No need to breach any systems when the vendor gives the data away for free.
Dozens of unsecured databases exposed on the public web are the target of an automated ‘meow’ attack that wipes data without any explanation.
Presumably a company like Garmin would have BCP in place, and yet the outage is still ongoing. A post-mortem will be interesting to see.
The WastedLocker ransomware, used by a notorious Russian hacking group, is said to be to blame.
Twitter is being used for a cryptocurrency scam by using several high profile hijacked user accounts. It’s not hard to imagine far more nefarious things that could have happen – from stock market manipulation to political warfare.
Twitter was thrown into chaos on Wednesday after accounts for some of the world’s most recognizable public figures, executives and celebrities starting tweeting out links to bitcoin scams. Twitter says the attack happened because someone tricked or coerced an employee into providing access to internal Twitter administrative tools. This post is an attempt to lay…
Ebay – and others – have been caught deploying port scanning on your machine when you visit their website. We’re not talking about scanning your gateway. We’re talking about scanning the very machine that you’re using to visit their website. How is this possible? Well, modern browsers support a technology known as WebRTC that makes it possible to do video conferencing – among others – without installing software. This technology is what enables port scanning to be done by the website. To protect yourself, you should install browser add-ons to disable WebRTC when not in use.
Websites are scanning for open ports on your PC to help fight fraud, but this data also flows into a massive, global tracking database.
Apply awarded a 100K bug bounty for a relatively simple – but admittedly high impact – bug. This researcher got lucky.
What if I say, your Email ID is all I need to takeover your account on your favorite website or an app. Sounds scary, right? This is what a bug in Sign in with Apple allowed me to do.
Source: Zero-day in Sign in with Apple
The storytelling here is fantastic. It reads like drama, but it actually happened in real life. This is the story of the hacker who stopped WannaCry. It’s a long article but definitely worth reading till the end.
At 22, Marcus Hutchins put a stop to the worst cyberattack the world had ever seen. Then he was arrested by the FBI. This is his untold story.
The rise of Zoom is undeniable in today’s climate. Work, school, communities, etc. are all adopting Zoom and other video messaging platform as a primary means of communication. However, Zoom – the company – has some questionable practices, which leads to Zoom – the product – having many security and privacy issues. Here is an entire article devoted to problems with Zoom:
Every Zoom Security and Privacy Flaw So Far, and What You Can Do to Protect Yourself
The problems with Zoom extend beyond its recent troubles. More articles related to Zoom issues:
MOE suspends use of Zoom in home-based learning following breaches involving obscene images
Who has banned Zoom? Google, NASA, and more
‘Zoombombing’ City Hall: Online Harassment Surges As Public Meetings Go Virtual
Google Told Its Workers That They Can’t Use Zoom On Their Laptops Anymore
Zoom admits some calls were routed through China by mistake
Security and Privacy Implications of Zoom
Thousands of Zoom video calls left exposed on open Web
A Quick Look at the Confidentiality of Zoom Meetings
New Zoom Hack Lets Hackers Compromise Windows and Its Login Password
Zoom is Leaking Peoples’ Email Addresses and Photos to Strangers
Zoom iOS App Sends Data to Facebook Even if You Don’t Have a Facebook Account
The Zoom Desktop App Lets Any Website Take Over Your Mac’s Camera. Here’s What To Do About It.
Apple has pushed a silent Mac update to remove hidden Zoom web server
A severe vulnerability is discovered in one of the core components of Windows. Microsoft has since released an urgent out-of-band patch to all affected machines.
“Microsoft is aware of a remote code execution vulnerability in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target SMB Server or SMB Client.” reads the advisory published by Microsoft.
This vulnerability affects WhatsApp desktop – which I didn’t know exists – for Mac and Windows. It does so by exploiting unpatched bugs in the older version of Electron that WhatsApp desktop uses.
Critical Security Flaw Found in WhatsApp Desktop Platform Allowing Cybercriminals Read From The File System Access