Researchers have identified what they are calling an Early Bird code injection technique used by the Iranian group APT33 to burrow the TurnedUp malware inside infected systems while evading anti-malware tools.
Source: threatpost.com
SRL researchers Karsten Nohl and Jakob Lell spent two years analyzing Android devices, checking to see if the phones actually had installed the security patches that the software said it had. The pair found that many devices had what they call a “patch gap,” where the phone’s software would claim it was up to date with security patches but was, in reality, missing up to a dozen of the patches.
I recently encountered an interesting phishing scheme when reviewing telemetry of incidents blocked by Trustwave Secure Web Gateway (SWG). My investigation into the scheme uncovered some interesting points and led me here:
Source: trustwave.com
The RSA cryptosystem has had its fair share of attacks over the years, but among the most impressive, you can find the infamous Bleichenbacher attack [Ble98], which doomed PKCS v1.5 in 1998. Nineteen years later, the ROBOT attack proved that the Bleichenbacher attack was still a concern today. Now, what alternatives to RSA PKCS v1.5 do we have?
Well, itssuccessor, RSA OAEP also known as RSA PKCS v2.1 is obviously a good candidate.
In 2016, my colleague, Matt Braithwaite, ran an experiment in Google Chrome which integrated a post-quantum key-agreement primitive (NewHope) with a standard, elliptic-curve one (X25519). Since that time, the submissions for the 1st round of NIST’s post-quantum process have arrived. We thus wanted to consider which of the submissions, representing the new state of the art, would be most suitable for future work on post-quantum confidentiality in TLS.
The campaign, which has been running for at least four months, is able to compromise websites running a variety of content management systems, including WordPress, Joomla, and SquareSpace. That’s according to a blog post by Jérôme Segura, lead malware intelligence analyst at Malwarebytes. The hackers, he wrote, cause the sites to display authentic-appearing messages to a narrowly targeted number of visitors that, depending on the browsers they’re using, instruct them to install updates for Firefox, Chrome, or Flash.
Great Western Rail is urging all customers to change their passwords after identifying a successful attack to access GWR.com accounts over the last week.
Source: co.uk
Three major browser makers —Google, Microsoft, and Mozilla—have put their official backing behind a new W3C API called Web Authentication (WebAuthn) that is advertised as a reliable alternative to passwordless online authentication.
Source: bleepingcomputer.com
Ad serving firm Flashtalking analyzed 20 advertisers worldwide throughout Q4 2017 and found that 64% of their tracking cookies were either blocked or deleted by web browsers. According to the research, rejection rates on mobile devices were particularly high—75% of mobile cookies were rejected, compared with 41% on desktop.
Source: emarketer.com
A local start-up company founded last year, OneGram, is issuing a gold-backed cryptocurrency — part of efforts to convince Muslims that investing in cryptocurrencies complies with their faith.
Source: venturebeat.com
The World Wide Web Consortium (W3C) and FIDO Alliance today announced that a new spec, WebAuthn (‘Web Authentication’) had been promoted to the Candidate Recommendation stage, the penultimate stage in the Web standards process.
Source: arstechnica.com
The inside story behind how we made $107K investing in CryptoKitties and briefly set the record for the highest sale ever. Later, we made ~$8K running an automated arbitrage bot.
Source: hackernoon.com
Development for CryptoPets started just four days after CryptoKitties’ launch on November 28, and is basically a cross between Pokémon and CrytoKitties. Owners’ pets can battle each other, and those who put in time and effort to “train” their pets will increase their value in the “adoption center,” Mitchell Opatowsky, project manager at CryptoPets, explained to Motherboard in an email.
Source: vice.com
JingWang (“clean internet” in Chinese) doesn’t just block access to specific websites. It also searches your Android phone for “illegal” images, audio recordings, and videos, and can upload them to an external server – alongside identifying details of your phone such as its IMEI number, model, phone number, and manufacturer.
Source: bitdefender.com
Hackers equipped with just a laptop and a $30 handheld FM radio could have hijacked the emergency alert system sirens of San Francisco. The hack could have made them go off whenever they wanted, and made the system broadcast custom messages, according to researchers.
Source: vice.com
The makers of the programmable Fuze smart card say it’s powerful enough to be your wallet in one card yet secure enough to be used the same way as traditional payment cards—including trusting it to restaurant servers when paying the bill. But it turns out that convenience comes with a major catch. A flaw makes it possible for anyone with even brief physical control of the card to surreptitiously siphon all data stored on the device.
As if there weren’t already cameras enough in this world, researchers created a new type that is both microscopic and self-powered, making it possible to embed just about anywhere and have it work perpetually. It’s undoubtedly cool technology, but it’s probably also going to cause a spike in tinfoil sales.
Source: techcrunch.com
In Xinjiang, a part of western China that a Muslim minority population calls home, the government forces residents to install an Android app that scans devices for particular files. Now, cybersecurity researchers have found that the so-called JingWang app has horrendous security practices for transferring data, and uncovered more details on what exactly the app does to phones.
Source: vice.com
Cryptocurrency miners are always looking for a way to save on electricity costs. Sometimes that involves funding huge mining operations moving to small towns to take advantage of cheap hydro power, or developing obscure mining rig set ups that use Teslas or human body heat as their source of power.
Source: vice.com
On April 6, Monero tweaked its mining algorithm “to curb any potential threat of ASICs and preserve ASIC resistance.” That same day, Ethereum core developers met to discuss whether they should change Ethereum’s algorithm and ultimately decided not to for the time being, much to the chagrin of the Ethereum community.
Source: vice.com