-
Security News @infosec.pub IllNess @infosec.pub Subaru Starlink flaw let hackers hijack cars in US and Canada
Security researchers have discovered an arbitrary account takeover flaw in Subaru's Starlink service that could let attackers track, control, and hijack vehicles in the United States, Canada, and Japan using just a license plate.
Curry says Subaru patched the vulnerability within 24 hours of the researchers' report and was never exploited by an attacker.
-
Security News @infosec.pub IllNess @infosec.pub Hackers use Windows RID hijacking to create hidden admin account
A North Korean threat group has been using a technique called RID hijacking that tricks Windows into treating a low-privileged account as one with administrator permissions.
-
Security News @infosec.pub IllNess @infosec.pub Hacker infects 18,000 "script kiddies" with fake malware builder
The CloudSEK researchers disrupted the botnet by utilizing hard-coded API tokens and a built-in kill switch to uninstall the malware from infected devices.
-
Security News @infosec.pub IllNess @infosec.pub Fake Homebrew Google ads target Mac users with malware
"Mac Homebrew Project Leader here. This seems taken down now," tweeted McQuaid.
-
Security News @infosec.pub IllNess @infosec.pub Mirai Variant Murdoc Botnet Exploits AVTECH IP Cameras and Huawei Routers
To safeguard against such attacks, it's advised to monitor suspicious processes, events, and network traffic spawned by the execution of any untrusted binary/scripts. It's also recommended to apply firmware updates and change the default username and password.
-
Security News @infosec.pub IllNess @infosec.pub Malicious PyPi package steals Discord auth tokens from devs
A malicious package named 'pycord-self' on the Python package index (PyPI) targets Discord developers to steal authentication tokens and plant a backdoor for remote control over the system.
-
Security News @infosec.pub IllNess @infosec.pub Apple Bug Allows Security Bypass Without Physical Access
cross-posted from: https://lemmy.zip/post/30049292
Emergent macOS vulnerability lets adversaries circumvent Apple's System Integrity Protection (SIP) by loading third-party kernels.
-
Security News @infosec.pub IllNess @infosec.pub Google OAuth Vulnerability Exposes Millions via Failed Startup Domains
New research has pulled back the curtain on a "deficiency" in Google's "Sign in with Google" authentication flow that exploits a quirk in domain ownership to gain access to sensitive data.
-
Security News @infosec.pub IllNess @infosec.pub Biden White House to go all out in final, sweeping cybersecurity order
www.csoonline.com Biden White House goes all out in final, sweeping cybersecurity orderThe ambitious final executive order requires 52 agency actions to bolster cyber protections and counter adversaries, including a new plan to address spiraling digital identity theft.
The ambitious final executive order requires 52 agency actions to bolster cyber protections and counter adversaries, including a new plan to address spiraling digital identity theft.
-
Security News @infosec.pub Deebster @infosec.pub Leaks Show Which Phones Secretive Tech ‘Graykey’ Can Unlock
www.404media.co Leaked Documents Show What Phones Secretive Tech ‘Graykey’ Can UnlockThe documents provide never-been-seen insight into the current cat-and-mouse game between forensics companies and phone manufacturers Apple and Google.
Archive Today mirror: https://archive.ph/JTLIU
AI summary
The webpage discusses leaked documents revealing the capabilities of Graykey, a phone unlocking and forensics tool utilized by law enforcement globally. According to the documents obtained by 404 Media, Graykey can retrieve only partial data from modern iPhones running iOS 18 and iOS 18.0.1. There is no information on its functionality with the recently released iOS 18.1. This leak is significant for Grayshift, the company behind Graykey, especially since it has been acquired by Magnet Forensics, another player in the digital forensics field. Unlike its competitor Cellebrite, which has experienced similar leaks, this is the first detailed disclosure of the specific phones Graykey can and cannot access. The documents also provide insights into Graykey's capabilities with Android devices. Overall, this situation highlights the ongoing struggle between forensics tools and phone manufacturers like Apple and Google. The informati
-
Security News @infosec.pub IllNess @infosec.pub 
gbhackers.com New Bluetooth Vulnerability Leak, Your Passcode to Hackers During PairingNew Bluetooth Vulnerability, this flaw could allow hackers to intercept passcodes during the device pairing process.
