US consumers - Freezing your credit files DOES NOT HELP if you have not heard of NCTUE? Here is the bonus, NCTUE is also tied to Equifax. You may have to add NCTUE to the list of orgs to request credit freeze.

Mobile phone merchants do not ask any of the four credit bureaus, they are making credit queries with this organization. 

There are four “exchanges” that feed into the NCTUE’s system: the NCTUE itself; something called “Centralized Credit Check Systems“; the New York Data Exchange; and the California Utility Exchange.

The NYDE is operated by Equifax Credit Information Services Inc. (yes, that Equifax). Verizon is one of many telecom providers that use the NYDE (and recall that AT&T was the founder of NCTUE).

Many people who have succeeded in freezing their credit files with Equifax have nonetheless had their identities stolen and new accounts opened in their names thanks to a lesser-known credit bureau that seems to rely entirely on credit checking entities operated by Equifax.

NCTUE makes it fairly easy to obtain any records they may have on Americans.  Simply phone them up (1-866-349-5185) and provide your Social Security number and the numeric portion of your registered street address.

you can place a freeze on your NCTUE report by calling their 800-number — 1-866-349-5355.


https://krebsonsecurity.com/2018/05/another-credit-freeze-target-nctue-com/

where would you want to spend your security dollars based on the following:

The Wandera’s Phishing Report 2018 shows 
(1) iOS users are 18x more likely to be phished than to download malware,
(2) 4000 new mobile phishing websites are launched every day.
(3) 57% of all Internet traffic coming from mobile devices.
(4) 170% increase of SMS phishing
      and
       A 102% increase in social app phishing from 2017 to 2018.
(5) The average iOS user has 14 different accounts on their work phone.
(6) 90% of cyberattacks start with a phishing attack
(7) Users are 3x more likely to fall for phishing on mobile than desktop.





Applications where mobile phishing attacks originate

• Messaging (17.3%)
• Social media (16.4%)
• Dating (6.2%)
• Gaming (11.3%)
• Email (15.4%)

Top 5 apps for messenger phishing
1. Messenger (inbuilt iOS/Android)
2. WhatsApp
3. Facebook Messenger
4. LINE
5. Viber

Top 10 brands targeted by phishing attacks

1. Facebook
2. Apple
3. Google
4. Amazon
5. Paypal
6. Government sites
7. Microsoft
8. Fox News
9. Dropbox
10. Whatsapp.

Top 5 TLDs that host phishing attacks

• .com
• .ga
• .tk
• .ml
• .cf

https://www.helpnetsecurity.com/2018/05/08/ios-phishing-malware/

Message bomb for Android Phones

 Involves sending and receiving a specially crafted (whatsapp) message with hidden symbols in-between spaces. Tapping on a portion of the text will basically make the app 'expand' the hidden symbols, potentially overloading the app and even the OS

A bug is being forwarded via WhatsApp messages which when tapped, could send not just the Android app crashing but possibly even the entire Android device as well



Another "message bomb" which is causing the messaging platform to crash is more "nefarious, looks too innocent" and does not come with a warning. The message includes special characters followed by an emoji that do not display visibly but are used to change text behaviour. The message, containing the text "This is very interesting!" is followed by a crying laughing emoji at the end. As per a Reddit user, the message is so heavy that it is crashing the smartphone upon copying and pasting on another chat box. The string of characters, leading to the enormous size of the message is what is expected to be crashing the app.


http://www.ehackingnews.com/2018/05/new-whatsapp-message-can-crash-your-app.html

On your smartphone, Is it possible to deliver Malware via your browser without downloading an app? - Yes using an old technique called "row hammering" ,the researchers call it "Glitch" attack.

Greatly simplified, row hammering means reading the same DRAM memory addresses over and over again

Aim: pull off a row hammering attack in the browser, using nothing more than JavaScript served up in a web page.

They figured out how to align their “hammerable row” with a JavaScript array in such a way that random bit flips in the array might, with a bit of luck, give them read and write access to memory in ways that JavaScript is supposed to prevent.

That means not only data leakage by reading from memory that’s supposed to be private, but also the possibility of remote code execution (RCE) by poking machine code into protected memory and then running it. 


https://nakedsecurity.sophos.com/2018/05/05/serious-security-the-glitch-row-hammering-attack/

Process Doppelganging - If you are worried about Ransomware then you should be aware of it (SynAck ransomware is using it already using this technique)

fileless evasion technique for bypassing real-time file scanning by most AV software and next generation AV tools for all versions of Windows since Windows Vista. Unlike malware that has to be written to disk or run completely from memory, with Process Doppelganging, threat actors can build malware that can run from what appears to be a completely legitimate-looking file

By manipulating how Windows handles file transactions, attackers can pass off malicious actions as harmless, legitimate processes, even if they are using known malicious code


SynAck's latest version also can detect whether it's being launched from an automated sandbox: if so, it will promptly exit the sandbox. Before it actually begins to encrypt files, SynAck also checks the hashes of all processes that are running on the compromised machine, and tries to kill any processes that match a list of processes hard-coded into the malware.

Processes that SynAck is designed to kill include virtual machines, database applications, backup systems, and gaming applications in what appears to be a bid to make it easier to seize high-value files which may otherwise be tied to a running process,

https://www.darkreading.com/attacks-breaches/synack-ransomware-gets-dangerous-doppleganging-feature/d/d-id/1331736?_mc=KJH-Twitter-2018-05

"Alexa, are you spying on me?" — aaaa.....mmmm.....hmmm.....maybe!!!

Amazon  allows developers to build custom 'skills,' applications for Alexa, which is the brain behind millions of voice-activated smart devices including Amazon Echo Show, Echo Dot, and Amazon Tap.

Security researchers have developed a new malicious 'skill' for Amazon's popular voice assistant Alexa that can turn your Amazon Echo into a full-fledged spying device.




Luckily, you can still spot the spy red handed if you notice the blue light on your Echo device activated for a longer period, especially when you are not chit-chatting with it


https://thehackernews.com/2018/04/amazon-alexa-hacking-skill.html

For some, this could be a very useful infographic. World's best hangover cure

https://informationisbeautiful.net/visualizations/worlds-best-hangover-cure/