Facebook patent would turn your mic on to analyze how you watch ads

Further ReadingFacebook’s Cambridge Analytica scandal, explained [Updated]As Facebook tries to get ahead of public pressure about what the service does and doesn’t track about its users, a patent application has emerged which would enable something that the service’s detractors have long theorized and feared: silently triggered microphones that keep tabs on Facebook users. The patent, filed by Facebook in December 2016 and published on June 14 (PDF), emerged this week thanks to its discovery by UK publication Metro. The patent’s language revolves specifically around advertisements—Facebook’s biggest cash cow—and how a device with an installed app could be triggered by a vague ‘activation module’ to turn on its microphone and listen to how those ads play out in an average home.

A new data breach may have exposed personal information of almost every American adult

A little-known Florida company may have exposed the personal data of nearly every American adult, according to a new report. Wired reported Wednesday that Exactis, a Palm Coast, Fla.-based marketing and data-aggregation company, had exposed a database containing almost 2 terabytes of data, containing nearly 340 million individual records, on a public server. That included records of 230 million consumers and 110 million businesses.

PROPagate Code Injection Technique Detected in the Wild for the First Time

PROPagate is a relatively new code injection technique discovered last November. Back then, a security researcher found that an attacker could abuse the SetWindowSubclass API, a function of the Windows operating system that manages GUIs, to load and execute malicious code inside the processes of legitimate apps. The infosec research community deemed the technique innovative, similar in creativity to the AtomBombing technique, albeit both different in their own right.

File-Wiping Malware Placed Inside Gentoo Linux Code After GitHub Account Hack

An unknown hacker has temporarily taken control over the GitHub account of the Gentoo Linux organization and embedded malicious code inside the operating system’s distributions that would delete user files. Thankfully, the malicious code fails to trigger properly and users’ files remain safe. How the hacker gained access to Gentoo’s GitHub account still remains a mystery, but since announcing the hack late last night, the Gentoo team says it regained control over their account, albeit their profile remained offline at the time of this article’s publication.

Adidas Announces Data Breach

The company says it became aware of the breach on Tuesday, June 26, when it learned that an unauthorized party was claiming to have acquired the details of Adidas customers. The company said it’s still investigating the breach with law enforcement and security firms. The sportswear company did not include a tally of affected customers, but some news outlets like CBS, the Wall Street Journal, and Bloomberg reported citing inside sources that ‘a few millions’ of Adidas customers might be impacted.

DBGer Ransomware Uses EternalBlue and Mimikats to Spread Across Networks

The change was not only in name but also in the ransomware’s modus operandi. According to the researcher, whose discovery was later confirmed by an Intezer code similarity analysis, the new (Satan) DBGer ransomware now also incorporates Mimikatz, an open-source password-dumping utility. The purpose of DBGer incorporating Mimikatz is for lateral movement inside compromised networks.

This fits a recently observed trend in Satan’s modus operandi. The Satan ransomware launched in January 2017 as a Ransomware-as-a-Service (RaaS) portal, allowing anyone to register and create custom versions of the Satan ransomware. First versions were unsophisticated, as most new ransomware variants tend to be.

SEC announces cryptocurrency ether is not a security

Are bitcoin and ether securities? Finally, one of the biggest questions and debates in crypto has been answered by the SEC, officially. In an announcement at Yahoo Finance’s All Market Summit: Crypto in San Francisco on Thursday,the U.S. Securities and Exchange Commission Director of Corporate Finance William Hinman said that the commission would not be classifying ether or bitcoin as securities.

The commission’s policy is in line with what SEC Chair Jay Clayton said recently about bitcoin: that cryptocurrencies are not securities and the definition of “security” would not change to include bitcoin. (Clayton said digital tokens were securities, but cryptocurrencies were not.) Hinman’s announcement marks the official position of the SEC: the name isn’t important, but the way in which it’s sold, promised, and behaves is the key deciding factor.

Malicious Docker Containers Earn Cryptomining Criminals $90K

Seventeen malicious Docker containers earned cryptomining criminals $90,000 in 30 days in what could be a harbinger of things to come. The figure may seem tame compared to some of the larger paydays that cryptojackers have earned. But, researchers at Kromtech Security Center warn containers are shaping up to be the next ripe target for these types of criminals.

Kromtech said the malicious Docker images (17 in total) were pulled down from the Docker Hub image repository. Researchers can’t say for sure how many times the rogue containers were used by Docker Hub users, but Kromtech estimates that the 17 images were downloaded collectively 5 million times during the year they were available. All 17 were removed from Docker Hub on May 10 by Docker, afterFortinetfound the containers and published a report on the images being used to mine cryptocurrency.

17 Backdoored Docker Images Removed From Docker Hub

The Docker team has pulled 17 Docker container images that have been backdoored and used to install reverse shells and cryptocurrency miners on users’ servers for the past year. The malicious Docker container images have been uploaded on Docker Hub, the official repository of ready-made Docker images that sysadmins can pull and use on their servers, work, or personal computers. These Docker images allow sysadmins to quickly start an application container within seconds, without having to create their own Docker app container, a complicated and painstaking process that not all users are technically capable or inclined to do.

MIT Device Uses WiFi to ‘See’ Through Walls and Track Your Movements

Anyone who has ever been intrigued by ads for x-ray specs in the back of a comic book will appreciate the latest work out of MIT, which advances technology to “see” through walls. Using WiFi, a team at Computer Science and Artificial Intelligence Laboratory (CSAIL) is now able to “see” a person on the other side of a wall and precisely track their movements, even if it’s something as subtle as giving a high five, according to new research to be presented at the Conference on Computer Vision and Pattern Recognition next week. Katabi told me that previous versions of the technology developed by her team were table to give you the position of the person and kind of their vague, blob-like outline, but not precise movements.

Cortana Hack Lets You Change Passwords on Locked PCs

Microsoft has patched a vulnerability in the Cortana smart assistant that could have allowed an attacker with access to a locked computer to use the smart assistant and access data on the device, execute malicious code, or even change the PC’s password to access the device in its entirety. The issue was discovered by Cedric Cochin, Cyber Security Architect and Senior Principle Engineer at McAfee. Cochin privately reported the problems he discovered to Microsoft in April.

UK’s Dixons Carphone admits huge data breach

Dixons Carphone has admitted a huge data breach involving 5.9 million payment cards and 1.2 million personal data records. It is investigating the hacking attempt, which began in July last year. Dixons Carphone said it had no evidence that any of the cards had been used fraudulently following the breach.

There was ‘an attempt to compromise’ 5.8 million credit and debit cards but only 105,000 cards without chip-and-pin protection had been leaked, it said. The hackers had tried to gain access to one of the processing systems of Currys PC World and Dixons Travel stores, the firm said. Dixons Carphone shares were down more than 3% in early afternoon trading.

Code Injection in Moodle

Moodle is a widely-used open-source e-Learning software with more than 127 million users allowing teachers and students to digitally manage course activities and exchange learning material, often deployed by large universities. In this post we will examine the technical intrinsics of a critical vulnerability in the previous Moodle release detected by RIPS Code Analysis. It is located in the Quiz component of Moodle and can be successfully exploited through the teacher role in order to perform remote code execution.

Simple technique bypassed macOS signature checks by third-party tools

For almost 11 years, hackers have had an easy way to get macOS malware past the scrutiny of a host of third-party security tools by tricking them into believing the malicious wares were signed by Apple, researchers said Tuesday. Digital signatures are a core security function for all modern operating systems. The cryptographically generated signatures make it possible for users to know with complete certainty that an app was digitally signed with the private key of a trusted party.

Florida skips gun background checks for a year after employee forgets login

In Florida, the site of recent mass shootings such as at the Stoneman Douglas High School and the Pulse nightclub, more than a year went by in which the state approved applications without carrying out background checks. This meant the state was unaware if there was a cause to refuse a licence to allow somebody to carry a hidden gun – for example, mental illness or drug addiction. The reason is dismayingly banal: an employee couldn’t remember her login.

Ethereum “Giveaway” Scammers Have Tricked People Out of $4.3 Million

The EtherScamDB website was created by the team behind the MyCrypto wallet service for the purpose of tracking various types of online scams centering around the Ethereum platform and associated cryptocurrencies and assets. For the past few months, the website has been inventorying various types of Ethereum scams, such as classic phishing sites that imitate legitimate apps and wallets, trust-trading sites that push inaccurate advice or recommendations, but also online giveaways scams that promise to multiply Ether funds if victims transfer crooks a small sum of money. The latter category has recently become rampant on Twitter, and on a daily basis, the social network’s most popular tweets are often inundated by these ‘Ether giveaway’ scams.

Apple Bans Apps That Mine Cryptocurrencies

Apple has updated its review guidelines to specifically prohibit iOS and Mac apps uploaded on the company’s official App Store from utilizing users’ devices for cryptocurrency mining operations. The ban applies for apps designed explicitly with mining operations in mind. Other cryptocurrency-related functions, like managing or trading cryptocoin funds, are still permitted.

Two sections have been updated in the new App Store Review Guidelines —section 2.4.2 (Hardware Compatibility) and 3.1.5 (b) (ii) (Cryptocurrencies). Apple updated its App Store review guidelines last week, during the WWDC 2018 conference. The company took this step after hidden cryptocurrency mining has become the most popular cybercrime trend among malware developers this past year.

Bitcoin price takes a dive after another cryptocurrency exchange hack

The exchange in question is called Coinrail, and if you visit its website right now you’ll see a “System maintenance” message that tells you more than they’re just updating the servers. The devil’s in the detail – the site is down because it got hacked over the weekend. The statement on Coinrail’s website says that some (but not all) of the cryptocurrency exchange’s digital currency was stolen by hackers.

Tens of Thousands of Android Devices Are Exposing Their Debug Port

The issue is not new, being first spotted by the team at Qihoo 360 Netlab in February, this year, when they detected an Android worm that was spreading from Android device to Android device, infecting them with a cryptocurrency miner named ADB.Miner. The ADB.Miner worm exploited the Android Debug Bridge (ADB), a feature of the Android OS used for troubleshooting faulty devices. In the default version of the Android OS, the ADB feature is turned off, and users need to manually enable it while connecting their device via a USB connection.

Canada using Excel function for immigration lottery

Canada’s family-reunification program is using a common spreadsheet application to select candidates as part of a process critics say is flawed and open to manipulation. As the first step in the program, the federal government uses Microsoft Excel to randomly pick applications in its lottery, The Globe and Mail has learned. Experts have warned that using Excel to conduct such a sensitive lottery could be problematic, and that the lottery process itself may make the system less fair over all.