Facebook Introduces New Features for End-to-End Encrypted Messenger App

Facebook Introduces New Features for End-to-End Encrypted Messenger App,

Meta Platforms on Monday announced that it has started to expand global testing of end-to-end encryption (E2EE) in Messenger chats by default.
« Over the next few months, more people will continue to see some of their chats gradually being upgraded with an extra layer of protection provided by end-to-end encryption, » Meta’s Melissa Miranda said.
The social media behemoth said it intends to notify

,

Meta Platforms on Monday announced that it has started to expand global testing of end-to-end encryption (E2EE) in Messenger chats by default.
« Over the next few months, more people will continue to see some of their chats gradually being upgraded with an extra layer of protection provided by end-to-end encryption, » Meta’s Melissa Miranda said.
The social media behemoth said it intends to notify

, ,
https://thehackernews.com/2023/01/facebook-introduces-new-features-for.html

Samsung Galaxy Store App Found Vulnerable to Sneaky App Installs and Fraud

Samsung Galaxy Store App Found Vulnerable to Sneaky App Installs and Fraud,

Two security flaws have been disclosed in Samsung’s Galaxy Store app for Android that could be exploited by a local attacker to stealthily install arbitrary apps or direct prospective victims to fraudulent landing pages on the web.
The issues, tracked as CVE-2023-21433 and CVE-2023-21434, were discovered by NCC Group and notified to the South Korean chaebol in November and December 2022. Samsung

,

Two security flaws have been disclosed in Samsung’s Galaxy Store app for Android that could be exploited by a local attacker to stealthily install arbitrary apps or direct prospective victims to fraudulent landing pages on the web.
The issues, tracked as CVE-2023-21433 and CVE-2023-21434, were discovered by NCC Group and notified to the South Korean chaebol in November and December 2022. Samsung

, ,
https://thehackernews.com/2023/01/samsung-galaxy-store-app-found.html

SaaS Security Posture Management (SSPM) as a Layer in Your Identity Fabric

SaaS Security Posture Management (SSPM) as a Layer in Your Identity Fabric,

The move to SaaS and other cloud tools has put an emphasis on Identity & Access Management (IAM). After all, user identity is one of the only barriers standing between sensitive corporate data and any unauthorized access. 
The tools used to define IAM make up its identity fabric. The stronger the fabric, the more resistant identities are to pressure from threat actors. However, those pressures

,

The move to SaaS and other cloud tools has put an emphasis on Identity & Access Management (IAM). After all, user identity is one of the only barriers standing between sensitive corporate data and any unauthorized access. 
The tools used to define IAM make up its identity fabric. The stronger the fabric, the more resistant identities are to pressure from threat actors. However, those pressures

, ,
https://thehackernews.com/2023/01/saas-security-posture-management-sspm.html

Ce malware menace de prendre le contrôle de votre smartphone à distance

Ce malware menace de prendre le contrôle de votre smartphone à distance,

android

Un dangereux malware visant les smartphones Android a été repéré. Il est capable de prendre le contrôle complet d’un téléphone à distance pour commettre une fraude.

,

android

Un dangereux malware visant les smartphones Android a été repéré. Il est capable de prendre le contrôle complet d’un téléphone à distance pour commettre une fraude.

, ,
https://www.01net.com/actualites/ce-malware-menace-de-prendre-le-controle-de-votre-smartphone-a-distance.html

Threat Actors Turn to Sliver as Open Source Alternative to Popular C2 Frameworks

Threat Actors Turn to Sliver as Open Source Alternative to Popular C2 Frameworks,

The legitimate command-and-control (C2) framework known as Sliver is gaining more traction from threat actors as it emerges as an open source alternative to Cobalt Strike and Metasploit.
The findings come from Cybereason, which detailed its inner workings in an exhaustive analysis last week.
Sliver, developed by cybersecurity company BishopFox, is a Golang-based cross-platform post-exploitation

,

The legitimate command-and-control (C2) framework known as Sliver is gaining more traction from threat actors as it emerges as an open source alternative to Cobalt Strike and Metasploit.
The findings come from Cybereason, which detailed its inner workings in an exhaustive analysis last week.
Sliver, developed by cybersecurity company BishopFox, is a Golang-based cross-platform post-exploitation

, ,
https://thehackernews.com/2023/01/threat-actors-turn-to-sliver-as-open.html

Massive Ad Fraud Scheme Targeted Over 11 Million Devices with 1,700 Spoofed Apps

Massive Ad Fraud Scheme Targeted Over 11 Million Devices with 1,700 Spoofed Apps,

Researchers have shut down an « expansive » ad fraud scheme that spoofed more than 1,700 applications from 120 publishers and impacted roughly 11 million devices. 
« VASTFLUX was a malvertising attack that injected malicious JavaScript code into digital ad creatives, allowing the fraudsters to stack numerous invisible video ad players behind one another and register ad views, » fraud prevention firm

,

Researchers have shut down an « expansive » ad fraud scheme that spoofed more than 1,700 applications from 120 publishers and impacted roughly 11 million devices. 
« VASTFLUX was a malvertising attack that injected malicious JavaScript code into digital ad creatives, allowing the fraudsters to stack numerous invisible video ad players behind one another and register ad views, » fraud prevention firm

, ,
https://thehackernews.com/2023/01/massive-ad-fraud-scheme-targeted-over.html

Roaming Mantis Spreading Mobile Malware That Hijacks Wi-Fi Routers’ DNS Settings

Roaming Mantis Spreading Mobile Malware That Hijacks Wi-Fi Routers’ DNS Settings

,

Threat actors associated with the Roaming Mantis attack campaign have been observed delivering an updated variant of their patent mobile malware known as Wroba to infiltrate Wi-Fi routers and undertake Domain Name System (DNS) hijacking.
Kaspersky, which carried out an analysis of the malicious artifact, said the feature is designed to target specific Wi-Fi routers located in South Korea.

,

Threat actors associated with the Roaming Mantis attack campaign have been observed delivering an updated variant of their patent mobile malware known as Wroba to infiltrate Wi-Fi routers and undertake Domain Name System (DNS) hijacking.
Kaspersky, which carried out an analysis of the malicious artifact, said the feature is designed to target specific Wi-Fi routers located in South Korea.

, ,
https://thehackernews.com/2023/01/roaming-mantis-spreading-mobile-malware.html

Gamaredon Group Launches Cyberattacks Against Ukraine Using Telegram

Gamaredon Group Launches Cyberattacks Against Ukraine Using Telegram,

The Russian state-sponsored cyber espionage group known as Gamaredon has continued its digital onslaught against Ukraine, with recent attacks leveraging the popular messaging app Telegram to strike military and law enforcement sectors in the country.
« The Gamaredon group’s network infrastructure relies on multi-stage Telegram accounts for victim profiling and confirmation of geographic location,

,

The Russian state-sponsored cyber espionage group known as Gamaredon has continued its digital onslaught against Ukraine, with recent attacks leveraging the popular messaging app Telegram to strike military and law enforcement sectors in the country.
« The Gamaredon group’s network infrastructure relies on multi-stage Telegram accounts for victim profiling and confirmation of geographic location,

, ,
https://thehackernews.com/2023/01/gamaredon-group-launches-cyberattacks.html

WhatsApp Hit with €5.5 Million Fine for Violating Data Protection Laws

WhatsApp Hit with €5.5 Million Fine for Violating Data Protection Laws,

The Irish Data Protection Commission (DPC) on Thursday imposed fresh fines of €5.5 million against Meta’s WhatsApp for violating data protection laws when processing users’ personal information.
At the heart of the ruling is an update to the messaging platform’s Terms of Service that was enforced in the days leading to the enforcement of the General Data Protection Regulation (GDPR) in May 2018,

,

The Irish Data Protection Commission (DPC) on Thursday imposed fresh fines of €5.5 million against Meta’s WhatsApp for violating data protection laws when processing users’ personal information.
At the heart of the ruling is an update to the messaging platform’s Terms of Service that was enforced in the days leading to the enforcement of the General Data Protection Regulation (GDPR) in May 2018,

, ,
https://thehackernews.com/2023/01/whatsapp-hit-with-55-million-fine-for.html

Chinese Hackers Exploited Recent Fortinet Flaw as 0-Day to Drop Malware

Chinese Hackers Exploited Recent Fortinet Flaw as 0-Day to Drop Malware,

A suspected China-nexus threat actor exploited a recently patched vulnerability in Fortinet FortiOS SSL-VPN as a zero-day in attacks targeting a European government entity and a managed service provider (MSP) located in Africa.
Telemetry evidence gathered by Google-owned Mandiant indicates that the exploitation occurred as early as October 2022, at least nearly two months before fixes were

,

A suspected China-nexus threat actor exploited a recently patched vulnerability in Fortinet FortiOS SSL-VPN as a zero-day in attacks targeting a European government entity and a managed service provider (MSP) located in Africa.
Telemetry evidence gathered by Google-owned Mandiant indicates that the exploitation occurred as early as October 2022, at least nearly two months before fixes were

, ,
https://thehackernews.com/2023/01/new-chinese-malware-spotted-exploiting.html