Daily Cyber Brief
Russian-based Pushwoosh tricks US Army and others into running its code, GitHub sets up private vulnerability reports, and Whoosh confirms data breach...
Cybersecurity
US government agencies including the Army and Centers for Disease Control and Prevention pulled apps running Pushwoosh code after learning the software company – which presents itself as American – is actually Russian, according to Reuters. Pushwoosh is a software…
A dangerous new malware loader with features for determining whether it's on a business system or a personal computer has begun rapidly infecting systems worldwide over the past few months. Researchers at VMware Carbon Black are tracking the threat, dubbed…
GitHub is offering a scheme for security researchers to privately report vulnerabilities found in public repositories. Being able to privately report code flaws is important to researchers who are often left with choices that can lead to more security problems, GitHub said in a blog post…
Search giant Google has agreed to a $391.5 million settlement with 40 states to resolve an investigation into how the company tracked users’ locations, state attorneys general announced Monday. The states’ investigation was sparked by a 2018 Associated Press story…
The Russian scooter-sharing service Whoosh has confirmed a data breach after hackers started to sell a database containing the details of 7.2 million customers on a hacking forum. Whoosh is Russia's leading urban mobility service platform, operating in 40 cities with over…
The National Security Agency (NSA) published a new guide last week to aid software developers in preventing and mitigating software memory safety issues and connected vulnerabilities. The document describes scenarios where malicious cyber actors exploit poor…
Security teams running unpatched, Internet-connected Zimbra Collaboration Suites (ZCS) should just go ahead and assume compromise, and take immediate detection and response action. That's according to a new alert issued by the Cybersecurity and Infrastructure…
A malicious for-profit group named 'Fangxiao' has created a massive network of over 42,000 web domains that impersonate well-known brands to redirect users to sites promoting adware apps, dating sites, or 'free' giveaways. The imposter domains are used as part of what…
The Australian government announced over the weekend it is considering banning ransomware payments in response to the Medibank data breach. The group behind the hack has been linked by the Australian Federal Police (AFP) to Russian cyber-criminals with…
Canadian supermarket and pharmacy chain Sobeys is recovering from a cyberattack that might have involved the Black Basta ransomware. Sobeys is the second largest supermarket chain in Canada and a wholly-owned subsidiary of Empire Company Limited, which…