News

According to a new study by BlueVoyant, the percentage of media companies susceptible to compromise is double the figure across all other sectors. The vendor performed a cybersecurity posture analysis on 485 organisations from the media industry. The findings were compiled in its Media Industry Cybersecurity Challenges report. Prompt patching appeared a challenge for media companies, with 60% of identified systems still unprotected six weeks after a patch. 30% of the media companies analysed are...

Budget Android device models that are counterfeit versions associated with popular smartphone brands contain multiple hidden trojans designed to target WhatsApp and WhatsApp Business messaging app. Doctor Web first came across the malware in July 2022. It was discovered in the system partition of at least four different smartphones: radmi note 8, P48pro, Note30u, and Mate40. The cybersecurity firm published a report earlier this week. It stated: "These incidents are united by the fact that...

General Bytes, the Bitcoin ATM manufacturer, confirmed that it was the victim of a cyberattack that exploited a previously unknown flaw in its software to steal cryptocurrency from its users. The company issued an advisory last week. It stated: "The attacker was able to create an admin user remotely via CAS administrative interface via a URL call on the page that is used for the default installation on the server and creating the first administration...

Cryptojackers, trojanised crypto-currency miners, continue to spread across computers globally, while also becoming stealthier and increasingly avoiding detection. The new analysis was published by Microsoft's 365 Defender Research Team on Thursday. The technical write up reads: “In the past several months, Microsoft Defender Antivirus detected cryptojackers on hundreds of thousands of devices every month." “These threats also continue to evolve: recent cryptojackers have become stealthier, leveraging living-off-the-land binaries (LOLBins) to evade detection.” Cryptojackers are using...

Amazon have patched a high-severity security issue in its Ring app for Android in May that could have enabled a rogue application installed on a user's device to access sensitive information and camera recordings. The Ring app for Android has over 10 million downloads. Application security firm Checkmarx explained that it identified a cross-site scripting (XSS) flaw that said it could be weaponised as part of an attack chain to trick victims into installing a...

On Wednesday, Apple released security updates for iOS, iPadOS and macOS platforms to remediate two zero-day vulnerabilities previously exploited by threat actors to compromise devices. The issues were: CVE-2022-32893 - An out-of-bounds issue in WebKit which potentially lead to the execution of arbitrary code by processing a specially crafted web content CVE-2022-32894 - An out-of-bounds issue in the operating system's Kernel that could be abused by a malicious application to execute arbitrary code with the highest...

The North Korea state-backed Lazarus Group has been observed to be targeting job seekers with malware capable of executing on Apple Macs with Intel and M1 chipsets. ESET, a Slovak cybersecurity firm, linked these events to a campaign dubbed "Operation In(ter)ception" that was first disclosed in June 2020 and involved using social engineering tactics to trick employees working in the military and aerospace sectors into opening fake job offer documents. The latest attack is no...

Researchers have discovered 8000 exposed Virtual Network Computing instances, which could put numerous global organisations at risk of remote compromise. As a matter of fact, the instances were managed by critical infrastructure (CNI) organisations, who are responsible for water treatment plants, manufacturing plants and research facilities. With disabled authentication, malicious actors have the ability to hijack certain endpoints and with it, the industrial control systems these may be connected to. This is because VNC is...

On Monday, popular end-to-end encrypted messaging service Signal disclosed the cyberattack aimed at Twilio earlier this month may have exposed the phone numbers of roughly 1900 users. Signal said, "for about 1,900 users, an attacker could have attempted to re-register their number to another device or learned that their number was registered to Signal. All users can rest assured that their message history, contact lists, profile information, whom they'd blocked, and other personal data remain private...

Alphabet Inc's Google Unit was ordered by Australia's Federal Court to pay A$60million in penalties for misleading users on collection of their personal location data, according to Australia's competition watchdog. The court found that Google mislead some customers about their personal location data that was being collected through their Android mobile devices between January 2017 and December 2018. Google misled users into believing that the "location history" setting on their Android phones was the only...