January 28, SecurityWeek – (International) Samsung patches critical vulnerabilities in Android devices. Samsung released a maintenance update for its major Android flagship Galaxy models that patched 16 vulnerabilities including a flaw in Skia which allowed attackers to conduct denial-of-service attacks via a crafted media file, and a remote code execution (RCE) flaw in Android Mediaserver, which allowed attackers to cause memory corruption, among other vulnerabilities. Source
January 28, Softpedia – (International) WhatsApp will get security indicators to highlight encrypted chats. WhatsApp mobile messaging application will release two new features in its WhatsApp 3.0 interface including the “Show security indicators” feature that will add a lock icon to a user’s WhatsApp encrypted conversations and the “Share my account info” feature that will send a user’s WhatsApp data to Facebook servers in an effort to improve users’ Facebook experience. Source
January 28, Help Net Security – (International) Cisco plugs hole in firewall devices that could lead to device hijacking. Cisco released firmware updates for its RV220W Wireless Network Security Firewall devices, specifically versions prior to 1.0.7.2, after an anonymous researcher working with Beyond Security discovered a critical vulnerability that allowed attackers to send crafted Hypertext Transfer Protocol (HTTP) request embedded with malicious Structured Query Language (SQL) statements to the management interface of a targeted device, which may allow attackers to bypass authentication protocols on the management interface and gain administrative privileges on the infected device. Source
January 28, SecurityWeek – (International) LG patches severe smartphone hijack vulnerability. LG Electronics released patches fixing a critical vulnerability in the Smart Notice application (SNAP), which comes pre-loaded on all LG smartphones, after researchers from BugSec and Cynet discovered the flaw can allow attackers to extract private user information from the device’s secure digital (SD) card, WhatsApp application data, and private user images, as well as render users vulnerable to phishing attacks, ultimately resulting in the installation of mobile malware on the affected devices. Attackers can exploit the vulnerability through different methods due to functionality issues and validation issues. Source
January 28, SecurityWeek – (International) Oracle to kill Java browser plugin. Oracle reported January 27 that it plans to discontinue the Java browser plugin in its Java Development Kit (JDK) 9 and remove the plugin completely from JDK and Runtime Environment (JRE) in a future Java release due to the large number of vulnerabilities found in the plugin. Security experts advised users to disable the application unless specifically needed and to ensure users are running the latest Java version. Source
January 28, Threatpost – (International) BlackEnergy APT group spreading malware via tainted word docs. Researchers from Kaspersky Lab discovered attackers were delivering the BlackEnergy malware via spear phishing emails with malicious Microsoft Word document attachments, which are embedded with malicious macros to target Industrial Control Systems (ICS) and Supervisory control and data acquisition (SCADA) companies around the world. Source
January 27, SecurityWeek – (International) This is what Microsoft’s vulnerability patching efforts looked like in 2015. Researchers from ESET released a report that analyzed the most affected components in Microsoft Windows during 2015 and addressed the importance of patching vulnerabilities, which revealed that more than 570 vulnerabilities were patched in Microsoft products and that many of the patches affected the Internet Explorer (IE) browser. Source