Skip to main content

Security

New Drupalgeddon Attacks Enlist Shellbot to Open Backdoors

posted onOctober 11, 2018
by l33tdawg
Credit: Flickr

Researchers are warning of a new wave of cyberattacks targeting unpatched Drupal websites that are vulnerable to Drupalgeddon 2.0. What’s unique about this latest series of attacks is that adversaries are using PowerBot malware, an IRC-controlled bot also called PerlBot or Shellbot.

Even with the latest iOS 12 update, your iPhone’s lockscreen is unsafe

posted onOctober 2, 2018
by l33tdawg
Credit: Hot for Security

Once again, a way of bypassing the iPhone’s passcode lock to expose users’ photos and contacts has been discovered.

Jose Rodriguez, who has uncovered vulnerabilities in iOS’s lock screen security on a number of occasions in the past, has produced a video demonstrating an (admittedly convoluted) way of accessing information on locked iOS devices that really should be out of bounds.

Google taking new steps to prevent malicious Chrome extensions

posted onOctober 2, 2018
by l33tdawg
Credit: Arstechnica

Google has announced plans to further restrict Chrome extensions in a bid to crack down on the number of malicious extensions found in the Chrome Web Store.

We've seen a spate of malicious extensions this year; the extensions do things like steal credentials and participate in click fraud schemes. The malicious extensions take advantage of the considerable access to webpages that extensions have.

New Zealand Customs Can Fine You for Refusing to Disclose Passwords

posted onOctober 2, 2018
by l33tdawg
Credit: Wikipedia

Travelers who refuse to hand over the passwords to their computers and smartphones to New Zealand's Customs Service could now face a $3,300 fine.

Officials in the country already had the power to search your digital devices. But the new Customs and Excise Act, which took effect on Monday, now lets them dangle the threat of a fine to anyone who refuses to hand over the passwords or encryption keys for their digital devices.

Facebook says hackers did not access other sites with its login

posted onOctober 2, 2018
by l33tdawg
Credit: Reuters

Facebook Inc said on Tuesday that investigators have determined that hackers did not access other sites that use the social networking site’s single sign-on in a massive cyber attack that the company disclosed last week.

“We analyzed third-party access during the time of the attack we have identified. That investigation has found no evidence that the attackers accessed any apps using Facebook Login,” said Guy Rosen, a Facebook vice president overseeing security, in a statement sent to Reuters.

DHS says teamwork is improving election security

posted onOctober 2, 2018
by l33tdawg
Credit: FCW

A month out from the 2018 midterms, all eyes are on the Department of Homeland Security as it approaches its first real test since being given a broader election security mandate in the wake of the 2016 presidential elections.

Speaking at a cybersecurity event hosted by the Washington Post, DHS Secretary Kirstjen Nielsen highlighted improvements in information sharing across the federal government and with state and local officials as well as closer relationships with stakeholders that will lead to faster coordination in the wake of an emerging threat.

Some Apple laptops shipped with Intel chips in "manufacturing mode"

posted onOctober 2, 2018
by l33tdawg
Credit: Wikipedia

L33tdawg: See this attack in action at HITBSecConf2018 - Dubai. 

Apple has secretly fixed a security issue affecting some laptops that shipped with Intel chips that were mistakenly left configured into "manufacturing mode."

The OS maker fixed the issue in June, with the release of macOS High Sierra 10.13.5, and Security Update 2018-003 for macOS Sierra and El Capitan.

I’ll livestream deletion of Zuckerberg's Facebook page, says hacker

posted onSeptember 28, 2018
by l33tdawg
Credit: Hot for Security

A Taiwanese bug hunter says that he will livestream his attempt to delete Mark Zuckerberg’s Facebook page this weekend.

Chang Chi-yuan is something of a minor celebrity in Taiwan, having regularly publicised security holes in online services, and even appeared on TV talk shows describing how boredom has driven him to “dabble” in hunting for bugs in the hope of earning cash through bounties. His past activities have seen him recognised in, for instance, on the “Hall of fame” page of Japan’s popular Line messaging service

Engineer fined for blogging exactly how to hack a hotel's Wi-Fi

posted onSeptember 28, 2018
by l33tdawg
Credit: Flickr

It's one thing to report website vulnerabilities before they're used maliciously. It's another to blog about a vulnerability online.

Singapore authorities fined Zheng Dutao, an engineer at Chinese internet giant Tencent, S$5,000 (about $3,660) this week after discovering he hacked into a hotel's Wi-Fi system and shared sensitive information on his blog, ZDNet reported Tuesday.