CyberSecure Specialist

Android Malware Used to Steal Facebook Accounts

Vietnam has been the most affected country from these apps, but Android users in any country could have downloaded them. Android apps are constantly being used by threat actors because of the availability of third-party app stores and the lack of strict app guidelines for apps published within those stores. Android users should only download apps through the official Google Play Store and only from trusted developers. https://www.bleepingcomputer.com/news/security/android-malware-infected-300-000-devices-to-steal-facebook-accounts/

Read More

Hypr Raises $25 Million for Passwordless Authentication Platform

New York City-based passwordless authentication solutions provider Hypr announced on Thursday that it has raised $25 million in a Series C1 funding round. The previous funding round, the Series C, was announced in April 2021, when the company raised $35 million. The latest investment, which brings the total to $97 million, was led by Advent International, with participation from .406 Ventures, RRE Ventures, Top Tier Capital, and Comcast Ventures. The money will be used to…

Read More

Three Innocuous Linux Vulnerabilities Chained to Obtain Full Root Privileges

Qualys’ Threat Research Unit has shown how a new Linux vulnerability could be chained with two other apparently harmless flaws to gain full root privileges on an affected system. The new vulnerability, tracked as CVE-2022-3328, is a race condition in Snapd, a Canonical-developed tool used for the Snap software packaging and deployment system. Specifically, the flaw impacts the ‘snap-confine’ program used by Snapd to construct the execution environment for Snap applications. The affected program is…

Read More

Who’s swimming in South Korean waters? Meet ScarCruft’s Dolphin

ESET researchers uncover Dolphin, a sophisticated backdoor extending the arsenal of the ScarCruft APT group ESET researchers have analyzed a previously unreported backdoor used by the ScarCruft APT group. The backdoor, which we named Dolphin, has a wide range of spying capabilities, including monitoring drives and portable devices and exfiltrating files of interest, keylogging and taking screenshots, and stealing credentials from browsers. Its functionality is reserved for selected targets, to which the backdoor is deployed…

Read More

Top tips to save energy used by your electronic devices

With the rapidly rising energy prices putting a strain on many households, what are some quick wins to help reduce the power consumption of your gadgets? This time last year few of us were concerned about how much energy we used. Even fewer probably bothered to check how much we were spending annually. That calculus was always going to change as Western countries began the journey to carbon neutrality in earnest. But it was given…

Read More

S3 Ep111: The business risk of a sleazy “nudity unfilter” [Audio + Text]

by Paul Ducklin BUSINESS RISKS FROM AFTER-HOURS MALWARE Click-and-drag on the soundwaves below to skip to any point. You can also listen directly on Soundcloud. With Doug Aamoth and Paul Ducklin. Intro and outro music by Edith Mudge. You can listen to us on Soundcloud, Apple Podcasts, Google Podcasts, Spotify, Stitcher and anywhere that good podcasts are found. Or just drop the URL of our RSS feed into your favourite podcatcher. READ THE TRANSCRIPT DOUG.  Crackdowns,…

Read More

The CHRISTMA EXEC network worm – 35 years and counting!

by Paul Ducklin Forget Sergeant Pepper and his Lonely Hearts Club Band, who taught the band to play a mere 20 years ago today. December 2022 sees the 35th anniversary of the first major self-spreading computer virus – the infamous CHRISTMA EXEC worm that temporarily crushed the major mainframe networks of the day… … not by any deliberately coded side-effects such as file scrambling or data deletion, but simply by leeching too much network bandwidth…

Read More

LastPass admits to customer data breach caused by previous breach

by Paul Ducklin Back in August 2022, popular password manager company LastPass admitted to a data breach. The company, which is owned by sofware-as-a-service business GoTo, which used to be LogMeIn, published a very brief but nevertheless useful report about that incident about a month later: Briefly put, LastPass concluded that the attackers managed to implant malware on a developer’s computer. With a beachhead on that computer, it seems that the attackers were then able…

Read More

The top 10 hacks and cyber security threats of 2022

Cyber crime is an ever-evolving problem, with an estimated cost of US$10trn by 2025. In 2021, there were over 4,100 publicly disclosed data breaches, which represents approximately 22 billion records exposed. The figures for 2022 are expected to at least match this, or potentially exceed it by as much as five percent.  Cyber Security Hub is dedicated to delivering breaking news from the cyber security sector. With this in mind, here are the news stories…

Read More

ConnectWise Quietly Patches Flaw That Helps Phishers

ConnectWise, which offers a self-hosted, remote desktop software application that is widely used by Managed Service Providers (MSPs), is warning about an unusually sophisticated phishing attack that can let attackers take remote control over user systems when recipients click the included link. The warning comes just weeks after the company quietly patched a vulnerability that makes it easier for phishers to launch these attacks. A phishing attack targeting MSP customers using ConnectWise. ConnectWise Control is…

Read More