technology-and-cybersecurity6.185 min read
Asos App Hijacked for Public Extortion, Triggering 10% Share Drop
5 days ago•Source: BBC
Technology And Cybersecurity News
The latest technology and cybersecurity stories, each synthesized from multiple sources with added background and context.
Featured Technology And Cybersecurity Stories
View original source
2.895 min•2 years ago
"Protect Your Google Account: Expert Tips to Thwart MultiLogin Vulnerabilities and Malware Attacks"
Google has advised Gmail users to sign out and back in to invalidate session tokens after a password change-resistant hack was discovered. Attackers exploited an undocumented authentication endpoint to maintain access to Google accounts by restoring expired session cookies. Despite the persistence of the exploit, Google asserts that stolen sessions can be invalidated and recommends users enable Enhanced Safe Browsing in Chrome for additional protection. The company has taken steps to secure compromised accounts and suggests that resetting passwords and signing out of all browser profiles can help prevent unauthorized access.
More Top Stories
2
3
"LastPass Mandates 12-Character Minimum for Master Passwords Post-Security Update"
BleepingComputer•2 years ago
More Technology And Cybersecurity Stories
"Enhanced Online Privacy: Discover a Browser That Outperforms Firefox in Protection"
LibreWolf is a web browser that enhances privacy and security beyond what Firefox offers. It removes tracking elements from URLs, deletes cookies and website data on closure, uses privacy-respecting search engines, and includes robust anti-fingerprinting measures. While it may break some websites that rely on tracking and fingerprinting, it's ideal for sensitive activities like banking. LibreWolf is available for Linux, MacOS, and Windows, but manual updates are required for MacOS and Windows. The installation process is straightforward, with additional steps for Linux users. If prioritizing online privacy is essential for you, LibreWolf could be a valuable tool.
"Securing Android Against Advanced Banking Threats That Evade Fingerprint Authentication"
Android users are being warned about the Chameleon banking trojan, a sophisticated malware that can bypass biometric security measures and steal PINs and banking information. The malware disguises itself as legitimate apps and can even circumvent Android 13's restricted setting feature. To protect against this threat, users should only download apps from official stores, keep their Android system updated, install reliable antivirus software, and avoid sideloading apps. If compromised, it's advised to change passwords using another device, use identity theft protection services, contact banks, alert contacts, and consider restoring the device to factory settings.
"Google Patches Up Almost 100 Security Flaws in Android Update"
December saw a flurry of security updates across major tech firms. Apple patched iOS vulnerabilities, including a WebKit browser engine flaw and a Kernel issue, and added protections against a Bluetooth-based attack. Google addressed nearly 100 security issues in Android, including critical Framework and System flaws, and patched an exploited Chrome zero-day vulnerability. Microsoft's Patch Tuesday was lighter, focusing on over 30 vulnerabilities, including a spoofing issue in Power Platform Connector. Mozilla fixed 18 Firefox security issues, and Apache patched a critical Struts 2 framework flaw. Atlassian and SAP also released critical patches for their respective software, addressing RCE vulnerabilities and privilege escalation bugs.
"Operation Triangulation: Unprecedented iPhone Exploit Campaign Unveils Unknown Hardware Vulnerabilities"
Kaspersky has uncovered details about "Triangulation," a highly sophisticated iOS spyware that exploited previously unknown Apple hardware features and zero-day vulnerabilities. The malware, which affected iPhones on iOS 15.7 and earlier, could activate without user interaction and access the device's physical memory, leaking sensitive data like microphone recordings and location. Although the latest Apple firmware patches these vulnerabilities, the origin and knowledge of the exploits used by the spyware remain a mystery, with some speculating on possible internal sources or reverse engineering by hackers. Apple has updated its devices to fix the security flaws, but the implications of the spyware's capabilities continue to raise concerns.
"Microsoft Shuts Down MSIX Protocol to Block Malware Exploits"
Microsoft has taken action to disable the ms-appinstaller protocol handler by default due to its exploitation by hackers to deploy malware, including ransomware. The company observed four threat actors, including Storm-0569 and FIN7, using the handler to bypass security mechanisms and distribute malware through fake ads and phishing via Microsoft Teams. The handler is now disabled in App Installer version 1.21.3421.0 or higher to prevent further abuse. This follows previous incidents where MSIX files were used for malware distribution, highlighting ongoing cybersecurity challenges.
"Apple's Urgent Security Patch Fixes Pegasus Spyware Threat on iOS Devices"
Apple has released an urgent update for all iPhone operating systems after researchers discovered a new security breach exploited by Israeli NSO's Pegasus spyware, prompting concerns about potential backlash from the United States.