News

Twitter says that some of its users' phone numbers and email addresses provided for account security like two-factor authentication may have been used accidentally for ad targeting. "We recently discovered that when you provided an email address or phone number for safety or security purposes (for example, two-factor authentication) this data may have inadvertently been used for advertising purposes, specifically in our Tailored Audiences and Partner Audiences advertising system," says the company. Source: Bleeping Computer

In this article we take a look at a phishing campaign that pretends to be an Amazon AWS suspension notice for unpaid bills that looks good enough to trick many users. A billing notice from a vendor, especially one like Amazon, that states that your account has been suspended for unpaid bills, may confuse a user enough to click on the email link. Attackers are capitalizing on this confusion by sending emails that pretend to...

The operators behind the RobbinHood ransomware have changed their language in the ransom note, at least in one variant of the malware, to take from victims all hope of decrypting the files for free and to make them pay for the recovery. Boastful and arrogant in their message, the cybercriminals point to past incidents involving their ransomware, which ended with victims paying much more than the ransom demand. Source: Bleeping Computer

Reyes Daniel Ruiz, a former Yahoo! software engineer, has pleaded guilty to using his access privileges at the company to hack users’ accounts so that he could download private images and videos mostly belonging to young women. A 10-year veteran of Yahoo!, Ruiz admitted to accessing around 6,000 accounts and storing the pilfered files at home. He then used these Yahoo! accounts as a stepping stone to compromise victims’ iCloud, Facebook, Gmail, DropBox, and other online...

Primary health organization (PHO) Tū Ora Compass Health from New Zealand disclosed a security breach that led to the exposure of medical and personally identifiable information (PII) of roughly 1 million people. PHOs are non-governmental organizations (NGOs) designed to provide support to the provision of fundamental primary health care services, mostly via general practices, to enrolled people. Source: Bleeping Computer

Several members-only dark web forums are reportedly auctioning what appears to be a stolen government database featuring the personal information of 92 million Brazilian citizens. The 16GB SQL database contains such information as name, birth date, mother’s name, gender and tax details including taxpayer IDs, according to BleepingComputer, which credits the discovery to a researcher with the Twitter user name Breach Radar. Source: SC Magazine

Instagram has added a new feature to its app to help users work out if an email was sent by the Facebook company or if it’s an attempted phishing scam. Now, if you receive an email claiming to be from Instagram, you can check if it’s genuine by heading over to the “Emails from Instagram” option in the app’s Security settings, which lists every email the service has sent you over the last 14 days....

Mimecast (NASDAQ: MIME), a leading email and data security company, announced the availability of its latest Email Security Risk Assessment (ESRA). The quarterly assessment is an aggregated report of tests that measure the efficacy of widely used email security systems. This quarter’s ESRA report found a significant increase in Business Email Compromise (BEC) attacks, emails containing dangerous file types, malware attachments and spam being delivered to users’ inboxes from incumbent email security systems. BEC attacks, also referred to as email-based impersonation...

Signal fixed a bug that could have allowed attackers to eavesdrop on victims by placing and then immediately auto-answering a call, without the callee's permission. The bug is reminiscent of Apple's FaceTime bug discovered in January, which similarly allowed attackers to eavesdrop on other iPhone users by placing and auto-approving a FaceTime audio or video call. This time, the bug only works via Signal audio calls, and not video, as the Signal app requires users to manually...

The United States and Baltic states on Sunday agreed to beef up cooperation to protect the Baltic energy grid from cyber attacks as they disconnect from the Russian electricity grid. US Energy Secretary Rick Perry and his Lithuanian, Latvian and Estonian counterparts termed the agreement "a critical moment for the Baltic States in strengthening cybersecurity" in strategic energy infrastructure. Source: France24