Google publicly drop iPhone exploit
A Google researcher announced that he is planning to release a powerful tool for iOS 11 that the security community thinks it can use to jailbreak the iPhone. Ian Beer is a Google Project Zero security researcher, and one of the most prolific iOS bug hunters. https://motherboard.vice.com/en_us/article/d3xpyz/google-iphone-ios-jailbreak
Newly uncovered 'MoneyTaker' hacker group stole millions from U.S. & Russian banks
Security researchers have uncovered a previously undetected group of Russian-speaking hackers that has silently been targeting banks, financial institutions and legal firms, primarily in the United States, UK, and Russia. Moscow-based security firm Group-IB published a 36-page report on Monday, providing details about the newly-disclosed hacking group, dubbed MoneyTaker, which has been operating since at least May 2016. https://www.group-ib.com/blog/moneytaker
1.4 billion plain-text passwords found circulating online
Researchers from security firm 4iQ have discovered a new collective database on the dark web that contains a whopping 1.4 billion usernames and passwords in clear text. The aggregate database, found on 5 December in an underground community forum, is said to be the largest ever aggregation of various leaks found in the dark web to date, 4iQ founder and chief technology officer Julio Casal noted in a blog post.
ROBOT attack: 19 year-old Bleichenbacher attack on encrypted Web reintroduced
A 19-year-old vulnerability has been re-discovered in the RSA implementation from at least 8 different vendors—including F5, Citrix, and Cisco—that can give man-in-the-middle attackers access to encrypted messages. Dubbed ROBOT (Return of Bleichenbacher's Oracle Attack), the attack allows an attacker to perform RSA decryption and cryptographic operations using the private key configured on vulnerable TLS servers. https://robotattack.org/
Three hackers plead guilty to creating IoT-based Mirai DDoS botnet
U.S. federal officials have arrested three hackers who have pleaded guilty to computer-crime charges for creating and distributing the Mirai botnet that crippled some of the world's biggest and most popular websites by launching the massive DDoS attacks last year. https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/
Bluetooth-enabled gun safe hacked. Surprised?
The Vaultek VT20i works by allowing users to set up an access PIN from the PIN pad. There is also an Android app that allows the owner to unlock the safe via the Bluetooth LE protocol. Before unlocking the safe, an app must pair with the safe. The pairing code is the same as the safe's unlock code. According to researchers, the Android app allows for an unlimited number of pairing attempts. https://www.twosixlabs.com/bluesteal-popping-gatt-safes/
India tells troops to delete Chinese apps from phones
In an advisory sent to troops at the end of November, Indian authorities warned soldiers that Chinese apps transmit user data back to servers located in China, and the Chinese government may use data collected by these services to pinpoint their location across the border.
Tech Support scammers invade Spotify forums to rank in search engines
Over the past few months, Tech Support scammers have been using the Spotify forums to inject their phone numbers into the first page of the Google & Bing search results. They do this by submitting a constant stream of spam posts to the Spotify forums, whose pages tend to rank well in Google.
Adware maker tries to intimidate Security firm with cease and desist letters
Cyber-security firm Cybereason says it received multiple cease and desist letters from an Israeli company they suspect is allegedly behind the OSX/Pirrit adware strain. Through the letters, the company tried to block Cybereason from publishing a new report on one of their products. Despite the legal threats, Cybereason published its research earlier today, a report detailing the new tactics employed by OSX/Pirrit, a macOS adware strain. https://www.cybereason.com/hubfs/Content%20PDFs/OSX.Pirrit%20Part%20III%20The%20DaVinci%20Code.pdf
Data breach at website with 45 million users discovered during academic research
In a live test, researchers said they registered accounts at over 2,300 sites. At the end of the study's period, scientists said that attackers accessed email accounts for 19 of these sites, including one with a userbase of over 45 million. UCSD researchers reached out to each website, but to their astonishment, none notified users of the breach. https://www.sysnet.ucsd.edu/~jdeblasio/papers/tripwire-imc17.pdf
15 December 2017