liquefied natural gas LNG producer, RasGas, according to news reports. RasGas is based in Qatar, a peninsular nation located within the larger Arabian Peninsula. The LNG producer has reportedly been offline...

FDA: Software Failures Responsible for 24% Of All Medical Device Recalls

Software failures were behind 24 percent of all the medical device recalls in 2011, according to data from the U.S. Food and Drug Administration, which said it is gearing up its labs to spend more time analyzing the quality and security of software-based medical instruments and equipment. The FDA...

Intel Processor SYSRET Vulnerability Affecting Some 64-Bit Systems

A flaw exists in the way that a specific instruction is handled on some types of Intel 64-bit chips that could open up some operating systems and types of virtualization software to attacks, according to an alert issued last week but revised today by the United States Computer Emergency Readiness...

Google Patches 14 Chrome Bugs Ahead of Pwn2Own, Pays $30k in Special Rewards

Just two days before the annual Pwn2Own contest is set to begin at CanSecWest, Google has patched a huge set of serious vulnerabilities in its Chrome browser. In addition to the 14 high-risk flaws fixed in Chrome, the company also handed out rewards of $10,000 each to three researchers who...

Google Fixes Seven Flaws in New Chrome 14 Release

Google has fixed seven security vulnerabilities in its Chrome browser with a new release on Tuesday. Six of the bugs fixed in Chrome are rated high, with just one listed as critical. The company paid out $10,000 in bounties for the bugs it fixed in this release. In addition to the security fixes,...

Experts Converge at RFIDsec to Discuss NFC Security Implications

RFID security problems have been biting at the ankles of users and companies that deploy the technology for several years now, but they’ve been mostly on the fringes of mainstream security concerns. But now, as the technology becomes more widespread and pervasive, that is beginning to change...

New Malware Murofet Following Conficker's Lead

It’s been a blissful few months since Conficker last reared its over-hyped head, but now there’s a new piece of malware that is adopting some of the tactics that Conficker used. The malware, known as Murofet, is using Conficker’s technique of generating thousands of new domains for updates every...

Cryptome Outs Identities of Hackers Behind Breach

Less than a week after the Cryptome.org archive was hacked and defaced, the site has posted the names, addresses and phone numbers of two individuals it accuses of being involved in the attack. In an update on Friday, Cryptome founder John Young posted contact information for three individuals he...

'High Risk' Flaw Fixed in Google Chrome

Google has pushed out a new version of its Chrome browser to fix a high-severity security hole that could lead to malicious code execution attacks. The vulnerability could be exploited to run arbitrary code within the Google Chrome sandbox, the company said in an advisory. The raw details: The v8...

Adam Shostack on Privacy and the PETS '09 Workshop

Dennis Fisher talks with Microsoft’s Adam Shostack about the Privacy Enhancing Technologies Symposium, the definition of privacy in today’s world and the role of technology in helping to enhance and protect that privacy. Show notes: Adam’s blog post on “Understanding Privacy” by Dan Solove...

Adobe under fire for poor security response

In the wake of the zero-day attacks against Adobe’s Acrobat and Reader product lines, the company is taking a lot of flack for its poor response to handling the issue — specifically around communicating the risks and providing migitation guidance for end users. Over on the ZDNet Zero Day blog, I...

Scammers Target NFT Discord Channel

Discord a public chat application designed for gamers has grown popular among crypto owners all over the world. Attackers are targeting the Discord servers of several popular nonfungible token NFT projects. Josh Fraser founder of Origin protocol shared a thread on Twitter earlier this month,...

Thousands of Malicious npm Packages Threaten Web Apps

More than 1,300 malicious packages have been identified in the most oft-downloaded JavaScript package repository used by developers, npm, in the last six months — a rapid increase that showcases how npm has become a launchpad for a range of nefarious activities. New research from open-source...

Segway Hit by Magecart Attack Hiding in a Favicon

Segway, maker of the iconic – and much-spoofed – personal motorized transporter familiar from guided city tours everywhere, has been serving up a nasty credit-card harvesting skimmer via its website that’s likely linked to Magecart Group 12. That’s according to Malwarebytes, which noted that “We...

1.1M Compromised Accounts Found at 17 Major Companies

There have been more than 1.1 million online accounts compromised in a series of credential-stuffing attacks against 17 different companies, according to a New York State investigation. Credential-stuffing attacks, such as last year’s attack on Spotify, use automated scripts to try high volumes o...

‘Malsmoke’ Exploits Microsoft’s E-Signature Verification

Threat actors are exploiting Microsoft’s digital signature verification to steal user credentials and other sensitive information by delivering the ZLoader malware, which previously has been used to distribute Ryuk and Conti ransomware, researchers have found. Researchers at Check Point Research...

That Toy You Got for Christmas Could Be Spying on You

Many adults found it charming when Mattel upgraded its classic Fisher-Price Chatter telephone for its 60th anniversary in October with actual Bluetooth capabilities, so grownups, too, can use it — and for actual mobile phone calls. But flaws in the way the toy pairs with Bluetooth means that othe...

Top 10 Cybersecurity Best Practices to Combat Ransomware

If you’re like most IT professionals, the threat of a ransomware attack might keep you up at night. And you have a valid reason to worry — ransomware doesn’t discriminate. Organizations across every industry, public or private, are potential victims, if they haven’t been victims already. In fact,...

Magecart Credit Card Skimmer Avoids VMs to Fly Under the Radar

A new Magecart threat actor is stealing people’s payment card info from their browsers using a digital skimmer that uses a unique form of evasion to bypass virtual machines VM so it targets only actual victims and not security researchers. The Malwarebytes team discovered the new campaign, which...

Gigabyte Allegedly Hit by AvosLocker Ransomware

The AvosLocker ransomware gang is claiming that it breached tech giant Gigabyte and has leaked a sample of what it claims are files stolen from the Taiwanese company’s network. It’s offering to sell the rest. On Wednesday, the gang posted a “press release” announcing that it had purportedly gutte...

HP Omen Hub Exposes Millions of Gamers to Cyberattack

Millions of devices running the HP Omen Gaming Hub were using on a driver with a bug that could give attackers kernel-mode access without administrator privileges. HP has since released a patch, but a new report on the flaw CVE-2021-3437 from researchers from SentinelLabs details how the gaming...

Attackers Impersonate DoT in Two-Day Phishing Scam

Threat actors impersonated the U.S. Department of Transportation USDOT in a two-day phishing campaign that used a combination of tactics – including creating new domains that mimic federal sites so as to appear to be legitimate – to evade security detections. Between Aug. 16-18, researchers at...

Apple: Image-Detection Backdoor ‘Narrow’ in Scope

Apple provided additional design and security details this week about the planned rollout of a feature aimed at detecting child sexual abuse material CSAM images stored in iCloud Photos. Privacy groups like the Electronic Frontier Foundation warned that the process of flagging CSAM images...

XSS Bug in SEOPress WordPress Plugin Allows Site Takeover

A stored cross-site scripting XSS vulnerability in the SEOPress WordPress plugin could allow attackers to inject arbitrary web scripts into websites, researchers said. SEOPress is a search engine optimization SEO tool that lets site owners manage SEO metadata, social-media cards, Google Ad settin...

Ransomware Volumes Hit Record Highs as 2021 Wears On

Ransomware has seen a significant uptick so far in 2021, with global attack volume increasing by 151 percent for the first six months of the year as compared with the year-ago half. Meanwhile, the FBI has warned that there are now 100 different strains circulating around the world. From a...

Bad Apple: App Store Rife with Fraud, Fleeceware

A new analysis from the Washington Post reveals just how widespread fraud is across the Apple App Store, while also offering glimpse into the revenue flowing into Cupertino generated by those malicious activities. The Apple App Store has been under heightened scrutiny for maintaining its iron gri...

Securing Privileged Access Within Healthcare Orgs

Healthcare organizations have always been high-value targets for cybercriminals, as their networks store large volumes of personally identifiable information PII including Social Security numbers, dates of birth, addresses and very sensitive personal health data. Since the beginning of the COVID-...

Building Multilayered Security for Modern Threats

Considering recent announcements of major attacks caused by external malicious actors, including a ransomware attack on a U.S. gasoline pipeline, the need for increased security posture is as important as ever, and multilayered security remains the key. With rampant ransomware attacks and other...

It’s Time to Prepare for a Rise in Insider Threats

Earlier this year, Tesla discovered that an employee had stolen more than 6,000 files containing sensitive code. The software engineer, who was only employed for two weeks, had been hired as one of the few people who could access these files. This incident highlights the danger that insider threa...

DarkSide Suffers ‘Oh, Crap!’ Server Shutdowns

DarkSide, the ransomware-as-a-server RaaS gang that crippled Colonial Pipeline Co. a week ago, extorted around $5 million, and sent the fuel company a decryption tool that reportedly could barely limp through the process of unlocking files, has now been paralyzed itself. In the wee hours of Frida...

Apple’s ‘Find My’ Network Exploited via Bluetooth

Apple’s “Find My device” function for helping people track their iOS and macOS devices can be exploited to transfer data to and from random passing devices without using the internet, a security researcher has demonstrated. Security researcher Fabian Bräunlein with Positive Security developed a...

GitHub Prepares to Move Beyond Passwords

GitHub, the ubiquitous host for software development and version control and unfortunate target of a steady pitter-patter of attacks targeting the same, is now supporting security keys when using Git over SSH. In a post on Monday, GitHub security engineer Kevin Jones said that this is the next st...

Office 365 Cyberattack Lands Disgruntled IT Contractor in Jail

A former IT contractor has been sentenced to two years in prison after hacking into a company’s server and deleting the majority of its employees’ Microsoft Office 365 O365 accounts. The incident resulted in the company completely shutting down for two days. The 32-year-old contractor, Deepanshu...

Passwords, Private Posts Exposed in Hack of Gab Social Network

Distributed Denial of Secrets DDoSecrets, a self-proclaimed “transparency collective,” claim they have received more than 70 gigabytes of data exfiltrated from social media network Gab. Gab, which touts itself as “a social network that champions free speech, individual liberty and the free flow o...

Protecting Sensitive Cardholder Data in Today’s Hyper-Connected World

The payment processing system has steadily evolved over time. Greatly amplified by the COVID-19 pandemic, the use of electronic payment systems in this economy has soared nearly overnight. With online shopping at an all-time high as consumer behaviors shift toward more convenience and flexibility...

SolarWinds Hack Prompts Congress to Put NSA in Encryption Hot Seat

Members of Congress are demanding the U.S. National Security Agency NSA reveal what it knows about the 2015 Juniper Networks supply-chain delivery breach. In a letter sent by U.S. Senator Ron Wyden and nine additional members of Congress, the lawmakers demand a full account of the NSA-designed...

Researcher Builds Parler Archive Amid Amazon Suspension

A security researcher said she has scraped and is archiving 99 percent of Parler’s public posts, as the social-media network goes offline following suspensions from Amazon, Apple and Google. Archived content includes public posts from the social-media site. These posts reportedly included Parler...

Holiday Puppy Swindle Has Consumers Howling

Puppy photos are undeniably irresistible but beware; researchers have uncovered a scheme selling fake German Shepherd puppies for Bitcoin, leaving buyers crushed and without a tiny fuzzy friend to cuddle on Christmas morning. The scam was discovered by an intrepid researcher at Anomali, who got...

Microsoft Caught Up in SolarWinds Spy Effort, Joining Federal Agencies

UPDATE Microsoft has become the latest victim of the ever-widening SolarWinds-driven cyberattack that has impacted rafts of federal agencies and tech targets. Its president, Brad Smith, warned late Thursday to expect many more victims to come to light as investigations continue. Adversaries were...

Cryptologists Crack Zodiac Killer's 340 Cipher

A remote team of three hobbyist cryptologists have solved one of the Zodiac Killer’s cipher after a half century. And while the name of the elusive serial killer remains hidden, the breakthrough represents a triumph for cryptology and the basic building blocks of cybersecurity — access control an...