> TODAY'S SUMMARY (68 articles)
Today's cybersecurity landscape highlights several critical threats and developments. The new Hirudo Android malware is particularly concerning, as it replaces legitimate banking apps to steal credentials while evading security measures. Additionally, Microsoft's October Patch Tuesday saw a record 1,413 vulnerabilities addressed, including a zero-day actively exploited in the wild. Researchers also demonstrated the potential dangers of AI, with one team creating a full-chain Chrome exploit in just six days using public AI models. Meanwhile, fake "Meta Careers" pages are being used to phish Facebook and Google logins, emphasizing the ongoing risk of credential theft. Lastly, a crackdown on North Korean IT farms highlights the geopolitical dimensions of cyber threats.
|
// AI-powered summary generated at 12:01
Hackers Use Large Numbers of Transient Domains to Hide Attacks. Research shows 71% of hostnames appear for one day or less
Lookout claims 12-5pm is the most dangerous time for smartphone theft
In light of the recent compromises, you’re probably wondering what could have been done to prevent such attacks. According to some unverified articles it would appear that flaws in Apple’s services allowed an attacker to brute force passwords without any rate limiting or account lockout. While its...
The billion-plus credential theft by CyberVor hackers is now leading to compromises at Namecheap.
Poor password choices and a lack of two-factor authentication created the hacking opportunity.
In this post, we discuss the creation of a novel software obfuscation toolkit, MAST, implemented in the LLVM compiler and suitable for denying program understanding to even the most well-resourced adversary. Our implementation is inspired by effective obfuscation techniques used by nation-state malw...
Rogue state might seem short on tech know-how but it’s building offensive capabilities, says report
Initiative to foster greater information sharing across borders in bid to target high-end threats
We are proud to announce that McSema is now open source! McSema is a framework for analyzing and transforming machine-code programs to LLVM bitcode. It supports translation of x86 machine code, including integer, floating point, and SSE instructions. We previously covered some features of McSema in...
Al-Assad supporters could be linked to Syrian Electronic Army
Researchers warn inquisitive netizens not to click on links in unsolicited emails
A 2-day conference exploring state-of-the-art advances in security automation. We would like to share the call for papers for THREADS 2014, a research and development conference that is part of NYU-Poly’s Cyber Security Awareness Week (CSAW). Trail of Bits is a founding sponsor of THREADS. The final...
Hunger Games star Jennifer Lawrence one of many affected
A survey reveals that child molestors are sitting in one-fifth of corporate offices.
We’re proud to be a sponsor of the first Build it Break it programming contest, run by the University of Maryland (UMD) and supported by one of our own employees and PhD student at the university, Andrew Ruef. Build it Break it is a “flipped CTF” where contestants both implement secure software and...
Enterprises and web pages can add mobile codes to a 'post-password' identty management approach.
Former US Government Cyber Security Boss Convicted of Tor Pedophile Offences. FBI’s controversial Operation Torpedo claims another scalp
At Trail of Bits we are proud of our roots in academia and research, and we believe it is important to promote cyber security education for students of every academic level. We recently sponsored a High School Capture the Flag (CTF) event, we released a CTF Field Guide, and we are a regular part of...
ICO slams prisons service for failing to activate encryption on hard drive
UPS and Supervalu are two victims that have come forward.