Security Affairs

NOVEMBER 28, 2021

North Korea-linked APT group posed as Samsung recruiters is a spear-phishing campaign that targeted South Korean security companies that sell anti-malware solutions, Google TAG researchers reported. According to the Google Threat Horizons report, the state-sponsored hackers sent fake job offers to employees at the security companies.

Malware 125

Malware Phishing Antivirus Hacking 125

SecureWorld News

JANUARY 26, 2021

Google's Threat Analysis Group (TAG) has been working for several months to try to identify who is behind an ongoing campaign targeting security researchers, specifically those who work on vulnerability research and development at a variety of organizations. Google's TAG team discovery: cyberattack motive.

Social Engineering 92

Social Engineering Engineering Accountability Malware 92

Troy Hunt

OCTOBER 28, 2020

Everything becomes clear(er) if I manually change the font in the browser dev tools to a serif version: The victim I was referring to in the opening of this blog post? Obviously, the image is resized to the width of paragraphs on this blog, give it a click if you want to check it out at 1:1 size.

Phishing 362

Phishing Password Management Passwords Internet 362

Security Affairs

APRIL 23, 2023

Abandoned Eval PHP WordPress plugin abused to backdoor websites CISA adds MinIO, PaperCut, and Chrome bugs to its Known Exploited Vulnerabilities catalog At least 2 critical infrastructure orgs breached by North Korea-linked hackers behind 3CX attack American Bar Association (ABA) suffered a data breach,1.4

Spyware 72

Spyware Ransomware Malware Data breaches 72

Security Affairs

JANUARY 29, 2021

Microsoft, like Google TAG, observed a cyber espionage campaign aimed at vulnerability researchers that attributed to North Korea-linked Zinc APT group. ” This week, Google Threat Analysis Group (TAG) also warned of North Korea-linked hackers targeting security researchers through social media. eXplorer.

Malware 115

Malware Antivirus Hacking Accountability 115

Malwarebytes

OCTOBER 11, 2021

This time, it’s sniffing around users of Google services. Sometime late September, according to the folks at Google. Did Google catch all the malicious missives? Shane Huntley, Director of Google’s Threat Analysis Group, mentioned that they blocked all the emails sent. What else is Google doing in this realm?

Government 100

Government Phishing Accountability Passwords 100

SiteLock

AUGUST 27, 2021

However, as far back as 2014, Google has been calling for “HTTPS Everywhere” — stating, reasonably, that all communications across the internet should be secure, not only the checkout process. Chrome displays a serious warning if the connection cannot be loaded securely and privately.

eCommerce 52

eCommerce Insurance Encryption Internet 52

Troy Hunt

APRIL 19, 2018

Whilst this blog post is about a Pluralsight course I created with Lars Klint , it only really hit me during that bank conversation just how much there is to take onboard when it comes to securing things in the browser today. I was chatting to some folks at a bank just the other day about a bunch of modern web security standards.

Banking 119

Banking DNS 119

Security Affairs

MAY 23, 2022

Google’s Threat Analysis Group (TAG) uncovered campaigns targeting Android users with five zero-day vulnerabilities. Google’s Threat Analysis Group (TAG) researchers discovered three campaigns, between August and October 2021, targeting Android users with five zero-day vulnerabilities.

Spyware 133

Spyware Surveillance Government Banking 133

Google Security

FEBRUARY 10, 2022

Thanks to these incredible researchers, Vulnerability Reward Programs across Google continued to grow, and we are excited to report that in 2021 we awarded a record breaking $8,700,000 in vulnerability rewards – with researchers donating over $300,000 of their rewards to a charity of their choice. We now offer swag ! million in VRP rewards.

Internet 144

Internet Internet Manufacturing Hacking 144

Troy Hunt

JULY 31, 2018

In the launch blog post , I wrote about the nuances of assessing whether a site redirects insecure requests appropriately. For example, the list includes Instagram, Google in Russia and Netflix. Is an HTTP 200 and a meta refresh tag or some funky JS sufficient? They all do HTTPS.

Accountability 126

Accountability Insurance Banking Media 126

Scary Beasts Security

SEPTEMBER 22, 2009

In other news, I recently moved to work on the Chromium project / Google Chrome, which I'm very excited about. The bugs represented a range of different C vulnerability classes, which I thought might make an interesting blog post. Other: This blog post got too long. Out-of-bounds array index read in vorbis_dec.c:

Malware 50

Malware 50

Troy Hunt

NOVEMBER 14, 2017

That's pretty much XSS 101 - just get an alert box to fire - and reflecting a script tag is one of the most fundamental techniques attackers use to run their script on your website. No external videos embedded from YouTube, no JavaScript libraries off your favourite CDN and no analytics or tracking from Google. Also, no script blocks.

Hacking 220

Hacking Risk 220

SecureList

NOVEMBER 30, 2021

On January 25, the Google Threat Analysis Group (TAG) announced a state-sponsored threat actor had targeted security researchers. On March 31, Google TAG released an update on this activity showing another wave of fake social media profiles and a company the actor set up mid-March.

Malware 100

Malware Mobile Spyware Surveillance 100

Troy Hunt

NOVEMBER 5, 2018

Internet Explorer is no longer the dominant browser ( Chrome was in 3rd place back then ). Their site is still up and functional, but their Twitter account hasn't been active for 2 and a half years now and the last blog post they wrote was in 2014. Windows Server has gone from 2008 R2 to 2012 to 2012 R2 to 2016 to 2019.

Technology 194

Technology Architecture Marketing Internet 194

Troy Hunt

NOVEMBER 2, 2017

That really ramped up in Jan when both Chrome and Firefox started displaying warnings when a login form was served insecurely. A trawl back through the SSL tag on this blog shows other similar responses where amazingly, there are others who also think that this is just a protection racket run by Google.

Passwords 203

Passwords Penetration Testing Technology Accountability 203

Troy Hunt

JANUARY 10, 2018

Much of what I'm going to cover in the remainder of this blog post will focus on the site at uidai.gov.in It's the address on Aadhaar's Twitter account , it's the first result on a Google search and time and time again, it's promoted as the site people should go to before doing anything else Aadhaar related. Why do websites do this?

Hacking 279

Hacking Government Risk Encryption 279

SecureList

APRIL 27, 2021

In November and December 2020, two public blog posts were published about this campaign. We were able to trace the implant back to at least 2015, along with variants intended to hijack the execution of the Telegram and Chrome applications as a persistence method.

Malware 137

Malware Spyware Government Social Engineering 137

Scary Beasts Security

MAY 5, 2017

For what it’s worth, the woeful state of WebKit packaging on Linux was discussed in Feb 2016 in this blog post , which was picked up by Linux Weekly News. u.asInt64 & TagMask); } Where tag() returns the latter 4 bytes of the value, CellTag==0xfffffffb and TagMask==0xffff000000000002. LTS has passed end of life.]

Hacking 126

Hacking Mobile Accountability 126

Malwarebytes

MAY 24, 2022

The Google Threat Analysis Group (TAG) has revealed that of the nine zero-day vulnerabilities affecting Chrome, Android, Apple and Microsoft that it reported in 2021, five were in use by a single commercial surveillance company. Patches for the five vulnerabilities TAG mentions in its blog are available.

Spyware 133

Spyware Surveillance Government Marketing 133