Top 10 Stories

A new zero-day flaw that could give hackers root access to Apple Macs has been discovered by 18-year-old Italian security researcher Luca Todesco. But Todesco has run into heavy criticism forrevealing the bug on GitHub last Sunday without giving Apple time to patch it. Others in the industry have leapt to his defence, blaming Apple in turn for failing to offer vulnerability researchers bug bounty rewards. Todesco says that the privilege escalation flaw is a...

Information security man Clint Ruoho has detailed server-side vulnerabilities in the popular Pocket add-on bundled with Firefox that may have allowed user reading lists to be populated with malicious links. The since-patched holes were disclosed July 25 and fixed August 17 after a series of botched patches, and gave attackers access to the process running as root on Amazon servers. Ruho says the bookmarking app functioned as an internal network proxy and subsequent poor design...

Armed police officers were sent to the home of the founder of Mumsnet after a hacker made a hoax call as part of a wider attack on the parenting forum and its 7.7 million users. Justine Roberts said the website, which has more than 14m visits a month, was forced offline during a cyber-attack claimed by an internet troll called @DadSecurity on Twitter who posted taunts such as “RIP Mumsnet” on the social network. She...

Security researchers at Trend Micro have exposed another flaw in the Android's mediaserver component. It could be remotely exploited to install malware onto a target device by sending a specially crafted multimedia message. The vulnerability (CVE-2015-3842) affects almost all versions of Android devices with the potential of putting hundreds of millions of devices open to hackers. The security flaw involves a mediaserver component called AudioEffect. It uses an unchecked variable that comes from the client,...

A major security flaw in more than 100 car models has been exposed in an academic paper that was suppressed by a major manufacturer for two years. Flavio Garcia, a computer scientist at the University of Birmingham, and two colleagues from a Dutch university were unable to release the paper afterVolkswagen won a case in the high court to ban its publication. The research team discovered car manufacturers including Audi, Citroën, Fiat, Honda and Volvo,...

Target Corp. has reached a deal with Visa to settle claims over a massive 2013 data breach that exposed 40 million debit and credit card accounts. Both companies confirmed the agreement Tuesday, but wouldn't put a dollar amount on it. A person familiar with the situation said Target has agreed to fund up to $67 million in pre-tax payments to Visa and the financial institutions that issued the cards. Minneapolis-based Target said that the issuers...

A teenager was part of a team of hackers who caused government websites in the UK and one used by the FBI to crash through cyber attacks, a court heard. Working from the family home in Solihull, Charlton Floate also took control of other people's computers and "bragged" about the group's success on the internet, reports the Birmingham Mail. Floate, 19, of Starbold Crescent, Knowle, Solihull, has admitted three charges under the Computer Misuse Act...

Hackers who stole and leaked customer information from the Ashley Madison website for cheating spouses have apparently made good on their threat to post all of the data they took online. A group calling itself the Impact Team compromised the site which encourages married users to cheat on their spouses and advertises 37 million members last month. At least two other dating sites, Cougar Life and Established Men, also owned by the same parent group,...

he U.S. Internal Revenue Service (IRS) said Monday a hacking attack into one of its computer databases revealed in May was much more extensive than previously thought, with nearly three times as many taxpayers hit by data theft. The IRS said in late May the tax return information of about 114,000 U.S. taxpayers had been illegally accessed by cyber criminals over the preceding four months, with another 111,000 unsuccessful attempts made. A new review has...

The University of Virginia announced Friday that attackers originating from China illegally accessed portions of its information technology systems, but that no personal information appears to have been affected. Despite an investigation – aided by Mandiant – indicating that banking information and health data and Social Security numbers are secure, the university took down its IT systems on Friday as part of a comprehensive security upgrade that was completed on Sunday. Now, all users are...