Security News > 2020

Researchers say the most serious vulnerability in the platform could allow attackers to remotely take control over parts of victims' TikTok account, such as uploading or deleting videos and changing settings on videos to make "Hidden" videos public. "Many of us use the TikTok app to share enjoyable moments and snip bits of fun memories in the form of a short video clips," researchers with Check Point Research said on Wednesday.

Google has pulled three malicious apps from Google Play, one of which exploits a recently patched kernel privilege escalation bug in Android to install the app aimed at spying on users. The Camero app would download a DEX file from a C&C, which would then download the callCam APK file and use the CVE-2019-2215 exploit to root the device, install the app and launch it without any user interaction or the user's knowledge.

Take this week's revelation by researcher Kevin Beaumont that serious vulnerabilities in Pulse Secure's Zero Trust business VPN system are being exploited to break into company networks to install the REvil ransomware. His evidence comprises anecdotal reports from victims mentioning unpatched Pulse Secure VPN systems being used as a way in by REvil.

The big one: rather than trying to verify that users are over the age of 13, it's just going to treat all content aimed at kids as if it is watched by kids, regardless of age of the viewer, and it's going to COPPA-ify that content. As per federal COPPA guidelines, that means that YouTube will limit data collection and use and the serving up of personalized ads on such videos.

MITRE on Tuesday announced the initial release of a version of its ATT&CK knowledge base that covers the tactics and techniques used by malicious actors when targeting industrial control systems. The new ATT&CK for ICS knowledge base builds upon it in an effort to help critical infrastructure and other organizations whose environments house ICS. In addition to a matrix that provides an overview of the tactics and techniques used by adversaries, ATT&CK for ICS covers attack techniques in more detail, the malware used by threat actors, and the threat groups known to have launched ICS-related attacks.

With so much personal information-including high-value targets like financial data and account information-flowing through such dispersed channels, the prime CHEW motivation for attacking the retail organism is of course criminal intent. All these factors are part of the risk portfolio for any retail organization, representing avenues of attack that security pros must look to cut off.

The FBI has sent a letter to Apple asking for help in accessing encrypted data stored on two iPhones belonging to a deceased shooter. The FBI has told Apple that Alshamrani's devices are encrypted and that efforts to guess his passwords have been unsuccessful, NBC News reports.

On the last day of 2019, foreign exchange company Travelex was hit by cyber attackers wielding the Sodinokibi ransomware. More than a week later, the company's websites and online services are still offline despite the company's remediation efforts.

The US Department of Homeland Security has issued a total of three warnings in the last few days encouraging people to be on the alert for physical and cyber attacks from Iran. The warnings directly address IT professionals with advice on how to secure their networks against Iranian attack.

Facebook will be using its own staff, as well as independent fact-checkers, to judge a video's authenticity. Given the latitude the new policy gives to satire, parody, or videos altered with simple/cheapo technologies, it might mean that some pretty infamous, and widely shared, cheapfakes will be given a pass and left on the platform.