Recherche : [arstechnica]

How Google Authenticator made one company’s network breach much, much worse https://arstechnica.com/security/2023/09/how-google-authenticator-gave-attackers-one-companys-keys-to-the-kingdom

16/09/2023 12:21:15

Google's app for generating MFA codes syncs to user accounts by default. Who knew?

With 0-days hitting Chrome, iOS, and dozens more this month, is no software safe? | Ars Technica https://arstechnica.com/security/2023/09/with-0-days-hitting-chrome-ios-and-dozens-more-this-month-is-no-software-safe/

14/09/2023 00:26:45

With 70 zero-days uncovered so far this year, 2023 is on track to set a new record.

North Korea-backed hackers target security researchers with 0-day https://arstechnica.com/security/2023/09/north-korea-backed-hackers-target-security-researchers-with-0-day/

11/09/2023 23:03:12

Google researchers say currently unfixed vulnerability affects a popular software package.

WinRAR 0-day that uses poisoned JPG and TXT files under exploit since April | Ars Technica https://arstechnica.com/security/2023/08/winrar-0-day-that-uses-poisoned-jpg-and-txt-files-under-exploit-since-april/

24/08/2023 08:39:23

Vulnerability allows hackers to execute malicious code when targets open malicious ZIP files.

Microsoft takes pains to obscure role in 0-days that caused email breach https://arstechnica.com/security/2023/07/microsoft-takes-pains-to-obscure-role-in-0-days-that-caused-email-breach/

16/07/2023 01:43:21

Critics also decry Microsoft's "pay-to-play" monitoring that detected intrusions.

WordPress plugin installed on 1 million+ sites logged plaintext passwords https://arstechnica.com/security/2023/07/wordpress-plugin-installed-on-1-million-sites-logged-plaintext-passwords

15/07/2023 14:00:20

AIOS bills itself as an "all-in-one" security solution. A just-fixed bug undermined that.

Hackers exploit gaping Windows loophole to give their malware kernel access https://arstechnica.com/security/2023/07/hackers-exploit-gaping-windows-loophole-to-give-their-malware-kernel-access/

12/07/2023 09:37:03

Microsoft blocks a new batch of system drivers, but the loophole empowering them remains.

Mass exploitation of critical MOVEit flaw is ransacking orgs big and small | Ars Technica https://arstechnica.com/information-technology/2023/06/mass-exploitation-of-critical-moveit-flaw-is-ransacking-orgs-big-and-small/

07/06/2023 07:46:55

SQL injection attacks on MOVEit file-transfer service likely to get worse.

“Clickless” iOS exploits infect Kaspersky iPhones with never-before-seen malware | Ars Technica https://arstechnica.com/information-technology/2023/06/clickless-ios-exploits-infect-kaspersky-iphones-with-never-before-seen-malware/

02/06/2023 13:27:34

"Operation Triangulation" stole mic recordings, photos, geolocation, and more.

Here’s how long it takes new BrutePrint attack to unlock 10 different smartphones https://arstechnica.com/information-technology/2023/05/hackers-can-brute-force-fingerprint-authentication-of-android-devices/

28/05/2023 14:11:44

Researchers have devised a low-cost smartphone attack that cracks the authentication fingerprint used to unlock the screen and perform other sensitive actions on a range of Android devices in as little as 45 minutes.

Inner workings revealed for “Predator,” the Android malware that exploited 5 0-days https://arstechnica.com/information-technology/2023/05/inner-workings-revealed-for-predator-the-android-malware-that-exploited-5-0-days/

28/05/2023 13:46:18

Spyware is sold to countries including Egypt, Indonesia, Oman, Saudi Arabia, and Serbia.
Smartphone malware sold to governments around the world can surreptitiously record voice calls and nearby audio, collect data from apps such as Signal and WhatsApp, and hide apps or prevent them from running upon device reboots, researchers from Cisco’s Talos security team have found.

Apple uses iOS and macOS Rapid Security Response feature for the first time https://arstechnica.com/gadgets/2023/05/seven-months-in-ios-and-macos-get-their-first-rapid-security-updates/

02/05/2023 07:03:36

When it announced iOS 16, iPadOS 16, and macOS Ventura at its Worldwide Developers Conference last summer, one of the features Apple introduced was something called "Rapid Security Response." The feature is meant to enable quicker and more frequent security patches for Apple's newest operating systems, especially for WebKit-related flaws that affect Safari and other apps that use Apple's built-in browser engine.

Android app from China executed 0-day exploit on millions of devices | Ars Technica https://arstechnica.com/information-technology/2023/03/android-app-from-china-executed-0-day-exploit-on-millions-of-devices/

03/04/2023 18:11:01

Fast-growing e-commerce app Pinduoduo had an EvilParcel stow-away.

Darknet markets generate millions in revenue selling stolen personal data https://arstechnica.com/tech-policy/2022/12/darknet-markets-generate-millions-in-revenue-selling-stolen-personal-data/

03/12/2022 18:30:46

A handful of markets were responsible for trafficking most of the data.

LockBit ransomware suspect nabbed in Canada, faces charges in the US https://arstechnica.com/information-technology/2022/11/feds-charge-man-for-his-alleged-involvement-in-pushing-lockbit-ransomware/

13/11/2022 21:13:50

Automation features make LockBit one of the more destructive pieces of ransomware.
Federal prosecutors on Thursday charged a dual Russian and Canadian national for his alleged participation in a global campaign to spread ransomware known as LockBit.

Mikhail Vasiliev, 33, of Bradford, Ontario, Canada, was taken into custody in late October by authorities in Ontario, officials at Interpol said. He is now in custody in Canada awaiting extradition to the US.