A snapshot of last week’s reported breaches and vulnerabilities

EOSBet Dice
A hacker exploited a vulnerability in a blockchain-based betting app in order to steal over 44,400 EOS coins. The app lets users bet EOS cryptocurrency as part of a classic dice game. The hacker sent transactions to the EOSBet main game account, which exploited a lack of proper parameter checks and tricked the game into sending back fake earnings. To read more: https://www.zdnet.com/article/blockchain-betting-app-mocks-competitor-for-getting-hacked-gets-hacked-four-days-later/

Trend Micro
Multiple apps developed by Trend Micro are no longer available on the Mac App store after researchers found they were collecting browser history. The apps that have been removed are Dr. Antivirus, Dr. Cleaner and Dr. Unarchiver. To read more: https://www.bleepingcomputer.com/news/security/trend-micro-apps-leak-user-data-removed-from-mac-app-store/

Linux Kodi
Users of Kodi, a popular media player, are the targets of a malware campaign. At least three popular repositories of Kodi add-ons were infected and then spread cryptocurrency mining malware. To read more: https://www.zdnet.com/article/windows-and-linux-kodi-users-infected-with-cryptomining-malware/

Veeam
A backup and data recovery company accidentally exposed a database containing more than 200 gigabytes of customer records. The database which didn’t have a password exposed 445 million email addresses. To read more: https://techcrunch.com/2018/09/11/veeam-security-lapse-leaked-over-440-million-email-addresses/

Reported Vulnerabilities

Tor Browser
Zerodium, an exploit vendor, publicly revealed a critical zero-day flaw in the Tor anonymous browsing software that could reveal a person’s identity to the sites they visit. The vulnerability is found in the NoScript browser plugin which comes pre-installed with the Mozilla Firefox bundle in the Tor software. To read more: https://thehackernews.com/2018/09/tor-browser-zero-day-exploit.html

Safari
A security researcher discovered a serious vulnerability that could allow attackers to spoof web addresses in the Microsoft Edge web browser for Windows and Safari for iOS. While Microsoft has fixed the vulnerability, Safari is still unpatched. To read more: https://thehackernews.com/2018/09/browser-address-spoofing-vulnerability.html

Firmware Bug
Researchers have built a proof of concept tool that prevents firmware from clearing secrets from memory. A successful attacker could steal “anything that happens to be in memory” like passwords and corporate network credentials. Microsoft and Apple are downplaying the risk because an attacker would need physical access to a device for the exploit to work. To read more: https://techcrunch.com/2018/09/12/security-flaw-in-nearly-all-modern-pcs-and-macs-leaks-encrypted-data/

Tesla
Security researchers have discovered a way to remotely hack a Tesla Model S by cloning its key fob. To read more: https://thehackernews.com/2018/09/tesla-model-s-remote-hack.html

VPNs
Researchers found vulnerabilities in popular VPN software, ProtonVPN, and NordVPN, which can lead to the execution of arbitrary code by attackers. The flaws CVE-2018–3952 and CVE-2018–4010 permit code execution on Microsoft Windows machines. To read more: https://www.zdnet.com/article/popular-vpns-contain-code-execution-security-flaws-despite-patches/

iOS attack
A security researcher found a new way to crash and restart any iPhone with 15 lines of code. The attack includes a webpage which, if visited, will crash and restart any iPhone or iPad. The code exploits a weakness in the web rendering engine. To read more: https://techcrunch.com/2018/09/15/a-new-css-based-web-attack-will-crash-and-restart-your-iphone/?utm_medium=TCnewsletter

Alpine Linux
Security researchers documented a remote-code execution flaw in Alpine Linux. The vulnerability could be exploited by someone with man-in-the-middle (MITM) network access or operating a malicious package mirror to inject arbitrary code via apk. To read more: https://www.theregister.co.uk/2018/09/15/alpine_linux_bug/

FragmentStack
Microsoft fixed the vulnerability that could cause Windows systems to become unresponsive due to 100% CPU utilization. The vulnerability is already well known in the Linux community. To read more: https://www.zdnet.com/article/fragmentsmack-vulnerability-also-affects-windows-but-microsoft-patched-it/

Intel
Intel released firmware updates for a security flaw that allows an attacker to recover, modify or delete data stored on Intel’s CPU chip-on-chip system. The vulnerability affects the Intel Converged Security and Manageability Engine. To read more: https://www.zdnet.com/article/security-flaw-can-leak-intel-me-encryption-keys/

Blueborne
Nine exploitable Bluetooth vulnerabilities that were discovered last year are still unsecured on two billion devices. The devices remain exposed because users haven’t updated them, or because they won’t receive updates at all. To read more: https://www.zdnet.com/article/two-billion-devices-still-exposed-after-blueborne-vulnerabilities-reveal/

MacOS Kernel
A severe vulnerability discovered in the Webroot SecureAnywhere antivirus software allows attacks to take place at the kernel level. This flaw impacts the macOS version of the software. To read more: https://www.zdnet.com/article/code-execution-bug-discovered-in-macos-webroot-secureanywhere-antivirus-software/

Cold boot
Security researchers detailed a new variation of a cold boot attack that can mess with a computer’s firmware to disable security measures. All cold boot attacks require physical access and special hardware tooling to perform. To read more: https://www.zdnet.com/article/new-cold-boot-attack-affects-nearly-all-modern-computers/

Want to learn more?

Sign up below and receive these reports and more directly in your inbox.

https://upscri.be/9816bc/

Like the report? Sign up below and get it in your inbox.