LifeJournal: 26 million of records stolen in 2014 sold on the dark web.

Blogging platform LifeJournal did experience a data breach in 2014 but credentials appeared online this year.

According to different sources, the first hackers’ mention of the data availability started in the end of 2018. Another blogging platform, DreamWidth, forked previously from the LifeJournal, was also targeted via multiple credential stuffing attacks.

While LifeJournal never confirmed a breach, multiple resources had published some details found on the dark web. ZDNet with a help of threat intelligence firm Kela has confirmed the existence of the LifeJournal database online.

#programming #coding #quotes

Silent Night: Zeus Banking Trojan.

According to researches Zeus, a famous banking Trojan, has been recently sold in the underground markets. As was published by Malwarebytes and HYAS, the Trojan, dubbed Silent Night, was distributed via COVID-19 spam campaigns and RIG exploit kit.

According to Malwarebytes, Silent Night is compatible with all operating system and known by collecting information from online forms. It also performs web injections in different web browsers (Chrome, Firefox, IE), takes screenshots, steals cookies, passwords from Chrome, banking credentials.

In 2011 Zeus’s source code was leaked. Since then, different Zeus’ “versions” were developed and released. Recently banks observed an attack from one of this developed Trojans, Zeus Sphinx.

Facebook: In-app Scam Notifications.

Facebook is presenting Messenger notifications to warn people about connecting with scammers.

According to Mashable, if you are talking with someone who may be scammer, Messenger will send you a “safety notice” and propose steps you can take to avoid potential scam.

People under 18 will now receive alerts in a case of inappropriate Facebook conversation.

Jay Sullivan, Facebook’s director of product management, recently wrote in an official blog: “We developed these safety tips with machine learning that looks at behavioral signals like an adult sending a large amount of friend or message requests to people under 18.“

70% of Mobile and Desktop Applications Contain Bugs.

Based on Veracode’s annual State of Software Security report 70 % of mobile and desktop apps contain open-source bugs. Analysis has examined more than 350 000 external libraries used in 81 000 applications and found that open-source libraries are commonly used.

These libraries may contain bugs and re-using the code developers are spreading these bugs.

According to Veracode: “It would be nearly impossible to innovate with software without these libraries. However, lack of awareness about where and how open source libraries are being used and their risk factors is a problematic practice.”

Based on the report the main libraries are Swift, .NET, Go and PHP. Swift has the highest level of flaws; .NET libraries has the lowest percentage of bugs. Go and PHP are in the middle between the first two.

Veracode also found that the most common vulnerability category is a cross-site scripting (XSS) – present in 30% of analysed libraries. Insecure deserialization stands after – 23.5 % and access control has 20.3 %.

#programming #coding #quotes

New Smartphone Chip from Samsung: Soon?

Samsung announced a new secure element to protect sensitive data on smartphones. According to Samsung, the chip (S3FV0RR) will be offered as standalone turnkey with security software. It will provide protection on smartphones and tablets for different operations such as mobile payments, isolate storage etc. The chip can also be used as cryptocurrency wallet and e-passport.

Samsung said that SE chip will be available in the third quarter of 2020.