Found 3153 bookmarks
Custom sorting
EvilProxy Phishing-as-a-Service with MFA Bypass Emerged in Dark Web
EvilProxy Phishing-as-a-Service with MFA Bypass Emerged in Dark Web
Following the recent Twilio hack leading to the leakage of 2FA (OTP) codes, cybercriminals continue to upgrade their attack arsenal to orchestrate advanced phishing campaigns targeting users worldwide. Resecurity has recently identified a new Phishing-as-a-Service (PhaaS) called EvilProxy advertised in the Dark Web. On some sources the alternative name is Moloch, which has some connection to a phishing-kit developed by several notable underground actors who targeted the financial institutions and e-commerce sector before.
#Resecurity#EN#2022#EvilProxy#Phishing-as-a-Service#MFA#Bypass#2FA
·resecurity.com·
EvilProxy Phishing-as-a-Service with MFA Bypass Emerged in Dark Web
Malicious Cookie Stuffing Chrome Extensions with 1.4 Million Users
Malicious Cookie Stuffing Chrome Extensions with 1.4 Million Users
A few months ago, we blogged about malicious extensions redirecting users to phishing sites and inserting affiliate IDs into cookies of eCommerce sites. Since that time, we have investigated several other malicious extensions and discovered 5 extensions with a total install base of over 1,400,000 "...the extensions also track the user’s browsing activity."
#mcafee#2022#EN#malicious#extensions#Chrome#Analysis#privacy#browser#cookie#Stuffing
·mcafee.com·
Malicious Cookie Stuffing Chrome Extensions with 1.4 Million Users
Sharkbot is back in Google Play
Sharkbot is back in Google Play
Authored by Alberto Segura (main author) and Mike Stokkel (co-author) Introduction After we discovered in February 2022 the SharkBotDropper in Google Play posing as a fake Android antivirus and cleaner, now we have detected a new version of this dropper active in the Google Play and dropping a new version of Sharkbot.This new dropper doesn't…
#fox-it#EN#2022#sharkbot#SharkBotDropper#GooglePlay#antivirus#cleaner#fake
·blog.fox-it.com·
Sharkbot is back in Google Play
Peut-on encore, en Suisse, recourir à des services cloud offerts par Microsoft ?
Peut-on encore, en Suisse, recourir à des services cloud offerts par Microsoft ?
Dans une prise de position publiée le 13 juin 2022, le Préposé fédéral à la protection des données et à la transparence a estimé que le recours aux services cloud M365 de Microsoft serait susceptible de violer la Loi fédérale sur la protection des données, quand bien même le projet de la Caisse nationale suisse d'assurance en cas d'accidents (SUVA) envisage que les données soient hébergées en Suisse et que le cocontractant du responsable du traitement soit une entité européenne du Groupe Microsoft.
#swissprivacy#FR#2022#CH#Suisse#Préposé-fédéral#Microsoft#cloud#protection#données#Cloud-Act
·swissprivacy.law·
Peut-on encore, en Suisse, recourir à des services cloud offerts par Microsoft ?
Adoption de l’OPDo et confirmation de l’entrée en vigueur de la nLPD
Adoption de l’OPDo et confirmation de l’entrée en vigueur de la nLPD
Comme cela était attendu, le Conseil fédéral a adopté les projets d’Ordonnance sur la protection des données (OPDo) et d’Ordonnance sur les certifications en matière de protection des données (OCPD) Plus rien ne s’oppose donc à l’entrée en vigueur de la Loi sur la protection des données révisée (nLPD) le 1er septembre 2023. Le Conseil fédéral a en effet souhaité laisser encore un peu de temps aux petites et moyennes entreprises pour se mettre en conformité.
#smetille#CH#FR#2022#legal#nLPD#lois#protection#OPDo#données#Suisse#Switzerland#law
·smetille.ch·
Adoption de l’OPDo et confirmation de l’entrée en vigueur de la nLPD
Tech tool offers police ‘mass surveillance on a budget’
Tech tool offers police ‘mass surveillance on a budget’
Local law enforcement agencies from suburban Southern California to rural North Carolina have been using an obscure cellphone tracking tool, at times without search warrants, that gives them the power to follow people’s movements months back in time, according to public records and internal emails obtained by The Associated Press.
#ApNews#EN#2022#AP-Investigations#Technology#Police#California#Arkansas#Weekend-Reads#North-Carolina#privacy#Government-surveillance#Law-enforcement-agencies#Criminal-investigations
·apnews.com·
Tech tool offers police ‘mass surveillance on a budget’
Cette entreprise vend des données aussi sensibles que des visites dans des centres IVG - Numerama
Cette entreprise vend des données aussi sensibles que des visites dans des centres IVG - Numerama
La Federal Trade Commission, l'agence responsables des bonnes pratiques commerciales aux États-Unis, a lancé une procédure judiciaire contre Kocheva, un groupe chargé du traitement de données de milliers d'entreprises, dont Googles Ads, TikTok ou Tinder. Cette société est accusée de revendre des informations très
#numerama#FR#2022#Ftc#US#Kochava#data-broker#privacy
·numerama.com·
Cette entreprise vend des données aussi sensibles que des visites dans des centres IVG - Numerama
Revealing Europe's NSO
Revealing Europe's NSO
An Italian surveillance company is tracking people all over the world on a grand scale on behalf of its clients – including in countries with a recent history of corruption and human rights abuses. Its powerful spyware was recently found in Kazakhstan and Romania. Europe’s parliamentarians voice growing concern about an out-of-control surveillance industry and call for it to be regulated.
#lighthousereports#EN#2022#Investigation#Tykelab#Hermit#spyware
·lighthousereports.nl·
Revealing Europe's NSO
An interview with initial access broker Wazawaka: 'There is no such money anywhere as there is in ransomware
An interview with initial access broker Wazawaka: 'There is no such money anywhere as there is in ransomware
Editor’s Note: Last April, a ransomware group threatened to expose police informants and other sensitive information if the Washington, D.C. Metropolitan Police Department did not pay a demand. The brazen attack was the work of a gang known as Babuk, which in early 2021 gained a reputation for posting stolen databases on its website from victims that refused to pay a ransom. Just days after it tried to extort the Metropolitan Police Department, Babuk announced it was closing its ransomware affiliate program, and would focus on data theft and extortion instead.
#therecord#EN#2022#Wazawaka#Babuk#interview#ransomware#criminal
·therecord.media·
An interview with initial access broker Wazawaka: 'There is no such money anywhere as there is in ransomware
Linux Kernel Exploit (CVE-2022-32250) with mqueue
Linux Kernel Exploit (CVE-2022-32250) with mqueue
Netfilter is a framework in the Linux kernel for implementing various networking-related tasks with user-defined handlers. Netfilter provides various functions for packet filtering, network address translation and port translation, and packet logging. Netfilter represents a set of hooks that allow other kernel modules to register callback functions in the kernel’s networking stack.
#theori#EN#2022#exploit#Linux#mqueue#CVE-2022-32250#Kernel
·blog.theori.io·
Linux Kernel Exploit (CVE-2022-32250) with mqueue
Vulnerability in Linux containers – investigation and mitigation
Vulnerability in Linux containers – investigation and mitigation
Operating system access controls, that constrain which programs can open which files, have existed for almost as long as computers themselves. Access controls are still widely used and are more flexible and efficient when compared to cryptographically protecting files. Despite the long history, ther
#benthamsgaze#EN#2022#constrain#Linux#containers#investigation#Access#controls
·benthamsgaze.org·
Vulnerability in Linux containers – investigation and mitigation
Break me out of sandbox in old pipe - CVE-2022-22715 Windows Dirty Pipe
Break me out of sandbox in old pipe - CVE-2022-22715 Windows Dirty Pipe
In February 2022, Microsoft patched the vulnerability I used in TianfuCup 2021 for escaping Adobe Reader sandbox, assigned CVE-2022-22715. The vulnerability existed in Named Pipe File System nearly 10 years since the AppContainer was born. We called it "Windows Dirty Pipe". In this article, I will share the root cause and exploitation of Windows Dirty Pipe. So let's start our journey.
#whereisk0shl#EN#2022#CVE-2022-22715#Windows#Dirty-Pipe#PoC#ANALYSIS
·whereisk0shl.top·
Break me out of sandbox in old pipe - CVE-2022-22715 Windows Dirty Pipe
THREAT ANALYSIS REPORT: Bumblebee Loader – The High Road to Enterprise Domain Control
THREAT ANALYSIS REPORT: Bumblebee Loader – The High Road to Enterprise Domain Control
Cybereason GSOC observed distribution of the Bumblebee Loader and post-exploitation activities including privilege escalation, reconnaissance and credential theft. Bumblebee operators use the Cobalt Strike framework throughout the attack and abuse credentials for privilege escalation to access Active Directory, as well as abusing a domain administrator account to move laterally, create local user accounts and exfiltrate data...
#cybereason#EN#2022#THREAT#ANALYSIS#REPORT#Bumblebee#Loader#CobaltStrike
·cybereason.com·
THREAT ANALYSIS REPORT: Bumblebee Loader – The High Road to Enterprise Domain Control