Lifeboat Foundation: Safeguarding Humanity
Toggle light / dark theme

Blog

Category: cybercrime/malcode – Page 176

In February, an artificial intelligence lab cofounded by Elon Musk informed the world that its latest breakthrough was too risky to release to the public. OpenAI claimed it had made language software so fluent at generating text that it might be adapted to crank out fake news or spam.

On Thursday, two recent master’s graduates in computer science released what they say is a re-creation of OpenAI’s withheld software onto the internet for anyone to download and use.

Aaron Gokaslan, 23, and Vanya Cohen, 24, say they aren’t out to cause havoc and don’t believe such software poses much risk to society yet. The pair say their release was intended to show that you don’t have to be an elite lab rich in dollars and PhDs to create this kind of software: They used an estimated $50,000 worth of free cloud computing from Google, which hands out credits to academic institutions. And they argue that setting their creation free can help others explore and prepare for future advances—good or bad.

Read more | >

The Internal Revenue Service (IRS) is warning taxpayers about a snowballing email attack that uses messages pretending to be legitimate IRS communications. The end game for the effort is malware being installed on unsuspecting users’ machines; imposters may gain control of the taxpayer’s computer or secretly download software that tracks every keystroke, eventually giving them passwords to sensitive accounts, such as financial accounts.

The gambit starts with messages to taxpayers from email addresses that spoof legitimate IRS addresses. The emails contain a link to a spoofed IRS.gov website that displays fake details about the targeted recipient’s tax refund, return or account.

The fake emails have subject lines like “Automatic Income Tax Reminder” or “Electronic Tax Return Reminder.” They claim to contain a “temporary password” or “one-time password” to access the files purportedly needed to submit a request for a refund or for information. However, those files are actually just malware in disguise.

Read more | >

In a recent Security Response Center update from Microsoft, the company detailed the discovery of two “critical” Remote Code Execution (RCE) vulnerabilities.

The vulnerabilities are “wormable”, meaning that any future malware that exploits these could jump from computer to computer without any need for users sending it across.

RELATED: MICROSOFT JOINS APPLE, AMAZON AS $1 TRILLION COMPANY

Read more | >

A group of security researchers has found that some cameras are vulnerable to ransomware attacks via Wi-Fi or hijacked computers (using the USB connection) that can render a camera and its photos entirely usage until a sum of money is paid to the hackers.

Check Point Software Technologies has shown (as seen in the video above) that Canon DSLRs (it’s not clear if other cameras are also affected) are susceptible to ransomware attacks, an increasingly common exploitation in which a hacker disables a device until the owner pays a ransom to regain control. As more and more electronics gain internet connectivity, these attacks are becoming more common, particularly since manufacturers typically don’t put the same sort of effort into fortifying the network security of small electronics as they do into computers. Canon released a statement in which they offered some barebones tips to avoid being susceptible to these attacks and noted that there have been no known instances of such an attack occurring. They did not indicate whether they plan to fix the vulnerabilities through firmware updates, so it probably doesn’t hurt to be a bit more careful to protect your photos.

Read more | >

PITTSBURGH, Aug. 12, 2019 /PRNewswire/ — Carnegie Mellon University’s competitive hacking team, the Plaid Parliament of Pwning (PPP), just won its fifth hacking world championship in seven years at this year’s DefCon security conference, widely considered the “World Cup” of hacking. The championship, played in the form of a virtual game of “capture the flag,” was held August 8–11 in Las Vegas.

PPP now holds two more DefCon titles than any other team in the 23-year history of DefCon hosting the competition.

“If you’re wondering who the best and brightest security experts in the world are, look no further than the capture the flag room at DefCon,” says David Brumley, a professor of Electrical and Computer Engineering at Carnegie Mellon, and the faculty advisor to the team.

Read more | >

Security researchers from Google’s Project Zero team recently uncovered pre-installed apps in Android devices that either allowed remote attackers to carry out remote code execution, could disable Google Play Protect in devices, or could collect information on users’ web activities.

At the Black Hat cybersecurity conference in Las Vegas, Maddie Stone, a security researcher on Project Zero and who previously served as Senior Reverse Engineer & Tech Lead on Android Security team, revealed that her team discovered three instances of Android malware being pre-installed in budget Android phones in the recent past.

One such pre-installed app was capable of turning off Google Play Protect, the default mobile security app in Android devices, thereby leaving devices vulnerable to all forms of cyber attacks or remote surveillance. The Project Zero team also found an app pre-installed on Android phones that gathered logs of users’ web activities.

Read more | >