Researchers from Kaspersky Lab have developed a method of decrypting files affected with the latest version of CryptXXX, a malware program that combines ransomware and information-stealing capabilities.CryptXXX was first discovered in April by security researchers from Proofpoint. In addition to encrypting user files on local drives and network shares, the malware also steals saved log-in credentials from browsers, instant messaging applications, FTP clients and email clients. It then asks for a US$500 ransom to be paid in bitcoins.Researchers from Kaspersky Lab found a way to recover files affected by the original variant of CryptXXX and created a decryptor tool. However, on May 6, CryptXXX authors released a new version that rendered that tool ineffective.To read this article in full or to leave a comment, please click here
Researchers from Kaspersky Lab have developed a method of decrypting files affected with the latest version of CryptXXX, a malware program that combines ransomware and information-stealing capabilities.CryptXXX was first discovered in April by security researchers from Proofpoint. In addition to encrypting user files on local drives and network shares, the malware also steals saved log-in credentials from browsers, instant messaging applications, FTP clients and email clients. It then asks for a US$500 ransom to be paid in bitcoins.Researchers from Kaspersky Lab found a way to recover files affected by the original variant of CryptXXX and created a decryptor tool. However, on May 6, CryptXXX authors released a new version that rendered that tool ineffective.To read this article in full or to leave a comment, please click here
The Petya ransomware now bundles a second file-encrypting program for cases where it cannot replace a computer's master boot record to encrypt its file table.Petya is an unusual ransomware threat that first popped up on security researchers' radar in March. Instead of encrypting a user's files directly, it encrypts the master file table (MFT) used by NTFS disk partitions to hold information about file names, sizes and location on the physical disk.Before encrypting the MFT, Petya replaces the computer's master boot record (MBR), which contains code that initiates the operating system's bootloader. Petya replaces it with its own malicious code that displays the ransom note and leaves computers unable to boot.To read this article in full or to leave a comment, please click here
Adobe Systems has released a security update for Flash Player in order to fix a publicly known vulnerability, as well as 24 privately reported security flaws.The company issued a warning about the zero-day -- previously unknown and unpatched -- vulnerability on Tuesday, saying that it is aware of an exploit available in the wild. The flaw, tracked as CVE-2016-4117, was reported by security researchers from FireEye.To read this article in full or to leave a comment, please click here
Adobe Systems has released a security update for Flash Player in order to fix a publicly known vulnerability, as well as 24 privately reported security flaws.The company issued a warning about the zero-day -- previously unknown and unpatched -- vulnerability on Tuesday, saying that it is aware of an exploit available in the wild. The flaw, tracked as CVE-2016-4117, was reported by security researchers from FireEye.To read this article in full or to leave a comment, please click here
Two vulnerabilities recently patched in 7-Zip could put at risk of compromise many software products and devices that bundle the open-source file archiving library.The flaws, an out-of-bounds read vulnerability and a heap overflow, were discovered by researchers from Cisco's Talos security team. They were fixed in 7-Zip 16.00, released Tuesday.The 7-Zip software can pack and unpack files using a large number of archive formats, including its own 7z format, which is more efficient than ZIP. Its versatility and open-source nature make it an attractive library to include in other software projects that need to process and deal with archived files.To read this article in full or to leave a comment, please click here
Two vulnerabilities recently patched in 7-Zip could put at risk of compromise many software products and devices that bundle the open-source file archiving library.The flaws, an out-of-bounds read vulnerability and a heap overflow, were discovered by researchers from Cisco's Talos security team. They were fixed in 7-Zip 16.00, released Tuesday.The 7-Zip software can pack and unpack files using a large number of archive formats, including its own 7z format, which is more efficient than ZIP. Its versatility and open-source nature make it an attractive library to include in other software projects that need to process and deal with archived files.To read this article in full or to leave a comment, please click here
The IT department of the U.S. House of Representatives has blocked access to Yahoo Mail and the Google App Engine platform due to malware threats.On April 30, the House’s Technology Service Desk informed users about an increase in ransomware related emails on third-party email services like Yahoo Mail and Gmail."The House Information Security Office is taking a number of steps to address this specific attack," the Technology Service Desk said in an email obtained and published by Gizmodo. "As part of that effort, we will be blocking access to Yahoo Mail on the House Network until further notice."To read this article in full or to leave a comment, please click here
The IT department of the U.S. House of Representatives has blocked access to Yahoo Mail and the Google App Engine platform due to malware threats.On April 30, the House’s Technology Service Desk informed users about an increase in ransomware related emails on third-party email services like Yahoo Mail and Gmail."The House Information Security Office is taking a number of steps to address this specific attack," the Technology Service Desk said in an email obtained and published by Gizmodo. "As part of that effort, we will be blocking access to Yahoo Mail on the House Network until further notice."To read this article in full or to leave a comment, please click here
Adobe Systems is working on a patch for a critical vulnerability in Flash Player that hackers are already exploiting in attacks. In the meantime, the company has released other security patches for Reader, Acrobat, and ColdFusion.The Flash Player vulnerability is being tracked as CVE-2016-4117 and affects Flash Player versions 21.0.0.226 and earlier for Windows, OS X, Linux, and Chrome OS. Successful exploitation can allow attackers to take control of affected systems."Adobe is aware of a report that an exploit for CVE-2016-4117 exists in the wild," the company said in an advisory published Tuesday. "Adobe will address this vulnerability in our monthly security update, which will be available as early as May 12."To read this article in full or to leave a comment, please click here
Adobe Systems is working on a patch for a critical vulnerability in Flash Player that hackers are already exploiting in attacks. In the meantime, the company has released other security patches for Reader, Acrobat, and ColdFusion.The Flash Player vulnerability is being tracked as CVE-2016-4117 and affects Flash Player versions 21.0.0.226 and earlier for Windows, OS X, Linux, and Chrome OS. Successful exploitation can allow attackers to take control of affected systems."Adobe is aware of a report that an exploit for CVE-2016-4117 exists in the wild," the company said in an advisory published Tuesday. "Adobe will address this vulnerability in our monthly security update, which will be available as early as May 12."To read this article in full or to leave a comment, please click here
Microsoft released patches for 51 vulnerabilities Tuesday, including one affecting Internet Explorer that hackers have exploited in targeted attacks against organizations in South Korea.The Microsoft patches were covered in 16 security bulletins, eight rated critical and eight important. The affected products include Windows, Internet Explorer, Microsoft Edge, Office and Microsoft .NET Framework.The patches included in the IE and Edge security bulletins, MS16-051 and MS16-052, are among the most important ones and should be prioritized because they can be exploited to compromise computers when users visit specially crafted Web pages.To read this article in full or to leave a comment, please click here
Microsoft released patches for 51 vulnerabilities Tuesday, including one affecting Internet Explorer that hackers have exploited in targeted attacks against organizations in South Korea.The Microsoft patches were covered in 16 security bulletins, eight rated critical and eight important. The affected products include Windows, Internet Explorer, Microsoft Edge, Office and Microsoft .NET Framework.The patches included in the IE and Edge security bulletins, MS16-051 and MS16-052, are among the most important ones and should be prioritized because they can be exploited to compromise computers when users visit specially crafted Web pages.To read this article in full or to leave a comment, please click here
The U.K.'s National Crime Agency (NCA) failed in its attempt to use what critics described as a legal backdoor to force a suspected hacker to provide the decryption key for data on multiple devices.Lauri Love, 31, was arrested by U.K. authorities in 2013 under suspicion of hacking into computers belonging to multiple U.S. government agencies including NASA, the FBI, the Federal Reserve, and the Army.Love is the subject of separate indictments in courts in New Jersey, New York, and Virginia and faces extradition to the U.S. An extradition hearing is scheduled for the end of June.To read this article in full or to leave a comment, please click here
The U.K.'s National Crime Agency (NCA) failed in its attempt to use what critics described as a legal backdoor to force a suspected hacker to provide the decryption key for data on multiple devices.Lauri Love, 31, was arrested by U.K. authorities in 2013 under suspicion of hacking into computers belonging to multiple U.S. government agencies including NASA, the FBI, the Federal Reserve, and the Army.Love is the subject of separate indictments in courts in New Jersey, New York, and Virginia and faces extradition to the U.S. An extradition hearing is scheduled for the end of June.To read this article in full or to leave a comment, please click here
Over the past week security researchers have seen increasing attempts by hackers to find servers vulnerable to remote code execution vulnerabilities recently found in the ImageMagick Web server library.The flaws were publicly disclosed last Tuesday by researchers who had reason to believe that malicious attackers already had knowledge about them after an initial fix from the ImageMagick developers proved to be incomplete. The flaws were collectively dubbed ImageTragick and a website with more information was set up to attract attention to them.To read this article in full or to leave a comment, please click here
Over the past week security researchers have seen increasing attempts by hackers to find servers vulnerable to remote code execution vulnerabilities recently found in the ImageMagick Web server library.The flaws were publicly disclosed last Tuesday by researchers who had reason to believe that malicious attackers already had knowledge about them after an initial fix from the ImageMagick developers proved to be incomplete. The flaws were collectively dubbed ImageTragick and a website with more information was set up to attract attention to them.To read this article in full or to leave a comment, please click here
Wireless networking device manufacturer Aruba Networks has fixed multiple vulnerabilities in its software that could, under certain circumstances, allow attackers to compromise devices.The vulnerabilities were discovered by Sven Blumenstein from the Google Security Team and affect ArubaOS, Aruba's AirWave Management Platform (AMP) and Aruba Instant (IAP).There are 26 different issues, ranging from privileged remote code execution to information disclosure, insecure updating mechanism and insecure storage of credentials and private keys. However, Aruba combined them all under two CVE tracking IDs: CVE-2016-2031 and CVE-2016-2032.Common issues that are shared by all of the affected software packages have to do with design flaws in an Aruba proprietary management and control protocol dubbed PAPI.To read this article in full or to leave a comment, please click here
Wireless networking device manufacturer Aruba Networks has fixed multiple vulnerabilities in its software that could, under certain circumstances, allow attackers to compromise devices.The vulnerabilities were discovered by Sven Blumenstein from the Google Security Team and affect ArubaOS, Aruba's AirWave Management Platform (AMP) and Aruba Instant (IAP).There are 26 different issues, ranging from privileged remote code execution to information disclosure, insecure updating mechanism and insecure storage of credentials and private keys. However, Aruba combined them all under two CVE tracking IDs: CVE-2016-2031 and CVE-2016-2032.Common issues that are shared by all of the affected software packages have to do with design flaws in an Aruba proprietary management and control protocol dubbed PAPI.To read this article in full or to leave a comment, please click here
Wireless networking device manufacturer Aruba Networks has fixed multiple vulnerabilities in its software that could, under certain circumstances, allow attackers to compromise devices.The vulnerabilities were discovered by Sven Blumenstein from the Google Security Team and affect ArubaOS, Aruba's AirWave Management Platform (AMP) and Aruba Instant (IAP).There are 26 different issues, ranging from privileged remote code execution to information disclosure, insecure updating mechanism and insecure storage of credentials and private keys. However, Aruba combined them all under two CVE tracking IDs: CVE-2016-2031 and CVE-2016-2032.Common issues that are shared by all of the affected software packages have to do with design flaws in an Aruba proprietary management and control protocol dubbed PAPI.To read this article in full or to leave a comment, please click here
Lucian Constantin