News

Low-key but effective, steganography is an old-school trick of hiding code within a normal-looking image, where many cybersecurity pros may not think to look. A recent Fortinet report found that one of these threats in need of monitoring is the recent revival of the “old school” trick of steganography. Source: Threatpost

Operations at two major US-based chemical companies, Hexion and Momentive, were disrupted recently by a cyberattack reportedly involving LockerGoga, the ransomware that recently hit Norwegian aluminum giant Norsk Hydro. Source: TechBizWeb

Lower-level workers and contributors are the employees most at risk for cyberattacks, according to digital marketing agency Reboot. They found that 67 percent of all highly-targeted attacks are carried out against "lower-level employees" such as customer service representatives. Source: PCMag

Apple released today security updates for iOS, fixing 51 vulnerabilities in version 12.2 of the operating system. The list of patches covers a wide variety of bugs an adversary could potentially manipulate to obtain effects like denial-of-service, privilege escalation, and information disclosure to gaining root privileges, overwriting arbitrary files, or executing code of the attacker's choice. Source: Bleeping Computer

For nearly half a year, computer maker ASUS was unwittingly pushing malware that gave hackers backdoor access to thousands of computers, according to Kaspersky Lab. Hackers managed to compromise one of the company's servers used to provide software updates to ASUS machines. The attack, which has been given the name ShadowHammer was discovered late last year and has since been stopped.  Source: Engadget

A major flaw in defibrillator implants, used by more than 31,000 people in the UK, could allow hackers to take control of the devices and harm patients. The US Department of Homeland Security has issued a warning on devices used to treat patients with heart conditions, stating that an attacker could modify or control a device remotely using radio waves. As many as 750,000 devices globally are thought to be at risk. Source: The Telegraph

A popular family tracking app was leaking the real-time locations of more than 238,000 users for weeks after the developer left a server exposed without a password. Source: Tech Crunch

Disaster relief org FEMA has admitted, conveniently on a Friday night, to accidentally leaking banking details and other personal information of 2.3 million hurricane and wildfire survivors. Source: The Register

Royal Bank of Scotland (RBS) customers have been put at risk of cyber-attack after being recommended flawed security software. Since January, the banking group has begun to offer its business banking customers a product called Thor Foresight Enterprise free of charge. Security researchers uncovered a flaw in it that made customers less secure. Source: BBC News

A team of security researchers has hacked a Tesla Model 3 car on the last day of the Pwn2Own 2019 hacking contest that was held this week in Vancouver, Canada. Team Fluoroacetate --made up of Amat Cama and Richard Zhu-- hacked the Tesla car via its browser. They used a JIT bug in the browser renderer process to execute code on the car's firmware and show a message on its entertainment system. Source: ZDNet