The Devcore researchers said as many as 400,000 servers are at risk. Queries on the Shodan computer search engine identified a large number of servers that reported running vulnerable versions. The developers published a fix with version 4.90.1, which was released on February 10.
Any organization that uses Exim should ensure it’s using the latest version.
Source: arstechnica.com
National Trading Standards said that the defendants set up copycat websites between January 2011 and November 2014 that mimicked government services such as applying for or renewing passports, visas, birth or death certificates, driving licences and tests, car tax discs and the London Congestion Charge.
Source: bbc.com
The existence of the Geek Squad informants was first revealed via the prosecution of a California doctor named Mark Rettenmaier. After Rettenmaier sent his computer to Geek Squad for repair in 2011, technicians working out of a massive Kentucky repair shop discovered thousands of images depicting child abuse on Rettenmaier’s device. Court filings later revealed that there were “eight FBI informants at Geek Squad City,” and a number had received $500 to $1,000 payments in exchange for acting as confidential sources.
A large number of banks, credit unions and other financial institutions just pushed customers onto new e-banking platforms that asked them to reset their account passwords by entering a username plus some other static identifier — such as the first six digits of their Social Security number (SSN), or a mix of partial SSN, date of birth and surname. Here’s a closer look at what may be going on (spoiler: small, regional banks and credit unions have grown far too reliant on the whims of just a few major online banking platform providers).
Academics from the University of Michigan have shown that one single malicious car could trick US-based smart traffic control systems into believing an intersection is full and force the traffic control algorithm to alter its normal behavior, and indirectly cause traffic slowdowns and even block street intersections.
Source: bleepingcomputer.com
The company, called Grayshift, has released marketing materials to police and forensics organizations promising to unlock iPhones with its GrayKey tool, according to Forbes, which obtained a copy of those materials. GrayKey will cost law enforcement $15,000 for 300 uses. Those that want to be able to unlock iPhones an unlimited number of times will need to pay $30,000.
Use of remote-access software in e-voting systems was reported last month by The New York Times Magazine in an article headlined ‘The Myth of the Hacker-Proof Voting Machine.’ The article challenged the oft-repeated assurance that voting machines are generally secured against malicious tampering because they’re not connected to the Internet.
Source: arstechnica.com
Malware was discovered on point of sales systems at more than 160 Applebee’s restaurants, exposing credit card information from unknowing diners.
Source: threatpost.com
Records posted Tuesday by the Electronic Frontier Foundation following a freedom of information lawsuit filed last year reveal that federal agents would pay Geek Squad managers who pass on information about illegal materials on devices sent in by customers for repairs.
Source: zdnet.com
Given the state’s definition of sexual content, the Ciccone/Gallo bill would force ISPs to block pretty much all pornography, even if it was performed by consenting adults and violates no law.
Source: arstechnica.com
Continuing on in our Encryption 101 series, where we gave a malware analyst’s primer on encryption and demonstrated encryption techniques using ShiOne ransomware, we now look at what it takes to break an encryption. In order for something as powerful as encryption to break, there needs to be some kind of secret flaw. That flaw is often a result of an error in implementation.
Now, Plattsburgh could become the first municipality in the US to put a moratorium on Bitcoin mining. According to a proposed law tabled by the mayor on March 1, the city is seeking to put an 18-month moratorium on any new Bitcoin mining operations while new regulations around zoning and electricity use are drafted. A public meeting to discuss the proposal is planned for March 15.
Google, which has made strides in applying its proprietary deep learning tools to improve language translation, and vision recognition, has a cross-team collaboration within the company to work on the AI drone project.
Source: theintercept.com
Retina-X Studios, which sells several products marketed to parents and employers to keep tabs on their children and employees—but also used by jealous partners to spy on their significant others—announced that its shutting down all its spyware apps on Tuesday with a message at the top of its website.
Source: vice.com
Tal Be’ery and Amichai Shulman found that the always-listening Cortana agent responds to some voice commands even when computers are asleep and locked, allowing someone with physical access to plug a USB with a network adapter into the computer, then verbally instruct Cortana to launch the computer’s browser and go to a web address that does not use https—that is, a web address that does not encrypt traffic between a user’s machine and the website. The attacker’s malicious network adapter then intercepts the web session to send the computer to a malicious site instead, where malware downloads to the machine, all while the computer owner believes his or her machine is protected.
Gozi ISFB is a well-known and widely distributed banking trojan, and has been in the threat landscape for the past several years. Banking trojans are a widely distributed type of malware that attackers leverage in an attempt to obtain banking credentials from customers of various financial institutions. The source code associated with Gozi ISFB has been leaked several times over the years, and the robust features available within the Gozi ISFB code base have since been integrated into additional malware, such as GozNym.
In an attempt to predict startup success from their inception, I and four of my colleagues at NYU developed an AI-powered engine and conducted a digital footprint analysis of more than 6,000 founders using data points such as educational background, employment history, entrepreneurial experience, and personality traits. Based on that training data, our algorithm then predicts how likely a brand new startup is to succeed and gives it a score.
There have been lots of reasons to be concerned about how easily someone with the right tools and knowledge could do very bad things with cellular communications networks. And while none of them have necessarily been to the level of some of the fictional stunts pulled off on television (see Mr. Robot), new research shows that things are even worse than they appear—and in many cases, that’s because of how carriers have implemented cellular standards.
The stolen Uber data included the names and driver’s license information of around 600,000 drivers—including at least 13,500 from Pennsylvania—as well as data belonging to 25 million users in the US. It impacted over 57 million people in total. ‘Uber violated Pennsylvania law by failing to put our residents on timely notice of this massive data breach,’ Josh Shapiro, the states’s attorney general, said in a statement.
Everyone knew the MoviePass deal is too good to be true — and as is so often the case these days, it turns out you’re not the customer, you’re the product. And in this case they’re not even attempting to camouflage that. Mitch Lowe, the company’s CEO, told an audience at a Hollywood event that “we know all about you.”