News
Attackers capitalizing on unpatched WordPress sites
The critical exploit reported on last week is currently being used in the wild by several hacker groups. The most successful campaign has compromised over 66.000 webpages, using the exploit for SEO spam purposes. Most Wordpress sites are patched automatically, but some owners wish to do manual testing first. If you are one of those, you might want to hurry up.
Australian intelligence publishes their eight essential anti-hacking rules
An Australian intelligence agency called the Australian Signals Directorate (ASD) has released a set of eight straight forward rules on how to mitigate 85% of targeted intrusions. The rules are, in short: white-list applications, disable macro's, patch applications, block Java/Flash/ads, restrict admin rights, use 2fa, patch your OS, make daily backups.
See their full advisory here.
How Google fought back against a crippling IoT-powered botnet and won
Short yet interesting read on how Project Shield, an anti-DDOS service by Google, took over the protection of Brian Krebs' blog when Akamai threw in the towel.
Dutch will hand count ballots due to hacking fears
The Dutch always vote by paper, but use software to count the votes afterwards. For the upcoming election in March they've decided to count by hand instead, out of fear of hackers interfering with the process. Rightfully so, it seems, because "the tallying software was distributed by CD-ROM to regional counting centers where it was installed on old computers that were internet connected".
New method can catch smartphone thieves in 14 seconds
According to research by the Ben-Gurin university it is possible to identify a smartphone thief in 14 seconds. They do this by defining a pattern of how the owner usually touches the screen: frequency, pressure, speed, etc. This could be very useful to quickly lock someone out of your phone, whether they stole it or if they were snooping around while you weren't looking.
InterContinental confirms payment card breach at 12 U.S. hotels
InterContinental, the company holding the Holiday Inn brand among others, reported a data breach of credit cards in 12 of its hotels. Only cards used in the restaurants and bars are affected, they say, not the ones used at the front desk.
Anonymous hacker took down 10,000+ dark web sites, including child abuse content
A hacker from Anonymous took down a webhosting service called Freedom Hosting II. It seems he just wanted to hack in for fun or profit, but when he saw that they hosted a huge amount of child pornography, he decided to take the service provider down.
Macro malware comes to macOS
Important to know for us Mac users: a hacker group based out of Russia is using Office macro's that only run on the Mac version of Office. The current attack is done by e-mail with the subject line "U.S. Allies and Rivals Digest Trump’s Victory – Carnegie Endowment for International Peace.docm."
Sophos acquires Invincea
Invincea, an anti-malware company using machine learning instead of signatures to detect malware and viruses, has been acquired by Sophos for $100 million.
Hacker pwns 150,000 printers to issue a security warning
Over the weekend about 150.000 printers were hacked by someone calling himself Stackoverflowin, printing a message urging them to fix their security (in not very eloquent terms), and boasting about his hack.