Afraid of missing important security news during the week? We're here to help! Every week we put together a curated list of all important security news in one place, for your reading pleasure. Enjoy!
We were gone for a few weeks, but since many of you have asked for a comeback, here it is. We'll try to keep it alive!
For the less technical
- Real people are turning their accounts into bots on Instagram
- Gmail users receive mysterious spam messages from themselves
- Claims by Joy Reid’s cybersecurity expert fall apart
- F.A.K.E. Security - exposing the snake-oil salesmen
- RSA conference app leaks user data
- Ex-employee Sun Trust helps compromise 1.5 million bank clients
- DDoS-for-hire service Webstresser dismantled
- Ransomware infects Ukraine energy ministry website
- China cyberspies mined Japanese firms for North Korean secrets
- US urged to act immediately to save its systems from the ‘growing threat of Chinese cyber theft’
- Security experts hacked an electronic lock system used by hotels worldwide
- We don’t know what to do if a satellite gets hacked
- A screenshot API used to mining cryptocurrencies
For the more technical
- Google's Project Zero exposes unpatched Windows 10 lockdown bypass + technical description
- Vulnerabilities in Rockwell Automation industrial networking solutions
- Firms using WebEx at risk of poisoned Flash attacks
- LinkedIn AutoFill exposed visitor name, email to third-party websites
- Another critical Drupal flaw discovered
- Keeping Drupal sites safe with Cloudflare's WAF
- Breaking bad to make good: Firefox CVE-2017–7843
- WD My Cloud EX2 serves your files to anyone + more information
- Milestone XProtect .NET deserialization vulnerability
- Volkswagen Group models vulnerable to hackers
- The “unpatchable” exploit that makes every current Nintendo Switch hackable
- D-Link router riddled with vulnerability
- HooToo TripMate routers are cute but insecure
- A new MikroTik RouterOS vulnerability
- Beware the tech support scam
- NTLM credentials theft via PDF files
- VMware escape by two bugs in 1 second
- Establishing a baseline for Remote Desktop Protocol
- Lateral attacks between IoT devices
- Exploit/bypass PHP escapeshellarg/escapeshellcmd functions
- Running system commands through Nvidia signed binaries
- Escalating privileges with ACLs in Active Directory
- About 1.5 million hotel reservation records leaked through a simple newsletter system
- Zebrocy heavily used by the Sednit/APT28 group
- New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia
- Energetic Bear/Crouching Yeti: attacks on servers
- GravityRAT - the two-year evolution of an APT targeting India
- Attackers fake computational power to steal cryptocurrencies from mining pools
- New hacks siphon private cryptocurrency keys from airgapped wallets (PDF)
- BGP leaks and cryptocurrencies
- Malicious calculator app adds up Bitvote coins in cryptomining scheme
- True scale of Bitcoin ransomware extortion revealed
- Satan ransomware adds EternalBlue exploit
- Russian “Troldesh” AKA Encoder.858 or Shade is back
- Necurs evolves to evade spam detection via Internet shortcut file
- Metamorfo campaigns targeting Brazilian users
- WebMonitor RAT comes with Command and Control as a Service (C2aaS)
- XLoader Android spyware and banking trojan distributed via DNS spoofing
- Report on the global proliferation of Netsweeper
- Introducing Windows Defender System Guard runtime attestation
- A tool to help assess the security of Azure Cloud environment subscriptions
- First glance on OS VRP by Huawei
- Enhancing Pwned Passwords privacy by exclusively supporting anonymity
- It’s impossible to prove your laptop hasn’t been hacked
Did you enjoy this list? You can subscribe to one of our feeds on Twitter, Facebook or RSS.
Comments