Magecart Hits 80 Major eCommerce Sites in Card-Skimming Bonanza
More than 80 global eCommerce sites have been uncovered that were actively compromised by Magecart groups. Magecart, a loose affiliation of attack groups responsible for the payment-card attacks on Ticketmaster, Forbes, British Airways, Newegg and others, typically insert virtual credit-card skimmers, also known as formjacking, into a web application (usually the shopping cart), and proceed to steal credit card information to sell on the black market.
Check Point Patches Privilege Escalation Flaw in Endpoint Client
Check Point Software patched a vulnerability discovered in its Endpoint Security Initial Client software for Windows allowing potential attackers to escalate privileges and execute code using SYSTEM privileges. The privilege escalation security flaw tracked as CVE-2019-8461 makes it possible for attackers to run malicious payloads using system-level privileges as well as evade anti-malware detection by bypassing application whitelisting
Regional municipal ransomware attacks soar; MS-ISAC can help
More than 70 cities and towns have been hit with ransomware attacks so far this year with all levels of state and local governments the intended victims of nearly two-thirds of all ransomware attacks according to new analysis by the cybersecurity firm Barracuda Networks. These statistics include the recent sweep of attacks that struck 22 Texas towns and cities, which officials say was led by a single threat actor.
Trojanized CamScanner App Had 100 Million Google Play Downloads
Google has removed a legitimate-looking PDF creator app with 100 million downloads after security researchers revealed it contained Trojan malware. Igor Golovin and Anton Kivva at Russian AV vendor Kaspersky decided to take a closer look at the popular CamScanner app after multiple negative reviews over the previous month indicated something had gone wrong.
Android Trojan Infects Tens of Thousands of Devices in 4 Months
A new Trojan dropper dubbed xHelper was observed while slowly but steadily spreading to more and more Android devices since May, with over 32,000 smartphones and tablets having been found infected in the last four months. Trojan droppers are tools used by threat actors to deliver other more dangerous malware strains to already compromised devices, including but not limited to clicker Trojans, banking Trojans, and ransomware.
Bruce Schneier: The Myth of Consumer-Grade Security
The Department of Justice wants access to encrypted consumer devices but promises not to infiltrate business products or affect critical infrastructure. Yet that's not possible, because there is no longer any difference between those categories of devices. Consumer devices are critical infrastructure. They affect national security. And it would be foolish to weaken them, even at the request of law enforcement.
This Bluetooth security flaw affects tons of devices
David Starobinski and Johannes Becker, researchers from Boston University, uncovered that popular Bluetooth devices including iPhones, iPads, Apple Watches, and FitBits—and workplace essentials including MacBooks and Microsoft tablets and laptops—have a flaw that exposes device users to the risk of being tracked by unwanted adversaries.
