New Release: Tor Browser 10.0.15

Tor Project

Tor Browser 10.0.15 is now available from the Tor Browser download page and also from our distribution directory.

This version updates Openssl to 1.1.1k. In addition, Tor Browser 10.0.15 includes a bugfix for when Javascript is disabled on websites.

Relay operators who use the Windows Expert Bundle are strongly encouraged to upgrade their relay.

Note: Android Tor Browser will be available in the coming days.

Full article

Watch Out! That Android System Update May Contain A Powerful Spyware

The Hacker News

Researchers have discovered a new information-stealing trojan, which targets Android devices with an onslaught of data-exfiltration capabilities — from collecting browser searches to recording audio and phone calls.

While malware on Android has previously taken the guise of copycat apps, which go under names similar to legitimate pieces of software, this sophisticated new malicious app masquerades itself as a System Update application to take control of compromised devices.

The spyware creates a notification if the device’s screen is off when it receives a command using the Firebase messaging service, Zimperium researchers said in a Friday analysis. The ‘Searching for update..’ is not a legitimate notification from the operating system, but the spyware.

Full article

Apple releases emergency update for iPhones, iPads, and Apple Watch

ZDNet

Apple has released an emergency update to patch a serious vulnerability (https://support.apple.com/en-us/HT212258) found in iOS, iPadOS, and watchOS.

The patches are iOS 14.4.2, iPadOS 14.4.2, and watchOS 7.3.3, respectively. 

The vulnerability, discovered by Google’s Threat Analysis Group, affects Apple’s WebKit browser engine, and what makes this an urgent update is the fact that the Apple claims that the vulnerability is being actively exploited.

Details from Apple are limited, but such vulnerabilities could be used to carry out malicious actions such as directing users to phishing sites.

Full article

Apple Issues Urgent Patch Update for Another Zero‑Day Under Attack

The Hacker News

Merely weeks after releasing out-of-band patches for iOS, iPadOS, macOS and watchOS, Apple has released yet another security update for iPhone, iPad, Apple Watch to fix a critical zero-day weakness that it says is being actively exploited in the wild.

Tracked as CVE-2021-1879, the vulnerability relates to a WebKit flaw that could enable adversaries to process maliciously crafted web content that may result in universal cross-site scripting attacks.

“This issue was addressed by improved management of object lifetimes,” the iPhone maker noted.

Apple has credited Clement Lecigne and Billy Leonard of Google’s Threat Analysis Group for discovering and reporting the issue. While details of the flaw have not been disclosed, the company said it’s aware of reports that CVE-2021-1879 may have been actively exploited.

Full article

New Android malware spies on you while posing as a System Update

Bleeping Computer

New malware with extensive spyware capabilities steals data from infected Android devices and is designed to automatically trigger whenever new info is read to be exfiltrated.

The spyware can only be installed as a ‘System Update’ app available via third-party Android app stores as it was never available on Google’s Play Store.

This drastically limits the number of devices it can infect, given that most experienced users will most likely avoid installing it in the first place.

The malware also lacks a method to infect other Android devices on its own, adding to its limited spreading capabilities.

Full article

German Parliament targeted again by Russian state hackers

Bleeping Computer

Email accounts of multiple German Parliament members were targeted in a spearphishing attack. It is not yet known if any data was stolen during the incident.

The attack was carried out by sending phishing emails sent to the German politicians’ private emails, as Der Spiegel reported on Friday.

It is believed that the attackers were able to gain access to the email accounts of seven members of the German federal parliament (Bundestag) and 31 members of German regional parliaments.

Most parliament members targeted in this attack are part of the CDU/CSU and SPD governing parties.

A Bundestag spokesperson said that the attackers didn’t target the Bundestag’s network. After the attack was detected, all targeted parliament members were immediately notified.

Full article

Ars Technica

Researchers have discovered a new advanced piece of Android malware that finds sensitive information stored on infected devices and sends it to attacker-controlled servers.

The app disguises itself as a system update that must be downloaded from a third-party store, researchers from security firm Zimperium said on Friday. In fact, it’s a remote-access trojan that receives and executes commands from a command-and-control server. It provides a full-featured spying platform that performs a wide range of malicious activities.

Full article

Linux powers the internet, confirms EU commissioner

Opensource.com

In 20 years of EU digital policy in Brussels, I have seen growing awareness and recognition among policymakers in Europe of the importance of open source software (OSS). A recent keynote by EU internal market commissioner Thierry Breton at the annual EU Open Source Policy Summit in February provides another example—albeit with a sense of urgency and strategic opportunity that has been largely missing in the past.

Commissioner Breton did more than just recognize the “long list of [OSS] success stories.” He also underscored OSS’s critical role in accelerating Europe’s €750 billion recovery and the goal to further “embed open source” into Europe’s longer-term policy objectives in the public sector and other key industrial sectors.

In addition to the commissioner’s celebration that “Linux is powering the internet,” there was a policy-related call to action to expand the OSS value proposition to many other areas of digital sovereignty. Indeed, with only 2.5 years of EU Commission mandate remaining, there is a welcome sense of urgency. I see three possible reasons for this: 1. fresh facts and figures, 2. compelling policy commitments, and 3. game-changing investment opportunities for Europe.

Full article

Brazil leads in phishing attacks

ZDNet

Brazil is a world leader in phishing attacks, with one in five Internet users in the country targeted at least once in 2020, according to research.

According to the report on phishing by cybersecurity firm Kaspersky, Brazil tops a list of five countries with the highest rate of users targeted for data theft throughout last year. The other nations cited are Portugal, France, Tunisia and French Guiana.

The number of phishing attacks against mobile devices increased by more than 120% between February and March 2020 alone, according to the study. Factors behind the increase in scams include the boost in internet usage and access to services online such as internet and mobile banking and online shopping as a result of social distancing measures, as well as large-scale adoption of remote work and the anxiety around information about the pandemic.

Full article

Please stop leaking your own personal data online, Indonesia’s COVID-19 taskforce tells citizens

The Register

Indonesian officials have asked its nation’s citizens to stop leaking their own personal data on social media by sharing pictures of certificates attesting to their receipt of COVID-19 vaccinations.

In a Tuesday press conference, Indonesia’s COVID-19 task force spokesman Wiku Adisasmito explained that the certificates include a QR code that, when scanned, can yield personal medical data.

Adisasmito explained the possible consequences of data leakage at a Tuesday press conference.

Full article