ATENTION‼ New - CVE-2016-10736 (social_pug)
📖 Read
via "National Vulnerability Database".
The "Social Pug - Easy Social Share Buttons" plugin before 1.2.6 for WordPress allows XSS via the wp-admin/admin.php?page=dpsp-toolkit dpsp_message_class parameter.📖 Read
via "National Vulnerability Database".
❌ ThreatList: $1.7M is the Average Cost of a Cyber-Attack ❌
📖 Read
via "Threatpost | The first stop for security news".
Brand damage, loss of productivity, falling stock prices and more contribute to significant business impacts in the wake of a breach.📖 Read
via "Threatpost | The first stop for security news".
Threat Post
ThreatList: $1.7M is the Average Cost of a Cyber-Attack
Brand damage, loss of productivity, falling stock prices and more contribute to significant business impacts in the wake of a breach.
🕴 7 Privacy Mistakes To Keep Security Pros on Their Toes 🕴
📖 Read
via "Dark Reading: ".
When it comes to privacy, it's the little things that can lead to big mishaps.📖 Read
via "Dark Reading: ".
Dark Reading
7 Privacy Mistakes To Keep Security Pros on Their Toes
When it comes to privacy, it's the little things that can lead to big mishaps.
❌ Judge: Law Enforcement Can’t Force Suspects to Unlock iPhones with FaceID ❌
📖 Read
via "Threatpost | The first stop for security news".
A ruling found that coercing suspects to open their phones using biometrics violates the fourth and fifth amendments.📖 Read
via "Threatpost | The first stop for security news".
Threat Post
Judge: Law Enforcement Can’t Force Suspects to Unlock iPhones with FaceID
A ruling found that coercing suspects to open their phones using biometrics violates the fourth and fifth amendments.
🕴 US Judge: Police Can't Force Biometric Authentication 🕴
📖 Read
via "Dark Reading: ".
Law enforcement cannot order individuals to unlock devices using facial or fingerprint scans, a California judge says.📖 Read
via "Dark Reading: ".
Dark Reading
US Judge: Police Can't Force Biometric Authentication
Law enforcement cannot order individuals to unlock devices using facial or fingerprint scans, a California judge says.
🕴 7 Privacy Mistakes To Keep Security Pros on Their Toes 🕴
📖 Read
via "Dark Reading: ".
When it comes to privacy, it's the little things that can lead to big mishaps.📖 Read
via "Dark Reading: ".
Dark Reading
7 Privacy Mistakes That Keep Security Pros on Their Toes
When it comes to privacy, it's the little things that can lead to big mishaps.
🔐 Smart building security flaws leave schools, hospitals at risk 🔐
📖 Read
via "Security on TechRepublic".
Vendors of smart building hardware issued updates to products without disclosing that vulnerabilities were patched, leading security systems for schools and hospitals to be accessible via the web.📖 Read
via "Security on TechRepublic".
TechRepublic
Smart building security flaws leave schools, hospitals at risk
Vendors of smart building hardware issued updates to products without disclosing that vulnerabilities were patched, leading security systems for schools and hospitals to be accessible via the web.
🕴 Online Fraud: Now a Major Application Layer Security Problem 🕴
📖 Read
via "Dark Reading: ".
The explosion of consumer-facing online services and applications is making it easier and cheaper for cybercriminals to host malicious content and launch attacks.📖 Read
via "Dark Reading: ".
Darkreading
Online Fraud: Now a Major Application Layer Security Problem
The explosion of consumer-facing online services and applications is making it easier and cheaper for cybercriminals to host malicious content and launch attacks.
🕴 SEC Issues Charges in 'Edgar' Database Hack 🕴
📖 Read
via "Dark Reading: ".
One defendant is still facing charges issued in 2015 for a $30 million hacking and securities fraud scheme.📖 Read
via "Dark Reading: ".
Darkreading
SEC Issues Charges in 'Edgar' Database Hack
One defendant is still facing charges issued in 2015 for a $30 million hacking and securities fraud scheme.
❌ Data Breach Roundup: U.S. Healthcare, Cryptopia, SingHealth and Experian ❌
📖 Read
via "Threatpost | The first stop for security news".
January is off to a running start on the data breach front, while Experian is predicting new attack frontiers ahead.📖 Read
via "Threatpost | The first stop for security news".
Threat Post
Data Breach Roundup: U.S. Healthcare, Cryptopia, SingHealth and Experian
January is off to a running start on the data breach front, while Experian is predicting new attack frontiers ahead.
🕴 Report: Bots Add Volume to Account Takeover Attacks 🕴
📖 Read
via "Dark Reading: ".
Bots that can launch hundreds of attacks per second are making account takeover fraud more difficult to defend against.📖 Read
via "Dark Reading: ".
Darkreading
Report: Bots Add Volume to Account Takeover Attacks
Bots that can launch hundreds of attacks per second are making account takeover fraud more difficult to defend against.
❌ IDenticard Zero-Days Allow Corporate Building Access, Location Recon ❌
📖 Read
via "Threatpost | The first stop for security news".
Multiple hardcoded passwords allow attackers to create badges to gain building entry, access video surveillance feeds, manipulate databases and more.📖 Read
via "Threatpost | The first stop for security news".
Threat Post
IDenticard Zero-Days Allow Corporate Building Access, Location Recon
Multiple hardcoded passwords allow attackers to create badges to gain building entry, access video surveillance feeds, manipulate databases and more.
<b>⌨ “Stole $24 Million But Still Can’t Keep a Friend” ⌨</b>
<code>Unsettling new claims have emerged about Nicholas Truglia, a 21-year-old Manhattan resident accused of hijacking cell phone accounts to steal tens of millions of dollars in cryptocurrencies from victims. The lurid details, made public in a civil lawsuit filed this week by one of his alleged victims, paints a chilling picture of a man addicted to thievery and all its trappings. The documents suggest that Truglia stole from his father and even a dead man — all the while lamenting that his fabulous new wealth brought him nothing but misery.</code><code>Media</code><code>The unflattering profile was laid out in a series of documents tied to a lawsuit lodged by Michael Terpin, a cryptocurrency investor who co-founded the first angel investor group for bitcoin enthusiasts in 2013. Terpin alleges that crooks stole almost $24 million worth of cryptocurrency after fraudulently executing a “SIM swap” on his mobile phone account at AT&T in early 2018. Terpin also is pursuing a $200 million civil lawsuit against AT&T in connection with the theft.</code><code>Authorities arrested Truglia on November 14, 2018 on suspicion of using SIM swaps to steal approximately $1 million worth of cryptocurrencies from a different Silicon Valley executive. But Terpin’s civil lawsuit (PDF) maintains that evidence was revealed at Truglia’s bail hearing that he had texted his father and multiple friends to brag about the $24 million hack on the day of Terpin’s theft, allegedly offering to take friends to the Super Bowl with “porn star escorts.”</code><code>Terpin’s lawsuit includes a large number of supporting documents, including an affidavit filed by Chris David, a 25-year-old New York City resident who claims to have been an acquaintance of Truglia’s until he began to unravel the source of his new friend’s overnight riches.</code><code>In his affidavit (PDF), David describes himself as a self-employed private jet broker who met Truglia in a fitness center attached to Truglia’s luxury apartment building. Truglia allegedly struck up a conversation about booking private jets with his cryptocurrency. When the two met again a few days later, David says Truglia showed him accounts on his mobile phone and computer indicating he had over $7 million in cash in a JP Morgan account and more than $12 million in various cryptocurrencies.</code><code>“At the same time, Nick showed me two thumb drives (Trezors),” David recounted. “One had over $40 million in cash value of various cryptos, and the other one had over $20 million cash value of various cryptos.”</code><code>David said Truglia initially explained his wealth by saying he’d made the money by mining cryptocurrencies, but that Truglia later would admit he stole the funds.</code><code>“Over the next few months, Nick and I socialized at nightclubs, local bars, the gym, and in his apartment playing video games,” David recounted. “Gradually, I got to know Nick. He does not have a job or visible means of support. His typical day is to get up late, go to the gym, eat at the deli across the street, play video games late into the night and he had no friends. Nick was an egotistical braggart about his life and wealth. For example, once at a crowded lounge, he said: ‘Chris, I have more money than all of the people here tonight.'”</code><code>David started documenting Truglia’s activities after he and several of his friends were arrested for allegedly stealing Truglia’s laptop, mobile phone and Trezor drive. That incident, recounted in this New York Post story and in David’s own testimony, indicates that Truglia later recanted the accusation and chalked it up to confusion resulting from a heavy night of drinking.</code><code>According to David, when Truglia wasn’t bragging about his wealth he was displaying it openly: He lived in a $6,000 per month apartment, wore a Rolex watch which he claimed cost $100,000, and boasted he was going to purchase…
<code>Unsettling new claims have emerged about Nicholas Truglia, a 21-year-old Manhattan resident accused of hijacking cell phone accounts to steal tens of millions of dollars in cryptocurrencies from victims. The lurid details, made public in a civil lawsuit filed this week by one of his alleged victims, paints a chilling picture of a man addicted to thievery and all its trappings. The documents suggest that Truglia stole from his father and even a dead man — all the while lamenting that his fabulous new wealth brought him nothing but misery.</code><code>Media</code><code>The unflattering profile was laid out in a series of documents tied to a lawsuit lodged by Michael Terpin, a cryptocurrency investor who co-founded the first angel investor group for bitcoin enthusiasts in 2013. Terpin alleges that crooks stole almost $24 million worth of cryptocurrency after fraudulently executing a “SIM swap” on his mobile phone account at AT&T in early 2018. Terpin also is pursuing a $200 million civil lawsuit against AT&T in connection with the theft.</code><code>Authorities arrested Truglia on November 14, 2018 on suspicion of using SIM swaps to steal approximately $1 million worth of cryptocurrencies from a different Silicon Valley executive. But Terpin’s civil lawsuit (PDF) maintains that evidence was revealed at Truglia’s bail hearing that he had texted his father and multiple friends to brag about the $24 million hack on the day of Terpin’s theft, allegedly offering to take friends to the Super Bowl with “porn star escorts.”</code><code>Terpin’s lawsuit includes a large number of supporting documents, including an affidavit filed by Chris David, a 25-year-old New York City resident who claims to have been an acquaintance of Truglia’s until he began to unravel the source of his new friend’s overnight riches.</code><code>In his affidavit (PDF), David describes himself as a self-employed private jet broker who met Truglia in a fitness center attached to Truglia’s luxury apartment building. Truglia allegedly struck up a conversation about booking private jets with his cryptocurrency. When the two met again a few days later, David says Truglia showed him accounts on his mobile phone and computer indicating he had over $7 million in cash in a JP Morgan account and more than $12 million in various cryptocurrencies.</code><code>“At the same time, Nick showed me two thumb drives (Trezors),” David recounted. “One had over $40 million in cash value of various cryptos, and the other one had over $20 million cash value of various cryptos.”</code><code>David said Truglia initially explained his wealth by saying he’d made the money by mining cryptocurrencies, but that Truglia later would admit he stole the funds.</code><code>“Over the next few months, Nick and I socialized at nightclubs, local bars, the gym, and in his apartment playing video games,” David recounted. “Gradually, I got to know Nick. He does not have a job or visible means of support. His typical day is to get up late, go to the gym, eat at the deli across the street, play video games late into the night and he had no friends. Nick was an egotistical braggart about his life and wealth. For example, once at a crowded lounge, he said: ‘Chris, I have more money than all of the people here tonight.'”</code><code>David started documenting Truglia’s activities after he and several of his friends were arrested for allegedly stealing Truglia’s laptop, mobile phone and Trezor drive. That incident, recounted in this New York Post story and in David’s own testimony, indicates that Truglia later recanted the accusation and chalked it up to confusion resulting from a heavy night of drinking.</code><code>According to David, when Truglia wasn’t bragging about his wealth he was displaying it openly: He lived in a $6,000 per month apartment, wore a Rolex watch which he claimed cost $100,000, and boasted he was going to purchase…
🕴 Hijacking a PLC Using its Own Network Features 🕴
📖 Read
via "Dark Reading: ".
Researcher to show how attackers can exploit the built-in advanced connectivity functions in some Rockwell PLCs.📖 Read
via "Dark Reading: ".
Dark Reading
Hijacking a PLC Using its Own Network Features
Researcher to show how attackers can exploit the built-in advanced connectivity functions in some Rockwell PLCs.
ATENTION‼ New - CVE-2016-10738
📖 Read
via "National Vulnerability Database".
Zenbership v107 has CSRF via admin/cp-functions/event-add.php.📖 Read
via "National Vulnerability Database".
ATENTION‼ New - CVE-2016-10737
📖 Read
via "National Vulnerability Database".
Serendipity 2.0.4 has XSS via the serendipity_admin.php serendipity[body] parameter.📖 Read
via "National Vulnerability Database".
⚠ Police can’t compel biometric phone unlocking, rules judge ⚠
📖 Read
via "Naked Security".
The landmark decision asserts the same legal protection for biometrics that we're given for passcodes.📖 Read
via "Naked Security".
Naked Security
Feds can’t force you to unlock your phone with finger or face, says judge
The landmark decision asserts the same legal protection for biometrics that we’re given for passcodes.
⚠ Beware buying Fortnite’s V-Bucks, you could be funding organised crime ⚠
📖 Read
via "Naked Security".
Credit card thieves are laundering money by purchasing the in-game currency V-Bucks, then selling it back at a discount to players.📖 Read
via "Naked Security".
Naked Security
Beware buying Fortnite’s V-Bucks, you could be funding organised crime
Credit card thieves are laundering money by purchasing the in-game currency V-Bucks, then selling it back at a discount to players.
⚠ Intel patches another security flaw in SGX technology ⚠
📖 Read
via "Naked Security".
Of the six advisories Intel released last week, the most interesting is a flaw discovered in the company’s Software Guard Extensions (SGX).📖 Read
via "Naked Security".
Naked Security
Intel patches another security flaw in SGX technology
Of the six advisories Intel released last week, the most interesting is a flaw discovered in the company’s Software Guard Extensions (SGX).
⚠ Are you sure those WhatsApp messages are meant for you? ⚠
📖 Read
via "Naked Security".
Abby Fuller got a shock when she logged into WhatsApp using a new telephone number. She found someone else’s messages waiting for her.📖 Read
via "Naked Security".
Naked Security
Are you sure those WhatsApp messages are meant for you?
Abby Fuller got a shock when she logged into WhatsApp using a new telephone number. She found someone else’s messages waiting for her.
❌ VOIPO Database Exposes Millions of Texts, Call Logs ❌
📖 Read
via "Threatpost | The first stop for security news".
VOIPO acknowledged that a development server had been accidentally left publicly accessible, and took the server offline.📖 Read
via "Threatpost | The first stop for security news".
Threat Post
VOIPO Database Exposes Millions of Texts, Call Logs
VOIPO acknowledged that a development server had been accidentally left publicly accessible, and took the server offline.