Afraid of missing important security news during the week? We’re here to help! Every week we put together a curated list of all important security news in one place, for your reading pleasure. Enjoy!
For the less technical
- Microsoft: Using multi-factor authentication blocks 99.9% of account hacks
- Programmer discovers thousands of phone numbers, addresses, and geolocations apparently leaked by Russia’s ‘SORM’ surveillance tech
- It was sensitive data from a U.S. anti-terror program – and terrorists could have gotten to it for years, records show
- China intercepts WeChat texts from U.S. and abroad, researcher says
- Breach exposes data belonging to Imperva Cloud WAF customers
- Hostinger resets customer passwords after security incident
- Binance to give KYC hack victims VIP accounts
- More than £900,000 confiscated from from cyber hacker
- Capital One hacker suspected to have stolen data from 30 other companies
- Justice Department indicts 80 individuals in a massive business email scam bust
- Ransomware hits hundreds of dentist offices in the US + more information
- Using voice search? Use caution when asking for auto dial from your smart device
For the more technical
- New DDoS attack-vector via WS-Discovery/SOAPoverUDP, port 3702
- Vulnerabilities in popular VPNs (PDF)
- Over 14,500 Pulse Secure VPN endpoints vulnerable to CVE-2019-11510
- Check Point Endpoint Security Initial Client for Windows – privilege escalation to SYSTEM
- Cisco REST API container for IOS XE software authentication bypass vulnerability
- PrivEsc in Lenovo Solution Centre, 10 minutes later
- Case study: Searching for a vulnerability pattern in the Linux kernel
- DejaBlue: Analyzing a RDP heap overflow
- QEMU VM escape
- Apple patches previously fixed security bug that allowed iPhone jailbreak
- Why iOS 12.4 jailbreak is a big deal for the law enforcement
- A very deep dive into iOS Exploit chains found in the wild
- Cryptographic key used to sign one of Facebook’s Android apps compromised
- How I hacked Instagram again
- Instagram phishing uses 2FA as a lure
- How I found a critical flaw in airlines online manage booking system
- A cryptocurrency heist, starring your web browser
- Hackers could steal a Tesla Model S by cloning its key fob—again
- An advertising dropper in Google Play
- TrickBot modifications target U.S. mobile users
- TrickBot is using Google Docs to trick Proofpoint’s Gateway
- More_eggs, anyone? Threat actor ITG08 strikes again
- TA505 at it again: Variety is the spice of ServHelper and FlawedAmmyy
- Oil and gas firms targeted by new Lyceum threat group + more information
- The state of industrial cybersecurity 2019 (PDF)
- Putting an end to Retadup: A malicious worm that infected hundreds of thousands
- Ares ADB IoT botnet targeting Android devices especially STBs/TVs
- New Nemty ransomware may spread via compromised RDP connections
- Detecting and stopping an APT41 operation
- RAT Ratatouille: Backdooring PCs with leaked RATs
- Advanced phishing campaign delivers Quasar RAT
- China Chopper still active 9 years later
- ‘Heatstroke’ campaign uses multistage phishing attack to steal PayPal and credit card information
- Won a free iPhone? No, it’s Calendar spam
- Malicious WordPress redirect campaign attacking several plugins
- All your clicks belong to me: Investigating click interception on the web (PDF)
- Hashcatch – a script to capture handshakes of nearby WiFi networks
- How to extract and decrypt Signal conversation history from the iPhone
- How to access screen time password and recover iOS restrictions password
- Compressed ISO files (ISZ)
Did you enjoy this list? You can subscribe to one of our feeds on Twitter, Facebook or RSS.