Content by Jeremy Kirk

E-Commerce Skimming Attacks Evolve Into iFrame Injection

Jeremy Kirk  •  May 22, 2019

Criminal gangs have been hitting e-commerce sites hard lately by injecting their malicious code to "skim" customers' payment card details. In a recent twist, Malwarebytes spotted a malicious iFrame that steps in front of the normal payment process to intercept card details.

Database May Have Exposed Instagram Data for 49 Million

Jeremy Kirk  •  May 21, 2019

There's been a potential leak of personally identifiable information from Instagram, but it's not clear yet whether the data on 49 million users came directly from the social media company. A database that was left online without password protection has since been taken down.

Salesforce Says Permissions Bungle Almost Fixed

Jeremy Kirk  •  May 20, 2019

Salesforce says it has nearly recovered from a botched database update that wiped out user permissions within its Pardot marketing management product on Friday. The error allowed Salesforce users access to previously restricted profiles.

Researchers: Aircraft Landing Systems Vulnerable

Jeremy Kirk  •  May 17, 2019

The majority of aircraft accidents occur during landing. And during bad weather or low-visibility, pilots are trained to entirely trust their instruments. But researchers say they can spoof wireless signals to a critical landing system, which could cause planes to miss runways.

Trump Signs Executive Order That Could Ban Huawei

Jeremy Kirk  •  May 16, 2019

U.S. President Donald Trump on Wednesday signed a long-expected executive order that bans the purchase of telecommunication equipment from nations deemed to pose a spying risk. Also, Huawei was banned by the Commerce Department from buying U.S. components without obtaining a license first.

To Prevent Another WannaCry, Microsoft Patches Old OSs

Jeremy Kirk  •  May 15, 2019

Microsoft has taken the extraordinary step of issuing patches for its old XP, Windows 2003, Windows 7 and Windows Server 2008 operating systems. The problem is an easy-to-exploit Remote Desktop Services vulnerability that could be turned into a worm.

Cisco's 'Thrangrycat' Router Flaw Tough to Neuter

Jeremy Kirk  •  May 14, 2019

Researchers report finding a vexing vulnerability in Cisco routers that could invisibly undermine device integrity and allow attackers to take full control of a router, if combined with a second exploit. Unfortunately, hardware design flaws could complicate Cisco's efforts to safeguard users.

Alleged SIM Swappers Charged Over Cryptocurrency Thefts

Jeremy Kirk  •  May 13, 2019

Nine men have been charged in connection with an alleged SIM card swapping scheme that led to the theft of $2.4 million in cryptocurrency, the U.S. Justice Department says. The scheme allegedly involved the bribing of employees of Verizon and AT&T.

Chinese Men Charged With Hacking Health Insurer Anthem

Jeremy Kirk  •  May 10, 2019

Two Chinese men have been indicted on charges related to the breach of health insurer Anthem, which saw the personal information of 78.8 million individuals stolen, as well as attacks against three other large U.S. companies.

Canadian Mobile Provider Exposed Payment Card Numbers

Jeremy Kirk  •  May 8, 2019

An unsecured database belonging to Canadian mobile operator Freedom Mobile exposed personal details and unencrypted payment card data, according to two security researchers who discovered the data. The database has since been secured, with Freedom Mobile blaming the error on a third-party provider.

Report: Chinese Hackers First to Use NSA Cyberattack Tools

Jeremy Kirk  •  May 7, 2019

A Chinese hacking group was using exploits and tools developed by the NSA months before the tools were released by another group, Symantec says in a new report. The surprising report deepens the mystery around an extraordinary situation in which the U.S.'s most effective cyberweapons were compromised.

SAP's NetWeaver: New Exploits for Misconfigurations

Jeremy Kirk  •  May 3, 2019

New exploits released online that target long-known configuration weaknesses in SAP's NetWeaver platform could pose risks to payroll, invoicing and manufacturing processes, according to researchers at Onapsis. As many as 50,000 companies could be vulnerable.

Aussie Security Researcher Avoids Prison Over Hacking

Jeremy Kirk  •  May 2, 2019

An Australian security researcher who pleaded guilty to several charges related to probing the network of popular car-sharing service GoGet has avoided jail time. Nik Cubrilovic was sentenced to 400 hours of community service and must pay restitution to GoGet.

Vodafone, Huawei Dispute Report of Telnet 'Backdoor'

Jeremy Kirk  •  May 1, 2019

Vodafone is disputing a Bloomberg report that security vulnerabilities and backdoors within Huawei networking equipment could have allowed unauthorized access to its fixed-line carrier network in Italy. The report comes as Huawei continues to face concerns over its engineering practices and government ties.

Australia's New Infosec Regulation: A Compliance Challenge

Jeremy Kirk  •  April 30, 2019

Health insurers and financial institutions across Australia are in the final stretch of preparing for a cybersecurity regulation that looks to put companies on a strong footing amidst an increasingly hostile hacking environment. Here's why compliance with the regulation, CPS 234, is challenging.