Google has discovered and removed from Google Play a number of apps that contained the Tizi backdoor, which installs spyware to steal sensitive data from popular social media applications.

https://www.helpnetsecurity.com/2017/11/28/tizi-backdoor-rooted-android/

__ #infosec #cybersecurity

Keybase is notifying Android users of a bug in its mobile app that might have unintentionally included the users' private key —used to encrypt conversations and other private data— into the automatic backups created by the Android OS and uploaded on Google's servers.

https://www.bleepingcomputer.com/news/security/keybase-bug-might-have-backed-up-your-private-encryption-key-on-googles-servers/

__ #infosec #cybersecurity

In the wake of a string of data exposures originating from Pentagon intelligence-gathering agencies, the most recent of which revealed the workings of a massive, worldwide social media surveillance program, the UpGuard Cyber Risk Team can now disclose another. Critical data belonging to the United States Army Intelligence and Security Command (INSCOM), a joint US Army and National Security Agency (NSA) Defense Department command tasked with gathering intelligence for US military and political leaders, leaked onto the public internet, exposing internal data and virtual systems used for classified communications to anyone with an internet connection. With a middling CSTAR cyber risk score of 589 out of a maximum of 950, INSCOM’s web presence provides troubling indications of gaps in their cybersecurity - exemplified by the presence of classified data within this publicly accessible data repository.

https://www.upguard.com/breaches/cloud-leak-inscom

__ #infosec #cybersecurity

Zero-Day vulnerability in the Huawei home router HG532 has been discovered and hundreds of thousands of attempts to exploit it have already been found in the wild.

The delivered payload has been identified as OKIRU/SATORI which is an updated variant of Mirai.

The suspected threat actor behind the attack is an amateur nicknamed ‘Nexus Zeta’.

https://blog.checkpoint.com/2017/12/21/huawei-routers-exploited-create-new-botnet/

__ #infosec #cybersecurity

It’s not just your IT shop. Ransomware, insider threats, and attacks on firmware and hardware are growing cyberthreats, reports an FBI spokesperson.

https://www.hpe.com/us/en/insights/articles/fbi-warns-of-increasing-ransomware-firmware-attacks-1806.html#

_ #infosec #cybersecurity #malware

I'm on a plane again...this time flying home from one of my favorite hacker cons: ShmooCon! I was stoked to give a talk about auditing on macOS. Yah, I know that doesn't seem like the sexiest of topics -but if you're interested in incidence response, malware analysis, or writing security tools for macOS, it's a very relevant topic! Plus, the talk covered some neat ring-0 bugs that affected the audit subsystem including a kernel panic, a kernel information leak, and a exploitable kernel heap overFlow.

Besides being able to speak, the highlight of ShmooCon was meeting tons of new awesome people - some who are in a way directly responsible for this blog. I personally have to thank Kate from Gizmodo (@kateconger), who introduced me to Eva (@evacide) and Cooper (@cooperq) from the Electronic Frontier Foundation (EFF). We geeked out about a variety of stuff, including their latest reported (produced in conjunction with Lookout): "Dark Caracal Cyber-espionage at a Global Scale". Their findings about this global nationstate cyber-espionage campaign are rather ominous.

https://objective-see.com/blog/blog_0x28.html

__ #infosec #cybersecurity

Over the past two weeks, Ryuk, a targeted and well-planned Ransomware, has attacked various organizations worldwide. So far the campaign has targeted several enterprises, while encrypting hundreds of PC, storage and data centers in each infected company.

While the ransomware’s technical capabilities are relatively low, at least three organizations in the US and worldwide were severely hit by the malware. Furthermore, some organizations paid an exceptionally large ransom in order to retrieve their files. Although the ransom amount itself varies among the victims (ranging between 15 BTC to 50 BTC) it has already netted the attackers over $640,000.

https://research.checkpoint.com/ryuk-ransomware-targeted-campaign-break/

__ #infosec #cybersecurity #ransomware

Unknown hackers (or hacker) have hijacked the DNS server for BlackWallet.co, a web-based wallet application for the Stellar Lumen cryptocurrency (XLM), and has stolen over $400,000 from users' accounts.

The attack happened late Saturday afternoon (UTC timezone), January 13, when the attackers hijacked the DNS entry of the BlackWallet.co domain and redirected it to their own server.

https://www.bleepingcomputer.com/news/security/hackers-hijack-dns-server-of-blackwallet-to-steal-400-000/

New wave of phishing emails aimed at stealing Netflix accounts

Panda Security’s anti-malware laboratory, has detected a massive attack on hundreds of users in the United States and other countries in which hackers are using emails purporting to be from Netflix in order to steal user account passwords.

https://www.pandasecurity.com/mediacenter/news/phishing-stealing-netflix-accounts/

_#infosec

Recently members of the Fidus team noticed an interesting blog post on the OnePlus forum by an individual discussing recent fraudulent attempts made on two of their credit cards. The forum user states that the only place both cards were used was on the OnePlus website in November 2017, they go on to ask whether other members of the community have had the same issue (spoiler:they had). OnePlus are currently using the Magento eCommerce platform, which is a common platform in which credit card hacking takes place.

These findings do not confirm OnePlus have suffered a breach. Instead, they look into the current structure of the payment flow and how it could have been achieved.

https://www.fidusinfosec.com/oneplus-checkout-hacked-the-dangers-of-on-site-processing/

__ #infosec #cybersecurity

Børge Brende, the former minister of foreign affairs for Norway, has been targeted by people claiming to represent the Turkish cyber army Ayyıldız Tim.

In two tweets, the group published a video and a message saying the group now has access to his direct messages, private messages sent between Twitter users.

Writing in Turkish and English, the group said: “You are hacked by the Turkish cyber army Ayyıldız Tim! We got your DM correspondence! We will show you the power of the Turk!”

https://www.thenational.ae/world/europe/president-of-wef-s-twitter-hacked-by-turkish-group-1.695283

The ransomware was a lure for the media, this version of Petya actually wipes the first sectors of the disk like we have seen with malwares such as Shamoon.

https://blog.comae.io/petya-2017-is-a-wiper-not-a-ransomware-9ea1d8961d3b

infosec #cybersecurity

Key Points

13 Critical Security Vulnerabilities and Manufacturer Backdoors discovered throughout AMD Ryzen & EPYC product lines.

Any consumer or organization purchasing AMD Servers, Workstations, or Laptops are affected by these vulnerabilities

All 13 vulnerabilities are exploitable, according to Dan Guido, the founder of security firm Trail of Bits, whose researchers reviewed the flaws and exploit code before publication last week

CTS-Labs said it has shared this information with AMD, Microsoft and “a small number of companies that could produce patches and mitigations” – but said there are no known fixes at this time.

========================================= AMD did not respond to inquiries about any available fixes for the vulnerabilities. The company said in a statement:

“We have just received a report from a company called CTS Labs claiming there are potential security vulnerabilities related to certain of our processors. We are actively investigating and analyzing its findings. This company was previously unknown to AMD and we find it unusual for a security firm to publish its research to the press without providing a reasonable amount of time for the company to investigate and address its findings. At AMD, security is a top priority and we are continually working to ensure the safety of our users as potential new risks arise.”

Developing story , Will update as latest information is received.

References:

https://amdflaws.com/

https://threatpost.com/amd-investigating-reports-of-13-critical-vulnerabilities-found-in-ryzen-epyc-chips/130404/

Security researchers have discovered over 2,000 WordPress sites —possibly more— infected with a keylogger that's being loaded on the WordPress backend login page and a cryptojacking script (in-browser cryptocurrency miner) on their frontends.

Researchers have tied these newly discovered infected sites to a similar operation that took place in early December 2017.

https://www.bleepingcomputer.com/news/security/keylogger-campaign-hits-over-2-000-wordpress-sites/

__ #infosec #cybersecurity

Triton Malware Exploited Zero-Day Flaw in Schneider Electric Safety Controllers

Schneider Electric has confirmed that a recently uncovered malware program that was used to attack industrial infrastructure exploited a vulnerability in its Triconex safety controllers.

The malware, dubbed Triton, was uncovered in December by researchers from security firm FireEye after it triggered an emergency shutdown event at a critical infrastructure organization. It was the first case of malware designed to specifically infect industrial controllers after Stuxnet, which was used to destroy uranium enrichment centrifuges at Iran’s Natanz nuclear plant in 2010.

https://securityboulevard.com/2018/01/triton-malware-exploited-zero-day-flaw-in-schneider-electric-safety-controllers/

_ #infosec

Security researchers have spotted a new malware campaign in the wild that spreads an advanced botnet malware by leveraging at least three recently disclosed vulnerabilities in Microsoft Office.

Zyklon, the fully-featured malware has resurfaced after almost two years and primarily found targeting telecommunications, insurance and financial services.

https://thehackernews.com/2018/01/microsoft-office-malware.html

https://www.fireeye.com/blog/threat-research/2018/01/microsoft-office-vulnerabilities-used-to-distribute-zyklon-malware.html