News – August 2019


  • Some of Russia’s surveillance tech leaked data for more than a year

    August 30, 2019

    A Russian security researcher has found that hardware equipment meant to be used by Russian authorities to intercept internet traffic had been leaving data exposed on the internet. The leaky equipment were SORM devices. These are hardware wiretaps that all Russian internet service providers and mobile telecoms must install in their data centers to comply with ...

  • Google finds malicious sites pushing iOS exploits for years

    August 30, 2019

    Security researchers at Google said they found malicious websites that served iPhone exploits for almost three years. The attacks weren’t aimed at particular iOS users, as most iOS exploits tend to be used, but were aimed at any user accessing these sites via an iPhone. “There was no target discrimination; simply visiting the hacked site was enough ...

  • Hiding in Plain Text: Jenkins Plugin Vulnerabilities

    August 30, 2019

    Jenkins is a widely used open-source automation server that allows DevOps developers to build, test, and deploy software efficiently and reliably. In order to make the most out of Jenkins’ modular architecture, developers make use of plugins that help extend its core features, allowing them to expand the scripting capabilities of build steps. As of writing, there ...

  • French Cyber Police Takedown Paris-based Botnet

    August 29, 2019

    C3N cybercrime unit, along with the FBI and Avast, take down French botnet that infected 850,000 computers French cyber police have reportedly taken down a botnet, that infected more that 850,000 computers, mostly in South America. According to AFP, the operation began in March 2019 when Czech antivirus firm Avast alerted the Cybercrime Fighting Center (C3N) of the ...

  • Google launches bounty program to spot misuses of Google API, Chrome, and Android user data

    August 29, 2019

    Google announced today a new bug bounty program through which security researchers can report cases of abuse where third-party apps are stealing or misusing Google user data. The new bounty program is named the Developer Data Protection Reward Program (DDPRP), and security researchers can report cases of potential data abuse in third-party apps that have access to ...

  • Russian police take down malware gang that infected 800,000+ Android smartphones

    August 29, 2019

    Russian authorities have arrested members of the TipTop cybercrime group, believed to have infected more than 800,000 Android smartphones with malware since 2015. The group operated by renting Android banking trojans from underground hacking forums, which they later hid inside Android apps distributed via search engine ads and third-party app stores. TipTop has been active since 2015, ...

  • FIN6 Switches Up PoS Tactics to Target E-Commerce

    August 29, 2019

    The group is using the More_eggs JScript backdoor to anchor its attack. The financial cybergang known as the FIN6 group, known for going after brick-and-mortar point-of-sale (PoS) data in the U.S. and Europe, has changed up its tactics to target e-commerce sites. According to researchers at IBM X-Force Incident Response and Intelligence Services (IRIS), FIN6 (a.k.a. ITG08) ...

  • Patch now: Cisco IOS XE routers exposed to rare 10/10-severity security flaw

    August 29, 2019

    Cisco is urging customers to install updates for a critical bug affecting its popular IOS XE operating system that powers millions of enterprise network devices around the world. The bug has a rare Common Vulnerability Scoring System (CVSS) version 3 rating of 10 out of a possible 10 and allows anyone on the internet to bypass the login ...

  • Exploitation of Windows CVE-2019-0708 (BlueKeep): Three Ways to Write Data into the Kernel with RDP PDU

    August 29, 2019

    In May 2019, Microsoft released an out-of-band patch update for remote code execution vulnerability CVE-2019-0708, which is also known as “BlueKeep” and resides in code to Remote Desktop Services (RDS). This vulnerability is pre-authentication and requires no user interaction, making it particularly dangerous as it has the unsettling potential to be weaponized into a destructive exploit. ...

  • ‘Heatstroke’ Campaign Uses Multistage Phishing Attack to Steal PayPal and Credit Card Information

    August 29, 2019

    Despite having an apparent lull in the first half of 2019, phishing will remain a staple in a cybercriminal’s arsenal, and they’re not going to stop using it. The latest example is a phishing campaign dubbed Heatstroke, based on a variable found in their phishing kit code. Heatstroke demonstrates how far phishing techniques have evolved —  from merely mimicking ...

  • WannaCry-style cyber attack could trigger full NATO response, says Secretary General

    August 28, 2019

    NATO Secretary General Jens Stoltenberg has said a cyber attack on a single member state could constitute an attack on all 29 members. The announcement effectively incorporates cyber security into Article 5 of the NATO founding treaty, a “collective defence commitment” which compels all members to come to the defence of one or more countries threatened ...

  • Spam and phishing in Q2 2019

    August 28, 2019

    In the second quarter of 2019, scammers were making active use of cloud-based data storage services such as Google Drive and Google Storage to hide their illegal content. The reasoning behind this is simple: a link from a legitimate domain is seen as more trustworthy by both users and spam filters. Most often, such links point to ...

  • Hackers mount attacks on Webmin servers, Pulse Secure, and Fortinet VPNs

    August 25, 2019

    To nobody’s surprise, hacker groups have started exploiting vulnerabilities that have been made public earlier this month, taking advantage of public technical details and demo exploit code to launch attacks against real-world targets. Attacks have started this week, and they’ve been seen targeting Webmin, a web-based utility for managing Linux and *NIX systems, but also enterprise ...

  • AMEO ‘concerned’ about nation-state attacks on power grids

    August 22, 2019

    “For the energy sectors and critical infrastructure sectors, particularly around electricity, we are concerned about nation-state actors,” says Tim Daly, chief security officer (CSO) for the Australian Energy Market Operator (AEMO). “Nation-states are looking to have capability and implants that are persistent within critical organisations,” he told the Gartner Security and Risk Management Summit in Sydney ...

  • Russian Hacking Group Targeting Banks Worldwide With Evolving Tactics

    August 21, 2019

    Silence APT, a Russian-speaking cybercriminal group, known for targeting financial organizations primarily in former Soviet states and neighboring countries is now aggressively targeting banks in more than 30 countries across America, Europe, Africa, and Asia. Active since at least September 2016, Silence APT group’s most recent successful campaign was against Bangladesh-based Dutch-Bangla Bank, which lost over $3 ...

  • Firefox And Chrome Fight Back Against Kazakhstan’s Spying

    August 21, 2019

    Against the backdrop of China, Russia, and Iran working to sequester their own private, national internets, other countries like Kazakhstan have experimented with similar balkanization and internet-control initiatives. Kazakhstan first piloted a monitoring system in 2015 that would offer access to all web traffic within the country, even encrypted data. After fierce debate and some legal hurdles over the ...

  • A botnet has been cannibalizing other hackers’ web shells for more than a year

    August 21, 2019

    A major botnet operation has been attacking and taking over the web shells (backdoors on web servers) of other malware operations for more than a year, security researchers from Positive Technologies revealed today. Researchers linked the botnet to a former Windows trojan named Neutrino (also known as Kasidet), whose operators appear to have shifted from targeting desktop users ...

  • Unpatchable security flaw found in popular SoC boards

    August 20, 2019

    Security researchers have discovered an unpatchable security flaw in a popular brand of system-on-chip (SoC) boardsmanufactured by Xilinx. The vulnerable component is Xilinx’s Zynq UltraScale+ brand, which includes system-on-chip (SoC), multi-processor system-on-chip (MPSoC), and radio frequency system-on-chip (RFSoC) products used inside automotive, aviation, consumer electronics, industrial, and military components. According to security researchers with Inverse Path — F-Secure’s hardware ...

  • Hackers Planted Backdoor in Webmin, Popular Utility for Linux/Unix Servers

    August 20, 2019

    Following the public disclosure of a critical zero-day vulnerability in Webmin last week, the project’s maintainers today revealed that the flaw was not actually the result of a coding mistake made by the programmers. Instead, it was secretly planted by an unknown hacker who successfully managed to inject a backdoor at some point in its build ...

  • Newly Registered Domains: Malicious Abuse by Bad Actors

    August 20, 2019

    Newly registered domains (NRDs) are known to be favored by threat actors to launch malicious campaigns. Academic and industry research reports have shown statistical proof that NRDs are risky, revealing malicious usage of NRDs including phishing, malware, and scam. Therefore, best security practice calls for blocking and/or closely monitoring NRDs in enterprise traffic. Despite the evidence, there hasn’t yet ...