Security News > 2020 > August
The US bans on Chinese apps TikTok and WeChat are not particularly valuable for US security, experts told AFP Friday, but could step up broader commercial pressure on Beijing and help President Donald Trump appear tough as he seeks reelection. The WeChat ban especially, they say, actually harms a large number of Chinese Americans, US-based Chinese, and businesses working with China, all for whom the app is essential to communications.
Sold by retailers including Amazon, Walmart, and Home Depot, U-Tec's $139.99 UltraLoq is marketed as a "Secure and versatile smart deadbolt that offers keyless entry via your Bluetooth-enabled smartphone and code." Users can share temporary codes and 'Ekeys' to friends and guests for scheduled access, but according to Tripwire researcher Craig Young, a hacker able to sniff out the device's MAC address can help themselves to an access key, too.
Popular video conferencing app Zoom has addressed several security vulnerabilities, two of which affect its Linux client that could have allowed an attacker with access to a compromised system to read and exfiltrate Zoom user data-and even run stealthy malware as a sub-process of a trusted application. After Ahmed privately reported the issues to Zoom in April and subsequently in July, the company issued a fix on August 3.
Multiple Reddit moderator accounts have been compromised and abused to post pro-Trump messages on a variety of subreddits. The hackers appear to have targeted moderator accounts that did not have two-factor authentication enabled, and leveraged their rights to modify subreddits or even remove moderator accounts that had fewer rights.
Researchers have identified more than 30 vulnerabilities across 20 popular content management systems, including Microsoft SharePoint and Atlassian Confluence. "In the most simple attack scenario, the attacker has access to the target CMS applications such as regular Sharepoint users being able to create their own sites and therefore being able to provide their own templates," Muñoz explained.
The city of Lafayette - technically a home-rule municipality - with a population of around 30,000, said it has opted to pay ransomware criminals a $45,000 fee after deciding that it was a better use of cash than spending time and money wiping and reformatting all of their machines. Patrick Wardle, principal security boffin at JAMF and Apple security expert, has a new warning for macOS users: look out for malicious Office Macros.
A critical vulnerability in ManageEngine ADSelfService Plus, an Active Directory password-reset solution, could allow attackers to remotely execute commands with system level privileges on the target Windows host. ManageEngine ADSelfService Plus is developed by ManageEngine, a division of Zoho Corporation, a software development company that focuses on web-based business tools and information technology.
The latest articles and the latest Naked Security Live video - all in one place. Enjoy.
A 350% increase in phishing websites was reported in the first quarter of the year, many targeting hospitals and health care systems and hindering their work responding to the COVID-19 pandemic, the U.N. counterterrorism chief said Thursday. Vladimir Voronkov told the U.N. Security Council that the upsurge in phishing sites was part of "a significant rise in cybercrime in recent months" reported by speakers at last month's first Virtual Counterterrorism Week at the United Nations.
TeamViewer team recently released a new version of its software that includes a patch for a severe vulnerability, which, if exploited, could let remote attackers steal your system password and eventually compromise it. Discovered by Jeffrey Hofmann of Praetorian, the newly reported high-risk vulnerability resides in the way TeamViewer quotes its custom URI handlers, which could allow an attacker to force the software to relay an NTLM authentication request to the attacker's system.