Popular video-conferencing Zoom is leaking personal information of at least thousands of users, including their email address and photo, and giving strangers the ability to attempt to start a video call with them through Zoom. The issue lies in Zoom’s “Company Directory” setting, which automatically adds other people to a user’s lists of contacts if Read more about Zoom is Leaking Peoples’ Email Addresses and Photos to Strangers[…]

In this publication we describe a technique which would have allowed a threat actor to potentially identify and join active meetings. All the details discussed in this publication were responsibly disclosed to Zoom Video Communications, Inc. In response, Zoom introduced a number of mitigations, so this attack is no longer possible. The Problem If you Read more about Zoom: how you were able to join random meetings due to incredibly poor security design[…]

The FBI has issued a warning about video messaging service Zoom, and New York Attorney General’s office has made an inquiry into its cybersecurity practices, after a string of disturbing incidents involving takeovers of teleconferences. Per Agence France-Presse, malicious individuals have been taking advantage of lax security and the surge in teleconferencing during the coronavirus Read more about FBI Issues Warning, NY Attorney General Makes Inquiry After Wave of Zoom Hijackings[…]

Zoom, the video conferencing service whose use has spiked amid the Covid-19 pandemic, claims to implement end-to-end encryption, widely understood as the most private form of internet communication, protecting conversations from all outside parties. In fact, Zoom is using its own definition of the term, one that lets Zoom itself access unencrypted video and audio Read more about Zoom Meetings Aren’t End-to-End Encrypted, Despite Misleading Marketing. Also, they mine your data with vampire teeth.[…]

Hackers have slurped biz comms customers’ data from a database run by one of O2’s largest UK partners. In an email sent to its customers, the partner, Aerial Direct, said that an unauthorised third party had been able to access customer data on 26 February through an external backup database, which included personal information on Read more about Your data was ‘taken without permission’, customers told, after personal info accessed in O2 UK partner Aerial Direct database[…]

Earlier this month, the multibillion-dollar cruise conglomerate Carnival Corp. announced that two of its most popular lines—Holland America and Princess Cruises—were respectively slammed with hacks compromising the sensitive personal intel of cruise-goers and cruise-workers alike. Even though neither announcement makes mention of when each respective breach was disclosed, pulling up the source code for the Read more about Carnival Corp. (Holland America / Princess Cruises) Discloses nasty customer Data Breach Amid Covid-19 Panic[…]

Whisper, the secret-sharing app that called itself the “safest place on the Internet,” left years of users’ most intimate confessions exposed on the Web tied to their age, location and other details, raising alarm among cybersecurity researchers that users could have been unmasked or blackmailed. The data exposure, discovered by independent researchers and shown to Read more about 900 Million Secrets From 8 Years of ‘Whisper’ App Were Left Exposed Online[…]

Federal regulators waived a rule Wednesday that was causing airlines to fly nearly empty planes just to avoid losing takeoff and landing rights at major airports. The Federal Aviation Administration said it would suspend the rule through May 31 to help airlines that are canceling flights because of the new virus outbreak. The FAA assigns Read more about US Rule Waiver Will Reduce Empty Planes During Virus Outbreak (after in EU) and then closes US airspace to EU flights after blaming EU for Corona[…]

Named Load Value Injection, or LVI for short, this is a new class of theoretical attacks against Intel CPUs. While the attack has been deemed only a theoretical threat, Intel has released firmware patches to mitigate attacks against current CPUs, and fixes will be deployed at the hardware (silicon design) level in future generations. A Read more about Intel CPUs vulnerable to new LVI attacks, allows information injection[…]

Web researcher David Eade found and reported CVE-2020-8987 to Avast: this is a trio of blunders that, when combined, can be exploited by a snooper to silently intercept and tamper with an AntiTrack user’s connections to even the most heavily secured websites. This is because when using AntiTrack, your web connections are routed through the Read more about Avast’s and AVG AntiTrack promised to protect your privacy. Instead, it opened you to miscreant-in-the-middle snooping[…]

In fact, the marketing database also contained some subscribers’ requests to block or unblock access to X-rated and gambling websites, unique ID numbers of stolen cellphones, and records of whichever site they were visiting before arriving at the Virgin Media website. This is according to British infosec shop Turgensec, which discovered the poorly secured Virgin Read more about FYI: When Virgin Media said it leaked ‘limited contact info’, it meant p0rno filter requests, IP addresses, IMEIs as well as names, addresses and more[…]

Over the past few years, owners of cars with keyless start systems have learned to worry about so-called relay attacks, in which hackers exploit radio-enabled keys to steal vehicles without leaving a trace. Now it turns out that many millions of other cars that use chip-enabled mechanical keys are also vulnerable to high-tech theft. A Read more about Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys[…]

Based on Google data, two in five of Android users worldwide may no longer be receiving updates, and while these devices won’t immediately have problems, without security support there is an increased risk to the user. Our latest tests have shown how such phones and tablets, including handsets still available to buy from online marketplaces Read more about More than one billion Android devices at risk of malware threats, no longer being updated[…]

Virgin Media, one of the UK’s biggest ISPs, on Thursday admitted it accidentally spilled 900,000 of its subscribers’ personal information onto the internet via a poorly secured database. The cableco said it “incorrectly configured” a storage system so that at least one miscreant was able to access it and potentially siphon off customer records. The Read more about Virgin broadband ISP spills 900,000 punters’ records into wrong hands from insecure database[…]

Microsoft reckons 0.5 per cent of Azure Active Directory accounts as used by Office 365 are compromised every month. The Window giant’s director of identity security, Alex Weinert, and IT identity and access program manager Lee Walker revealed the figures at the RSA conference last month in San Francisco. “About a half of a per Read more about Enable MFA: 1.2 million Azure Active Directory (Office 365) accounts compromised every month, reckons Microsoft[…]

An error in chipset read-only memory (ROM) could allow attackers to compromise platform encryption keys and steal sensitive information. Intel has thanked Positive Technologies experts for their discovery of a vulnerability in Intel CSME. Most Intel chipsets released in the last five years contain the vulnerability in question. By exploiting vulnerability CVE-2019-0090, a local attacker Read more about Unfixable vulnerability in Intel CSME allows crypto key stealing and local access to files[…]

The European Commission has told its staff to start using Signal, an end-to-end-encrypted messaging app, in a push to increase the security of its communications. The instruction appeared on internal messaging boards in early February, notifying employees that “Signal has been selected as the recommended application for public instant messaging.” The app is favored by privacy Read more about EU Commission to staff: Switch to Signal messaging app[…]

A billion-plus computers, phones, and other devices are said to suffer a chip-level security vulnerability that can be exploited by nearby miscreants to snoop on victims’ encrypted Wi-Fi traffic. The flaw [PDF] was branded KrØØk by the bods at Euro infosec outfit ESET who discovered it. The design blunder is otherwise known as CVE-2019-15126, and Read more about Wi-Fi of more than a billion PCs, phones, gadgets can be snooped on. But you’re using HTTPS, SSH, VPNs… right?[…]

Automating connections from 3rd party providers makes it easy to access your financial data because people re-use their logins and these logins have been repeatedly leaked online. New data from security and content delivery company Akamai shows that one in every five attempts to gain unauthorized access to user accounts is now done through application Read more about Your banks’ APIs are a major target for credential stuffing attacks[…]

In the early hours of this morning, a very large number of Samsung devices around the world received a push notification from the vendor’s Find my Mobile app. That notification simply read “1/1”. […] A handful of Reg staffers also received the notification, which caused surprise and concern at Vulture Central – not least because Read more about All that Samsung users found on UK website after weird Find my Mobile push notification was… other people’s details[…]

Penetration testers looking at commercial shipping and oil rigs discovered a litany of security blunders and vulnerabilities – including one set that would have let them take full control of a rig at sea. Pen Test Partners (PTP), an infosec consulting outfit that specialises in doing what its name says, reckoned that on the whole, Read more about Shipping is so insecure we could have driven off in an oil rig, says Pen Test Partners[…]

Facebook knew about a huge security flaw that let hackers to steal personal data from millions of its users almost one year before the crime, yet failed to fix it in time, the Telegraph can reveal. Legal documents show that the company was repeatedly warned by its own employees as well as outsiders about a Read more about Facebook was repeatedly warned of security flaw that led to biggest data breach in its history[…]

Thousands of images, videos and records pertaining to plastic surgery patients were left on an unsecured database where they could be viewed by anyone with the right IP address, researchers said Friday. The data included about 900,000 records, which researchers say could belong to thousands of different patients. The data was generated at clinics around Read more about Plastic surgery images and invoices leak from unsecured database[…]