Articles In Security

By Nancy Rand, Posted in Security

July 13, SecurityWeek – (International) SAP patches critical Clickjacking vulnerabilities. SAP released 10 Security Patch Day Notes and 26 Support Package Notes addressing several vulnerabilities, including a critical Clickjacking flaw in multiple SAP frameworks and technologies, denial of service flaws, missing authorization checks, code injection, and a cross-site scripting (XSS) issue, among other vulnerabilities. Source July 13, Softpedia – (International) New Stampado ransomware advertised... read more.

• July 14, 2016

By Nancy Rand, Posted in Security

  July 11, Softpedia – (International) MIUI vulnerability affects millions of Xiaomi Android devices. Security researchers from IBM’s Security Intelligence team reported that a remote code execution (RCE) vulnerability exists in MIUI analytics component in versions prior to MIUI Global Stable 7.2 after researchers discovered that the self-update mechanism can be hijacked via a Man-in-the-Middle (MitM) attack and used to deliver malicious update packages. The analytics package uses Hypertex... read more.

• July 13, 2016

By Nancy Rand, Posted in Security

July 12, SecurityWeek – (International) Code execution flaw plagues Intel Graphics Driver. Security researchers from Cisco Talos discovered a local code execution vulnerability in Intel HD Graphics Windows Kernel Mode Driver version 10.18.14.4264 that could allow an attacker to run arbitrary code on a victims’ system or cause denial-of-service (DoS) by sending a specially crafted D3DKMTEscape request to the Intel DH Graphics drivers. Microsoft removed the NTVDM subsystem from its Windows 8 to mi... read more.

• July 13, 2016

By Nancy Rand, Posted in Security

July 7, Softpedia – (International) Dangerous GNU wget vulnerability still not patche din all Linux distros. Security researchers from Golunski and SecuriTeam discovered a GNU wget vulnerability that could be exploited to allow an attacker to upload arbitrary files and achieve code execution due to wget’s improper handling of file names when redirecting users from an initial Hypertext Transfer Protocol (HTTP) Uniform Resource Locator (URL) to a File Transfer Protocol (FTP) link. Source July 7,... read more.

• July 12, 2016

By Nancy Rand, Posted in Security

July 7, Softpedia – (International) New “Patchwork” cyber-espionage group uses copy-pasted malware for its attacks. Security researchers from Cymmetria reported that a new cyber-espionage group dubbed, Patchwork Advanced Persistent Threat (APT) was seen infecting at least 2,500 machines since December 2015 and can infect an underlying operating system (OS) with their malware using spear-phishing emails that contain PowerPoint files as attachments, which are embedded with the Sandworm explo... read more.

• July 12, 2016

By Nancy Rand, Posted in Security

July 1, Softpedia – (International) Google finds 16 bugs, 2 zero-days, in Windows kernel font handling. Microsoft released patches for its Windows kernel that fixed 16 flaws after security researchers from Project Zero discovered that Windows executes all font processing operations in the kernel’s ring-0 with the highest level of permissions, allowing attackers to have direct access to the entire operating system (OS). Source July 1, Softpedia – (International) Free decrypter available fo... read more.

• July 12, 2016

By Nancy Rand, Posted in Security

July 4, Softpedia – (International) Flaws in free SSL tool allowed attackers to get SSL certificates for any domain. StartCom released a new version of its StartEncrypt Linux tool after a security researcher from CompuTest discovered the product had several design and implementation flaws that could allow an attacker to extract signatures from any Web site that enables its users to upload files including GitHub and Dropbox. In addition, an attacker could obtain Secure Sockets Layer (SSL) certificates... read more.

• July 12, 2016

By Nancy Rand, Posted in Security

July 5, SecurityWeek – (International) Information-collecting Android keyboard tops 50 million installs. Security researchers from Pentest Limited discovered a third-party keyboard application for Android dubbed “Flash Keyboard” was allegedly seen conducting malicious activity by communication with servers in several countries and sending personal data including the device manufacturer and model number, International Mobile Station Equipment Identity (IEMI), Android version, user email add... read more.

• July 12, 2016

By Nancy Rand, Posted in Security

June 30, Softpedia – (International) Google adds SEO spam notifications to Google analytics dashboard. Google reported that it will be enhancing its security notifications for compromised Web sites by integrating the Safe Browsing application programming interface (API) into the Google Analytics dashboard, which will help detect malware and warn the Webmaster of a search engine optimization (SEO) spam on their Web site. Source June 29, Softpedia – (International) Android ransomware quadrupled i... read more.

• July 01, 2016

By Nancy Rand, Posted in Security

June 29, Softpedia – (International) Symantec products affected by multiple “as bad as it gets” vulnerabilities. A security researcher from Google’s Project Zero initiative discovered several vulnerabilities in Symantec’s security products including buffer overflow flaws, memory corruption flaws, and a high-severity flaw that does not require user interaction, affects default configuration, and allows the software to run on the highest privilege levels possible due to a vulnera... read more.

• June 30, 2016