A week in security (June 22 – 28)

-

shutterstock_610335074.jpg

Last week on Malwarebytes Labs, we provided a zero-day guide for 2020 featuring recent attacks and advanced preventive techniques, and we learned how to cough in the face of scammers, offering security tips for the 2020 tax season. We also looked at a web skimmer hiding within EXIF metadata that was exfiltrating credit cards via image files.

In the most recent episode of our podcast Lock and Code, we talked to Matt Davey and Kyle Swank of 1Password about strengthening and forgetting passwords.

Other cybersecurity news

  • Google removed 106 extensions from its Chrome Web Store for collecting sensitive user data as part of a campaign targeting oil and gas, finance, and healthcare sectors. (Source: The Hacker News)
  • DDoSecrets has published BlueLeaks, data from over 200 police departments, law enforcement training, and support resources and fusion centers. (Source: ThreatPost)
  • A sophisticated and well-crafted attack campaign has been hitting unprepared organizations with Nefilim – aka Nephilim – ransomware. (Source: Gov Info Security)
  • An IBM survey found that newly-minted remote workers actually present a significant cybersecurity risk, without being at fault. (Source: IBM Security)
  • Billing information for some clients that was stored in a browser’s cache may have been compromised, Twitter said in an email to business clients. (Source: SC Magazine UK)
  • A European bank suffered the biggest PPS DDoS attack to date, and a new botnet is suspected to be behind the attack. (Source: Bleeping Computer)
  • Researchers discovered a new variant of Lucifer—a hybrid cryptojacking malware—involved in numerous incidents of CVE-2019-9081 exploitation in the wild. (Source: Palo Alto Networks)
  • An online engineer warned people to stay away from Tik-Tok after close investigation revealed intrusive user tracking and other issues. (Source: BoredPanda)
  • Nvidia released a set of security updates to remove vulnerabilities in the Nvidia GPU Display Driver. (Source: ZDNet)
  • Sodinokibi ransomware operators that claimed to have siphoned confidential docs on Nicki Minaj, Mariah Carey, and Lebron James from an American law firm are threatening to auction off the info. (Source: The Register)

Stay safe, everyone!

The post A week in security (June 22 – 28) appeared first on Malwarebytes Labs.

https://ift.tt/2ZeLBok

Comments

Post a Comment

Popular posts from this blog

Takeaways from the outcry over Dior’s Johnny Depp perfume ad: Tuesday Wake-Up Call

-
Welcome to Ad Age’s Wake-Up Call, our daily roundup of advertising, marketing, media and digital news. You can sign up to get an audio version of this briefing on your Alexa device. Dior pulls a perfume ad starring Johnny Depp Yet another luxury brand just had to backtrack after a culturally insensitive move. Dior on Friday pulled an ad for its “Sauvage” perfume, as Business of Fashion reports ; the spot starred Johnny Depp playing guitar in the desert while a Native American dancer, Canku One Star, performed in traditional dress. The company portrayed the spot as “an authentic journey deep into the Native American soul.” But the brand was quickly accused of cultural appropriation. Critics seemed most troubled by the juxtaposition of Native American imagery with the word "Sauvage"—which means “wild” in French, but which also evokes the history of labeling indigenous groups as “savages.”  LVMH-owned Parfums Christian Dior had apparently tried to proceed cautiously. It coo
Read more

When the coronavirus infodemic strikes

-
Image
Social media sites are stepping up their efforts in the war against misinformation… specifically, the coronavirus/COVID-19 infodemic . There’s a seemingly endless stream of potentially dangerous misinformation flying around online related to the COVID-19 pandemic, and that could have fatal results. It’s boomtown in fake-news land riding high on the wave of people being left with their tech devices 24/7. I myself regularly see everything posted online from “hand gel is an immunizer” (nope) and “children can’t be affected” (not true) to “UK rules mean domestic abuse survivors have to stay with their abusive spouse” (absolutely not true at all and hugely dangerous to claim).  We even have engineers being spat on thanks to 5G conspiracy theories potentially resulting in transmission of coronavirus . Turns out a global pandemic is a lightning rod for pushing people to conspiracy theories galore, to the extent that some folks have to go hunting for guides to wean their family members a
Read more

Patch, Or Your Solid State Drives Roll Over And Die

-
Image
Expiration dates for computer drives? That’s what a line of HP solid-state drives are facing as the variable for their uptime counter is running out. When it does, the drive “expires” and, well, no more data storage for you! There are a series of stages in the evolution of a software developer as they master their art, and one of those stages comes in understanding that while they may have a handle on the abstracted world presented by their development environment they perhaps haven’t considered the moments in which the real computer that lives behind it intrudes. Think of the first time you saw an SQL injection attack on a website, for example, or the moment you realised that a variable type is linked to the physical constraints of the number of memory locations it has reserved for it. So people who write software surround themselves with an armoury of things they watch out for as they code, and thus endeavour to produce software less likely to break. Firmly in that arena is the size
Read more