Top 10 Stories

The gang behind the Carbanak banking malware, which was tied to at least $1 billion in fraud from 2012 to 2014, appears to be back, wielding new tactics. Recently, four new variants of Carbanak have been used to target victims in the United States and Europe via spear-phishing attacks, warns Denmark-based CSIS Security Group (seeCybercrime Gang: Fraud Estimates Hit $1 Billion). CSIS says the attacks mark a resurgence of activity from the cybercrime gang, which experts...

When Metro Bank opened its doors five years ago, it was reportedly the first new high street bank to launch in the UK for over 150 years. It may have joined an old club, but now its customers are at risk of falling for the modern threat of online fraud. The genuine Twitter accounts of Metro Bank are @Metro_Bank and – for customer service –@MetroBank_Help. However, if you need help from Metro Bank be very careful...

Security researchers have disclosed vulnerabilities that could be exploited by cyber attackers in products from Kaspersky Lab and FireEye. Controversial Google security researcher Tavis Ormandy tweeted that he had tested a successful exploit of a vulnerability in Kaspersky Lab’s antivirus software. Ormandy tweeted about the exploit on 5 September 2015, copying in Kaskpersky Lab Threatpost blogger Ryan Naraine, followed by a tweet the next day saying Kaspersky Lab was rolling out a fix. Naraine responded to...

Mozilla has announced on Friday that an attacker managed to access security-sensitive information about a considerable number of (at the time) unpatched Firefox vulnerabilities, and that there is evidence that at least one of them has been exploited in attacks in the wild. The breach didn't happen because there is a critical vulnerability in Mozilla's Bugzilla web-based bugtracker, but because the attacker managed to get hold of a privileged users' account password, as the user...

Crooks behind the world's worst exploit kit, Angler, have added the latest Adobe Flash vulnerabilities to the suite's long list of attack vectors. Angler now sports support for some of the 35 Flash player holes detailed and patched last month that includes eight memory corruption flaws and five type confusion bugs. French malware man Kafeine says Angler has added an integer overflow (CVE-2015-5560) that allows for arbitrary code execution via unspecified vectors. It affects unpatched...

CERT.org has reported Seagate wireless hard drives include “undocumented Telnet services” accessible with a hard-coded password. This allows “unrestricted file download capability to anonymous attackers with wireless access to the device.”And another flaw makes it possible to upload anything into the devices' default file-sharing directory. The devices are effectively a small network-attached storage device: there's every chance more than a few are doing duty as a de facto file server in very small businesses. View...

The University of NSW Facebook page has been hacked for the second time in as many days. ​The university posted a series of photos of Lebanese-American porn star Mia Khalifa on Sunday night, along with links to "extreme curves" and suggestions on the top universities in Italy. The second round of hacking at the eastern suburbs institution came after it had to scramble to remove similar updates on Saturday - when its open day was marred by posts...

Fiat Chrysler said Friday it is voluntarily recalling 7,810 SUVs due to a software glitch that could make the vehicles vulnerable to remote control. Half of the vehicles, which are 2015 Jeep Renegade SUVs equipped with 6.5-inch touchscreens, are still at dealerships, the carmaker said in a statement. The company downplayed the risk to drivers, saying it was unaware of injuries related to the problem and had received no complaints. View full story

Anonymous has launched another online battle against members of the Islamic State (IS, formerly ISIS/ISIL) group. The hacktivists are targeting and attacking the online network of supporters and suspected websites of the IS. A recent developing offshoot of the Anonymous group, known as GhostSec or Ghost Security, revealed that their members are attacking thousands of publicity websites and social media accounts operated by the ISIS group. GhostSec members organised a list of potential Twitter accounts that are being...

HMRC is spewing job applicants’ email addresses to potential rivals in mass circular responses it has blamed on “a technical glitch”. A reader got in touch to report their email address had been circulated to all other applicants in three instances. In an email seen by The Reg, the reader’s address was included in a list which included nearly 500 other addresses. View full story