Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×

Submission + - IcedID: Original New Banking Trojan Emerges (helpnetsecurity.com)

Orome1 writes: IcedID, a new banking Trojan that does not seem to have borrowed code from other similar threats, has entered the financial cybercrime arena. It was first spotted in the wild in September 2017, and it currently targets banks, payment card providers, mobile services providers, payroll, webmail, and ecommerce sites in the US, Canada and the UK. IcedID has a modular architecture, and its current capabilities are likely just the beginning.

Submission + - Google Will Remove Apps That Misuse Android Accessibility Services From Google P (helpnetsecurity.com)

Orome1 writes: Android app developers whose offerings implement Accessibility Services for reasons other that helping users with disabilities use their apps have less then 30 days to switch to other methods, or risk their apps being removed from Google Play and their developer account terminated. Google has yet to say explicitly why they are making this move, but it’s believed that it’s a measure meant to stymie malware developers.

Submission + - Node.js Security: Are Developers Confident In The Quality Of Their Code? (helpnetsecurity.com)

Orome1 writes: A NodeSource and Sqreen joint developer survey of nearly 300 CTOs, CIOs and developers revealed that, while the developer community fully understands the risks of operating in the open Internet and the complexities of building secure code, developers are not taking advantage of tools that can identify and mitigate threats. The vast majority of the developers (79 percent) have poor to no insight as to when their applications are under attack.

Submission + - Phishing Is A Greater Threat To Users Than Keyloggers And Third-Party Breaches (helpnetsecurity.com)

Orome1 writes: Researchers from Google, University of California, Berkeley, and the International Computer Science Institute, scoured private and public forums, paste sites, and search index sites from March 2016 to March 2017, and identified 788,000 potential victims of keyloggers; 12.4 million potential victims of phishing kits; and 1.9 billion usernames and passwords exposed via data breaches. Using this dataset, they explored to what degree the passwords stolen from various online services enable an attacker to obtain a victim’s valid email credentials and, therefore, to gain access to and hijack their accounts.

Submission + - Chrome To Start Blocking Unwanted Redirects (helpnetsecurity.com)

Orome1 writes: By early 2018, Chrome will be blocking several types of unwanted and annoying redirects. In Chrome 64, these unexpected redirects triggered by third-party iframes will be blocked, users will be notified about it via an infobar, but will remain on the original page and be able to continue their browsing. Secondly, the browser will prevent actions that are aimed at circumventing Chrome’s pop-up blocker, i.e. instances when clicking a link opens the desired destination in a new tab, while the main window navigates to a different, unwanted page.

Submission + - The Wild West Of Drive-By Cryptocurrency Mining (helpnetsecurity.com)

Orome1 writes: As more and more Coinhive clones continue popping up, chances of users’ CPU power being hijacked for cryptocurrency mining are rising. According to Malwarebytes’ latest figures, their AV solution blocked an average of 8 million cryptojacking attempts per day from late September to late October. And that’s just the attempts tied to Coinhive domains and proxies! Rogue advertisers have used online ads to load the mining code surreptitiously in malvertising attacks. There is also the case of tech support scammers that use browser lockers to scare victims into thinking they have a virus.

Submission + - Privacy Issues We Need To Solve Before Non-Medical Iimplants Become Pervasive (helpnetsecurity.com)

Orome1 writes: The cybernetic revolution is happening, and it’s imperative that civil liberties and privacy issues are addressed by system designers, innovators, regulators, and legislators, says James Scott, a Senior Fellow at cybersecurity think tank ICIT (Institute for Critical Infrastructure Technology). He expects sophisticated cybernetic implant systems to be more widely deployed in the next decade, and would like to see security-by-design be prioritized while implant devices are still in the inceptive phase. If we fail to do that, he says, there may not be any way to mitigate the onslaught of privacy and security harms poised to disrupt humanity’s potential evolution.

Submission + - Apple Protects Its Wi-Fi Enabled Devices From KRACK Attack (helpnetsecurity.com)

Orome1 writes: Apple has released security updates for its many popular products, and has finally plugged the recently unveiled WPA2 flaws that allow attackers to extract sensitive information from Wi-Fi traffic. Fixes for preventing a KRACK attack being leveraged against users have been included in the updates for all of Apple’s Wi-Fi enabled devices: Macs, iPhones and iPads, Apple Watch and Apple TV.

Submission + - Researchers Analyze 3,200 Unique Phishing Kits (helpnetsecurity.com)

Orome1 writes: Researchers set out to analyze phishing kits left behind by lazy phishers on compromised websites/servers, so they trawled through sites hosting phishing URLs that have been submitted to Phishtank and OpenPhish. After a month, they found 3,200 unique ones, and their analysis revealed that there is some kit reuse, even though it’s not as extensive as expected given that the whole point of phishing kits is to make it easy for attackers to reuse code across phishing sites. They also found that only 11 percent of the compromised sites hosted multiple unique phishing kits, which means that either the same actor ran multiple campaigns simultaneously, or that multiple actors have compromised the same host.

Submission + - Firefox To Block Canvas-Based Browser Fingerprinting Attempts (helpnetsecurity.com)

Orome1 writes: Starting with Firefox 58, users will be able to refuse websites’ requests for information extracted via the HTML5 canvas element, which can be used to fingerprint their browsers. Browser fingerprinting is used as an alternative to browser cookies by websites and web analytics services that want to identify users and track their online behavior. With the change, which will require sites to prompt users for permission before they can extract canvas data, Firefox will become the first of the major browsers to do something about this ubiquitous online tracking technique.
Firefox

Firefox To Get a Better Password Manager (bleepingcomputer.com) 92

Catalin Cimpanu, reporting for BleepingComputer: Mozilla engineers have started work on a project named Lockbox that they describe as "a work-in-progress extension [...] to improve upon Firefox's built-in password management." Mozilla released the new extension for employee-use only at first, but users can install it by going to this or this links. Lockbox revamps Firefox's antiquated password management utility with a new user interface (UI). A new Firefox UI button is also included, in case users want to add a shortcut in their browser's main interface to open Lockbox without going through all the menu options. Support for a master password is included, helping users secure their passwords from unauthorized access by co-workers, family members, or others.
First Person Shooters (Games)

Thousands of Videogame-Playing Soldiers Could Shape the Future of War (theatlantic.com) 216

An anonymous reader quotes the Atlantic: As far as video games go, Operation Overmatch is rather unremarkable. Players command military vehicles in eight-on-eight matches against the backdrop of rendered cityscapes -- a common setup of games that sometimes have the added advantage of hundreds of millions of dollars in development budgets. Overmatch does have something unique, though: its mission. The game's developers believe it will change how the U.S. Army fights wars. Overmatch's players are nearly all soldiers in real life. As they develop tactics around futuristic weapons and use them in digital battle against peers, the game monitors their actions.

Each shot fired and decision made, in addition to messages the players write in private forums, is a bit of information soaked up with a frequency not found in actual combat, or even in high-powered simulations without a wide network of players. The data is logged, sorted, and then analyzed, using insights from sports and commercial video games. Overmatch's team hopes this data will inform the Army's decisions about which technologies to purchase and how to develop tactics using them, all with the aim of building a more forward-thinking, prepared force... While the game currently has about 1,000 players recruited by word of mouth and outreach from the Overmatch team, the developers eventually want to involve tens of thousands of soldiers. This milestone would allow for millions of hours of game play per year, according to project estimates, enough to generate rigorous data sets and test hypotheses.

Submission + - Critical Flaws In Maritime Comms System Could Endanger Entire Ships (helpnetsecurity.com)

Orome1 writes: IOActive security consultant Mario Ballano has discovered two critical cybersecurity vulnerabilities affecting Stratos Global’s AmosConnect communication shipboard platform. The platform works in conjunction with the ships' satellite equipment, and integrates vessel and shore-based office applications, as well as provides services like Internet access for the crew, email, IM, position reporting, etc. The vulnerabilities were found in AmosConnect 8.4.0, and Stratos Global was notified a year ago. But Inmarsat won't fix them, and has discontinued the 8.0 version of the platform in June 2017.

Submission + - Camera-Based, Single-Step Two-Factor Authentication Resilient To Attacks (helpnetsecurity.com) 3

Orome1 writes: A group of researchers from Florida International University and Bloomberg LP have created Pixie, a camera-based two-factor authentication system that could end up being a good alternative to passwords and biometrics-based 2FA options. “Pixie authentication is based on what the user has (the trinket) and what the user knows (the particular trinket among all the other objects that the user readily has access to, angle and viewpoint used to register the trinket),” the researchers explained. “Pixie assigns the duty of storing the token for the second factor to a physical object outside the mobile device.”

Slashdot Top Deals

On the eighth day, God created FORTRAN.

Working...