​#authentication #flaw #websites #cybersecurity #customerdata #login #vulnerabilities #applicationsecurity #risk

Open Authorization (OAuth) standards are used for many websites and apps to allow cross-platform authentication through social media accounts like Facebook as well as google, apple and more.

The vulnerability found in the implementation could allow attackers to take over user accounts, access and/or leak sensitive information, and even commit financial fraud.

In March, Salt discovered a flaw in Booking.com's implementation of OAuth that could have allowed attackers to take over user accounts and gain full visibility into their personal or payment-card data, as well as log in to accounts on the website's sister platform, Kayak.com.

Furthermore, researchers revealed in a blog post from the 24th of May, that specifically, the flaw potentially could affect any users that use various social media accounts to log into an online service that uses the framework.

Because the OAuth authentication meanwhile counts as a standard in modern service-based architectures, as well as in emerging artificial intelligence (AI)-based platforms, any vulnerabilities in OAuth implementations have a broad reach.

→ Read more on darkreading.com 

​#android #operatingsystem #spyware #google #playstore #malware #cybercrime #cybersecurity

An Android app from the Google Play store, with more than 50,000 downloads, was retrofitted with malicious functions after one year.

The app iRecorder - Screen Recorder, had been showing spyware since August 2022, such as the leaking of microphone recordings, certain image and video files as well as documents, among other things. IT security researchers from Eset became aware of the app, which has since been removed from the Play Store by Google, but may still be found in other app stores and archives.

→ Read more on heise.de 

​#research #fingerprint #personaldata #bruteprint #attack #cybersecurity #security #vulnerabilities

Researchers at Zhejiang University have found several smartphone vulnerabilities that allow attacks on fingerprint sensors and thus access.

The so-called BrutePrint attack creates the possibility for a brute force attack on various devices, whereby the steps to be taken require a certain amount of effort. Among the devices examined, iOS devices proved to be more resistant to brute force attacks. Authentication and encrypted SPI communication prevented them, whereas other Android devices did. The CAMF vulnerability, however, managed to triple the number of login attempts.

→ Read more on heise.de 

​#autonomousdriving #dataclaim #dataprotection #electriccar #electromobility #tesla #transport

Through an informant, the newspaper Handelsblatt received information about far more error-prone problems with Tesla's Autopilot driving assistant than previously assumed.

In addition to personal data of employees, almost 4,000 customer complaints could be filtered out of the approximately 23,000 files, which, among other things, criticise the self-acceleration and faulty braking functions that led to more than a thousand accidents.

The first lawsuit was filed eight years ago, and the first claims for damages are already underway, particularly in the USA, where Tesla CEO Elon Musk is now having to justify himself.

→ Read more on heise.de 

​#phishing #cyberattack #school #target #victim #account #account #attack #cybercrime #cybersecurity #securityawareness

Around 75 schools in the districts of Munich and Berchtesgadener Land were affected by a cyberattack last week, paralysing data processing.

It has now become known how this happened. Apparently, a previous phishing email at one school led to an account to the official school administration system being taken over. Anonymous participants complained about little support from the district administration.

→ Read more on sueddeutsche.de 

​#databreach #healthcare #customerdata #personaldata #access #system #attacker #cybercrime #cybersecurity

One of the leading US medical device suppliers "Apria Healthcare LLC" has been the victim of a cyberattack that stole the credit card information of nearly two million customers. Among other things, personal data such as account, credit and debit card numbers, as well as PINs and security codes were stolen from Apria's systems.

There was reportedly a similar incident as early as 2019, before the second occurred in 2021. Apria reports that there has been no misuse of the data to date and that the attackers' target was a sum of money. The affected customers received a free offer from Apria for credit card monitoring and identity theft protection.

→ Read more on cybernews.com 

​#securitybreach #industrialfacilities #criticalinfrastructure #networksecurity #update #cybercrime #cybersecurity

Moxa MXsecurity Series takes on network monitoring solutions for industrial facilities. This involves admins monitoring networks to detect security incidents, among other things. However, as the developers have stated, this could now be precisely the gateway for attackers.

Through the critical security gap, attackers could endanger critical infrastructure worldwide and, in the worst case, take over instances completely. According to CISA, attacks should be possible remotely and with comparatively little effort.However, a security update is already available, which is why admins are asked to install the new version 1.0.1 as soon as possible.

Further tips from the authority can be found in the article.

→ Read more on heise.de 

​#LockBit #hacker #ransomware #databreach #customerdata #personaldata #identitytheft #healthcare #cybercrime #cybersecurity

In the US, Managed Care of North America (MCNA) Dental is one of the largest government-sponsored providers of dental care and oral health insurance. In a published notice on the company's website, the nearly 9 million people affected are informed of the late February 2023 data breach and also instructions on how to obtain free identity theft protection. To prevent misuse of the data, the company has also called in law enforcement agencies.

The hacker group LockBit claimed responsibility for the attack and stole personal data, including address, national insurance number, and insurance and treatment details, in order to obtain an extortion sum of 10 million US dollars. At the beginning of April, the stolen data was published and available for free download.

All affected customers should therefore pay particular attention to fraudulent activity and signs of identity theft in their reports and be wary of targeted phishing emails.

→ Read more on bleepingcomputer.com 

​+49 89 360 5310 | security-awareness@metafinanz.de

​The editors are not responsible for the content of each article.