FluBot Android Malware Expected to Start Targeting U.S.
Initially observed in Spain, FluBot has since expanded operations to reach Germany, Hungary, Italy, Poland, and the UK as well, with tens of thousands of malicious SMS messages that leverage FedEx, DHL, and Correos lures being sent hourly. The malware is believed to have made over 7,000 victims in the UK alone, where the campaign…
Google Broke Australian Law Over Location Data Collection: Court
The US company faces potential fines of “many millions” of dollars over the case, which was brought by the Australian Competition and Consumer Commission (ACCC), the regulators’ chief Rod Sims said. The federal court found that in 2017 and 2018 Google misled some users of phones and tablets featuring its Android operating system by collecting…
Google Patches Critical Code Execution Vulnerability in Android
Tracked as CVE-2021-0430 and affecting Android 10 and 11, the code execution vulnerability is deemed critical severity. The bug was patched as part of the 2021-04-01 security patch level. “The most severe of these issues is a critical security vulnerability in the System component that could enable a remote attacker using a specially crafted file…
Attackers Turn Struggling Software Projects Into Trojan Horses
On Dec. 4, users of a simple Android program — a barcode scanner — started witnessing odd behavior when their smartphones suddenly began opening up their browser to display unwanted advertisements. While the devices exhibited the hallmarks of a malware or adware infection, the compromises puzzled most users since they had not recently downloaded new…
Enterprise Windows Threats Drop as Mac Attacks Rise: Report
Just as the COVID-19 pandemic changed the way we live and work, malware operators changed the way they attack enterprise targets. Last year businesses saw Windows malware detections drop and Mac detections rise as criminals tossed old tactics and focused on targeted attacks. In the “2020 State of Malware” report, Malwarebytes researchers explore how attack…
40% of COVID-19 contact tracing apps lack basic protections
Guardsquare announced the release of a report which reassesses the levels of security protections and privacy risks of COVID-19 contact tracing apps. The report found that of the 95 mobile apps analyzed, 60% use the official API for secure exposure notifications. For the remaining 40% of the contact tracing apps, the majority of which gather…
Elusive hacker-for-hire group Bahamut linked to historical attack campaigns
Attack attribution is one of the most difficult aspects of malware research and it’s not uncommon for different security companies to attribute attack campaigns to different threat actors only to later discover that they were the work of the same group. However, a new paper by researchers at Blackberry stands out by exposing an elusive…
85% of COVID-19 tracking apps leak data
71% of healthcare and medical apps have at least one serious vulnerability that could lead to a breach of medical data, according to Intertrust. The report investigated 100 publicly available global mobile healthcare apps across a range of categories—including telehealth, medical device, health commerce, and COVID-tracking—to uncover the most critical mHealth app threats. Cryptographic issues…
Vulnerabilities in Qualcomm Chips Expose Billions of Devices to Attacks
During a presentation at DEF CON last week, Check Point security researcher Slava Makkaveev revealed how vulnerabilities in the compute digital-signal processor (DSP) – a subsystem that enables the processing of data with low power consumption – could open the door for Android applications to perform malicious attacks. The proprietary subsystem is licensed for programming…
20,000+ new vulnerability reports predicted for 2020, shattering previous records
Over 9,000 new vulnerabilities have been reported in the first six months of 2020, and we are on track to see more than 20,000 new vulnerability reports this year — a new record, Skybox Security reveals. Reshaping the way that people work 50% increase in mobile vulnerabilities highlights dangers of blurring line between corporate and…
