Sooner or later you are going to have to address the Flash problem on your computers.
And there doesn’t seem a better time with a zero-day vulnerability being actively exploited by an organised hacking gang.
The post Adobe Flash is putting your computer at risk – and there’s no patch yet appeared first on We Live Security.
Vulnerable hospital equipment details can be found online, two security researchers have found.
The post Vulnerable medical equipment details disclosed online appeared first on We Live Security.
It’s time to update Flash once again, and don’t forget to reduce the attack surface by enabling “Click to Play”… or uninstall it altogether.
The post Update Flash now! Adobe releases patch, fixing critical security holes appeared first on We Live Security.
Do you own an Apple device? A recent vulnerability discovered within AirDrop could pose as a risk to your files. (Photo via aayush.me)
Recently, an alarming vulnerability has cropped up on iOS devices. This security loophole allows an attacker to overwrite arbitrary files on a targeted device and, when used in combination with other procedures, install a signed app that devices will trust without presenting a warning notification to users.
In a recent article published on Threatpost, it’s noted that the vulnerability is located in a library that lies within both iOS and OS X. In this case, the library in question is AirDrop, the tool featured on Apple devices that allows users to directly send files to fellow Apple device quickly and effortlessly. The problem lies within the fact that Airdrop doesn’t use a sandboxing mechanism in the same way that many other iOS applications do. When making use of a sandbox, every application has its own container for files that it can’t get beyond the so-called “walls“ of.
AirDrop gives users to the choice to accept file transfers either from only their own contacts or anyone who sends them a request to send files. In the case that a user can receive files from anyone, it’s quite easy for an attacker to exploit their device on their locked iOS device. What’s more, the attacker can even make the attack without the user agreeing to accept a file transferred using AirDrop.
Directory traversal attacks make the exploitation of this vulnerability possible
Mark Dowd, the security researcher who discovered the vulnerability, has been able to repeatedly and reliably exploit the security flaw. The vulnerability allows the attacker to execute a directory traversal attack, in which the attacker attempts to access files that are not intended to be accessed. Thus, the attackers are capable of writing files to any location they choose on the file system.
Since sandboxing rules weren’t being strictly enforced on AirDrop, Dowd was able to read/write hidden system resources in combination with his own directory traversal attack. In doing so, he was able to upload his own application into the system and make it appear as trusted.
This bug has been reported to Apple, but a full patch has not yet been released for the recently-launched iOS 9. Therefore, if you’re the owner of one or more Apple devices, make sure that your AirDrop sharing options are set to private and that you’re only able to receive files from your contact list.
Follow Avast on Facebook, Twitter, YouTube, and Google+ where we keep you updated on cybersecurity news every day.
There was a cross-site scripting vulnerability in an eBay domain that could have allowed an attacker to steal users’ session cookies and take over their accounts. The company has removed the vulnerable page, according to the researcher who discovered the bug and disclosed it to eBay, Aditya Sood. The vulnerability existed on an eBay subdomain, […]
Bugzilla is the Mozilla bug database. Its purpose is to allow users to search for reported bugs and report new ones, according to its page. But what if it was compromised itself?
The post Mozillas Bugzilla: Hacker Gained Access To Privileged Account appeared first on Avira Blog.
An expert says that a popular Belkin router contains numerous vulnerabilities, making it extremely susceptible to attacks.
The post Multiple vulnerabilities identified in Belkin router appeared first on We Live Security.
Apple has resolved a serious security vulnerability known as Ins0mnia in its latest update.
The post iOS vulnerability Ins0mnia fixed by Apple appeared first on We Live Security.
Dolphin and Mercury Android browsers have major vulnerabilities, allowing for remote code execution and arbitrary reading and writing of files.
The post Dolphin and Mercury Android browsers have major vulnerabilities appeared first on We Live Security.
Mumsnet, the phenomenally popular British parenting website, has suffered an attack from hackers which has seen users’ accounts breached, and passwords stolen. And the damage doesn’t end there…
The post MumsNet hit by hack, DDoS attack and SWAT appeared first on We Live Security.
