Security daily (01-10-2021)

Google pushes emergency update for Chrome zero-days, the latest in a hectic year for vulnerabilities

Google Chrome has issued emergency updates for two zero-day flaws that attackers are exploiting, the second pair for the browser in a month. It’s been a record year for such flaws, which previously unknown to the vendor. Chrome itself has caught 12 zero-days to date in 2021 compared to eight in all of 2020, according to Google’s Project Zero “0day in the Wild” database, which tracks zero-days. By many measurements, Chrome is the world’s most popular browser, with one report putting its user count at nearly 3.3 billion. That makes it a lucrative target for hackers. There doesn’t appear to be just one answer for the rise in zero-days in 2021, even as more people seem to invest in hacking techniques. Defenders are also improving their own detection skills. “Google is aware the exploits” for the two flaws “exist in the wild,” the company wrote on Thursday. Google otherwise didn’t […] The post Google pushes emergency update for Chrome zero-days, the latest in a hectic year for vulnerabilities appeared first on CyberScoop. (CyberScoop)

Neiman Marcus alerts 4.6 million customers about May 2020 data breach

Retailer Neiman Marcus is notifying some 4.6 million customers that their information was compromised in a May 2020 data breach, the company said. The Dallas-based chain announced Thursday that hackers accessed user names and passwords, as well as security questions and answers associated with consumer accounts. The luxury fashion chain, one of the largest in the U.S., forced password changes for customers who did not reset their credentials following the incident, and is working with the security firm Mandiant to investigate the matter. Unidentified intruders accessed roughly 3.1 million payment cards and virtual gift cards, the company said, adding that 85% of those numbers are invalid or have expired. There is no evidence that accounts at Neiman Marcus-owned Bergdorf Goodman or Horchow were affected in the matter, the company said in a statement. Word of the breach arrives as Neiman Marcus, like other brick-and-mortar retailers, tries to recover from a […] The post Neiman Marcus alerts 4.6 million customers about May 2020 data breach appeared first on CyberScoop. (CyberScoop)

Gift card fraud: four suspects hit with money laundering charges

Gift card fraud may sound like small beer against ransomware - but it's personal, it hurts, and it's still a multi-million dollar problem. (Naked Security)

Neiman Marcus Data Breach Impacts 4.6 Million Customers

(News ≈ Packet Storm)

FCC Aggressively Moves To Block Spam Calls

(News ≈ Packet Storm)

IKEA Put Cameras In Employee Warehouse Bathrooms

(News ≈ Packet Storm)

Apple Pay With Visa Hacked To Make Payments With Locked iPhones

(News ≈ Packet Storm)

Apple Pay Can be Abused to Make Contactless Payments From Locked iPhones

Cybersecurity researchers have disclosed an unpatched flaw in Apple Pay that attackers could abuse to make an unauthorized Visa payment with a locked iPhone by taking advantage of the Express Travel mode set up in the device's wallet. "An attacker only needs a stolen, powered on iPhone. The transactions could also be relayed from an iPhone inside someone's bag, without their knowledge," a group (The Hacker News)

Chinese Hackers Used a New Rootkit to Spy on Targeted Windows 10 Users

A formerly unknown Chinese-speaking threat actor has been linked to a long-standing evasive operation aimed at South East Asian targets as far back as July 2020 to deploy a kernel-mode rootkit on compromised Windows systems. Attacks mounted by the hacking group, dubbed GhostEmperor by Kaspersky, are also said to have used a "sophisticated multi-stage malware framework" that allows for providing (The Hacker News)

Beware of Fake Amnesty International Antivirus for Pegasus that Hacks PCs with Malware

In yet another indicator of how hacking groups are quick to capitalize on world events and improvise their attack campaigns for maximum impact, threat actors have been discovered impersonating Amnesty International to distribute malware that purports to be security software designed to safeguard against NSO Group's Pegasus surveillanceware.  "Adversaries have set up a phony website that looks (The Hacker News)

Here's a New Free Tool to Discover Unprotected Cloud Storage Instances

The IDC cloud security survey 2021 states that as many as 98% of companies were victims of a cloud data breach within the past 18 months. Fostered by the pandemic, small and large organizations from all over the world are migrating their data and infrastructure into a public cloud, while often underestimating novel and cloud-specific security or privacy issues.  Nearly every morning, the (The Hacker News)

MFA Glitch Leads to 6K+ Coinbase Customers Getting Robbed

Coinbase suspects phishing led to attackers getting personal details needed to access wallets but also blamed a flaw in its SMS-based 2FA. (Threatpost)

3.1M Neiman Marcus Customer Card Details Breached

Experts say the detection delay of 17 months is a colossal security blunder by the retailer.  (Threatpost)

Flubot Malware Targets Androids With Fake Security Updates

The banking trojan keeps switching up its lies, trying to fool Android users into clicking on a fake Flubot-deleting app or supposedly uploaded photos of recipients. (Threatpost)

New APT ChamelGang Targets Russian Energy, Aviation Orgs

First appearing in March, the group has been leveraging ProxyShell against targets in 10 countries and employs a variety of malware to steal data from compromised networks. (Threatpost)


/security-daily/ 02-10-2021 23:44:22