Attackers sitting on a network can intercept Swift keyboard updates from Samsung, inject code, and potentially take remote control of millions of Android mobile devices.
In one of the more bizarre alleged hacking stories to emerge recently, federal authorities are investigating whether employees of the St. Louis Cardinals hacked into systems belonging to the Houston Astros and got access to internal team conversations about players, trades, scouting reports, and other sensitive information. The alleged attack against the Astros’ network is the focus[…]
Dell SecureWorks said a new version of the Stegoloader malware uses steganography to hide itself from detection.
Google today launched the Android Security Rewards program, a bug bounty for Android Nexus 6 and Nexus 9 devices.
Amazon has released its first transparency report, and for a company as large as Amazon, there is surprisingly little in the way of detail or explanation in the report. The company reported that it received 813 subpoenas, 25 search warrants, and 0-249 national security requests. Of the 813 subpoenas Amazon received in the first five[…]
Cloud-based password manager LastPass said its network has been breached and attackers stole personal information as well as salts and hashes.
The U.S.-China Economic and Security Review Commission tackled China and cyberespionage today in a D.C. hearing.
The attackers behind the recently disclosed Duqu 2.0 APT have used stolen digital certificates to help sneak their malware past security defenses, and one of the certificates used in the attacks was issued to Foxconn, the Chinese company that manufactures products for Apple, BlackBerry, Dell, and many other companies. Researchers at Kaspersky Lab, who discovered[…]
The Yoast WordPress SEO plugin, which has been downloaded more than 14 million times, has a serious cross-site scripting vulnerability that can allow an attacker to force a vulnerable site to execute arbitrary HTML code. The bug may have been reported to the plugin’s developer as long as two years ago, but it was still[…]
A RFP, which has since been taken down, surfaced last week from the Naval Supply Systems Command seeking operational exploits and vulnerability intelligence for commercial software from leading IT vendors.