Menu

Latest articles

Friend’s girlfriend sextortion scam infects PCs with Raccoon malware
New TrickBot Variant Updates Anti-Analysis Tricks
More Than Half of IoT Devices Vulnerable to Severe Attacks
Secret-sharing app Whisper shared secrets like last known location and actual password tokens in exposed database
Necurs Botnet in Crosshairs of Global Takedown Offensive
How to Tell if a Website Has Been Compromised
FBI arrests alleged owner of Deer.io, top market for stolen accounts
Securing the deployment of OpenShift Container Platform 4
Trial for accused CIA leaker ends in hung jury
Brave browser to block web fingerprinting with randomisation
The Reg produces exhibit A1: A UK court IT system running Windows XP
Google: You know we said that Chrome tracker contained no personally identifiable info? Forget we ever said that
Stuck at home? Need something to keep busy with? Microsoft has 115 ideas – including an awful SMBv3 security hole to worry about
That LVI CPU hole wasn’t the only Intel fix: Dozens of flaws patched to stop chips turning into potatoes
Critical Bugs in Rockwell, Johnson Controls ICS Gear
Microsoft Patches 26 Critical Bugs in Big March Update

security update

California tech industry gets its first big coronavirus hit: RSA Conference attendee infected, in serious condition
Popular ThemeREX WordPress Plugin Opens Websites to RCE
Firefox Bug Opens iPhone AirPods to Third-Party Snooping
High-Severity Flaws Plague Intel Graphics Drivers
You only LVI twice: Meltdown The Sequel strikes Intel chips – and full mitigation against data-meddling flaw will cost you 50%+ of performance
Hackers hit hackers in new malware campaign
Flaw in popular VPN service may have exposed customer data

NordVPN praised its bug bounty program and said that a fix had been shipped within two days The post Flaw in popular VPN service may have exposed customer data appeared first on WeLiveSecurity

Variant of Paradise Ransomware Targets Office IQY Files
Watch out for Office 365 and G Suite scams, FBI warns businesses
Google data puts innocent man at the scene of a crime
7 Cybersecurity Trends to Look Out for in 2020
Ex-Inspector General indicted for stealing data on 250k govt colleagues
Phone carriers may soon be forced to adopt anti-robocall tech
Android anti-virus products put to the test – which are the best at stopping new malicious apps?
Spear-Phishing Attack Lures Victims With ‘HIV Results’
Avast’s AntiTrack promised to protect your privacy. Instead, it opened you to miscreant-in-the-middle snooping
AMD, boffins clash over chip data-leak claims: New side-channel holes in decades of cores, CPU maker disagrees
Hackers are exploiting critical vulnerability in Microsoft Exchange server
NSO Group fires back at Facebook: You lied to the court, claims spyware slinger, and we’ve got the proof
Microsoft: 99.9 percent of hacked accounts didn’t use MFA

Only 11 percent of all enterprise accounts have multi-factor authentication enabled The post Microsoft: 99.9 percent of hacked accounts didn’t use MFA appeared first on WeLiveSecurity

Microsoft Exchange Server Flaw Exploited in APT Attacks
Months-long trial of alleged CIA Vault 7 exploit leaker ends with hung jury: Ex-sysadmin guilty of contempt, lying to FBI
It’s not a breach… it’s just that someone else has your data
Dark Web search engine Kilos lets users find hidden marketplaces
Comcast Xfinity published the contact details of 200,000 customers who paid for them to be kept private
UK Defence Committee probe into national security threat of Huawei sure to uncover lots of new and original insights
AMD Downplays CPU Threat Opening Chips to Data Leak Attacks
Coronavirus map used to spread malware
One billion Android smartphones racking up security flaws
Microsoft: Turn off Memory Integrity if it’s causing problems
Spyware maker NSO runs scared from Facebook over WhatsApp hacking charges, fails to show up in court
Now you need a notarized document to get a .gov domain
99% of compromised Microsoft enterprise accounts lack MFA
UK.gov is not sharing Brits’ medical data among different agencies… but it’s having a jolly good think about it
Check Point chap: Small firms don’t invest in infosec then hope they won’t get hacked. Spoiler alert: They get hacked
Virgin Media & T-Mobile data breach exposes customers data

An update that fixes one vulnerability is now available.

Don’t be fooled, experts warn, America’s anti-child-abuse EARN IT Act could burn encryption to the ground
Next-Gen Ransomware Packs a ‘Human’ Punch, Microsoft Warns
FYI: When Virgin Media said it leaked ‘limited contact info’, it meant p0rno filter requests, IP addresses, IMEIs as well as names, addresses and more
2 in 5 Android devices found vulnerable worldwide – That’s over a billion
UK spy auditor gives state snoops a big pat on the back for job well done – except MI5
Spread of Coronavirus-Themed Cyberattacks Persists with New Attacks
Remote working due to coronavirus? Here’s how to do it securely…
Critical Zoho Zero-Day Flaw Disclosed
Virgin Media left 900,000 consumers’ details exposed in unsecured database
201 million US demographic, personal records leaked online
Over one billion Android devices at risk as they no longer receive security updates
NordVPN quietly plugged vuln where an HTTP POST request without authentication would return detailed customer data

sudo: Stack based buffer overflow when pwfeedback is enabled (CVE-2019-18634) SL6 x86_64 sudo-1.8.6p3-29.el6_10.3.x86_64.rpm sudo-debuginfo-1.8.6p3-29.el6_10.3.x86_64.rpm sudo-debuginfo-1.8.6p3-29.el6_10.3.i686.rpm sudo-devel-1.8.6p3-29.el6_10.3.i686.rpm sudo-devel-1.8.6p3-29.el6_10.3.x86_64.rpm i386 sudo-1.8.6p3-29.el6_10.3.i686.rpm sudo-debuginfo-1.8.6p3-29.e [More…]

Run ANDROID on an iPhone? Are you SERIOUS?!?
Researcher finds 670 Microsoft subdomains vulnerable to takeover

The updated package fixes a security vulnerability: A flaw was found in mod_auth_openidc before version 2.4.1. An open redirect issue exists in URLs with a slash and backslash at the beginning. (CVE-2019-20479)

Updated pure-ftpd packages fix security vulnerabilities: An issue was discovered in Pure-FTPd 1.0.49. An uninitialized pointer vulnerability has been detected in the diraliases linked list. When the *lookup_alias(const char alias) or print_aliases(void) function is called,

The updated packages fix several issues including security vulnerabilities: In Libarchive 3.4.0, archive_wstring_append_from_mbs in archive_string.c has an out-of-bounds read because of an incorrect mbrtowc or mbtowc call. For example, bsdtar crashes via a crafted archive. (CVE-2019-19221)

Updated dojo package fixes security vulnerability: dojox was vulnerable to Cross-site Scripting. This was due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them (CVE-2019-10785).

The updated packages fix a security vulnerability: Mutation XSS in bleach.clean when noscript and raw tag whitelisted. (CVE-2020-6802)

Chrome extension cons cryptocurrency users out of hardware wallet key
Boots suspends loyalty card payments after hackers try to compromise accounts
More than a billion hopelessly vulnerable Android gizmos in the wild that no longer receive security updates – research
Cathay Pacific fined over crooks slurping its database for over 4 years
Boots yanks loyalty card payouts after 150K accounts get stuffed
Like a Virgin, hacked for the very first time… UK broadband ISP spills 900,000 punters’ records into wrong hands from insecure database
Android users, if you could pause your COVID-19 panic buying for one minute to install these critical security fixes, that would be great
Man hacks Indian tech support scam call center; leaks CCTV footage
Let’s Encrypt: OK, maybe nuking three million HTTPS certs at once was a tad ambitious. Let’s take time out
Zynga Faces Lawsuit Over Massive Words with Friends Breach
Chris Eng: Patch Management Challenges Drive ‘Security Debt’
Staffer emails compromised and customer details exposed in T-Mobile US’s third security whoopsie in as many years
Hackers dropping info-stealer malware with fake security certificate alerts
High-Severity Cisco Webex Flaws Fixed
‘Unfixable’ boot ROM security flaw in millions of Intel chips could spell ‘utter chaos’ for DRM, file encryption, etc
Coronavirus warning spreads computer virus
Facebook: No, we are not killing Libra

An update that fixes two vulnerabilities is now available.

It was discovered that there was an out-of-bounds write vulnerability in pdfresurrect, a tool for extracting or scrubbing versioning data from PDF documents.

Ethical hackers swarm Pentagon websites

xerces-c: XML parser contains a use-after-free error triggered during the scanning of external DTDs (CVE-2018-1311) SL7 x86_64 xerces-c-3.1.1-10.el7_7.i686.rpm xerces-c-3.1.1-10.el7_7.x86_64.rpm xerces-c-debuginfo-3.1.1-10.el7_7.i686.rpm xerces-c-debuginfo-3.1.1-10.el7_7.x86_64.rpm xerces-c-devel-3.1.1-10.el7_7.i686.rpm xerces-c-devel-3.1.1-10.el7_7.x86_64.rpm noar [More…]

nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605) SL7 x86_64 http-parser-2.7.1-8.el7_7.2.i686.rpm http-parser-2.7.1-8.el7_7.2.x86_64.rpm http-parser-debuginfo-2.7.1-8.el7_7.2.i686.rpm http-parser-debuginfo-2.7.1-8.el7_7.2.x86_64.rpm http-parser-devel-2.7.1-8.el7_7.2.i686.rpm http-parser-devel-2.7.1-8.el7_7.2.x86_64.rpm – Scient [More…]

Google launches FuzzBench service to benchmark fuzzing tools
Trump, Sanders Are the Top Brands for Cybercriminals
Enable that MF-ing MFA: 1.2 million Azure Active Directory accounts compromised every month, reckons Microsoft
Let’s Encrypt Pushes Back Deadline to Revoke Some TLS Certificates