Cyber Security Informer

Apple released iOS 17.2 to address a dozen of security flaws

Security Affairs

DECEMBER 12, 2023

Apple also addressed a code execution flaw, tracked as CVE-2023-42890, in the WebKit. The fact that the issues were discovered by Google TAG suggests they were exploited by a nation-state actor or by a surveillance firm. The IT giant addressed the flaw by improving memory handling. The flaw CVE-2023-42898 was discovered by Junsung Lee.

Surveillance

Surveillance Hacking Information Security

Recently patched Apple and Chrome zero-days exploited to infect devices in Egypt with Predator spyware

Security Affairs

SEPTEMBER 22, 2023

Citizen Lab and Google’s TAG revealed that the three recently patched Apple zero-days were used to install Cytrox Predator spyware. CVE-2023-41993 is an arbitrary code execution issue that resides in the Webkit. TAG experts explained that they were unable to capture the full Predator implant.

Spyware

Spyware Surveillance Mobile Hacking

Apple addressed 2 new iOS zero-day vulnerabilities

Security Affairs

NOVEMBER 30, 2023

The flaws are actively exploited in attacks in the wild, both issues reside in the WebKit browser engine. The fact that the issues were discovered by Google TAG suggests they were exploited by a nation-state actor or by a surveillance firm. The first vulnerability, tracked as CVE-2023-42916, is an out-of-bounds read.

Surveillance

Surveillance Engineering Hacking Information Security

Webinars

Reimagining Cybersecurity Training: Driving Real Impact on Security Culture

MORE WEBINARS

In 2022, more than 40% of zero-day exploits used in the wild were variations of previous issues

Security Affairs

JULY 30, 2023

The popular Threat Analysis Group (TAG) Maddie Stone wrote Google’s fourth annual year-in-review of zero-day flaws exploited in-the-wild [ 2021 , 2020 , 2019 ], it is built off of the mid-year 2022 review. ” reads the report published by Google TAG.

Firewall

Firewall Software Hacking Internet

macOS Zero-Day exploited in watering hole attacks on users in Hong Kong

Security Affairs

NOVEMBER 12, 2021

Google TAG researchers discovered that threat actors leveraged a zero-day vulnerability in macOS in a watering hole campaign aimed at delivering malware to users in Hong Kong. “To protect our users, TAG routinely hunts for 0-day vulnerabilities exploited in-the-wild. and another for the exploit chain. Pierluigi Paganini.

Malware

Malware Media Surveillance Encryption

Apple addressed two actively exploited zero-day flaws

Security Affairs

APRIL 7, 2023

Today, Apple published an emergency update for all iPhones to patch an exploit chain which we, together with @_clem1 (Google TAG) discovered in the wild. The flaw is a type confusion issue in WebKit that was addressed by the IT giant with improved checks.

Education

Education Media Hacking Accountability

Google: four zero-day flaws have been exploited in the wild

Security Affairs

JULY 14, 2021

Security researchers from Google Threat Analysis Group (TAG) and Google Project Zero revealed that four zero-day vulnerabilities have been exploited in the wild earlier this year. The four security flaws were discovered earlier this year and affect Google Chrome, Internet Explorer, and WebKit browser engine.

Surveillance

Surveillance Government Internet Internet

Google TAG shares details about exploit chains used to install commercial spyware

Security Affairs

MARCH 29, 2023

Google’s Threat Analysis Group (TAG) discovered several exploit chains targeting Android, iOS, and Chrome to install commercial spyware. Google’s Threat Analysis Group (TAG) shared details about two distinct campaigns which used several zero-day exploits against Android, iOS and Chrome. links sent over SMS to users.

Spyware

Spyware Surveillance Firmware Internet

Sophisticated attackers used DazzleSpy macOS backdoor in watering hole attacks

Security Affairs

JANUARY 25, 2022

The investigation started in November after Google TAG published a blogpost about watering-hole attacks targeting macOS users in Hong Kong. Google TAG researchers discovered that threat actors leveraged a zero-day vulnerability in macOS in a watering hole campaign aimed at delivering malware to users in Hong Kong.

Malware

Malware Media Authentication Hacking

New Mac malware raises more questions about Apple’s security patching

Malwarebytes

NOVEMBER 16, 2021

Google’s Threat Analysis Group (TAG) discovered a watering hole campaign in Hong Kong, targeting journalists and pro-democracy political groups. The first vulnerability used by the malware was CVE-2021-1789, which was a remote code execution (RCE) vulnerability in WebKit. Watering hole campaign discovered by Google.

Malware

Malware Software Antivirus Government

Google revealed how watering hole attacks compromised iPhone devices earlier this year

Security Affairs

AUGUST 30, 2019

Earlier this year, Google Threat Analysis Group (TAG) experts uncovered an iPhone hacking campaign, initially, they spotted a limited number of hacked websites used in watering hole attacks against iPhone users. “Earlier this year Google’s Threat Analysis Group (TAG) discovered a small collection of hacked websites.

Spyware

Spyware Hacking Advertising Encryption

A harmless SVG + XSLT curiousity

Scary Beasts Security

JANUARY 19, 2011

How do you execute code in a turing complete language via the tag? I expect it'll do the same in any WebKit browser, and Opera's error message implies it has all the pieces to follow suit if I tweaked the file a bit. Why, by combining an XSL transform into an SVG image of course!

ScamClub malvertising gang abused WebKit zero-day to redirect to online gift card scams

Security Affairs

FEBRUARY 17, 2021

Malvertising gang ScamClub has exploited an unpatched zero-day vulnerability in WebKit-based browsers in a campaign aimed at realizing online gift card scams. “A typical ScamClub payload has a few layers to it, starting with an ad tag that loads a malicious CDN hosted dependency. Pierluigi Paganini.

Scams

Scams Engineering Hacking Information Security

The Ups and Downs of 0-days: A Year in Review of 0-days Exploited In-the-Wild in 2022

Google Security

JULY 27, 2023

Maddie Stone, Security Researcher, Threat Analysis Group (TAG) This is Google’s fourth annual year-in-review of 0-days exploited in-the-wild [ 2021 , 2020 , 2019 ] and builds off of the mid-year 2022 review. In November 2022, TAG discovered the bug being used in-the-wild. However, Android Security referred the issue to ARM.

Spyware

Spyware Manufacturing Internet Internet

Ode to the use-after-free: one vulnerable function, a thousand possibilities

Scary Beasts Security

MAY 5, 2017

And as one commentator notes on a thread discussing a port of this vulnerability to the PlayStation 4 , “That one WebKit bug is the gift that keeps on giving” (Oct 2014). In general, everyone ships an out of date WebKit and Linux distributions are no different. LTS, and the WebKit backend for the Konqueror browser.

Hacking

Hacking Mobile Accountability

Cyber Security Informer

Apple released iOS 17.2 to address a dozen of security flaws

Recently patched Apple and Chrome zero-days exploited to infect devices in Egypt with Predator spyware

Webinars

Trending Sources

Apple addressed 2 new iOS zero-day vulnerabilities

Webinars

In 2022, more than 40% of zero-day exploits used in the wild were variations of previous issues

macOS Zero-Day exploited in watering hole attacks on users in Hong Kong

Apple addressed two actively exploited zero-day flaws

Google: four zero-day flaws have been exploited in the wild

Google TAG shares details about exploit chains used to install commercial spyware

Sophisticated attackers used DazzleSpy macOS backdoor in watering hole attacks

New Mac malware raises more questions about Apple’s security patching

Google revealed how watering hole attacks compromised iPhone devices earlier this year

A harmless SVG + XSLT curiousity

ScamClub malvertising gang abused WebKit zero-day to redirect to online gift card scams

The Ups and Downs of 0-days: A Year in Review of 0-days Exploited In-the-Wild in 2022

Ode to the use-after-free: one vulnerable function, a thousand possibilities

Stay Connected