Top 10 Stories

Released in October 2015, for a period of time, many thought Android 6 to be impervious to threats like GM Bot and other malware families that rely on the tactic of overlaying fake content on top of other apps. First signs of trouble appeared in May 2016, when Symantec researchers discovered Android malware abusing Android's Accessibility feature to target Android 6, and then in June 2016 when malware began using two other workarounds. View full...

Security researchers have demonstrated how to gain root privileges from a normal Android app without relying on any software bug. The unprivileged application is able to gain full administrative permissions by exploiting the Rowhammer vulnerability present in modern RAM chips. Essentially, malicious code can change the content of memory it should never be able to access. This means rogue mobile applications can abuse this hardware flaw to commandeer peoples' handhelds. View full story Original source:...

York said that his company worked with Akamai and Flashpoint to analyze the source of the junk traffic that targeted its managed DNS services, which provide on-demand DNS servers for popular websites such as Reddit, Imgur, Twitter, GitHub, Spotify, Soundcloud, PayPal, Yelp, and others. Because of this DDoS attack, Dyn's DNS servers weren't able to resolve DNS queries for the aforementioned services, and users couldn't access those websites, because their browsers and apps couldn't resolve...

Anti-malware machine and head of the Shellphish DARPA Grand Challenge bronze-medallist team has won US$100,000 from Google for security research efforts. University of California Santa Barbara doctor Giovanni Vigna landed Google's Security, Privacy and Anti-Abuse award for his long line of research into malware detection. Google did not specify the specific work for which he was awarded but Dr. Vigna has co-published dozens of papers in the field among some 200 works spanning Android, networking,...

The web design platform Weebly was hacked in February, according to the data breach notification site LeakedSource. Usernames and passwords for more than 43 million accounts were taken in the breach, although the passwords are secured with the strong hashing algorithm bcrypt. Weebly said in an email to customers that user IP addresses were also taken in the breach. “We do not believe that any customer website has been improperly accessed,” Weebly said in the...

One of the biggest breaches in India has compromised as many as 3.2 million payment cards as banks scramble to replace cards and request users to change security codes. Officials believe the breach originated from malware on the Hitachi Payment Services platform, which provides ATM and point of sale services, is responsible for the breach said 2.6 million of the affected cards are on the Visa and MasterCard platform, according to The Economic Times. View...

A serious vulnerability that has been present for nine years in virtually all versions of the Linux operating system is under active exploit, according to researchers who are advising users to install a patch as soon as possible. View full story ORIGINAL SOURCE: Ars Technica

US authorities have officially charged Martin Gottesfeld, 32, of Somerville, Massachusetts, for launching DDoS attacks against Boston Children's Hospital and the Wayside Youth and Family Support Network, a mental illness treatment facility in Framingham, Massachusetts. View full story ORIGINAL SOURCE: Softpedia

ESET has tested more than 12,000 home routers of users who agreed to share their data anonymously for statistical purposes. The results prove that 15% of the tested routers used weak passwords, with “admin” left as the username in most cases. During the test, common default usernames and passwords, as well as some frequently used combinations, were tested. It’s disturbing that more than one in seven of such simple simulated attacks was successful. View full...

U.S. bank regulators on Wednesday outlined cyber security standards meant to protect financial markets and consumers from online attacks against the nation's leading financial firms. Leading banks will be expected to use the most sophisticated anti-hacking tools on the market and to be able to recover from any attack within two hours, said officials briefing reporters on the plan. The rules, which will be finalized after industry input, is meant to raise cyber security to...