Friday, July 19, 2019

(From Twitter)For Infosec Pros who blame users -


Users: you gave us USB ports, but told us not to plug anything into them.

You tell us "Don't open links." But let's be real: if it was easy to spot a malicious link, you'd have already blocked it.

You tell us "don't open attachments" but it's something we HAVE to do for our jobs. Again, if spotting the malicious attachment was easy, why did you, the professionals, let it get to my inbox?

Thursday, July 18, 2019

We watch TV , ever wonder what could happen if if TV is watching us

Guy finds  a video of himself and his wife on an X-rated website.Later , “cybersecurity experts” discovered that a hacker had hijacked control of the camera in his smart TV and captured footage of him as he “canoodled” with his wife on the sofa.

https://www.grahamcluley.com/did-a-hacked-smart-tv-upload-footage-of-couple-having-sofa-sex-to-a-porn-website/

Wednesday, July 17, 2019

Spearphone Attack - New Attack Lets Android Apps Capture Loudspeaker Data Without Any Permission


A separate team of cybersecurity researchers has successfully demonstrated a new side-channel attack that could allow malicious apps to eavesdrop on the voice coming out of your smartphone's loudspeakers without requiring any device permission.

Dubbed Spearphone, the newly demonstrated attack takes advantage of a hardware-based motion sensor, called an accelerometer, which comes built into most Android devices and can be unrestrictedly accessed by any app installed on a device even with zero permissions.


https://thehackernews.com/2019/07/android-side-channel-attacks.html

Tuesday, July 16, 2019

Insider Threat - Forget DLP, how many of us block USB or Cloud Storage?

- A newly unsealed federal indictment charges a software engineer for stealing proprietary information from his workplace and bringing it to China,
Within two weeks of his hiring date, Yao downloaded more than 3,000 files containing proprietary and trade secret data related to the system that runs the company's locomotives. Over the following six months he continued to download electronic files containing technical documents and software source code.


https://www.darkreading.com/risk/software-engineer-charged-for-taking-stolen-trade-secrets-to-china/d/d-id/1335224

Attention please !! - Hackers Can Manipulate Media Files You Receive Via WhatsApp and Telegram



Dubbed "Media File Jacking," the attack leverages an already known fact that any app installed on a device can access and rewrite files saved in the external storage, including files saved by other apps installed on the same device.

Security researchers at Symantec yesterday demonstrated multiple interesting attack scenarios against WhatsApp and Telegram Android apps, which could allow malicious actors to spread fake news or scam users into sending payments to wrong accounts.

https://thehackernews.com/2019/07/media-files-whatsapp-telegram.html