Nastiest Malware 2023
News, Announcements, Tech Discussions
Hi all,I have a 64-bit laptop, and quite recently I renewed my licence (after using another AV for sometime), and after downloading the application from the My Account website and upon instalation, I noticed under taskbar settings, is is displayed as 32-bit. In some forums, I have read people advising not to run 32-bit AV applications on 64 machines. I am no techincal guy, so would like to hear from anyone who is knowledgable about this subject area:Is Webroot only availbe in 32-bit version? Is it advisable to run as 32-bit AV on a 64-bit machine? (does it limit the app`s protection capabilities?)
May 20, 2023 By Bill Toulas A new malware distribution campaign is underway impersonating the CapCut video editing tool to push various malware strains to unsuspecting victims.CapCut is ByteDance's official video editor and maker for TikTok, supporting music mixing, color filters, animation, slow-mo effects, picture-in-picture, stabilization, and more.It has over 500 million downloads on Google Play alone, and its website receives over 30 million hits monthly.The application's popularity, combined with nationwide bans in Taiwan, India, and other places, has pushed users to seek alternative ways of downloading the program.However, threat actors exploit this by creating websites that distribute malware disguised as CapCut installers. >> Full Article <<
A technique to abuse Microsoft's built-in source code editor has finally made it into the wild, thanks to China's Mustang Panda APT. September 13, 2024 By Nate Nelson A Chinese state-aligned espionage group has become the first documented threat actor to weaponize a known exploit in VS Code in a malicious attack.Visual Studio Code, or VS Code, is Microsoft's free source code editor for Windows, Linux, and macOS. According to Stack Overflow's 2023 survey of 86,544 developers, it's the most popular integrated development environment (IDE) among both new (78%) and professional developers (74%), by some distance. The next most popular IDE, Visual Studio, was used by 28% of respondents.In September 2023, a threat researcher described how an attacker could take advantage of a VS Code feature called "Tunnel" to gain initial access to a target's environment. Initially, the tactic was just fodder for red teaming. Now, according to Palo Alto Networks' Unit 42, China's Mustang Panda (aka Stately
With tons of advanced features, Apple Maps competes quite handily with the likes of Google Maps and Waze. I put together a big list of the best eight features hidden in Apple Maps.You can learn them all in this post — and see them in action in our video below. ⇨⇨ Full Article ⇦⇦
Apple said there’s “too significant a risk” of exposing the anti-exploit work needed to fend off the very adversaries involved in the case. September 13, 2024 By Ryan Naraine Apple has abruptly withdrawn its lawsuit against NSO Group, citing increased risk that the legal battle might unintentionally reveal sensitive vulnerability data and difficulties in acquiring essential information from the spyware vendor.In a court filing Friday, Apple said continuing the lawsuit now poses “too significant a risk” of exposing the anti-exploitation and threat intelligence efforts needed to fend off the very adversaries involved in the legal dispute.“When it filed this lawsuit nearly three years ago, Apple recognized that it would involve sharing information with third parties. However, developments since then have reshaped the risk landscape associated with sharing such information,” the Cupertino device maker said. >>Full Article<<
Apple has released a patch for Vision Pro after researchers showed how an attacker can obtain passwords typed by looking at keys. September 13, 2024 By Eduard Kovacs Apple has released a patch for its Vision Pro mixed reality headset after researchers showed how an attacker could obtain data typed by a user by tracking their eyes. One of the ways Vision Pro users can type is by using a virtual keyboard and looking at each of the keys they want to press. Researchers from the University of Florida and Texas Tech University have demonstrated an attack method, dubbed GAZEploit, that can be used to infer what a Vision Pro user is typing by tracking the eye movement of their avatar. >>Full Article<<
September 13, 2024 By Bill Toulas Kawasaki Motors Europe has announced that it's recovering from a cyberattack that caused service disruptions as the RansomHub ransomware gang threatens to leak stolen data.The company says the attack targeted its EU headquarters, and it is currently analyzing and cleaning any "suspicious material," such as malware, that may still be lurking on systems."At the start of September, Kawasaki Motors Europe (KME) was the subject of a cyber-attack which, although not successful, resulted in the company's servers being temporarily isolated until a strategic recovery plan was initiated later on the same day," reads the announcement."KME and its country Branches operate a large number of servers and, as a precaution, it was decided to isolate each one and put a cleansing process in place whereby all data was checked and any suspicious material identified and dealt with." >>Full Article<<
Microsoft is revamping how anti-malware tools interact with the Windows kernel to avoid another CrowdStrike faulty update catastrophe. September 13, 2024 By Ryan Naraine Microsoft plans to redesign the way anti-malware products interact with the Windows kernel in direct response to the global IT outage in July that was caused by a faulty CrowdStrike update. Technical details on the changes are not yet available, but the world’s largest software said “new platform capabilities” will be fitted into Windows 11 to allow security vendors to operate “outside of kernel mode” in the interest of software reliability. Following a one-day summit in Redmond with EDR vendors, Microsoft vice president David Weston described the OS tweaks as part of long-term steps to serve resilience and security goals. >>Full Article<<
CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.CVE-2024-8190 Ivanti Cloud Services Appliance OS Command Injection VulnerabilityThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizi
Just my thoughtI do not like this idea very much, The car spying on us, that is too much!!!!--------------------------------------------------------------------------------------------------------------------------- September 13, 2024 By Pieter Arntz Car manufacturer Ford Motor Company has filed a patent application for an in-vehicle advertisement presentation system based on information derived from several trip and driver characteristics. Among those characteristics—human conversations.In the abstract of the patent application publication Ford writes:“An example method includes determining vehicle information for a trip, the vehicle information including any one or more of a current vehicle location, a vehicle speed, a drive mode, and/or traffic information, the user information including any one or more of a route prediction, a speed prediction for the trip, and/or a destination, determining user preferences for advertisements from any one or more of audio signals within the vehicle
September 13, 2024 By Pierluigi Paganini Researchers uncovered an Android malware, dubbed Vo1d, that has already infected nearly 1.3 million Android devices in 197 countries.Doctor Web researchers uncovered a malware, tracked as Vo1d, that infected nearly 1.3 million Android-based TV boxes belonging to users in 197 countries. The malicious code acts as a backdoor and allows attackers to download and install third-party software secretly.In August 2024, several users reported that Dr.Web antivirus detected changes in their TV box system files. The problems were observed in several models, including the R4 (Android 7.1.2), TV BOX (Android 12.1), and KJ-SMART4KVIP (Android 10.1). The indicators of compromise are similar in all cases, with modifications to system files like install-recovery.sh and daemonsu. Additionally, four new files appeared: vo1d, wd, debuggerd, and debuggerd_real. The vo1d and wd files were identified as components of Vo1d Android trojan. >>Full Article<<
September 13, 2024 By Sergiu Gatlan Ivanti confirmed on Friday that a high-severity vulnerability in its Cloud Services Appliance (CSA) solution is now actively exploited in attacks."At the time of disclosure on September 10, we were not aware of any customers being exploited by this vulnerability. At the time of the September 13 update, exploitation of a limited number of customers has been confirmed following public disclosure," Ivanti said in an update added to its August advisory."Dual-homed CSA configurations with ETH-0 as an internal network, as recommended by Ivanti, are at a significantly reduced risk of exploitation."Ivanti advises admins to review the configuration settings and access privileges for any new or modified administrative users to detect exploitation attempts. Although not always consistent, some may be logged in the broker logs on the local system. It's also advised to review any alerts from EDR or other security software.The security flaw (CVE-2024-8190) allows
September 13, 2024 By Brian Krebs A cyberattack that shut down two of the top casinos in Las Vegas last year quickly became one of the most riveting security stories of 2023. It was the first known case of native English-speaking hackers in the United States and Britain teaming up with ransomware gangs based in Russia. But that made-for-Hollywood narrative has eclipsed a far more hideous trend: Many of these young, Western cybercriminals are also members of fast-growing online groups that exist solely to bully, stalk, harass and extort vulnerable teens into physically harming themselves and others.Image: Shutterstock.In September 2023, a Russian ransomware group known as ALPHV/Black Cat claimed credit for an intrusion at the MGM Resorts hotel chain that quickly brought MGM’s casinos in Las Vegas to a standstill. While MGM was still trying to evict the intruders from its systems, an individual who claimed to have firsthand knowledge of the hack contacted multiple media outlets to offer
September 12, 2024Microsoft has released the latest Microsoft Edge Stable Channel (Version 128.0.2739.79) which incorporates the latest updates of the Chromium project. https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security See more here about Edge security: Make sure to re-add back in the Privacy Protection area after every update. Click on GIF to see full size!
