Security News > 2020
Remember rowhammer vulnerability? A critical issue affecting modern DRAM chips that could allow attackers to obtain higher kernel privileges on a targeted system by repeatedly accessing memory cells and induce bit flips. To mitigate Rowhammer vulnerability on the latest DDR4 DRAM, many memory chip manufacturers added some defenses under the umbrella term Target Row Refresh that refreshes adjacent rows when a victim row is accessed more than a threshold.
Remember rowhammer vulnerability? A critical issue affecting modern DRAM chips that could allow attackers to obtain higher kernel privileges on a targeted system by repeatedly accessing memory cells and induce bit flips. To mitigate Rowhammer vulnerability on the latest DDR4 DRAM, many memory chip manufacturers added some defenses under the umbrella term Target Row Refresh that refreshes adjacent rows when a victim row is accessed more than a threshold.
A recently disclosed vulnerability affecting Zoho's ManageEngine Desktop Central endpoint management solution is already being exploited in attacks. Researcher Steven Seeley of Source Incite last week decided to disclose a critical Desktop Central vulnerability that can be exploited by a remote, unauthenticated attacker to execute arbitrary code with elevated privileges.
FBI officials last week arrested a Russian computer security researcher on suspicion of operating deer.io, a vast marketplace for buying and selling stolen account credentials for thousands of popular online services and stores. Prosecutors with the U.S. District Court for the Southern District of California allege Firsov was the administrator of deer.io, an online platform that hosted more than 24,000 shops for selling stolen and/or hacked usernames and passwords for a variety of top online destinations.
Someone has been trojanizing a wide variety of hacking tools to compromise the machines of hackers who want to use the tools for free, Cybereason researcher Amit Serper has revealed. "So far, we have found samples that are either pretending to be various hacking tools or pretending to be installers of the Chrome Internet browser," they noted.
A new variant of the Paradise ransomware attacks rarely-targeted Microsoft Office Excel IQY files, providing a new and relatively inobtrusive way to infiltrate and hijack an organization's network, researchers have found. Paradise ransomware has been active since 2017, though it's not as well-known as other ransomware campaigns.
The menace of Business Email Compromise is often overshadowed by ransomware but it's something small and medium-sized businesses shouldn't lose sight of. Bang on cue, the FBI Internet Crime Complaint Center has alerted US businesses to ongoing attacks targeting organisations using Microsoft Office 365 and Google G Suite.
Microsoft today announced that it has successfully disrupted the botnet network of the Necurs malware, which has infected more than 9 million computers globally, and also hijacked the majority of its infrastructure. "We were then able to accurately predict over six million unique domains that would be created in the next 25 months. Microsoft reported these domains to their respective registries in countries around the world so the websites can be blocked and thus prevented from becoming part of the Necurs infrastructure," Microsoft said.
Microsoft today announced that it has successfully disrupted the botnet network of the Necurs malware, which has infected more than 9 million computers globally, and also hijacked the majority of its infrastructure. "We were then able to accurately predict over six million unique domains that would be created in the next 25 months. Microsoft reported these domains to their respective registries in countries around the world so the websites can be blocked and thus prevented from becoming part of the Necurs infrastructure," Microsoft said.
Like many of us, McCoy had an Android phone that was linked to his Google account, and he used plenty of apps that store location data: Gmail, YouTube, and an exercise-tracking app called RunKeeper that feeds off of Google location data and which helps users to track their workouts. On the day of the burglary - 29 March 2019 - Google knew that McCoy had passed the scene of the crime three times within an hour as he looped through his neighborhood during his workout.