Microsoft today released a preview of Azure Stack, a version of the Azure services and infrastructure that you can run in your own datacenters.
In an FCC filing, Google has told the US government that it believes its secret airborne network won't interfere with any existing networks and won't harm any people or animals. Google has been hoping to perform a "two-year nationwide test" of the network and recently addressed some concerns people had raised about it.
In an interview with ZDNet, Pulse Secure VP of Strategy Kevin Sapp talks about balancing security risks and user access to protect networks.
Documents provided to The Intercept by National Security Agency whistleblower Edward Snowden show new evidence of a long-running surveillance campaign against drones flown by the Israelis, Syrians, and other nations in the region. The operation by the United Kingdom's Government Communications Headquarters (GCHQ) signals intelligence organization, with the assistance of the NSA, intercepted scrambled analog video feeds from remotely piloted aircraft and tracked the movement of drones.
HSBC has confirmed that it fought off a denial of service attack on its internet banking systems this morning.
A spokesperson for HSBC said: HSBC internet banking came under a denial of service attack this morning, which affected personal banking websites in the UK.
Google paid out over $2m to security researchers last year for reporting flaws in Google products, of which $200,000 went on bugs in Android in just five months.
There has been no shortage of point-of-sale (POS) threats in the past couple of years. This type of malicious software has gained widespread notoriety in recent time due to its use in high-profile breaches, some of which involved well-known brick and mortar retailers and led to the compromise of millions of payment cards. Our investigation into these threats has led to the analysis of a relatively newer POS malware known as CenterPOS.
Of all the Q4 2015 events in the world of DDoS attacks and the tools used to launch them, we picked out those that, in our opinion, best illustrate the main trends behind the evolution of these threats.
In an advisory posted Tuesday, the tech giant said the latest incarnation of the Firefox browser, version 44, includes fixes for a total of 12 security bugs.
Three of the flaws are deemed critical, two are high-risk, six have a "moderate" security risk and one is considered a minor issue.
LG is closing a security hole that makes it possible for attackers to steal chat histories and other sensitive data stored on an estimated 10 million G3 phones.
Firmware malware has been a hot topic ever since Snowden's leaks revealed NSA's efforts to infect BIOS firmware. However, BIOS malware is no longer something exclusive to the NSA, Lenovo's Service Engine or Hacking Team's UEFI rootkit are examples of why the security industry should put some focus on this strain of badness.
Chinese technology giant Huawei has announced that it will be upgrading Denmark's fixed broadband network to deliver download speeds of up to 1 gigabit per second by the end of 2017 thanks to a deal signed with Tele Danmark Communications (TDC).
Under the deal, Denmark will become the first nation to upgrade a broadband network in its entirety to Giga Coax technology, with the upgrade to begin in June 2016.
Maintainers of the OpenSSL cryptographic code library have fixed a high-severity vulnerability that made it possible for attackers to obtain the key that decrypts communications secured in HTTPS and other transport layer security channels.
While the potential impact is high, the vulnerability can be exploited only when a variety of conditions are met.
It seems like the browser’s InPrivate browsing feature may not be as ‘private’ as we’re lead to believe. Researcher Ashish Singh discovered that users' full browsing history was being stored on their hard drives, noting that “even the private browsing isn’t as private as it seems” in his report, published on Forensic Focus. He added that "websites visited in private mode are also stored in the browser’s WebCache file.”
Following Google's monthly fixes for its own Nexus devices in early January, Samsung has now disclosed details of the bugs it will be patching to remedy vulnerabilities in its flagship hardware. The update contains a blend of bugs in Google's update and others that Samsung has addressed independently.
Google's push for all websites to be HTTPS has so far been all carrot. But the company is now using its big stick: a large red cross through every website that doesn't offer an encrypted connection.
Tails is a live system that aims to preserve your privacy and anonymity. It helps you to use the Internet anonymously and circumvent censorship almost anywhere you go and on any computer but leaving no trace unless you ask it to explicitly.
It is a complete operating system designed to be used from a DVD, USB stick, or SD card independently of the computer's original operating system. It is Free Software and based on Debian GNU/Linux.
FireEye mobile security researchers examine the security risks of iOS apps that employ these alternate solutions for hot patching, and seek to prevent unintended security compromises in the iOS app ecosystem.
The mystery bug surfaced on Wednesday with multiple reports on Reddit, Twitter and Apple's support pages of Safari crashing when the address bar is used to search.
Symantec has found an Android ransomware variant (Android.Lockdroid.E) that uses new tactics, involving a fake package installation, to trick users into giving the malware device administrator rights. As well as encrypting files found on the compromised device, if administrator rights are obtained, the malware can lock the device, change the device PIN, and even delete all user data through a factory reset.
Oracle has announced that the days of the Java browser plugin are numbered, with its deprecation set for the upcoming Java Development Kit 9 release and its removal slated for a future release.
New security features in Google Chrome and Microsoft Edge, information about
Hacking Team exploits, and new features of Microsoft's Enhanced Mitigation Experience Toolkit (EMET)
Congressional oversight leaders are requiring most federal agencies to audit their networks to see if they use Juniper-manufactured firewalls that for four years contained an unauthorized backdoor for eavesdropping on encrypted communications.
Dolby’s DAX2 API ships with insecure file permissions giving the ability to get SYSTEM on (in this case), Windows 10 on a Lenovo Thinkpad.
The attacker gave Amazon fake details from a whois query, and got real address and phone number in exchange. Now they had enough to bounce around a few services, even convincing a bank to issue them a new copy of Credit Card.
Israel's Minister of Infrastructure, Energy and Water, Yuval Steinitz, told CyberTech 2016 attendees on Tuesday that the country's Public Utility Authority had been targeted by malware, and that some systems were still not working properly. "Yesterday we identified one of the largest cyber attacks that we have experienced," Steinitz said.
A recently identified backdoor in hardware sold by security company Fortinet has been found in several new products, many that were running current software, the company warned this week. The undocumented account with a hard-coded password came to light last week when attack code exploiting the backdoor was posted online.
In December of 2015 a critical vulnerability has been found in one of PayPal business websites (manager.paypal.com) that allowed to execute arbitrary shell commands on PayPal web servers via unsafe JAVA object deserialization and get access to production databases. The bug was immediately reported to PayPal security team and it was quickly fixed after that.
“Starting with this update to Skype and moving forward, your IP address will be kept hidden from Skype users,” Microsoft’s Skype team wrote in a blog post about the latest version, v. 22.214.171.124 for most users. “This measure will help prevent individuals from obtaining a Skype ID and resolving to an IP address.”
The stored cross-site scripting (XSS) bug is present in virtually all versions of Magento Community Edition and Enterprise Edition prior to 126.96.36.199 and 188.8.131.52, respectively, according to researchers from Sucuri, the website security firm that discovered and privately reported the vulnerability.
It turns out the privacy benefits Apple likes to talk about (and the FBI likes to complain about) basically disappear when iCloud Backup is enabled. Your messages, photos and whatnot are still protected while on your device and encrypted end-to-end while in transit. But you're also telling your device to CC Apple on everything. Those copies are encrypted on iCloud using a key controlled by Apple, not you, allowing the company (and thus anyone who gets access to your account) to see their content
California assembly member Jim Cooper (D-9th) introduced the legislation -- bill 1681 -- which requires any smartphone manufactured "on or after January 1, 2017, and sold in California after that date" to be "capable of being decrypted and unlocked by its manufacturer or its operating system provider."
At the end of every year, AV-Comparatives released a summary report to comment on the various anti-virus products tested over the year, and to highlight the high-scoring products of the various tests that took place over the course of the year.
Security researcher Lawrence Abrams explained in a blog post this week that a number of former victims and researchers have been working together for the past month to exploit a flaw in TeslaCrypt's encryption key storage algorithm. While this was kept quiet to prevent the malware's creator catching on and patching the flaw, now TeslaCrypt 3.0 has been released, the group have decided to release their findings.
A new ransomware dubbed the Magic Ransomware has been discovered that encrypts your data using AES encryption, adds the .magic extension to encrypted files, and then demands 1 bitcoin to get the data back. This ransomware is created in C# and when decompiled quickly become apparent that it is almost an exact copy of the open-source ransomware called eda2.
As a result of its recent crowdfunding campaign, the Tor Project announced Thursday that it had raised over $200,000 from more than 5,000 individuals over nearly two months.
The feed includes images of marijuana plantations, back rooms of banks, children, kitchens, living rooms, garages, front gardens, back gardens, ski slopes, swimming pools, colleges and schools, laboratories, and cash register cameras in retail stores, according to Dan Tentler, a security researcher who has spent several years investigating webcam security.
Researchers at the Threat Research Lab have identified a phishing campaign targeted at businesses and consumers who use Facebook – most likely designed by the same cyber criminals who developed the WhatsApp malware.
Researchers suspected the agency had also deployed a network investigative technique (NIT)—the FBI's term for a hacking tool—to infect users of the site. Now, confirmation of that hacking campaign has come about buried in a Washington Post report on the FBI's recent NIT usage.
A company that supplies audio-visual and building control equipment to the US Army, the White House, and other security-conscious organizations built a deliberately concealed backdoor into dozens of its products that could possibly be used to hack or spy on users, security researchers said.
Cisco Systems has released software updates to fix critical issues that could allow attackers to compromise digital encoders, unified computing system management servers and Firepower 9000 series security appliances.
A Critical Patch Update (CPU) is a collection of patches for multiple security vulnerabilities.
Imagine getting a notification from your bank, asking for your cooperation in installing an updated version of their mobile app. After downloading the app, it asks for administrator privileges. The notification you received said it would indeed prompt the question and so you allowed it. You try the app out and it works fine. You were even able to do a transaction without a hitch.
IBM X-Force researchers have been following new developments in the Dridex Trojan’s attack methodologies. In their latest alert, researchers divulged a new modus operandi launched by Evil Corp, the cybercrime group that owns and operates the Dridex banking Trojan.
A growing business today would have to be operating out of a cave on Mars not to realize the importance of information security. Attackers don't discriminate by company size, so it would be foolish to brush aside the importance of protection.
The most recent versions of Asacub – detected in September 2015 or later – have functionality that is more focused on stealing banking information than earlier versions. While earlier versions only used a bank logo in an icon, in the more recent versions we found several phishing screens with bank logos.
The new vulnerability identified by Skycure involves the way iOS handles Cookie Stores when dealing with Captive Portals. When iOS users connect to a captive-enabled network (commonly used in most of the free and paid Wi-Fi networks at hotels, airports, cafes, etc.), a window is shown automatically on users’ screens, allowing them to use an embedded browser to log in to the network via an HTTP interface. As part of Skycure’s continuous research on network-based attacks against mobile devices, we
As of the date of disclosure, this vulnerability has implications for approximately tens of millions of Linux PCs and servers, and 66 percent of all Android devices (phones/tablets).
The company has advised those who use the Intel Driver Update Utility to download an updated version of the software, which mitigates a vulnerability in how the software requests new drivers from Intel's servers.
Over the last two years it has become apparent that many influential governments, including those in Australia, the UK, the US, Russia, and others, have brought in measures to retain data on a mass scale.
Facebook, a company based on publicly sharing details about yourself, continues to make it easier for users to maintain some privacy when they visit the site. On Tuesday, Facebook announced additional support for using the Tor anonymity network with the Android version of its app.
The OS X El Capitan v10.11.3 Update improves the stability, compatibility, and security of your Mac, and is recommended for all users.
There’s one good thing that comes out of all those website breaches every year: Security researchers get to comb through all those lists of usernames and passwords to remind us just how bad most of our passwords are.
For almost three years, millions of servers and smaller devices running Linux have been vulnerable to attacks that allow an unprivileged app or user to gain nearly unfettered root access. Major Linux distributors are expected to fix the privilege escalation bug this week, but the difficulty of releasing updates for Android handsets and embedded devices means many people may remain susceptible for months or years.
Android-based phones are more affordable and, consequently, more popular worldwide. That is why threat actors responsible for targeted attacks have Android phones as their #1 priority and have developed implants for this operating system in particular.
This time, the victim is President Barack Obama’s senior advisor on science and technology John Holdren, Motherboard has learned. One of the cybercriminals linked to the group that hacked Brennan broke into Holdren’s home telephone and email account and set it so that all the calls would get forwarded to the Free Palestine Movement.
A woman whose husband died has spent months trying to gain access to his Apple account, according to a Canadian Broadcasting Corporation report today. Apple initially told the woman that she would have to provide a will and death certificate, but once she provided those documents the company reportedly asked for something else—a court order.
A proposed amendment to France's Digital Republic Bill, suggesting mandatory hardware backdoors to bypass encryption, has been rejected by the government.
The Ukrainian government said that Russia is behind cyber-attacks that have left its largest airport infected with the Black Energy malware.
Using a new phishing attack developed by security researcher Sean Cassidy, attackers could gain access to all passwords stored by a user of LastPass, including accounts protected by strong security measures like two-factor authentication.
If you stayed, ate or played at a Hyatt hotel between Aug. 13 and Dec. 8, 2015, there’s a good chance your credit or debit card data was stolen by unknown cyber thieves who infiltrated many of the hotel chain’s payment systems.
In September, Ars reported a drop-dead simple exploit that completely bypassed an OS X security feature known as Gatekeeper. Apple shipped a fix, but now the security researcher who discovered the original vulnerability said he found an equally obvious work-around.
In a recent analysis of Waledac (W32.Waledac) activity, Symantec observed a pump and dump stock spam campaign that potentially led to a 100 percent gain in the targeted stock price. The targeted stock in this case was Indie Growers Association (stock symbol: UPOT), a company linked to the cultivation of marijuana and carefully chosen for its historical skyrocketing stock price.
In mid-August 2015, in an attempt to educate people, Turkish security group Otku Sen published an open source code for ransomware dubbed “Hidden Tear” and made it available for everyone at github. Hidden Tear uses AES encryption and can evade common AV platforms because it’s a new malware. Otku Sen also published a short video demonstrating how ransomware worked.
Cisco patched multiple vulnerabilities affecting its wireless LAN Controller software, Identity Services Engine software, and Aironet access points. Two of the vulnerabilities are considered critical – including a bug that the United States Computer Emergency Readiness Team (US-CERT) warned could be exploited by a remote attacker to take over devices and an access point hardcoded password.
Ransomware — malicious software that encrypts the victim’s files and holds them hostage unless and until the victim pays a ransom in Bitcoin — has emerged as a potent and increasingly common threat online. But many Internet users are unaware that ransomware also can just as easily seize control over files stored on cloud services.
A critical bug that can leak secret cryptographic keys has just just been fixed in OpenSSH, one of the more widely used implementations of the secure shell (SSH) protocol.
David Fullagar, Vice President of Content Delivery Architecture at Netflix says: We will continue to respect and enforce content licensing by geographic location.
US security firm Vectra Networks has hacked a ‘tiny' D-Link web camera and turned it into a persistent backdoor into corporate networks.
The same individual or group claiming to be behind a recent breach of the personal e-mail account of CIA Director John Brennan now claims to be behind the hijacking of the accounts of Director of National Intelligence James Clapper.
Various kinds of cybrecrime training courses and how-to guides are available online. For a relatively small fee, anyone can learn how to commit fraud and become a criminal.
An information stealing Android threat (detected by Symantec as Android.Bankosy) added functionality to its code that can enable it to deceive voice call-based two-factor authorization (2FA) systems.
Only after threat of public exposure has eBay patched a severe XSS security vulnerability which exposed potentially millions of users to phishing campaigns and subsequent data theft.
Turkish national Onur Kopçak will likely spend the rest of his life behind bars for dabbling in credit card seizure and phishing campaign promotion, having landed a record 334-year prison sentence.
Less than a month after Juniper Network officials disclosed an unauthorized backdoor in the company's NetScreen line of firewalls, researchers have uncovered highly suspicious code in older software from Juniper competitor Fortinet.
Six critical vulnerabilities patched by Microsoft in January, and more.
Every month there are numerous cyber security conferences all around the world. Many of them post their talks on YouTube after the conference. The article lists talks from numerous security conferences. Go on, attend a free security conference from the comfort of your home or office!
Security researchers from the University of Trier have discovered a couple of vulnerabilities in the OAuth 2.0 authentication protocol that could enable hackers to subvert single sign-on systems. The protocol is widely used on social networking sites, such as Facebook and Google+, to authenticate users.
After analyzing the information that has been made available by affected power companies, researchers, and the media it is clear that cyber attacks were directly responsible for power outages in Ukraine.
Google's Project Zero discovered multiple trivial remote code execution vulnerabilities sitting within a password manager installed by Trend Micro as default alongside its AntiVirus product. An attacker could thereby obtain an unecnrypted dump of all stored logins and passwords.
Akamai reports that 2015 saw about 1500 DDoS attacks, an increase of 180% as compared with the previous year. However, the attacks were shorter and smaller than in the past. The average DDoS attack lasted 18 hours, which is less than the 22 hour average in 2014. Nevertheless, we can still expect attacks that last as long as a few days.
General Motors quietly flipped the switch on Detroit's first public security vulnerability disclosure program, launched in partnership with the bug bounty and disclosure portal provider HackerOne.
A new malvertising campaign on the PopAds network launching the Magnitude exploit kit via pop-under ads distributes CryptoWall 4.
Awesome fun, but the lack of SSL for firmware upgrades allows for rougue firmware to be loaded, turning the toy to the Dark Side.
A Smart TV can be equally vulnerable as any device connected to the Internet. Has the time come for firewalls on TVs?
Claims by Juniper in 2013 that its Netscreen encryption couldn't be subverted have been contradicted by researchers at the Real World Cryptography conference. The NetScreen line of firewalls contains unauthorized code that can surreptitiously decrypt traffic sent through virtual private networks. As a result, Juniper said it will remove the National Security Agency-developed function widely suspected of also containing a backdoor for eavesdropping.
A bug in Nvidia GPU drivers opens a vulnerability in Chrome's Incognito mode, allowing the contents of one application to leak into another.
LastPass announced that LastPass 4.0, a password management system, has been developed with general users in mind, and offers an interesting new feature that gives access to vaults to trusted contacts in case of emergency.
Given that there are very few threat reports that focus on or cover Canada, Trend Micro delves into the threats awaiting users on the Canadaian Internet landscape.
Making use of popular and free DNS services may protect against the effects of attacks against wired and wireless routers and local operators.
If you thought MD5 was banished from HTTPS encryption, you'd be wrong. It turns out that the fatally weak cryptographic hash function, along with its SHA1 cousin, are still widely used in the TLS protocol that underpins HTTPS. Researchers have devised a series of attacks that exploit the weaknesses to break or degrade key protection provided not only by HTTPS but also other encryption protocols, including IPsec and SSH.
The Brain Test malware family has unfortunately made a comeback on Google Play. Variants attempt to gain root privileges, and resist factory resets and other efforts to remove them, especially on rooted devices.
An SSL certificate from the free and open authority Let's Encrypt has been used in a malware campaign for the first time.
Time Warner Cable admits that the personal details of over 320,000 customers may have been leaked. However, the company said there are "no indications" its systems were breached, and pointed the finger at third-party firms that may have stored customer information.