Security

15th May 2018

GDPR causes a flood of new policies

The European Union claims that the General Data Protection Regulation (GDPR), which comes to term on May 25, is the most important change in data privacy regulation in 20 years. Many companies have spent months preparing for the changes, working on policy and compliance, and introducing changes to their products in order to meet new standards. We have received quite a few alerts and emails about those policy changes from a wide variety of companies. Combing through the alerts allowed us to see some interesting methods to solve—or evade—the problems that come with making businesses compliant. Let’s take a look at how different companies are coping with GDPR changes, and what you’ll need to pay attention to in those emails. Total evasion For some companies whose business interests are too slim in Europe, giving up seemed like the best option. File this alert from Unroll.Me, an app to unsubscribe from unwanted mailing lists, under “why bother.” because our service was not designed to c..

14th May 2018

A week in security (May 7 – May 13)

Last week on Labs, we looked at the case of a fake Android AV, an annoying adware that goes by the name of Kuik, the return of threat actors behind the Shopper Stop tech scam, a new Netflix phishing scam, the recent zero-day vulnerability in Internet Explorer, and the insufficiency of merely relying on the presence of the green padlock. Also, in a brief blog post, we talked about why we removed the blacklist of tech support scammers we have been dutifully maintaining for years. Other news Security researchers found a worm lurking in Facebook’s Messenger, and it steals account credentials from cryptocurrency platforms. (Source: InfoSec Institute) DDoS attacks are on the cusp of evolution. It would be foolish to expect it to die any time soon. (Source: Dark Reading) Oh no, they didn’t. OH. NO. THEY. DIDN’T! (Source: Graham Cluley’s blog) Speaking of Microsoft, hackers have found a way to bypass Safe Links, a feature in MS Office 365 that keeps malware and phishing attacks at bay. (Sourc..

11th May 2018

The fight for net neutrality and the might of cryptojacking malware | Avast

Cryptojacking like an animal: the Drupal vulnerability The San Diego Zoo is just one of almost 400 websites that has been compromised by a bug called Drupalgeddon 2.0. This vulnerability in the Drupal content management system was discovered and patched in March 2018. But the almost-400 infected sites, mostly government and university organizations, had not yet updated with the patch and unfortunately found themselves targeted by a cryptojacking scheme. The ploy saps CPU power from site visitors without their knowledge, using it to mine Monero.

11th May 2018

I still WannaCry one year later | Avast

On May 12, 2017, WannaCry, the biggest ransomware attack in history, spread like wildfire around the world, indiscriminately affecting PCs belonging to consumers, businesses, hospitals, and government departments. Now, nearly one year later, the same malware continues to be prevalent, reportedly hitting aircraft manufacturer Boeing recently. Since the initial attack last year, Avast has detected and blocked more than 176 million WannaCry attacks across 217 countries. In March 2018 alone, we blocked 54 million WannaCry attacks.

7th May 2018

Week in security (April 30 – May 6)

Last week on Labs, we examined the Spartacus ransomware, reported about a new tactic used by the Necurs malspam campaign, informed you about the recommended Twitter password change, and discussed engaging students to start considering careers in cybersecurity. Other news NTML credentials can be stolen via malicious Portable Document Format (PDF) files without any user interaction. (Source: SecurityWeek) Twitter sold data access to a Cambridge Analytica-linked researcher. (Source: Bloomberg) FacexWorm targets cryptocurrency users by spreading through Facebook Messenger. (Source: Security Affairs) New DNS encryption tools accelerate privacy online. (Source: HelpNetSecurity) IoT security: Is cryptocurrency-mining malware your next big headache? (Source: ZDNet) Companies from across the tech spectrum are lining up to protest the measure that would allow them to “hack back” with offensive initiatives in the face of a cyberattack. (Source: ThreatPost) Drive-by Rowhammer attack uses GPU to c..