Google limits which apps can access the list of installed apps on your device

Apps on Android have been able to infer the presence of specific apps, or even collect the full list of installed apps on the device. What’s more, an app can also set to be notified when a new app is installed.

Apart from all the usual concerns about misuse of such a data grab, the information can be abused by a potentially harmful app to fingerprint other installed apps, check for the presence of antivirus, affiliate fraud, and even for targeted ads.

In 2014, Twitter began tracking the list of apps installed on users’ devices as part of its “app graph” initiative with an aim to deliver tailored content. Digital wallet company MobiKwik was also caught collecting information about installed apps in the wake of a data breach that came to light earlier this week.

Indeed, a study undertaken by a group of Swiss researchers in 2019 found that “free apps are more likely to query for such information and that third-party libraries (libs) are the main requesters of the list of installed apps.”

“As users have on average 80 apps installed on their phones, most of them being free, there is a high chance of untrusted third-parties obtaining the list of installed apps,” the researchers added.

Another academic study published in March 2020 also found that 4,214 Google Play apps stealthily amassed a list of all other installed apps, thereby allowing developers and advertisers to build detailed profiles of users. Apps that do so typically achieve this by making use of what’s called installed application methods — getInstalledPackages() and getInstalledApplications() — with the researchers uncovering that apps in games, comics, personalization, autos and vehicles, and family categories topped the list of apps collecting this information.

Last year, Google attempted to rein in this behavior by preventing apps from accessing this information by default starting Android 11, while also introducing new permission called “QUERY_ALL_PACKAGES” for apps that need access to the list of other installed apps.

“This filtering behavior helps minimize the amount of potentially sensitive information that your app doesn’t need in order to fulfill its use cases, but that your app can still access,” Google said.

Now in an attempt to step up its efforts to restrict the misuse of the QUERY_ALL_PACKAGES permission, Google has said it treats the inventory of installed apps as personal and sensitive user data.

Effective May 5, 2021, the permission will be limited to only those apps that are used for device search, as well as antivirus apps, file managers, and browsers. Other apps such as a dedicated banking app or a digital wallet app can qualify for this permission solely for security-based purposes.

Google also said it wouldn’t allow apps to request the QUERY_ALL_PACKAGES permission when the “data is acquired for the purpose of sale” or the required task can be achieved by an alternative method.

“Apps that fail to meet policy requirements or do not submit a Declaration Form may be removed from Google Play,” the company noted. “If you change how your app uses these restricted permissions, you must revise your declaration with updated and accurate information. Deceptive and non-declared uses of these permissions may result in a suspension of your app and/or termination of your developer account.”

Found this article interesting? Follow THN on Facebook, Twitter and LinkedIn to read more exclusive content we post.

Read More

The post Google limits which apps can access the list of installed apps on your device appeared first on Malware Devil.

https://malwaredevil.com/2021/04/03/google-limits-which-apps-can-access-the-list-of-installed-apps-on-your-device-2/?utm_source=rss&utm_medium=rss&utm_campaign=google-limits-which-apps-can-access-the-list-of-installed-apps-on-your-device-2

Google limits which apps can access the list of installed apps on your device

Apps on Android have been able to infer the presence of specific apps, or even collect the full list of installed apps on the device. What’s more, an app can also set to be notified when a new app is installed.
Apart from all the usual concerns about misuse of such a data grab, the information can be abused by a potentially harmful app to fingerprint other installed apps, check for the presence
Read More

The post Google limits which apps can access the list of installed apps on your device appeared first on Malware Devil.

https://malwaredevil.com/2021/04/03/google-limits-which-apps-can-access-the-list-of-installed-apps-on-your-device/?utm_source=rss&utm_medium=rss&utm_campaign=google-limits-which-apps-can-access-the-list-of-installed-apps-on-your-device

Data, Data, and more Data!!!

Big data is exactly what is sounds like, large volumes of data sets. Today’s data is complex and comes in diverse forms that are constantly changing. Big data can be conveyed through volume, velocity, and variety. These elements, often called the “3 V’s of Big Data” define how data is expressed. Volume refers to the […]

The post Data, Data, and more Data!!! appeared first on Phoenix TS.

The post Data, Data, and more Data!!! appeared first on Security Boulevard.

Read More

The post Data, Data, and more Data!!! appeared first on Malware Devil.

https://malwaredevil.com/2021/04/02/data-data-and-more-data/?utm_source=rss&utm_medium=rss&utm_campaign=data-data-and-more-data

BBC Claims Americans Think of Presidents as Demigods

I’m really struggling to get through a BBC article called “Who truly was the most dishonest president?” This section in particular is really hard to read. Once upon a time Americans placed an almost childlike trust in their commanders-in-chief. They were venerated as demigods. When did it change? Many historians date this rupture to Lyndon … Continue reading BBC Claims Americans Think of Presidents as Demigods →

The post BBC Claims Americans Think of Presidents as Demigods appeared first on Security Boulevard.

Read More

The post BBC Claims Americans Think of Presidents as Demigods appeared first on Malware Devil.

https://malwaredevil.com/2021/04/02/bbc-claims-americans-think-of-presidents-as-demigods/?utm_source=rss&utm_medium=rss&utm_campaign=bbc-claims-americans-think-of-presidents-as-demigods

Inside the Ransomware Campaigns Targeting Exchange Servers

Security experts discuss the ransomware campaigns taking aim at Microsoft Exchange Server vulnerabilities patched last month.

As organizations around the world scrambled to patch critical Microsoft Exchange Server flaws patched last month, criminals upped the ante with multiple ransomware campaigns targeting vulnerable servers.

News of ransomware activity first emerged on March 12, only 10 days after Microsoft released the patches, and it arrived as researchers noticed an uptick in ransomware attacks following the disclosure of the Exchange Server zero-days. In the week ending March 30, the number of attacks involving the Exchange Server flaws had tripled to more than 50,000 around the world.

Check Point Research reports the industries most targeted in these attacks include government and military, manufacturing, and banking and finance. The most affected country is the United States, which makes up 49% of all exploit attempts, the United Kingdom (5%), the Netherlands (4%), and Germany.

The first ransomware variant to appear was DearCry/DoejoCrypt, which copies and encrypts files then overwrites and deletes the originals, a tactic seen earlier in WannaCry ransomware.

DoejoCrypt attacks begin with a variant of the China Chopper Web shell being deployed to an Exchange Server post-exploitation, Microsoft explains in a writeup. The Web shell writes a batch file to C:WindowsTempxx.bat; on all systems hit with this ransomware, this batch file does a backup of the Security Account Manager (SAM) database and the System and Security registry hives, which give attackers later access to the passwords of local users on the system.

Microsoft points out that because of the configurations that admins normally use on Exchange Servers, many infected systems likely have at least one service or scheduled task configured with a highly privileged account to perform tasks such as backups.

“As service account credentials are not frequently changed, this could provide a great advantage to an attacker even if they lose their initial Web shell access due to an antivirus detection,” the Microsoft 365 Defender Threat Intelligence Team explains in their blog post.

The encryption header that DoejoCrypt adds to infected files is similar to the header used in the WannaCry attacks, writes Sophos director of engineering Mark Loman in a blog post, noting this “seems more than a coincidence.” Analysis of DoejoCrypt samples revealed the binaries had no defense against antivirus signatures and all ransomware text strings were left “in plain sight.”

As of Microsoft’s March 25 post, the DoejoCrypt payload is “the most visible outcome” of the attackers’ actions; however, their access to credentials could help them in future campaigns.

“I expect anybody who hasn’t patched or mitigated the Web shells that were placed over the past month to be in a pretty rough spot,” says Juan Guerrero-Saade, principal threat researcher at SentinelOne. “This has become available to anybody now,” he says of the exploits.

Black KingDom: A Second Campaign Emerges
On Thursday, March 18, Sophos telemetry revealed another ransomware gang targeting vulnerable Exchange servers.

“Typically these campaigns start before the weekend because the majority of IT [teams] are understaffed on the weekend or typically don’t monitor their network,” Loman says in an interview with Dark Reading. The likelihood of this is even greater for organizations that haven’t prioritized patching their vulnerable on-premises Exchange Server, he adds.

Loman calls the Black KingDom ransomware “a bit of an oddball” and points out it has virtually nothing in common with DoejoCrypt, aside from the fact it targets the same vulnerability.

Black KingDom is “rudimentary and amateurish,” he writes in a blog post, and likely created by a “motivated script kiddie” because of the way it’s constructed. The ransomware was written in Python and compiled in a way that left its original source code embedded within the ransomware binary, which researchers reverse-engineered to dig up the original source code.

Its amateur nature is evident in Black KingDom’s approach to file encryption, which Loman calls the most interesting aspect of this ransomware. Normally, ransomware chooses a unique file extension for every file it encrypts, which ensures those file types won’t be encrypted twice, he explains. Black KingDom chooses a random file extension for every file it encrypts.

“That is really odd,” Loman notes. The ransomware also does not check if a file has already been encrypted, a step that other common forms of ransomware usually take.

“What we call ‘big game’ ransomware actors, like Ryuk or REvil or Clop, they all have these types of checks in their code so they don’t encrypt the system twice,” he explains. Black KingDom’s closest approach to this kind of “check” is a specific ransom note dropped on a victim’s machine. But if a victim removes the note, the machine can be encrypted again — making decryption much more difficult, even if the ransom is paid.

Further, he adds, Black KingDom’s ransom demand was $10,000, a small amount compared with some of today’s high ransom demands.

Loman admits he was surprised a comparatively amateurish group was able to pull this off given that Hafnium, the first group linked to any attacks targeting these vulnerabilities, is an advanced group linked to the Chinese government. He speculates Black KingDom may be related to a ransomware of the same name seen last year targeting machines running a vulnerable version of the Pulse Secure VPN concentrator software.

“There are several ways to get your ransomware delivered in businesses, but this group was specifically focusing on abusing a vulnerability on Internet-facing devices,” he says. In this way, they are making use of the low patching frequency of businesses running on-premises Exchange servers.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial … View Full Bio

Recommended Reading:

Comment |

Email This |

Print |

RSS

More Insights

Webcasts

Using MS Teams as Your Phone System – FREE Event 4/14

Cybersecurity Risk Management

More Webcasts

White Papers

The Ultimate Cyber Skills Strategy Cheat Sheet

How to Achieve Risk-Based Vulnerability Management

More White Papers

Reports

Improving Security by Moving Beyond VPN

Accelerate Threat Resolutions with DNS

More Reports

The post Inside the Ransomware Campaigns Targeting Exchange Servers appeared first on Malware Devil.

https://malwaredevil.com/2021/04/02/inside-the-ransomware-campaigns-targeting-exchange-servers-2/?utm_source=rss&utm_medium=rss&utm_campaign=inside-the-ransomware-campaigns-targeting-exchange-servers-2

Inside the Ransomware Campaigns Targeting Exchange Servers

Security experts discuss the ransomware campaigns taking aim at Microsoft Exchange Server vulnerabilities patched last month.

The post Inside the Ransomware Campaigns Targeting Exchange Servers appeared first on Malware Devil.

https://malwaredevil.com/2021/04/02/inside-the-ransomware-campaigns-targeting-exchange-servers/?utm_source=rss&utm_medium=rss&utm_campaign=inside-the-ransomware-campaigns-targeting-exchange-servers

Hackers Demand $40M in Ransom From Florida School District

Subscribe to Newsletters

Cybersecurity Risk Management FREE Event 4/22
Earn (ISC)2 CPEs at Interop Digital, April 29

More Informa Tech Live Events

White Papers

Threat Reconnaissance Lessons from the Private Sector for Federal & State Agencies

The Ultimate Cyber Skills Strategy Cheat Sheet

Improving Security by Moving Beyond VPN

How to Achieve Risk-Based Vulnerability Management

Smart Service Management: Working Better Together with a Connected Enterprise

More White Papers

Video

All Videos

Cartoon Contest

Write a Caption, Win an Amazon Gift Card! Click Here

Latest Comment: Job offer: Hatches random seeds at server farm.

Cartoon Archive

Current Issue

2021 Top Enterprise IT TrendsWe’ve identified the key trends that are poised to impact the IT landscape in 2021. Find out why they’re important and how they will affect you today!

Back Issues | Must Reads

Flash Poll

All Polls

How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.

Download Now!

Assessing Cybersecurity Risk in Today’s Enterprises

0 comments

The Malware Threat Landscape

0 comments

How Data Breaches Affect the Enterprise (2020)

0 comments

More Reports

Twitter Feed

Bug Report

Enterprise Vulnerabilities
From DHS/US-CERT’s National Vulnerability Database
CVE-2021-21529
PUBLISHED: 2021-04-02

Dell System Update (DSU) 1.9 and earlier versions contain a denial of service vulnerability. A local authenticated malicious user with low privileges may potentially exploit this vulnerability to cause the system to run out of memory by running multiple instances of the vulnerable application.

CVE-2021-21532
PUBLISHED: 2021-04-02

Dell Wyse ThinOS 8.6 MR9 contains remediation for an improper management server validation vulnerability that could be potentially exploited to redirect a client to an attacker-controlled management server, thus allowing the attacker to change the device configuration or certificate file.

CVE-2021-21533
PUBLISHED: 2021-04-02

Wyse Management Suite versions up to 3.2 contains a vulnerability wherein a malicious authenticated user can cause a denial of service in the job status retrieval page, also affecting other users that would have normally access to the same subset of job details

CVE-2020-27600
PUBLISHED: 2021-04-02

HNAP1/control/SetMasterWLanSettings.php in D-Link D-Link Router DIR-846 DIR-846 A1_100.26 allows remote attackers to execute arbitrary commands via shell metacharacters in the ssid0 or ssid1 parameter.

CVE-2021-30074
PUBLISHED: 2021-04-02

docsify 4.12.1 is affected by Cross Site Scripting (XSS) because the search component does not appropriately encode Code Blocks and mishandles the " character.

The post Hackers Demand $40M in Ransom From Florida School District appeared first on Malware Devil.

https://malwaredevil.com/2021/04/02/hackers-demand-40m-in-ransom-from-florida-school-district-2/?utm_source=rss&utm_medium=rss&utm_campaign=hackers-demand-40m-in-ransom-from-florida-school-district-2

FBI & CISA Warn of Active Attacks on FortiOS Vulnerabilities

A joint advisory warns admins of the likelihood of APT groups exploiting three vulnerabilities in the Fortinet FortiOS.

Editor’s Note: This story was updated on April 2 at 5:35 PM ET to include Fortinet’s statement.

The FBI and Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) today issued a joint advisory warning admins of active exploits targeting three vulnerabilities in Fortinet FortiOS.

In March 2021, the FBI and CISA observed advanced persistent threat (APT) attackers scanning devices on ports 4443, 8443, and 10443 for CVE-2018-13379 in FortiOS. They also noticed attackers scanning enumerated devices for CVE-2020-12812 and CVE-2019-5591. Officials believe attackers are attempting to access multiple government, commercial, and technology services networks.

“The APT actors may be using any or all of these CVEs to gain access to networks across multiple critical infrastructure sectors to gain access to key networks as pre-positioning for follow-on data exfiltration or data encryption attacks,” the full advisory states.

APT groups have historically exploited critical vulnerabilities to launch distributed denial-of-service attacks, ransomware campaigns, SQL injection attacks, spear-phishing campaigns, website defacements, and disinformation attacks, officials note.

The FortiOS advisory arrives two days after CISA issued further guidance on its emergency directive regarding the Microsoft Exchange Server vulnerabilities patched last month. Its latest update instructs federal departments and agencies to run Microsoft’s new Test-ProxyLogon.script and Safety Scanner tool to determine whether they have been compromised.

Fortinet followed up on its release of a patch for CVE-2018-13379 with blog posts in August 2019 and July 2020 to provide more details and warn customers of active attacks by APT 29. “If customers have not done so, we urge them to immediately implement the upgrade and mitigations,” Fortinet says in a statement on today’s advisory.

Read the CISA advisory for more information on the FortiOS exploits.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Recommended Reading:

Comment |

Email This |

Print |

RSS

More Insights

Webcasts

Cybersecurity Risk Management

More Webcasts

White Papers

Improving Security by Moving Beyond VPN

How to Achieve Risk-Based Vulnerability Management

More White Papers

Reports

Improving Security by Moving Beyond VPN

Accelerate Threat Resolutions with DNS

More Reports

The post FBI & CISA Warn of Active Attacks on FortiOS Vulnerabilities appeared first on Malware Devil.

https://malwaredevil.com/2021/04/02/fbi-cisa-warn-of-active-attacks-on-fortios-vulnerabilities-2/?utm_source=rss&utm_medium=rss&utm_campaign=fbi-cisa-warn-of-active-attacks-on-fortios-vulnerabilities-2

FBI: APTs Actively Exploiting Fortinet VPN Security Holes

Three security vulnerabilities in the Fortinet SSL VPN are being used to gain a foothold within networks before moving laterally and carrying out recon.
Read More

The post FBI: APTs Actively Exploiting Fortinet VPN Security Holes appeared first on Malware Devil.

https://malwaredevil.com/2021/04/02/fbi-apts-actively-exploiting-fortinet-vpn-security-holes/?utm_source=rss&utm_medium=rss&utm_campaign=fbi-apts-actively-exploiting-fortinet-vpn-security-holes

Hackers Demand $40M in Ransom From Florida School District

District officials say they have no intention of paying the ransom

The post Hackers Demand $40M in Ransom From Florida School District appeared first on Malware Devil.

https://malwaredevil.com/2021/04/02/hackers-demand-40m-in-ransom-from-florida-school-district/?utm_source=rss&utm_medium=rss&utm_campaign=hackers-demand-40m-in-ransom-from-florida-school-district

Save Time & Money With Automated Password Resets

If you’re still using helpdesk tickets to reset passwords, you’re wasting time and money. See how you save both with automated password resets.

The post Save Time & Money With Automated Password Resets appeared first on Security Boulevard.

Read More

The post Save Time & Money With Automated Password Resets appeared first on Malware Devil.

https://malwaredevil.com/2021/04/02/save-time-money-with-automated-password-resets/?utm_source=rss&utm_medium=rss&utm_campaign=save-time-money-with-automated-password-resets

Upcoming Webinar: Naked and Exposed: Stop Investigating Online without Managed Attribution

Educational webinar on managed attribution: Everything you wanted to know about browser fingerprint, MA and non-attribution, but didn’t know who to ask.

The post Upcoming Webinar: Naked and Exposed: Stop Investigating Online without Managed Attribution appeared first on Security Boulevard.

Read More

The post Upcoming Webinar: Naked and Exposed: Stop Investigating Online without Managed Attribution appeared first on Malware Devil.

https://malwaredevil.com/2021/04/02/upcoming-webinar-naked-and-exposed-stop-investigating-online-without-managed-attribution/?utm_source=rss&utm_medium=rss&utm_campaign=upcoming-webinar-naked-and-exposed-stop-investigating-online-without-managed-attribution

Sentiment Mining is Just Weird! – Kevin Finisterre – SW Unlocked

I’d like to discuss the concept of sentiment mining in context of DJI drone companies data collection program known as Sentinel and Supervisor.

→Visit our website: https://www.securityweekly.com
→Follow us on Twitter: https://www.twitter.com/securityweekly
→Like us on Facebook: https://www.facebook.com/secweekly

The post Sentiment Mining is Just Weird! – Kevin Finisterre – SW Unlocked appeared first on Malware Devil.

https://malwaredevil.com/2021/04/02/sentiment-mining-is-just-weird-kevin-finisterre-sw-unlocked/?utm_source=rss&utm_medium=rss&utm_campaign=sentiment-mining-is-just-weird-kevin-finisterre-sw-unlocked

Peel Back the Layers with Security Onion 2 – Doug Burks – SW Unlocked

Security Onion, founded in 2008, recently released Security Onion 2. It continues the tradition of including the best of breed open source components for threat hunting, enterprise security monitoring, and log management. In addition, it adds some brand new components and provides even better network and endpoint visibility than ever before. Let’s see how you can peel back the layers of your enterprise and make your adversaries cry!

→Visit our website: https://www.securityweekly.com
→Follow us on Twitter: https://www.twitter.com/securityweekly
→Like us on Facebook: https://www.facebook.com/secweekly

The post Peel Back the Layers with Security Onion 2 – Doug Burks – SW Unlocked appeared first on Malware Devil.

https://malwaredevil.com/2021/04/02/peel-back-the-layers-with-security-onion-2-doug-burks-sw-unlocked/?utm_source=rss&utm_medium=rss&utm_campaign=peel-back-the-layers-with-security-onion-2-doug-burks-sw-unlocked

The Full Purple Juice, Not the Watered Down Stuff – Jorge Orchilles, Bryson Bort – SW Unlocked

Everyone has heard of Purple Team by now, but how many have been able to quantify the value? In this talk, we cover all the roles of a Purple Team: Cyber Threat Intelligence, Red Team, Blue Team, and Exercise Coordination. We were asked to emulate various adversaries, with an increasing order of sophistication, while implementing defenses for the adversary TTPs. We were also asked to not spend any money on new technology. Instead, we had to tune the current security controls. See the results!

→Visit our website: https://www.securityweekly.com
→Follow us on Twitter: https://www.twitter.com/securityweekly
→Like us on Facebook: https://www.facebook.com/secweekly

The post The Full Purple Juice, Not the Watered Down Stuff – Jorge Orchilles, Bryson Bort – SW Unlocked appeared first on Malware Devil.

https://malwaredevil.com/2021/04/02/the-full-purple-juice-not-the-watered-down-stuff-jorge-orchilles-bryson-bort-sw-unlocked/?utm_source=rss&utm_medium=rss&utm_campaign=the-full-purple-juice-not-the-watered-down-stuff-jorge-orchilles-bryson-bort-sw-unlocked

Pentesting with Kubernetes – Matt Hamilton – SW Unlocked

“Kubernetes is not just a tool for building sandcastles, but also for knocking them over. This presentation will include security research “”tales from production””, as well as tools that exist (and some that don’t, but should!).

For those living in a DevOps world who care more about breaking than building, this is the talk for you. Matt will be sharing lessons learned, techniques, and failings in pentesting applications in Kubernetes.”

→Visit our website: https://www.securityweekly.com
→Follow us on Twitter: https://www.twitter.com/securityweekly
→Like us on Facebook: https://www.facebook.com/secweekly

The post Pentesting with Kubernetes – Matt Hamilton – SW Unlocked appeared first on Malware Devil.

https://malwaredevil.com/2021/04/02/pentesting-with-kubernetes-matt-hamilton-sw-unlocked/?utm_source=rss&utm_medium=rss&utm_campaign=pentesting-with-kubernetes-matt-hamilton-sw-unlocked

Automate Your Web Application Security – Mark Schembri – SW Unlocked

With a proliferation of application development and cloud deployments, coupled with the cybersecurity skills gap, how do you effectively secure your applications from attackers? To stay conversant with the always evolving cyber security threats, businesses have to emulate their attackers in order to protect their applications. Learn how to automate your web application security, including continuous penetration testing, which helps you prioritize your work on fixing the issues.

→Visit our website: https://www.securityweekly.com
→Follow us on Twitter: https://www.twitter.com/securityweekly
→Like us on Facebook: https://www.facebook.com/secweekly

The post Automate Your Web Application Security – Mark Schembri – SW Unlocked appeared first on Malware Devil.

https://malwaredevil.com/2021/04/02/automate-your-web-application-security-mark-schembri-sw-unlocked/?utm_source=rss&utm_medium=rss&utm_campaign=automate-your-web-application-security-mark-schembri-sw-unlocked

Network Security News Summary for Friday April 2nd, 2021

April PCAP Quiz; Coinhive Update; Forensicating BITS; More Water Trouble; QNAP Vulns

April 2021 Forensic Quiz
https://isc.sans.edu/forums/diary/April+2021+Forensic+Quiz/27266/

Coinhive Domains Used to Warn Victims
https://www.troyhunt.com/i-now-own-the-coinhive-domain-heres-how-im-fighting-cryptojacking-and-doing-good-things-with-content-security-policies/

Detecting Attacker’s BITS Utility Use
https://www.fireeye.com/blog/threat-research/2021/03/attacker-use-of-windows-background-intelligent-transfer-service.html

Kansas Man Indicted For Tampering With Public Water System
https://www.justice.gov/usao-ks/pr/indictment-kansas-man-indicted-tampering-public-water-system

Older QNAP Devices Vulnerable And No Longer Patched
https://securingsam.com/new-vulnerabilities-allow-complete-takeover/

keywords: qnap; kansas; water; bits; coinhive; troy hunt; april; quiz; packet; forensics

The post Network Security News Summary for Friday April 2nd, 2021 appeared first on Malware Devil.

https://malwaredevil.com/2021/04/01/network-security-news-summary-for-friday-april-2nd-2021-2/?utm_source=rss&utm_medium=rss&utm_campaign=network-security-news-summary-for-friday-april-2nd-2021-2

Network Security News Summary for Friday April 2nd, 2021

April PCAP Quiz; Coinhive Update; Forensicating BITS; More Water Trouble; QNAP Vulns

April 2021 Forensic Quiz
https://isc.sans.edu/forums/diary/April+2021+Forensic+Quiz/27266/

Coinhive Domains Used to Warn Victims
https://www.troyhunt.com/i-now-own-the-coinhive-domain-heres-how-im-fighting-cryptojacking-and-doing-good-things-with-content-security-policies/

Detecting Attacker’s BITS Utility Use
https://www.fireeye.com/blog/threat-research/2021/03/attacker-use-of-windows-background-intelligent-transfer-service.html

Kansas Man Indicted For Tampering With Public Water System
https://www.justice.gov/usao-ks/pr/indictment-kansas-man-indicted-tampering-public-water-system

Older QNAP Devices Vulnerable And No Longer Patched
https://securingsam.com/new-vulnerabilities-allow-complete-takeover/

keywords: qnap; kansas; water; bits; coinhive; troy hunt; april; quiz; packet; forensics

The post Network Security News Summary for Friday April 2nd, 2021 appeared first on Malware Devil.

https://malwaredevil.com/2021/04/01/network-security-news-summary-for-friday-april-2nd-2021/?utm_source=rss&utm_medium=rss&utm_campaign=network-security-news-summary-for-friday-april-2nd-2021

Solver-Aided Constant-Time Circuit Verification

Read More

The post Solver-Aided Constant-Time Circuit Verification appeared first on Malware Devil.

https://malwaredevil.com/2021/04/01/solver-aided-constant-time-circuit-verification-2/?utm_source=rss&utm_medium=rss&utm_campaign=solver-aided-constant-time-circuit-verification-2