Category: security

Spear-phishing is quickly becoming the most popular technique for hacking high-value targets. The SingHealth hack was suspected to be due to spear-phishing as well. HR is obviously most at risk, as they need to review resumes which can come as PDF or Word document.

The lawsuit notes the company determined that it was likely the same group of attackers responsible for both intrusions. Verizon also told the bank that the malware the attackers used to gain their initial foothold at the bank in the 2017 breach was embedded in a booby-trapped Microsoft Word document.

Source: Hackers Breached Virginia Bank Twice in Eight Months, Stole $2.4M — Krebs on Security

Much ado about nothing. The context was, some journalists were highly suspicious of the USB fan that was included in the goody bag for the media during the Trump-Kim summit in Singapore, deeming it a cybersecurity risk. It’s probably good not to plug untrusted USB devices into your machine but c’mon please give the organizers more credit than this.

A University of Cambridge researcher wanted to know if the fan was bugged.

Source: ‘Suspicious’ USB fan given out at Trump-Kim summit deemed safe | ZDNet

Be careful what you install, even if it’s from the official app/repository store. This also goes for browser extensions, docker images, Notepad++ add-ons, etc.

Oh, snap! Just because some packages are available to install directly from the Ubuntu Software Center doesn’t make them safe. This is proved by a recent discovery of malware in some snap packages from the Ubuntu Snaps Store.

Source: Malware Found In The Ubuntu Snap Store – Linux Uprising Blog

This is the classic DDoS attack, but with a twist. Instead of spamming servers through the Internet, someone is spamming phone lines through a phone botnet. Similar to DDoS, this makes it difficult for legitimate calls to go through.

Candidates for Malaysia’s 14th general election have claimed that their phones have been hacked and spammed with calls from overseas numbers.

Source: Malaysia general election candidates slam ‘dirty trick’ spam calls; Najib orders action

Your mobile phone may be hacked when visiting a hostile website. Researchers have used the Rowhammer attack to successfully run unauthorized code.

JavaScript based GLitch pwns browsers by flipping bits inside memory chips.

Source: Drive-by Rowhammer attack uses GPU to compromise an Android phone

Great news for web security. There’s no excuse not to adopt HTTPS for your website. We have reached the tipping point for HTTPS adoption and hopefully this will encourage the rest to do so.

Source: ACME v2 and Wildcard Certificate Support is Live