Security News > 2020 > March
A most entertaining piece of threat research from Check Point gives a unique insight into the "Working" life of a Nigerian email spammer who made thousands of dollars from stolen credit cards alone in recent years. Behind that facade of respectability, "Dton" was in fact an email spammer - a spammer working as part of a Nigerian cybercrime syndicate that generates its ill-gotten gains through buying and using stolen credit card details.
The app promises access to a coronavirus map tracker but instead holds your contacts and other data for ransom, DomainTools found. A new type of ransomware known as CovidLock encrypts key data on an Android device and denies access to the victims unless they pay up, according to the threat intelligence firm DomainTools.
In most cases of human-operated ransomware attacks against enterprises, the hackers don't trigger the malware immediately: according to FireEye researchers, in most of cases, at least three days passed between the first evidence of malicious activity and ransomware deployment. What are the attackers waiting for? One of the reasons for the delay is the wish to spread the ransomware to many systems before running it.
Some users have complained that the Windows security update released recently by Microsoft to patch a wormable vulnerability related to Server Message Block 3.0 is causing problems. Microsoft released an out-of-band update for Windows 10 and Windows Server on March 12 to fix CVE-2020-0796, a vulnerability that can allow an unauthenticated attacker to execute arbitrary code on SMB servers and clients.
Online guitar tutoring website TrueFire has apparently suffered a 'Magecart' style data breach incident that may have potentially led to the exposure of its customers' personal information and payment card information. TrueFire is one of the popular guitar tutoring websites with over 1 million users, where wanna-be-guitarists pay online to access a massive library of over 900 courses and 40,000 video lessons.
Online guitar tutoring website TrueFire has apparently suffered a 'Magecart' style data breach incident that may have potentially led to the exposure of its customers' personal information and payment card information. TrueFire is one of the popular guitar tutoring websites with over 1 million users, where wanna-be-guitarists pay online to access a massive library of over 900 courses and 40,000 video lessons.
The bug uses a sneaky trick called HTTP smuggling, which takes advantage of how back-end servers process requests using this protocol. A front-end proxy server might send it to one of several back-end servers, for example.
Rise and fall of a Nigerian cybercriminal called 'Dton,' who made hundreds of thousands of dollars in a 7-year campaign, outlined in new report. Ever wonder who's behind one of those Nigerian cyber-crime email campaigns asking you to enter into a shady business deal and how they're enacted? In a unique profile, researchers pulled back the curtain on such an attack with a report outlining how a Nigerian cybercriminal made hundreds of thousands of dollars over the course of seven years by targeting people through numerous malicious campaigns.
The Tor browser has fixed a bug that could have allowed JavaScript to execute on websites even when users think they've disabled it for maximum anonymity. The Tor Project revealed the issue in the release notes for version 9.0.6, initially suggesting users manually disable JavaScript for the time being if the issue bothered them.
If WordPress had a list of the most requested features, the ability to automatically update plugins and themes would surely be near the top. Some good news: according to a recent development update, the ability to do this is now being beta-tested in the form of a new plugin for WordPress 5.5, due in August.