Android Ransomware First to Encrypt Data on Mobile Devices

A strain of ransomware that encrypts data on Android mobile devices, the first of its kind, has spread to 13 countries since it was first spotted less than a month ago. Researchers at Kaspersky Lab today disclosed details on Pletor, an expensive Trojan that popped up on an underground forum selli...

ICS-CERT Alert on Easily Hackable Road Signs

A new, remotely exploitable vulnerability in Daktronics’ Vanguard software could make it even easier for attackers to hack electronic road signs, a task that was reportedly never very difficult to begin with. Daktronics’ Vanguard dynamic highway message sign configuration software was initially...

iOS 8 Will Randomize MAC Addresses to Help Stop Tracking

Apple enthusiasts have been poring over the feature list for iOS 8, due out this fall, geeking out over the tighter integration among all iOS devices, the improved mail app and myriad other bells and whistles. But perhaps the most important change is a subtle one hidden beneath the covers that wi...

Vodafone Transparency Report Reveals Global Surveillance

Vodafone, the world’s second largest telecommunications company, today published its first transparency report, its Law Enforcement Disclosure Report, in which it revealed that a small number of countries by law have direct access to the provider’s network. The report does not identify the...

Pinkie Pie Linux Kernel Patch Available

Several vulnerabilities have been patched in the Linux kernel that could have led to a denial of service or privilege escalation. Debian, which distributes versions of Linux for personal computers and network servers, warned about the vulnerabilities yesterday in a security update. The most...

WordPress to Deploy SSL on All its Sites by End of 2014

The movement by technology companies to encrypt their respective corners of the Internet continues to gain steam as more and more are enabling SSL and other encryption technologies such as Perfect Forward Secrecy to ward off surveillance and enhance the privacy and security of user data. WordPres...

Dennis Fisher and Mike Mimoso Discuss Edward Snowden, NSA and the new OpenSSL Vuln

Dennis Fisher and Mike Mimoso discuss the changes in the year since the first stories broke regarding Edward Snowden and the NSA and the new OpenSSL vulnerability.​ Download: digitalunderground155.mp3 Music by Chris Gonsalves...

Fake 'Placebo Apps' Booted From Google Play, Amazon

A handful of apps purporting to specialize in virus detection and malware scanning were recently removed from Google’s Play marketplace and Amazon after being deemed fake. Security researchers at FireEye discovered five apps in particular that accounted for up to 50,000 downloads and essentially...

June 2014 Microsoft Patch Tuesday Security Updates

Prompted by the disclosure of a zero-day vulnerability in Internet Explorer 8 more than six months after it was reported, Microsoft next Tuesday will finally issue a patch. HP’s Zero Day Initiative ZDI released on May 21 some detail on a previously unreported use-after-free bug in IE 8. No public...

Microsoft Calls for NSA Surveillance Reforms

On the anniversary of the first news reports on NSA surveillance, Microsoft general counsel Brad Smith seized the opportunity to draw a line in the sand with the U.S. government. Smith challenged the government curtail surveillance because it’s hurting business and impaling privacy and civil...

Dan Farmer Presents Research on IPMI Vulnerabilities

If enterprises are indeed moving services off premises and into the cloud, there are four letters those companies’ IT organizations should be aware of: IPMI. Short for Intelligent Platform Management Interface, these tiny computers live as an embedded Linux system attached to the motherboards of...

Linksys E4200 Vulnerability Enables Authentication Bypass

The Lynksys E4200 V2 dual band router contains a vulnerability that an attacker could exploit, bypassing the Web panel authentication mechanism and gaining administrative privileges on affected devices. Linksys has provided a firmware update that resolves the vulnerability. However, as is nearly...

New OpenSSL MITM Flaw Affects All Clients, Some Server Versions

There is a new, remotely exploitable vulnerability in OpenSSL that could enable an attacker to intercept and decrypt traffic between vulnerable clients and servers. The flaw affects all versions of the OpenSSL client and versions 1.0.1 and 1.0.2-beta1 of the server software. The new vulnerability...

COPA-DATA Patches DNP3 SCADA Vulnerability

A vulnerability exists in a particular brand of SCADA software that if left unpatched, could trigger a denial of service condition and go on to compromise the software’s communication connections, resulting in system instability. The problem is an improper input validation vulnerability and exist...

DARPA Cyber Grand Challenge Finale Set For DEF CON 2016

DARPA’s announcement last October that it would sponsor a $2 million contest, challenging academics and security industry stalwarts to come up with an automated network defense system, has already attracted 35 entrants and a high-profile venue to stage the tournament finale. The final stage of th...

Google Data Shows Encryption Trending In the Right Direction

The past year has seen a tremendous amount of change and turbulence in the security and privacy communities, much of it related to the NSA surveillance revelations. One of the things that has come out of all of the discussions and debates is a greater focus on the importance of encryption,...

Phishing Campaign Sending Dropbox Links to Zeus Downloads

With more enterprises sharing documents through Dropbox, the free online storage service is popping up in more spam and phishing scams. The latest doesn’t necessarily target data stored by individuals and companies on Dropbox, but instead preys on the trust users have in the service. Researchers ...

Google Releases End-to-End Encryption Extension

Google has released an early version of a Chrome extension that provides end-to-end encryption for data leaving the browser. The extension will allow users to encrypt emails from their webmail accounts. The move by Google is another step in the process of making Web communications more secure and...

NIST Seeking Public Comment on SHA-3 Crypto Algorithm

The National Institute of Standards and Technology NIST is inviting the public to analyze and comment on its Secure Hash Algorithm-3 SHA-3, the latest iteration of cryptographic hash functions endorsed and published by the U.S. standards agency in order to protect the integrity of electronic...

WordPress All-In-One SEO Pack Vulnerabilities Patched

A web design firm has patched two privilege escalation vulnerabilities that could have led to cross-site scripting attacks in a popular WordPress plugin it manages. If left unpatched, the issue could leave potentially millions of websites vulnerable. The problem exists in old versions of the All ...

GnuTLS Patches Critical Remote Code Execution Bug

GnuTLS, an open source cryptographic library, was a headliner in March because of a critical certificate verification vulnerability that some erroneously put in the same class as Apple’s infamous gotofail bug. The library, used in a number of Linux distributions including Red Hat, Debian and...

GameOver Zeus Takedown Shows Good Early Returns

The effect of the takedown of the GameOver Zeus botnet this week has been immediate and significant. Researchers who track the activity of the peer-to-peer botnet’s activity say that the volume of packets being sent out by infected machines has dropped to almost zero. On Friday, the FBI and...

Soraya Malware Packs Form Grabbing, Memory Scraping Functionality

Malware capable of infecting point-of-sale devices once was a novelty, but it’s quickly becoming more common. Researchers at Arbor Networks have unearthed a new strain of PoS malware called Soraya that can scrape memory and has the ability to intercept information sent from Web forms, a specialty...

Heartbleed Cupid Wireless Attacks Expose OpenSSL Over WPA

Regardless that the fervor over the Heartbleed OpenSSL vulnerability has died down considerably, patching the bug should remain a top priority for enterprises because researchers continue to find new exploit vectors. The latest takes aim at Heartbleed over wireless networks. A researcher with...

How I Got Here: Joe Grand

Dennis Fisher talks with Joe “Kingpin” Grand about his childhood taking apart early PCs and radios, his introduction to the BBS and early phreaking and hacking scene in Boston, his involvement with the L0pht, @stake and now his current life as an engineer running Grand Idea Studios.​ Download:...

Crowdsourcing to be Part of Phase Two of TrueCrypt Audit

TrueCrypt may yet get forked, but it won’t come at the hands of the Open Crypto Audit Project OCAP, which has a working plan to move forward with a cryptanalysis of the open source encryption software. OCAP is the brand name for the grassroots movement that arose out of the ashes of the Snowden...

FBI, European Authorities Go After GameOver Zeus Botnet

UPDATE–Law enforcement agencies in Europe and the United States, including Europol and the FBI, ran a coordinated takedown of the GameOver Zeus botnet on Friday, seizing servers and disrupting the botnet’s operation. Authorities say that the same botnet has been used to distribute the CryptoLocke...

As Snowden Anniversary Nears, EFF Urges Users to Ramp Up Privacy and Security

Time flies when you’re having fun. But it apparently also flies when there’s a new story every other day about NSA surveillance. It’s been nearly one year since the first story sourced from the documents Edward Snowden stole from the agency appeared, and with that in mind, the EFF is encouraging...

USPS Spam Campaign Drops Asprox Botnet Malware

A new spam campaign has emerged in support of the Asprox botnet. The scheme involves shipping receipt emails that contain malicious links and purport to come from the United States Postal Service USPS. Anyone who receives one of these emails and clicks on the link therein will have a zip file...

Google Complies with 'Right to be Forgotten'

In compliance with a Court of Justice of the European Union ruling, Google has taken steps toward a program that will allow Europeans to request their name be removed from certain searches. The ruling under the European Data Protection Law provides Europeans with the “right to be forgotten.” In...

Apache Patches Bugs in Tomcat

Apache recently patched Tomcat, fixing a trio of information disclosure bugs and a denial of service bug in the open source web server and servlet container. The denial of service bug, discovered in February by David Jorm of the Red Hat Security Response Team, could have allowed an attacker to...

Monsanto Suffers Data Breach at Precision Planting Unit

Monsanto, the massive international agricultural conglomerate, has disclosed a data breach that involved the personal information of customers and employees of its Precision Planting subsidiary. The breach included names, addresses, possibly Social Security numbers and some financial account...

NSA: Snowden Email Refutes Protests of Agency Surveillance

The National Security Agency has released an email from Edward Snowden sent last April to the Office of General Counsel that refutes the whistleblower’s contention that he notified authorities about the NSA’s surveillance reach. In an accompanying statement, the NSA said the message is the only o...

Iranian Campaign Snooped on U.S. and Israeli Officials

Iranian spies have carried out an intelligence gathering campaign since at least 2011 by targeting U.S. military, diplomats, D.C. journalists, and government emissaries, just to name a few, a via social media. According to iSIGHT Partners, a cyber threat intelligence firm, attackers have long bee...

San Diego State Warns of Possible Data Breach

San Diego State University has notified some of its current and former enrollees that some of their personal information may have been accessed by unauthorized users, after a database containing the information was found to be accessible by anyone on the affected department’s wired network. The...

Of TrueCrypt and the Warrant Canary

Apple’s first transparency report, released last November, was one in a string of many released following the start of the Snowden leaks by technology companies trying to distance themselves from the tentacles of NSA surveillance. Apple’s report, however, contained two sentences that made it stan...

OpenSSL Receives Funding for Developers, Will Undergo Security Audit

Scarcely a month after announcing the formation of a group designed to help fund open source projects, the Core Infrastructure Initiative has decided to provide the OpenSSL Project with enough money to hire two full-time developers and also will fund an audit of OpenSSL by the Open Crypto Audit...

HackerOne Bug Bounty Platform Lands Top Microsoft Security Expert

With bug bounties being all the rage, the platforms that support them are emerging as important pieces of the security research, disclosure and reward ecosystem. One of those platforms, HackerOne, has scored a major coup in hiring Katie Moussouris, the driving force behind Microsoft’s bounty...

TrueCrypt Warns Software 'Not Secure,' Development Shut Down

Is it a hoax, or the end of the line for TrueCrypt? At the moment, there is little more than speculation as to the appearance today of an ominous note greeting visitors to the TrueCrypt page at SourceForge. The text warns that the open source encryption software is not secure and informs users th...

Mixed Reviews on Microsoft myBulletins Patch Service

Microsoft today released its new myBulletins service, an interface where IT administrators can customize security patch update information. While providing users with a slick GUI that allows for extensive filtering of patch information by the products in use inside an enterprise or small company,...

FTC Asks Data Brokers, Congress for Transparency, Regulation

The Federal Trade Commission called on data brokers to be more transparent and give users more control over their personal information in a comprehensive report issued yesterday. The 100-plus page document, “Data Brokers: A Call for Transparency and Acccountability,” .PDF criticizes the industry...

CryptoLocker Ransomware Competitor May Have Fatal Flaw

CryptoLocker certainly changed the ransomware game last year when it threatened its victims with the loss of important files if a timely ransom payment was not made. Reportedly, criminal gangs utilizing this dangerous type of ransomware were earning hundreds of thousands of dollars per month...

Pinterest Launches Bug Bounty Program

Pinterest has become the latest major Web property to start a bug bounty program, joining the Bugcrowd platform and offering researchers rewards of up to…a shirt. The site, which enables users to post photos, recipes and other information, announced the new reward program Tuesday. Company officia...

Remotely Exploitable Flaws Haunt Lawful Intercept Surveillance Gear

UPDATE–The small, but growing, group of companies that supply so-called lawful intercept gear to intelligence agencies and law enforcement organizations around the world have operated mostly under the radar until very recently. Their products are used to record and scrutinize the communications o...

Siemens Fixes DoS Flaw in Rugged OS Devices

Siemens has patched a denial-of-service vulnerability that affected many versions of its Rugged Operating System, software that runs on some of the company’s RuggedCom switches and serial-to-ethernet devices. The vulnerability could enable a remote attacker to cause the Rugged OS software to cras...

Apple Ransomware Targeting iCloud Users Hits Australia

A handful of iPhone, iPad and Mac users, largely confined to Australia, awoke Tuesday to discover their devices had been taken hostage by ransomware. Instead of their normal home screens, users were greeted with a message promising that their devices would be unlocked if a ransom, somewhere betwe...

LulzSec Hacker Sabu Sentenced to Time Served

The LulzSec hacker-turned-informant known as Sabu avoided any more jail time and was sentenced to time served on Tuesday for his part in leading several of the group’s attacks on high-profile targets. Hector Monsegur walked out of court in New York a free man, thanks to his cooperation with the F...

Spotify Android Application at Issue in Breach

Users of Spotify on Android will soon be asked to update the application after a breach was reported this morning by the streaming music service’s chief technology officer. Oskar Stal wrote on the company’s website that the company is investigating unauthorized access to its systems and internal...

House Initiates NIST-NSA Separation on Crypto Standards

Eight months after an explosive revelation that encryption standards developed and evaluated by the National Security Agency were allegedly subverted by the intelligence outfit, a House committee has moved to sever the NSA’s involvement in the standards process. An amendment to the Frontiers in...

Zeus-Carberp Hybrid Trojan Pops Up

UPDATE–Researchers have discovered a hybrid Trojan that combines elements of two of the more notorious crimeware strains of the last few years: Zeus and Carberp. It’s not uncommon for malware writers to steal bits and pieces of code from one another, but both Zeus and Carberp were once exclusivel...