Threats & Vulnerabilities: Page

Another patched Apache Struts vulnerability exploited

News roundup: A new Apache Struts vulnerability was exploited in the wild mere days after it was patched. Plus, Facebook removes app over privacy concerns and more.

By Madelyn Bacon • Aug. 31, 2018

ATM jackpotting: How does the Ploutus.D malware work?

Ploutus.D malware recently started popping up in the U.S. after several ATM jackpotting attacks. Discover how this is possible and what banks can do to prevent this with Nick Lewis.

By Nick Lewis • Aug. 30, 2018

Windows 10 zero-day disclosed on Twitter, no fix in sight

Security researcher SandboxEscaper released proof-of-concept code for a Windows 10 zero-day on Twitter, but Microsoft has no details for a potential patch.

By Michael Heller • Aug. 29, 2018

Fortnite vulnerability on Android causes disclosure tension

Epic Games patched a Fortnite vulnerability in its Android installer, but Google's disclosure policy comes under fire once again as Epic Games' founder called the disclosure 'irresponsible.'

By Michael Heller • Aug. 28, 2018

NSA leaker Reality Winner sentenced to five years in jail

NSA leaker Reality Winner sentenced to 63 months in prison for releasing classified documents detailing an attack by the Russian military against U.S. election systems.

By Michael Heller • Aug. 24, 2018

Hundreds of Facebook accounts deleted for spreading misinformation

News roundup: Social media platforms shut down accounts spreading misinformation. The Facebook accounts deleted were tied to Iran, Russia. Plus, Ryuk ransomware spreads, and more.

By Madelyn Bacon • Aug. 24, 2018

What risks does the OpenFlow protocol vulnerability present?

Researchers found a vulnerability in OpenFlow that can cause problems. Learn how vendor-specific SDN controllers may cause these OpenFlow protocol vulnerabilities.

By Judith Myerson • Aug. 24, 2018

Intel disclosed Spectre-like L1TF vulnerabilities

News roundup: Intel disclosed L1TF vulnerabilities with similarities to Spectre, but with a focus on data. Plus, the NIST Small Business Cybersecurity Act is now a law, and more.

By Madelyn Bacon • Aug. 17, 2018

How is Oracle Micros POS affected by CVE 2018-2636?

A security researcher found a security flaw dubbed CVE-2018-2636 that enables the installation of malware on Oracle Micros POS systems. Learn more about the vulnerability.

By Nick Lewis • Aug. 17, 2018

Skygofree Trojan: What makes this spyware unique?

Android malware was discovered by Kaspersky Labs and named Skygofree. This Trojan targets smartphones and tablets using spyware and gathers user information and app data.

By Nick Lewis • Aug. 15, 2018

Google location tracking continues even when turned off

New research has discovered mobile apps may still store where users have been even after Google location-tracking services have been turned off.

By Michael Heller • Aug. 14, 2018

Okiru malware: How does this Mirai malware variant work?

A Mirai variant has the ability to put billions of devices at risk of becoming part of a botnet. Discover how this works and what devices are at risk with expert Nick Lewis.

By Nick Lewis • Aug. 13, 2018

Web cache poisoning attacks demonstrated on major websites, platforms

PortSwigger's James Kettle doesn't believe web cache poisoning is theoretical and to prove it, he demonstrated several attacks on major websites and platforms at Black Hat 2018.

By Rob Wright • Aug. 10, 2018

WhatsApp vulnerabilities let hackers alter messages

News roundup: New WhatsApp vulnerabilities enabled hackers to alter messages sent in the app. Plus, the PGA was hit with a ransomware attack, and more.

By Madelyn Bacon • Aug. 10, 2018

Irregularities discovered in WinVote voting machines

At Black Hat 2018, security researcher Carsten Schuermann unveiled the results of a forensic analysis of eight WinVote voting machines that had been used in Virginia elections.

By Rob Wright • Aug. 9, 2018

UPnP vulnerability: How is the UPnP protocol being misused?

The UPnP protocol is being misused to distribute malware through home routers. Expert Michael Cobb explains the UPnP vulnerability and how to defend against it.

By Michael Cobb • Aug. 9, 2018

Four new Mac malware strains exposed by Malwarebytes

Mac platforms are at risk after Malwarebytes discovered four new Mac malware strains. Learn how to protect your enterprise and how to mitigate these attacks with expert Nick Lewis.

By Nick Lewis • Aug. 7, 2018

BGP hijacking attacks target payment systems

Researchers discovered a wave of BGP hijacking attacks aimed at DNS servers related to payment-processing systems in an apparent effort to steal money from unsuspecting users.

By Michael Heller • Aug. 6, 2018

Coinhive malware infects tens of thousands of MikroTik routers

The cryptominer Coinhive malware has infected tens of thousands of MikroTik routers around the world, as malicious actors take advantage of poor patching habits by users.

By Michael Heller • Aug. 6, 2018

Microsoft’s NTFS flaw: What are the potential consequences?

A security researcher exposed an NTFS flaw that Microsoft deliberately hasn't patched. Expert Michael Cobb explains how the bug works and why it isn't being treated as severe.

By Michael Cobb • Aug. 6, 2018

Disclose.io launches vulnerability disclosure ‘safe harbor’

News roundup: Disclose.io offers legal bug bounty framework to give researchers safe harbor from legal action for vulnerability disclosures. Plus, Stamos exits Facebook, and more.

By Peter Loshin • Aug. 3, 2018

FIN7 members arrested after stealing 15 million credit card records

The FBI arrested three members of the FIN7 cybercrime gang -- also known as the Carbanak Group -- for targeting more than 100 businesses and stealing 15 million credit card records.

By Michael Heller • Aug. 2, 2018

Malvertising campaign tied to legitimate online ad companies

A new report from Check Point Research uncovers an extensive malvertising campaign known as Master134 and implicates several online advertising companies in the scheme.

By Rob Wright • July 31, 2018

SamSam ransomware payments reach nearly $6 million

New research reveals SamSam ransomware campaign has generated almost $6 million for attacker and appears to be the work of a single hacker who shows no sign of slowing down.

By Peter Loshin • July 31, 2018

NetSpectre is a remote side-channel attack, but a slow one

A new PoC attack using Spectre variant 1 called NetSpectre marks the first time Spectre v1 has been exploited remotely, although questions remain on the practicality of the attack.

By Michael Heller • July 31, 2018