ATENTION‼ New - CVE-2016-9749

IBM Campaign 9.1.0, 9.1.2, 10.0, and 10.1 could allow an authenticated user with access to the local network to bypass security due to lack of input validation. IBM X-Force ID: 120206.

📖 Read

via "National Vulnerability Database".

⚠ DerpTrolling game server DDoS attacker pleads guilty ⚠

Austin Thompson pleaded guilty on November 6 in a San Diego Federal court to knowingly causing damage to third-party computers.

📖 Read

via "Naked Security".

⚠ Update now! WordPress sites vulnerable to WooCommerce plugin flaw ⚠

Researchers have published details of a dangerous flaw in the way the hugely popular WooCommerce plugin interacts with WordPress that could allow an attacker with access to a single account to take over an entire site.

📖 Read

via "Naked Security".

⚠ Sent a photo to the wrong person? Facebook Messenger to let you unsend it ⚠

Think fast! You'll only have up to 10 minutes to hit unsend: a lot stingier than the hour afforded by WhatsApp.

📖 Read

via "Naked Security".

⚠ 258,000 encrypted IronChat phone messages cracked by police ⚠

They expect to cuff hundreds of criminals who used the pricey phones, which were sold with the crypto app preinstalled.

📖 Read

via "Naked Security".

🔐 How to install the SIPp testing tool on Ubuntu Server 18.04 🔐

If you need to stress test your VOIP (or other SIP telephony systems) installation, there's an open source tool for that. Jack Wallen shows you how to install and use SIPp.

📖 Read

via "Security on TechRepublic".

🕴 Vulnerabilities in our Infrastructure: 5 Ways to Mitigate the Risk 🕴

By teaming up to address key technical and organizational issues, information and operational security teams can improve the resiliency and safety of their infrastructure systems.

📖 Read

via "Dark Reading: ".

🕴 The Morris Worm Turns 30 🕴

How the historic Internet worm attack of 1988 has shaped security - or not.

📖 Read

via "Dark Reading: ".

❌ Embracing the Cybersecurity ‘Grey Space’ ❌

Security teams carefully monitor potential threat activity, but incidents aren’t always black and white.

📖 Read

via "Threatpost | The first stop for security news".

❌ Threatpost News Wrap Podcast for Nov. 9 ❌

The Threatpost editors break down the top news stories from this week.

📖 Read

via "Threatpost | The first stop for security news".

❌ ThreatList: Google Play Nine Times Safer Than Third-Party App Stores ❌

Out of the 2 billion Android users out there, the rate of potential malware infection is less than 1 percent across the board, Google says.

📖 Read

via "Threatpost | The first stop for security news".

🔐 How to install the SIPp testing tool on Ubuntu Server 18.04 🔐

If you need to stress test your VOIP (or other SIP telephone systems) installation, there's an open source tool for that—SIPp.

📖 Read

via "Security on TechRepublic".

🕴 Guilty Plea Made in Massive International Cell Phone Fraud Case 🕴

A former West Palm Beach resident is the fifth defendant to plead guilty in a case involving thousands of victims.

📖 Read

via "Dark Reading: ".

🕴 What You Should Know About Grayware (and What to Do About It) 🕴

Grayware is a tricky security problem, but there are steps you can take to defend your organization when you recognize the risk.

📖 Read

via "Dark Reading: ".

🕴 Dropbox Teams with Israeli Security Firm Coronet 🕴

The partnership is expected to improve threat detection for Dropbox while growing Coronet's user base.

📖 Read

via "Dark Reading: ".

<b>&#9000; Bug Bounty Hunter Ran ISP Doxing Service &#9000;</b>

<code>A Connecticut man who’s earned bug bounty rewards and public recognition from top telecom companies for finding and reporting security holes in their Web sites secretly operated a service that leveraged these same flaws to sell their customers’ personal data, KrebsOnSecurity has learned.</code><code>In May 2018, ZDNet ran a story about the discovery of a glaring vulnerability in the Web site for wireless provider T-Mobile that let anyone look up customer home addresses and account PINs. The story noted that T-Mobile disabled the feature in early April after being alerted by a 22-year-old “security researcher” named Ryan Stevenson, and that the mobile giant had awarded Stevenson $1,000 for reporting the discovery under its bug bounty program.</code><code>Media</code><code>The Twitter account @phobia, a.k.a. Ryan Stevenson. The term “plug” referenced next to his Twitch profile name is hacker slang for employees at mobile phone stores who can be tricked or bribed into helping with SIM swap attacks.</code><code>Likewise, AT&T has recognized Stevenson for reporting security holes in its services. AT&T’s bug bounty site lets contributors share a social media account or Web address where they can be contacted, and in Stevenson’s case he gave the now-defunct Twitter handle “@Phoobia.”</code><code>Stevenson’s Linkedin profile — named “Phobias” — says he specializes in finding exploits in numerous Web sites, including hotmail.com, yahoo.com, aol.com, paypal.com and ebay.com. Under the “contact info” tab of Stevenson’s profile it lists the youtube.com account of “Ryan” and the Facebook account “Phobia” (also now deleted).</code><code>Coincidentally, I came across multiple variations on this Phobia nickname as I was researching a story published this week on the epidemic of fraudulent SIM swaps, a complex form of mobile phone fraud that is being used to steal millions of dollars in cryptocurrencies.</code><code>Unauthorized SIM swaps also are often used to hijack so-called “OG” user accounts — usually short usernames on top social network and gaming Web sites that are highly prized by many hackers because they can make the account holder appear to have been a savvy, early adopter of the service before it became popular and before all of the short usernames were taken. Some OG usernames can be sold for thousands of dollars in underground markets.</code><code>This week’s SIM swapping story quoted one recent victim who lost $100,000 after his mobile phone number was briefly stolen in a fraudulent SIM swap. The victim said he was told by investigators in Santa Clara, Calif. that the perpetrators of his attack were able to access his T-Mobile account information using a specialized piece of software that gave them backdoor access to T-Mobile’s customer database.</code><code>Both the Santa Clara investigators and T-Mobile declined to confirm or deny the existence of this software. But their non-denials prompted me to start looking for it on my own. So naturally I began searching at ogusers-dot-com, a forum dedicated to the hacking, trading and sale of OG accounts. Unsurprisingly, ogusers-dot-net also has traditionally been the main stomping grounds for many individuals involved in SIM swapping attacks.</code><code>It didn’t take long to discover an account on ogusers-dot-com named “Ryan,” who for much of 2018 has advertised a number of different “doxing” services — specifically those aimed at finding the personal information of customers at major broadband and telecom companies.</code><code>In some of Ryan’s sales threads, fellow forum members refer to him as “Phob” or “Phobs.” In a post on May 27, Ryan says he’s willing to pay or trade for OG accounts under the name “Ryan,” “Ryans”, “RS,” “RMS” or “Stevenson” on any decent sized popular Web site. “hmu [hit me up] in a pm [private message] to talk,” Ryan urged fellow forum members.</code><code>Media</code><code>The OG User forum…

🕴 Inside CSAW, a Massive Student-Led Cybersecurity Competition 🕴

Nearly 400 high school, undergraduate, and graduate students advance to the final round of New York University's CSAW games.

📖 Read

via "Dark Reading: ".

❌ Recently-Patched Adobe ColdFusion Flaw Exploited By APT ❌

The critical vulnerability, which was patched earlier in September, has put ColdFusion servers at risk.

📖 Read

via "Threatpost | The first stop for security news".

❌ Lawsuits Aim Billions in Fines at Equifax and Ad-Targeting Companies ❌

The results could start a wave of major damages for companies that collect and sell consumer information.

📖 Read

via "Threatpost | The first stop for security news".

ATENTION‼ New - CVE-2017-17550

ZyXEL ZyWALL USG 2.12 AQQ.2 and 3.30 AQQ.7 devices are affected by a CSRF vulnerability via a cgi-bin/zysh-cgi cmd action to add a user account. This account's access could, for example, subsequently be used for stored XSS.

📖 Read

via "National Vulnerability Database".

🔐 Eight reasons more CEOs will be fired over cybersecurity breaches 🔐

Security is everyone's problem, but CEOs should make sure their organisation doesn't block its success. Gartner offers eight situations for CEOs to avoid if a breach occurs within their organisation.

📖 Read

via "Security on TechRepublic".