❌ EU Recalls Children’s Smartwatch That Leaks Location Data ❌

The children's smartwatch allows bad actors to track their location and communicate with them, according to the alert.

📖 Read

via "Threatpost | The first stop for security news".

🕴 Taming the Wild, West World of Security Product Testing 🕴

The industry has long needed an open, industry-standard testing framework. NetSecOPEN is working to make that happen.

📖 Read

via "Dark Reading: ".

❌ Google Patches Critical .PNG Image Bug ❌

Eleven critical bugs will be patched as part of the February Android Security Bulletin.

📖 Read

via "Threatpost | The first stop for security news".

🔐 Why your business needs to work with the government to fight cyber warfare 🔐

The US government will not be able to mitigate a cyber-enabled economic warfare attack without help from the private sector, according to a report from FDD and the Chertoff Group.

📖 Read

via "Security on TechRepublic".

⚠ Ep. 018 – Home invasions, snoopy apps and Android versus iOS [PODCAST] ⚠

Here's the latest Naked Security podcast - give it a listen!

📖 Read

via "Naked Security".

ATENTION‼ New - CVE-2017-1202

IBM BigFix Compliance 1.7 through 1.9.91 (TEMA SUAv1 SCA SCM) is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 123677.

📖 Read

via "National Vulnerability Database".

ATENTION‼ New - CVE-2017-1200

IBM BigFix Compliance 1.7 through 1.9.91 (TEMA SUAv1 SCA SCM) does not validate, or incorrectly validates, a certificate.This weakness might allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack. The software might connect to a malicious host while believing it is a trusted host, or the software might be deceived into accepting spoofed data that appears to originate from a trusted host. IBM X-Force ID: 123675.

📖 Read

via "National Vulnerability Database".

ATENTION‼ New - CVE-2017-1198

IBM BigFix Compliance 1.7 through 1.9.91 (TEMA SUAv1 SCA SCM) stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 123673.

📖 Read

via "National Vulnerability Database".

ATENTION‼ New - CVE-2017-1177

IBM BigFix Compliance 1.7 through 1.9.91 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 123429.

📖 Read

via "National Vulnerability Database".

ATENTION‼ New - CVE-2016-1000282

Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection.

📖 Read

via "National Vulnerability Database".

🕴 No Sign of 'Material' Nation-State Actor Impact on 2018 US Midterms 🕴

That's the conclusion of a classified postmortem report sent to the White House yesterday by Acting Attorney General and DHS Secretary.

📖 Read

via "Dark Reading: ".

🕴 Over 59K Data Breaches Reported in EU Under GDPR 🕴

In addition, 91 reported fines have been imposed since the regulation went into effect last May.

📖 Read

via "Dark Reading: ".

🕴 New Vulnerabilities Make RDP Risks Far From Remote 🕴



📖 Read

via "Dark Reading: ".

🕴 Mitigating the Security Risks of Cloud-Native Applications 🕴

While containers can create more secure application development environments, they also introduce new security challenges that affect security and compliance.

📖 Read

via "Dark Reading: ".

🕴 Cybercriminals Exploit Gmail Feature to Scale Up Attacks 🕴

Criminals are taking advantage of Gmail's 'dots don't matter' feature to set up multiple fraudulent accounts on websites, using variations of the same email address, Agari says.

📖 Read

via "Dark Reading: ".

❌ IoT Scale Flaws Enable Denial of Service, Privacy Issues ❌

Flaws in this connected smart scale might give the diet-challenged a legitimate reason to be nervous about using this vulnerable IoT device.

📖 Read

via "Threatpost | The first stop for security news".

🕴 Shellbot Crimeware Re-Emerges in Monero Mining Campaign 🕴

New attack uses a repurposed version of the Trojan that spreads using Internet Relay Chat.

📖 Read

via "Dark Reading: ".

<b>&#9000; More Alleged SIM Swappers Face Justice &#9000;</b>

<code>Prosecutors in Northern California have charged two men with using unauthorized SIM swaps to steal and extort money from victims. One of the individuals charged allegedly used a hacker nickname belonging to a key figure in the underground who’s built a solid reputation hijacking mobile phone numbers for profit.</code><code>According to indictments unsealed this week, Tucson, Ariz. resident Ahmad Wagaafe Hared and Matthew Gene Ditman of Las Vegas were part of a group that specialized in tricking or bribing representatives at the major wireless providers into giving them control over phone numbers belonging to people they later targeted for extortion and theft.</code><code>Investigators allege that between October 2016 and May 2018, Hared and Ditman grew proficient at SIM swapping, a complex form of mobile phone fraud that is often used to steal large amounts of cryptocurrencies and other items of value from victims.</code><code>The Justice Department says Hared was better known to his co-conspirators as “winblo.” That nickname corresponds to an extremely active and at one time revered member of the forum ogusers[.]com, a marketplace for people who wish to sell highly prized social media account names — including short usernames at Twitter, Instagram and other sites that can fetch thousands of dollars apiece.</code><code>Media</code><code>Winblo’s account on ogusers[.]com</code><code>Winblo was an associate and business partner of another top Oguser member, a serial SIM swapper known to Oguser members as “Xzavyer.” In August 2018, authorities in California arrested a hacker by the same name — whose real name is Xzavyer Clemente Narvaez — charging him with identity theft, grand theft, and computer intrusion.

</code><code>Prosecutors allege Narvaez used the proceeds of his crimes (estimated at > $1 million in virtual currencies) to purchase luxury items, including a McLaren — a $200,000 high-performance sports car.</code><code>According to the indictments against Hared and Ditman, one of the men (the indictment doesn’t specify which) allegedly used his ill-gotten gains to purchase a BMW i8, an automobile that sells for about $150,000.</code><code>Investigators also say the two men stole approximately 40 bitcoins from their SIM swapping victims. That’s roughly $136,000 in today’s conversion, but it would have been substantially more in 2017 when the price of a single bitcoin reached nearly $20,000.</code><code>Interestingly, KrebsOnSecurity was contacted in 2018 by a California man who said he was SIM swapped by Winblo and several associates. That victim, who asked not to be identified for fear of reprisals, said his Verizon mobile number was SIM hijacked by Winblo and others who used that access to take over his Twitter and PayPal accounts and then demand payment for the return of the accounts.</code><code>A computer specialist by trade, the victim said he was targeted because he’d invested in a cryptocurrency startup, and that the hackers found his contact information from a list of investors they’d somehow obtained. As luck would have it, he didn’t have much of value to steal in his accounts.</code><code>The victim said he learned more about his tormentors and exactly how they’d taken over his mobile number after they invited him to an online chat to negotiate a price for the return of his accounts.</code><code>“They told me they had called a Verizon employee line [posing as a Verizon employee] and managed to get my Verizon account ID number,” said my victim source. “Once they had that, they called Verizon customer service and had them reset the password. They literally just called and pretended to be me, and were able to get my account tied to another SIM card.”</code><code>The victim said his attackers even called his mom because the mobile account was in her name. Soon after that, his phone went dead.</code><code>“The funny thing was, after I got my account…

⚠ Digital signs left wide open with default password ⚠

One thing the world doesn't need: hackers who can broadcast to billboards of any size, be they PC monitor- or Godzilla-sized.

📖 Read

via "Naked Security".

⚠ Just two hacker groups are behind 60% of stolen cryptocurrency ⚠

Chainalysis found that two groups, which it calls Alpha and Beta, are responsible for stealing around $1 billion in funds from exchanges.

📖 Read

via "Naked Security".

⚠ Firefox 66 will silence autoplaying web audio ⚠

From Firefox 66 for desktop and Android, due in March, media autoplay of video or audio will be blocked by default.

📖 Read

via "Naked Security".