News

Multimedia processing components are one of today's most dangerous attack surfaces in any operating system. When it comes to managing multimedia files, all operating systems work the same. Any new multimedia file -- image, audio, video -- that reaches a device is automatically transferred to a local OS library that parses the file to know what it is and what to do with it next. From an attacker's perspective, bugs in multimedia processing components are...

Zaha Hadid Architects has warned architecture practices to be vigilant after hackers held its server to ransom while the company works remotely during the coronavirus pandemic. The practice, founded by the late Zaha Hadid, alerted the police after data was stolen last week, reported the Architects' Journal. The hacker used ransomware to encrypt all the data on a company server and demanded money from the practice to release it. Source: Dezeen

More than 150,000 emails spreading the Hupigon RAT that use adult dating as a lure have been uncovered, with almost half being sent to U.S. university and college email addresses. Several U.S. universities have been targeted in a widespread spear-phishing attack that uses adult dating as a lure. In reality, the emails spread the Hupigon remote access trojan (RAT), known to be leveraged by state-sponsored threat actors. Researchers from Proofpoint warned that the ongoing spear-phishing...

Hackers are actively targeting WordPress sites running the OneTone theme to exploit a vulnerability that allows them to read and write site cookies and create backdoor admin accounts. The campaign has been going since the start of the month, and it's still underway. The vulnerability is a cross-site scripting (XSS) bug in OneTone, a popular but now deprecated WordPress theme developed by Magee WP, available in both free and paid versions. Source

U.S. pharmaceutical giant ExecuPharm has become the latest victim of data-stealing ransomware. ExecuPharm said in a letter to the Vermont attorney general’s office that it was hit by a ransomware attack on March 13, and warned that Social Security numbers, financial information, driver licenses, passport numbers and other sensitive data may have been accessed. But TechCrunch has now learned that the ransomware group behind the attack has published the data stolen from the company’s servers....

The Israeli government says that hackers have targeted its water supply and treatment facilities last week. In a security alert sent by the Israeli National Cyber-Directorate (INCD), the agency is urging personnel at companies active in the energy and water sectors to change passwords for all internet-connected systems. If passwords can't be changed, the agency recommended taking systems offline until proper security systems can be put in place. The INCD alert, issued on April 23,...

Hackers accessed the University of Warwick's administrative network last year in an attack which has been kept secret from the affected individuals and organisations, Sky News has learnt. The security incident occurred when a staff member installed remote-viewing software enabling hackers to steal sensitive personal information on students, staff and even volunteers taking part in research studies. Because cyber security protections at the university were so poor, as per the findings of an internal report...

Since the Coronavirus pandemic has taken hold, Alert Logic has experienced a 92 percent increase in deployed endpoints. As a result, the industry’s first SaaS-enabled managed detection and response (MDR) provider is offering a 90-day free vulnerability detection with extended protection to help mitigate cyber-attacks aimed at the increased number of remote workers.  Alert Logic’s recent offer includes machine learning-enabled protection, AWS configuration checks, asset discovery, and vulnerability scanning. The Texas-based cybersecurity giant has also launched a COVID-19 resource centre which provides added advice on how to adjust...

The World Health Organization (WHO) said the recent leak of 450 active WHO email addresses and passwords along with credentials of thousands working on the response to the coronavirus pandemic didn’t put the organization’s systems at risk. Explaining that its systems were largely spared because “the data was not recent,” WHO said in a release that “the attack did impact an older extranet system, used by current and retired staff as well as partners.” Credentials...

Mozilla is raising payouts for the highest impact security flaws found in Firefox and related projects as part of a bug bounty revamp guided by its “more hardened security stance”. In an effort to make the policy “more friendly”, the open source browser developer has also clarified payout criteria, and abandoned a “first reporter wins” approach to payouts in favor of sharing the spoils among duplicate reporters. The non-profit said it would also continue publishing...