My colleagues from the Avast Threat Labs published an interesting (and detailed) blog post about Petya ransomware and its little brother, Mischa. This duo works together to encrypt disks and files, pushing innocent victims to pay thousands of dollars to regain access to their computers and files. Particularly interesting is that the ransomware authors have an established marketing strategy to promote Petya and Mischa. They created a brand for the ransomware, as well as an affiliate program, making it possible for the IT-savvy average Joe to distribute the ransomware.
Monthly Archives: September 2016
Critical DoS Flaw found in OpenSSL — How It Works
The OpenSSL Foundation has patched over a dozen vulnerabilities in its cryptographic code library, including a high severity bug that can be exploited for denial-of-service (DoS) attacks.
OpenSSL is a widely used open-source cryptographic library that provides encrypted Internet connections using Secure Sockets Layer (SSL) or Transport Layer Security (TLS) for the majority of websites, as well
Yahoo Data Breach: Top 5 things you should do immediately
Yahoo’s biggest nightmare was confirmed yesterday – back in late 2014, a copy of certain user account information has been stolen from Yahoo’s network. The story started developing in early August when a hacker named “Peace” was openly trying to sell personal information of more than 500 million Yahoo account users on the dark web.
According to Yahoo, the account information may have included names, email addresses, telephone numbers, dates of birth, hashed passwords and, in some cases, encrypted or unencrypted security questions and answers.
Even though the breach happened two years ago it is not too late to take action, especially if you haven’t changed your password in a while.
Top 5 things you should do immediately
Change your password now!
It is as simple as that. Change not only your Yahoo password on your Yahoo account, but also review all your online accounts on which you’ve used the same or similar information. The sooner you do it, the better!
Turn on the two-step authentication that Yahoo offers.
Two-step verification uses both your password and an extra security code to verify your identity whenever you sign in to your account. If someone else tries to access your account, even if they can guess your password, they still won’t be able to get in without using two-step verification.
Pick better passwords.
We cannot stress more on the fact that using the same passwords for many accounts is not recommended. As you remember Yahoo are not the only one who’ve had similar issues. Back in 2014 eBay asked 145 million of their users to change passwords after a data breach. Changing your passwords often must be a habit!
Update your security questions immediately.
Yahoo says about 1 billion people globally engage with one of its properties each month. The chances your password is in the wrong hands are not minimal and the risk is real. Take action and don’t wait anymore, time is key here.
Go through old emails and remove sensitive content.
If your Yahoo account information is indeed for sale on the dark web, someone can hack into your email at any minute. There is tons of document scans, tax returns, credit card details and invoices that may be laying around your inbox. All these documents contain information you want to keep for yourself.
Remain vigilant! After Yahoo admitted the data breach you may be approached by fraudsters pretending to be someone they are not. It is important for you to not engage with online fee-based, toll-free-number services. Even though the incident happened nearly 2 years ago and you may be off the hook, we advise you to remain cautious and spend some time making sure you are fully protected.
The post Yahoo Data Breach: Top 5 things you should do immediately appeared first on Panda Security Mediacenter.
8 years of Android: malware, malicious apps, and how to stay safe
At eight years old, Android is hugely popular. Both with users and attackers.
The post 8 years of Android: malware, malicious apps, and how to stay safe appeared first on WeLiveSecurity.
Half a billion Yahoo users victim to ‘biggest data breach in history’
Yahoo has confirmed that half a billion users may have had their data stolen in what has been described as the ‘biggest data breach in history.’
The post Half a billion Yahoo users victim to ‘biggest data breach in history’ appeared first on WeLiveSecurity.
Network Penetration Testing 101
Whitepaper called Network Penetration Testing 101. Written in Turkish.
3GP Player 4.7.0 – DLL Hijacking Vulnerability
Posted by Vulnerability Lab on Sep 23
Document Title:
===============
3GP Player 4.7.0 – DLL Hijacking Vulnerability
References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=1955
Release Date:
=============
2016-09-23
Vulnerability Laboratory ID (VL-ID):
====================================
1955
Common Vulnerability Scoring System:
====================================
5.6
Product & Service Introduction:
===============================…
DllHijackAuditor 3.5 – Stack Buffer Overflow Vulnerability
Posted by Vulnerability Lab on Sep 23
Document Title:
===============
DllHijackAuditor 3.5 – Stack Buffer Overflow Vulnerability
References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=1954
Release Date:
=============
2016-09-21
Vulnerability Laboratory ID (VL-ID):
====================================
1954
Common Vulnerability Scoring System:
====================================
6.3
Product & Service Introduction:…
Leaked NSA Hacking Tools Were 'Mistakenly' Left By An Agent On A Remote Server
If you are a hacker, you might have enjoyed the NSA’s private zero-day exploits, malware and hacking tools that were leaked last month.
But the question is: How these hacking tools ended up into the hands of hackers?
It has been found that the NSA itself was not directly hacked, but a former NSA employee carelessly left those hacking tools on a remote server three years ago after an
Kaspersky Internet Security Awarded Level 1 Certification by MRG Effitas
Kaspersky Lab announced today that its Kaspersky Internet Security solution was awarded a ‘Level 1’ certification from MRG Effitas, following its quarterly 360 Degree Assessment & Certification for Q2 2016.