Hacks

Cybercriminals continue to use the Coronavirus outbreak to launch various attacks such as malware, phishing, fraud, and disinformation campaigns. In the current situation, most of the organization has been closed and the employees are provided with options to work from home. So the RDP and the video communication platforms usage will be high. Attacks Targeting Zoom Recently  multiple vulnerabilities  detected with Zoom client that allows attackers to steal the Windows password and to escalate privileges with macOS. Researchers from IntSights  discovered  a shared database containing more than 2300 usernames and passwords to Zoom accounts. The database includes details of Zoom accounts such as email and password, others included meeting IDs, names and host keys. Along with Zoom credentials the database also includes data of “personal accounts, many corporate accounts were belonging to banks, consultancy companies, educational facilities, healthcare p...

Tech giants  Apple  and  Google  have joined forces to develop an interoperable contract-tracing tool that will help individuals determine if they have come in contact with someone infected with COVID-19. As part of this new initiative, the companies are expected to release an API that public agencies can integrate into their apps. The next iteration will be a built-in system-level platform that uses Bluetooth low energy (BLE) beacons to allow for contact tracing on an opt-in basis. The APIs are expected to be available mid-May for Android and iOS, with the broader contact tracing system set to roll out "in the coming months." "Privacy, transparency, and consent are of utmost importance in this effort, and we look forward to building this functionality in consultation with interested stakeholders," the companies said. The rare collaboration comes as governments worldwide are increasingly turning to technology such as phone tracking and facial recognition to battle...

NSO Group CEO Shalev Hulio Claim that Facebook tried to buy a Pegasus Spyware to monitor better their users especially access to the Apple user’s data and their activities. Pegasus is a powerful commercial spyware developed by Israel based spyware maker NSO group, also known as Q cyber technologies. The company claimed that they sell its spyware only government and law enforcement agencies for tracking criminals and terrorists, but it alleged that their technology also used to target the individual users around the world Oct 2019, Facebook  filed a lawsuit  against the NSO group in the U.S district count in northern direct of California for hacking its WhatsApp messenger by exploiting the zero-day vulnerability using Pegasus to steal the WhatsApp users data. Now, the Defendant of this case, NSO group or Q cyber technologies CEO and the major shareholder of the company  Shalev Hulio  declared that two Facebook representatives approached to NSO group t...

Cybersecurity researchers have discovered a new emerging IoT botnet threat that leverages compromised smart devices to stage ' distributed denial-of-service ' attacks, potentially triggered on-demand through platforms offering DDoS-for-hire services. The botnet, named "dark_nexus" by Bitdefender researchers, works by employing credential stuffing attacks against a variety of devices, such as routers (from Dasan Zhone, Dlink, and ASUS), video recorders, and thermal cameras, to co-opt them into the botnet. So far, dark_nexus comprises at least 1,372 bots, acting as a reverse proxy, spanning across various locations in China, South Korea, Thailand, Brazil, and Russia. "While it might share some features with previously known IoT botnets, the way some of its modules have been developed makes it significantly more potent and robust," the  researchers said . "For example, payloads are compiled for 12 different CPU architectures and dynamically delivered ...

By just making the users visiting a link, an attacker can hack the users’ iOS/macOS Camera using zero-day bugs in Safari. With iOS and macOS camera security model every app needs to assigned permission manually but Apple’s own app such as  Safari  gets access by default. Security researcher Ryan Pickren  discovered  seven new vulnerabilities with Safari browser that allows attackers to access your device’s camera, microphone, or location, and in some cases, saved passwords as well. Pickren said that Safari not using the method of the origin to keep track of the open website, “I deduced that Safari was likely running a Generic URI Syntax parser against all open windows to get the URIs’ hostnames, then doing some extra parsing on those.” Exploiting Bugs to Access Camera He started exploiting using javascript: data: and about, but that fails, but while parsing file: which specified for remote or FTP purpose( file://host.example.com/Share/path/to/file.txt ...