ATENTION‼ New - CVE-2016-1000282
📖 Read
via "National Vulnerability Database".
Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection.📖 Read
via "National Vulnerability Database".
🕴 No Sign of 'Material' Nation-State Actor Impact on 2018 US Midterms 🕴
📖 Read
via "Dark Reading: ".
That's the conclusion of a classified postmortem report sent to the White House yesterday by Acting Attorney General and DHS Secretary.📖 Read
via "Dark Reading: ".
Dark Reading
Cyberattacks & Data Breaches recent news | Dark Reading
Explore the latest news and expert commentary on Cyberattacks & Data Breaches, brought to you by the editors of Dark Reading
🕴 Over 59K Data Breaches Reported in EU Under GDPR 🕴
📖 Read
via "Dark Reading: ".
In addition, 91 reported fines have been imposed since the regulation went into effect last May.📖 Read
via "Dark Reading: ".
Darkreading
Over 59K Data Breaches Reported in EU Under GDPR
In addition, 91 reported fines have been imposed since the regulation went into effect last May.
🕴 Mitigating the Security Risks of Cloud-Native Applications 🕴
📖 Read
via "Dark Reading: ".
While containers can create more secure application development environments, they also introduce new security challenges that affect security and compliance.📖 Read
via "Dark Reading: ".
Dark Reading
Mitigating the Security Risks of Cloud-Native Applications
While containers can create more secure application development environments, they also introduce new security challenges that affect security and compliance.
🕴 Cybercriminals Exploit Gmail Feature to Scale Up Attacks 🕴
📖 Read
via "Dark Reading: ".
Criminals are taking advantage of Gmail's 'dots don't matter' feature to set up multiple fraudulent accounts on websites, using variations of the same email address, Agari says.📖 Read
via "Dark Reading: ".
Darkreading
Cybercriminals Exploit Gmail Feature to Scale Up Attacks
Criminals are taking advantage of Gmail's 'dots don't matter' feature to set up multiple fraudulent accounts on websites, using variations of the same email address, Agari says.
❌ IoT Scale Flaws Enable Denial of Service, Privacy Issues ❌
📖 Read
via "Threatpost | The first stop for security news".
Flaws in this connected smart scale might give the diet-challenged a legitimate reason to be nervous about using this vulnerable IoT device.📖 Read
via "Threatpost | The first stop for security news".
Threat Post
IoT Scale Flaws Enable Denial of Service, Privacy Issues
Flaws in this connected smart scale might give the diet-challenged a legitimate reason to be nervous.
🕴 Shellbot Crimeware Re-Emerges in Monero Mining Campaign 🕴
📖 Read
via "Dark Reading: ".
New attack uses a repurposed version of the Trojan that spreads using Internet Relay Chat.📖 Read
via "Dark Reading: ".
Darkreading
Shellbot Crimeware Re-Emerges in Monero Mining Campaign
New attack uses a repurposed version of the Trojan that spreads using Internet Relay Chat.
<b>⌨ More Alleged SIM Swappers Face Justice ⌨</b>
<code>Prosecutors in Northern California have charged two men with using unauthorized SIM swaps to steal and extort money from victims. One of the individuals charged allegedly used a hacker nickname belonging to a key figure in the underground who’s built a solid reputation hijacking mobile phone numbers for profit.</code><code>According to indictments unsealed this week, Tucson, Ariz. resident Ahmad Wagaafe Hared and Matthew Gene Ditman of Las Vegas were part of a group that specialized in tricking or bribing representatives at the major wireless providers into giving them control over phone numbers belonging to people they later targeted for extortion and theft.</code><code>Investigators allege that between October 2016 and May 2018, Hared and Ditman grew proficient at SIM swapping, a complex form of mobile phone fraud that is often used to steal large amounts of cryptocurrencies and other items of value from victims.</code><code>The Justice Department says Hared was better known to his co-conspirators as “winblo.” That nickname corresponds to an extremely active and at one time revered member of the forum ogusers[.]com, a marketplace for people who wish to sell highly prized social media account names — including short usernames at Twitter, Instagram and other sites that can fetch thousands of dollars apiece.</code><code>Media</code><code>Winblo’s account on ogusers[.]com</code><code>Winblo was an associate and business partner of another top Oguser member, a serial SIM swapper known to Oguser members as “Xzavyer.” In August 2018, authorities in California arrested a hacker by the same name — whose real name is Xzavyer Clemente Narvaez — charging him with identity theft, grand theft, and computer intrusion.
</code><code>Prosecutors allege Narvaez used the proceeds of his crimes (estimated at > $1 million in virtual currencies) to purchase luxury items, including a McLaren — a $200,000 high-performance sports car.</code><code>According to the indictments against Hared and Ditman, one of the men (the indictment doesn’t specify which) allegedly used his ill-gotten gains to purchase a BMW i8, an automobile that sells for about $150,000.</code><code>Investigators also say the two men stole approximately 40 bitcoins from their SIM swapping victims. That’s roughly $136,000 in today’s conversion, but it would have been substantially more in 2017 when the price of a single bitcoin reached nearly $20,000.</code><code>Interestingly, KrebsOnSecurity was contacted in 2018 by a California man who said he was SIM swapped by Winblo and several associates. That victim, who asked not to be identified for fear of reprisals, said his Verizon mobile number was SIM hijacked by Winblo and others who used that access to take over his Twitter and PayPal accounts and then demand payment for the return of the accounts.</code><code>A computer specialist by trade, the victim said he was targeted because he’d invested in a cryptocurrency startup, and that the hackers found his contact information from a list of investors they’d somehow obtained. As luck would have it, he didn’t have much of value to steal in his accounts.</code><code>The victim said he learned more about his tormentors and exactly how they’d taken over his mobile number after they invited him to an online chat to negotiate a price for the return of his accounts.</code><code>“They told me they had called a Verizon employee line [posing as a Verizon employee] and managed to get my Verizon account ID number,” said my victim source. “Once they had that, they called Verizon customer service and had them reset the password. They literally just called and pretended to be me, and were able to get my account tied to another SIM card.”</code><code>The victim said his attackers even called his mom because the mobile account was in her name. Soon after that, his phone went dead.</code><code>“The funny thing was, after I got my account…
<code>Prosecutors in Northern California have charged two men with using unauthorized SIM swaps to steal and extort money from victims. One of the individuals charged allegedly used a hacker nickname belonging to a key figure in the underground who’s built a solid reputation hijacking mobile phone numbers for profit.</code><code>According to indictments unsealed this week, Tucson, Ariz. resident Ahmad Wagaafe Hared and Matthew Gene Ditman of Las Vegas were part of a group that specialized in tricking or bribing representatives at the major wireless providers into giving them control over phone numbers belonging to people they later targeted for extortion and theft.</code><code>Investigators allege that between October 2016 and May 2018, Hared and Ditman grew proficient at SIM swapping, a complex form of mobile phone fraud that is often used to steal large amounts of cryptocurrencies and other items of value from victims.</code><code>The Justice Department says Hared was better known to his co-conspirators as “winblo.” That nickname corresponds to an extremely active and at one time revered member of the forum ogusers[.]com, a marketplace for people who wish to sell highly prized social media account names — including short usernames at Twitter, Instagram and other sites that can fetch thousands of dollars apiece.</code><code>Media</code><code>Winblo’s account on ogusers[.]com</code><code>Winblo was an associate and business partner of another top Oguser member, a serial SIM swapper known to Oguser members as “Xzavyer.” In August 2018, authorities in California arrested a hacker by the same name — whose real name is Xzavyer Clemente Narvaez — charging him with identity theft, grand theft, and computer intrusion.
</code><code>Prosecutors allege Narvaez used the proceeds of his crimes (estimated at > $1 million in virtual currencies) to purchase luxury items, including a McLaren — a $200,000 high-performance sports car.</code><code>According to the indictments against Hared and Ditman, one of the men (the indictment doesn’t specify which) allegedly used his ill-gotten gains to purchase a BMW i8, an automobile that sells for about $150,000.</code><code>Investigators also say the two men stole approximately 40 bitcoins from their SIM swapping victims. That’s roughly $136,000 in today’s conversion, but it would have been substantially more in 2017 when the price of a single bitcoin reached nearly $20,000.</code><code>Interestingly, KrebsOnSecurity was contacted in 2018 by a California man who said he was SIM swapped by Winblo and several associates. That victim, who asked not to be identified for fear of reprisals, said his Verizon mobile number was SIM hijacked by Winblo and others who used that access to take over his Twitter and PayPal accounts and then demand payment for the return of the accounts.</code><code>A computer specialist by trade, the victim said he was targeted because he’d invested in a cryptocurrency startup, and that the hackers found his contact information from a list of investors they’d somehow obtained. As luck would have it, he didn’t have much of value to steal in his accounts.</code><code>The victim said he learned more about his tormentors and exactly how they’d taken over his mobile number after they invited him to an online chat to negotiate a price for the return of his accounts.</code><code>“They told me they had called a Verizon employee line [posing as a Verizon employee] and managed to get my Verizon account ID number,” said my victim source. “Once they had that, they called Verizon customer service and had them reset the password. They literally just called and pretended to be me, and were able to get my account tied to another SIM card.”</code><code>The victim said his attackers even called his mom because the mobile account was in her name. Soon after that, his phone went dead.</code><code>“The funny thing was, after I got my account…
⚠ Digital signs left wide open with default password ⚠
📖 Read
via "Naked Security".
One thing the world doesn't need: hackers who can broadcast to billboards of any size, be they PC monitor- or Godzilla-sized.📖 Read
via "Naked Security".
Naked Security
Digital signs left wide open with default password
One thing the world doesn’t need: hackers who can broadcast to billboards of any size, be they PC monitor- or Godzilla-sized.
⚠ Just two hacker groups are behind 60% of stolen cryptocurrency ⚠
📖 Read
via "Naked Security".
Chainalysis found that two groups, which it calls Alpha and Beta, are responsible for stealing around $1 billion in funds from exchanges.📖 Read
via "Naked Security".
Naked Security
Just two hacker groups are behind 60% of stolen cryptocurrency
Chainalysis found that two groups, which it calls Alpha and Beta, are responsible for stealing around $1 billion in funds from exchanges.
⚠ Firefox 66 will silence autoplaying web audio ⚠
📖 Read
via "Naked Security".
From Firefox 66 for desktop and Android, due in March, media autoplay of video or audio will be blocked by default.📖 Read
via "Naked Security".
Naked Security
Firefox 66 will silence autoplaying web audio
From Firefox 66 for desktop and Android, due in March, media autoplay of video or audio will be blocked by default.
⚠ Jack’d dating app is showing users’ intimate pics to strangers ⚠
📖 Read
via "Naked Security".
A clear and present danger: Anyone with a web browser who knows where to look can access Jack'd users' photos, be they private or public.📖 Read
via "Naked Security".
Naked Security
Jack’d dating app is showing users’ intimate pics to strangers
A clear and present danger: Anyone with a web browser who knows where to look can access Jack’d users’ photos, be they private or public.
🕴 7 Tips For Communicating With the Board 🕴
📖 Read
via "Dark Reading: ".
The key? Rather than getting bogged down in the technical details, focus on how a security program is addressing business risk.📖 Read
via "Dark Reading: ".
Dark Reading
7 Tips For Communicating With the Board
The key? Rather than getting bogged down in the technical details, focus on how a security program is addressing business risk.
❌ Modern Cybercrime: It Takes a Village ❌
📖 Read
via "Threatpost | The first stop for security news".
Today's financial cyber-rings have corporate insider and management roles -- cybercrime is not just just for hackers and coders anymore.📖 Read
via "Threatpost | The first stop for security news".
Threat Post
Modern Cybercrime: It Takes a Village
Today's financial cyber-rings have corporate insider and management roles — cybercrime is not just just for hackers and coders anymore.
🔐 4 tips to keep your business safe online, according to Google 🔐
📖 Read
via "Security on TechRepublic".
Most people still lack an understanding of best practices for passwords and other security measures, Google found.📖 Read
via "Security on TechRepublic".
TechRepublic
4 tips to keep your business safe online, according to Google
Most people still lack an understanding of best practices for passwords and other security measures, Google found.
🔐 Data breaches, GDPR lead 54% of companies to increase IT security spending 🔐
📖 Read
via "Security on TechRepublic".
One in three companies is still unprepared for many potential cybersecurity threats, according to an eSecurityPlanet.com report.📖 Read
via "Security on TechRepublic".
TechRepublic
Data breaches, GDPR lead 54% of companies to increase IT security spending
One in three companies is still unprepared for many potential cybersecurity threats, according to an eSecurityPlanet.com report.
❌ Microsoft Confirms Serious ‘PrivExchange’ Vulnerability ❌
📖 Read
via "Threatpost | The first stop for security news".
The elevated privilege flaw exists in Microsoft Exchange and would allow a remote attacker to impersonate an administrator.📖 Read
via "Threatpost | The first stop for security news".
Threat Post
Microsoft Confirms Serious ‘PrivExchange’ Vulnerability
The elevated privilege flaw exists in Microsoft Exchange and would allow a remote attacker to impersonate an administrator.
🕴 Serverless Computing: 'Function' vs. 'Infrastructure' as-a-Service 🕴
📖 Read
via "Dark Reading: ".
How much do companies really gain from offloading security duties to the cloud? Let's do the math.📖 Read
via "Dark Reading: ".
Darkreading
Serverless Computing: 'Function' vs. 'Infrastructure' as-a-Service
How much do companies really gain from offloading security duties to the cloud? Let's do the math.
🔐 3 things businesses need to know about customer privacy expectations 🔐
📖 Read
via "Security on TechRepublic".
After a data breach, 57% of consumers blame companies above everyone else, even hackers, for the event, according to an RSA Security report.📖 Read
via "Security on TechRepublic".
TechRepublic
3 things businesses need to know about customer privacy expectations
After a data breach, 57% of consumers blame companies above everyone else, even hackers, for the event, according to an RSA Security report.
❌ What are Data Manipulation Attacks, and How to Mitigate Against Them ❌
📖 Read
via "Threatpost | The first stop for security news".
Hackers don't always steal data. Sometimes the goal is to manipulate the data to intentionally trigger external events that can be capitalized on.📖 Read
via "Threatpost | The first stop for security news".
Threat Post
What are Data Manipulation Attacks, and How to Mitigate Against Them
Hackers don't always steal data. Sometimes the goal is to manipulate the data to intentionally trigger external events that can be capitalized on.