A study released by a forensic consultancy has singled out the top five vehicles most susceptible to hacking.

The results of the study, by PT&C|LWG Forensic Consulting Services, were based on published research by hackers, vehicle recall information and media reports.

The most hackable list includes the 2014 Jeep Cherokee, the 2014 Infiniti Q50, the 2015 Cadillac Escalade, the 2010 and 2014 Toyota Prius and the 2014 Ford Fusion.

Read more ...

According to a report recently issued by Akamai, the DD4BC criminal group has been responsible for at least 114 DDoS attacks on its customers.
According the Akamai firm, the criminal crews known as DD4BC has carried out at least 114 DDoS attacks with an average peak bandwidth of around 13.34 Gbps on its customers since April 2015.

Read more ...

Over two months after Italian surveillance software maker Hacking Team had its internal data leaked by hackers, vendors are apparently still fixing zero-day exploits from the company's arsenal.

On Tuesday, Microsoft published 12 security bulletins covering 56 vulnerabilities in the new Edge browser, Internet Explorer, Windows, Office, Skype for Business, .NET Framework and some of its other software products.

Read more ...

The US Justice Department issued guidelines for StingRay Surveillance devices, new rules define aim to ensure privacy protection and transparency.
Do you know what is a StingRay? If you want further details give a look to a post I wrote for the Infosec Institute on the StingRay Technology:

"StingRay is an IMSI-catcher (International Mobile Subscriber Identity) designed and commercialized by the Harris Corporation. The cellular-surveillance system costs as much as $400,000 in the basic configuration, and its price varies with add-ons ordered by the agency.

Read more ...

Detecting Remote Access Trojans can be very challenging because they mimic legitimate commercial remote administration tools, open legitimate network ports, and perform very surgical operations that don't resemble typical malware techniques, says Udi Shamir, CSO and head of SecurityLabs, SentinelOne.
No doubt this stealth aided attackers who used the Carbanak malware RAT, which, according to "Carbanak APT: The Great Bank Robbery", February 2015, Kaspersky Labs, infected banks globally, stole funds, and wreaked financial havoc estimated at up to $1 billion in losses.

Read more ...

The security expert Laxman Muthiyah from India has discovered a new vulnerability in the popular social network Facebook. This is the third bug discovered by the expert in since January, at the beginning of the year he found a serious flaw in Facebook graphs that allowed him to delete users’ Facebook photo album without being authenticated. A few weeks later he announced the discovery of a new critical flaw affecting the Facebook Photo Sync feature, a feature that allows the automatic uploads of photos from user’s mobile device to a private Facebook album, which is not visible to Facebook friends neither to other Facebook users. The flaw discovered by Laxman could allowed any third-party app to access user’s personal photographs from the hidden Facebook Photo Sync album, facebook comments hacking 3 This time the expert discovered a way to hack any Facebook Page, the vulnerability affects the “Facebook business pages” which are related to businesses and organizations. These pages are usually managed by a number of users, Laxman could allow third-party apps to take complete control of a Facebook business page with limited permissions, possibly making the victim permanently lose administrator access to the page. Laxman Muthiyah explained that third party Facebook applications can perform a number of actions, including post photos and status update on user behalf. However, Facebook doesn’t allow them to add or modify page admin roles. The popular social network allows administrators of business pages to assign different roles to different users through manage_pages, an access permission requested by third-party apps. The expert discovered that an attacker can use a simple string of requests to impersonate the admin of a Facebook page, below and example of string: POST /PGID/userpermissions HTTP/1.1Host: graph.facebook.comContent-Length: 245role=MANAGER&user=X&business=B&access_token=AAAA… The page PGID if used to identify the business associated to the page, the manage_pages request allows to assign the role of MANAGER to the user ‘X’ which allow the attacker to take over the Facebook business page.The expert also provided a video PoC for the exploitation of the flaw: https://www.facebook.com/7xter/videos/707721066037025/ Laxman ethically reported the flaw to the Facebook security team and was rewarded with 2500 USD as a part of Facebook’s bug bounty program.

We use cookies to maintain login sessions, analytics and to improve your experience on our website. By continuing to use our site, you accept our use of cookies, Terms of Use.