Week in review: FREAK flaw, a new PoS malware family, and the new issue of (IN)SECURE Magazine
Here’s an overview of some of last week’s most interesting news, interviews and articles:
A threat assessment of 7 million iOS and Android apps
Android malware is growing more pervasive, and iOS devices are also increasingly at risk.
HITB Haxpo: Connecting hackers, makers, builders and breakers
Youri van der Zwart is running HITB Haxpo – a free exhibition for hackers, makers and software developers taking place alongside the Hack In The Box conference in Amsterdam, 27th – 29th May 2015, In this article, he introduced the HITB Haxpo to our readers, and highlighted several interesting speakers and workshops.
0-day flaw in Seagate NAS devices endangers thousands
Seagate’s Business Storage 2-Bay NAS line of products, which is popular both with home and business users, sports a zero-day remote code execution vulnerability that can be easily exploited by attackers, security researcher OJ Reeves warned.
(IN)SECURE Magazine issue 45 released
(IN)SECURE Magazine is a free digital security publication discussing some of the hottest information security topics. Issue 45 has been released today.
Uber’s on a hunt for the attacker that compromised its drivers’ database
Uber’s Managing Counsel of Data Privacy Katherine Tassi has revealed that the company has suffered a data breach. One of its databases, which contains Uber drivers’ names and their license numbers, has been accessed by a third party.
3 ways to advocate for data security at your company
As cyber attacks grow more common and more sophisticated, businesses must make data security a priority. But often leadership is resistant. How can you advocate for stronger security within your organization?
Mass infection malware attack targets Android
The malware, dubbed Gazon, which uses victims’ mobile phone contacts to propagate, sends messages to their contacts linking to offers for spoof Amazon vouchers, which when opened, installs malware to their Android device.
Exposing the organized crime of tomorrow
A decline of traditional hierarchical criminal groups and networks will be accompanied by the expansion of a virtual criminal underground made up of individual criminal entrepreneurs, who come together on a project basis.
Global experiment exposes the dangers of using Wi-Fi hotspots
A global Wi-Fi hacking experiment exposed major security issues regarding the browsing habits of users around the globe.
Phishers target victims of iOS device theft
A clever phishing scheme has been spotted targeting users who have had their iPad or iPhone stolen, leading researchers to believe that it has been set up by a criminal group that offers thieves the service of finding out the information necessary to unlock the stolen devices.
Flaw in GoPro update mechanism reveals users’ Wi-Fi passwords
A vulnerability in the update mechanism for the wireless networks operated by GoPro cameras has allowed a security researcher to easily harvest over a 1,000 login credentials (including his own).
New PoS malware family discovered
A new family of PoS malware has been discovered and analyzed by Trend Micro researchers. They dubbed it PwnPOS, and believe that it has been in used since 2013, possibly even earlier. So how come it took so long for it to be spotted?
What’s the most common security threat for an organization?
One misconception when it comes to organization security is that threats typically come from outside an organization. The truth is, many security breaches originate from within the walls of a business and are driven by ignorance.
Cryptowall makes a comeback via malicious help files
A new spam wave has hit hundreds of mailboxes with malicious .chm attachments to spread the infamous Cryptowall ransomware.
Lepide Software launches LepideMigrator for Exchange
LepideMigrator for Exchange is a one-stop solution that migrates all user mailboxes, public folders and archive mailboxes along with their content and resources from an Exchange Server to another.
US air traffic control system is riddled with vulnerabilities
A recently released report by the US Government Accountability Office has revealed that despite some improvements, the Federal Aviation Administration (FAA) still needs to quash significant security control weaknesses that threaten the agency’s ability to ensure the safe and uninterrupted operation of the national airspace system (NAS).
Angler exploit kit and domain shadowing: A deadly combination
Attackers wielding the infamous Angler exploit kit are increasingly using hijacked registrant accounts to create huge amounts of subdomains for both redirecting victims and the destination pages hosting the exploit kit.
5 tips to avoid identity theft
Credit Sesame encourages consumers to consider these five actions when filing their taxes this year.
How DDoS attacks impact service providers
There’s a striking disparity between how threatened service providers feel by potential DDoS attacks and how prepared they are to mitigate one.
Anthem refuses comprehensive IT security audit after the breach
Recently breached US health insurer Anthem has refused to let The Office of Personnel Management’s Office of Inspector General (OIG) perform a full security audit of its systems, and this is not the first time this happened.
NLPRank: An innovative tool for blocking APT malicious domains
Security researchers working at OpenDNS’ Security Labs have developed NLPRank, a new system that helps detect – quickly and relatively accurately – phishing and malware-download sites set up by APT threat actors.
Banking Trojans target nearly 1,500 financial institutions
Nine of the most common and sophisticated financial Trojans in use are targeting 1,467 financial institutions in 86 countries, says a Symantec report compiled after the analysis of 999 configuration files from recent Trojan samples.
Windows vulnerable to FREAK attacks after all
Microsoft has released a security advisory on Thursday, confirming that all supported releases of Microsoft Windows are vulnerable to the recently documented FREAK (Factoring RSA Export Keys) attack. The FREAK flaw, discovered initially in OpenSSL and Apple’s Secure Transport implementation of SSL and TLS protocols, can be misused to force vulnerable clients and servers to used weak cipher suites. They, in turn, can be broken by determined and resourceful attackers, and this would allow them to intercept data exchanged by users and secure websites. In short, the encrypted connection between the two entities is undermined.
Expert tips to address third party security risks
Risks to sensitive data have never been greater. With the rise in cyber attacks and data breaches, outsourcing to third parties can present an exponential threat to corporations.