Top 10 Stories

With the arrival last week of the brand new .bank (or .BANK) top-level domain (TLD), everything to do with global online banking is about to get more expensive, more complex but, the experts claim, a lot more secure for both banks and consumers. View full story

A trio of FireEye researchers have reported twin 'app-demolishing' iOS vulnerabilities Apple has partially fixed in its latest update that could wreck core apps such as the App Store and Settings. View full story

Detour Gold Corp. is reaching out to former and current employees to tell them that their personal information may have been compromised due to a cyber attack. View full story

Ryan Ramminger, creator of an app called "Prized", has been fined $50,000 after the Federal Trade Commission revealed charges he had been using hidden malware within his app to "take control of the computing resources of consumers' mobile devices to mine for virtual currencies, such as Dogecoin, Litecoin and Quarkcoin." Customers were unaware of what was happening on their phones, however the terms of use of the app did specify that any code within it...

The Dridex banking malware has been uncovered in a spam email campaign targeting company accountants. The spam email has an attachment which is masquerading as legitimate by saying it was scanned from a Xerox Multifunction Printer and directly sent to the recipient. However, the file is really a macros-enabled .doc which will retrieve Dridex from numerous compromised webpages. Once installed, Dridex then hibernates until bank credentials are entered on the computer. Dridex then wakes up...

Middle Eastern Respiratory Syndrome, or MERS, has claimed 32 lives in a recent outbreak. Hackers are reportedly exploiting peoples' health concerns via a spear phishing attack. Researchers at Trend Micro found that a Japanese mass media company was targeted by the scam, which says it has an attachment claiming to provide information about the prevention of MERS. In reality, it was delivering a backdoor program. The attachment came in the form of a CHM file,...

Bernard Wagner, a researcher at MWR Labs, has reported flaws in the Fire phone that could allows apps to install certificates without interaction with users. The CertInstaller tool facilitates the installation of certificates in apps. But the flaws discovered by Wagner mean that apps which don't use certificate pinning are vulnerable to traffic interception. This in turn could lead to man-in-the-middle attacks. This kind of attack is used by attackers to secretly relay and possibly...

The Office of Personnel Management (OPM) has shut down the web gateway which supported Federal Background Investigations for contractors and employees in a move it has described as "proactive" and "temporary", in response to the discovery of a vulnerability. With the review of security measures at the agency still ongoing, a spokesperson has stated that this flaw is not involved in the recent breach, however this enhancement of security was necessary. The agency also stressed...

Attackers gained access to Clarksville Town Court classified records on June 23, potentially compromising information such as names, addresses, dates of birth, and Social Security numbers, James Guilfoyle, Clarksville Town Court judge, said in a statement emailed to SCMagazine.com on Thursday. View full story

A malware development squad is so determined to thwart meddling white hat researchers that it has produced a trojan riddled with obfuscation techniques and neurotic encryption. The Fobber banking trojan is based off Tinba version two, regularly hops between programs, and is distributed through the elusive and dangerous HanJuan exploit kit. View full story