Smith & Wesson Web Site Hacked to Steal Customer Payment Info
American gun manufacturer Smith & Wesson's online store has been compromised by attackers who have injected a malicious script that attempts to steal customer's payment information. This type of attack is called Magecart and is when hackers compromise a web site so that they can inject malicious JavaScript scripts into ecommerce or checkout pages.
Mixcloud user accounts up for sale on dark web
A hacker is ransoming account data stolen from UK-based music streaming service Mixcloud, according to news websites contacted by the attacker last week. News of the breach first emerged on Vice, which received 1,000 sample accounts from a claimed total of 21 million that a hacker called ‘A_W_S’ seems to have nabbed on or around 13 November.
Official: Russian-Owned Company Attempted Ohio Election Hack
Ohio detected and thwarted an election-related cyber attack earlier this month, the state’s elections chief said. Republican Secretary of State Frank LaRose said the “relatively unsophisticated” hacking attempt on Nov. 5, which was Election Day, originated in Panama but was traced to a Russian-owned company. LaRose told The Columbus Dispatch Tuesday that the would-be attackers were looking around for vulnerabilities in his office’s website.
Vulnerability in fully patched Android phones under active attack by bank thieves
A vulnerability in millions of fully patched Android phones is being actively exploited by malware that's designed to drain the bank accounts of infected users, researchers said on Monday. The vulnerability allows malicious apps to masquerade as legitimate apps that targets have already installed and come to trust, researchers from security firm Promon reported in a post.
Trend Micro finds new mobile malware masquerading as a chat app
A new kind of mobile malware that can steal victim’s personal information, including files and victims’ location data is hidden under the guise of a chat app, according to new research from Trend Micro. Since May, the new mobile malware, which Trend Micro dubs CallerSpy, has appeared on multiple occasions on a phishing site http://gooogle[.]press imitating apps such as Chatrious and Apex App.
FBI assesses Russian apps may be counterintelligence threat
All mobile apps developed by Russian entities may be counterintelligence threats to the United States, the FBI has assessed in a letter sent to the Senate’s minority leader. The bureau’s concerns about Russian counterintelligence operations come in response to an inquiry Sen. Chuck Schumer, D-NY, sent to the FBI this summer about whether Americans’ data on FaceApp was being provided to the Kremlin.
Smart TVs: The Cyberthreat Lurking in Your Living Room, Feds Warn
Black Friday and Cyber Monday sales of smart TVs are likely prodigious this Thanksgiving weekend – but consumers need to be aware of the hole they can punch in home cyber-defenses. That’s the word from the FBI, which warned that smart TVs, which hook up to the internet to allow users to access apps and stream Netflix and other video services, can be gateways for hackers.
Microsoft OAuth Flaw Opens Azure Accounts to Takeover
A vulnerability in the way Microsoft applications use OAuth for third-party authentication could allow an attacker to take over Azure cloud accounts. OAuth is a protocol that allows app users to share data about their accounts with third-party websites or apps, so that when they sign into the apps they don’t need to re-enter their passwords every time.
