The Hacker News Logo
Subscribe to Newsletter

The Hacker News - Cybersecurity News and Analysis: security vulnerability

New Comic Videos Take CISO/Security Vendor Relationship to the Extreme

New Comic Videos Take CISO/Security Vendor Relationship to the Extreme

October 10, 2019The Hacker News
Today's CISOs operate in an overly intensive environment. As the ones who are tasked with the unenviable accountability for failed protection and successful breaches, they must relentlessly strive to improve their defense lines with workforce education, training their security teams and last but definitely not least — looking for products that will upgrade and adjust their security against the rapidly evolving threat landscape. Finding the right solution is everything but an easy task. Part of what makes it hard is the tremendous number of security vendors that offer an infinite number of security products, promising that each can solve all the cyber problems of the planet with one hand tied behind its back. These CISO/vendor encounters are the theme of six short humoristic videos released this week that take them to the ultimate extreme. Here is one of the videos: If you want, you can watch all 6 funny videos here . These videos were partly inspired by David Spark
Google Researchers Disclose PoCs for 4 Remotely Exploitable iOS Flaws

Google Researchers Disclose PoCs for 4 Remotely Exploitable iOS Flaws

July 30, 2019Wang Wei
Google's cybersecurity researchers have finally disclosed details and proof-of-concept exploits for 4 out of 5 security vulnerabilities that could allow remote attackers to target Apple iOS devices just by sending a maliciously-crafted message over iMessage. All the vulnerabilities, which required no user interaction, were responsibly reported to Apple by Samuel Groß and Natalie Silvanovich of Google Project Zero, which the company patched just last week with the release of the latest iOS 12.4 update . Four of these vulnerabilities are "interactionless" use-after-free and memory corruption issues that could let remote attackers achieve arbitrary code execution on affected iOS devices. However, researchers have yet released details and exploits for three of these four critical RCE vulnerabilities and kept one (CVE-2019-8641) private because the latest patch update did not completely address this issue. The fifth vulnerability (CVE-2019-8646), an out-of-bounds re
Latest iOS 12.2 Update Patches Some Serious Security Vulnerabilities

Latest iOS 12.2 Update Patches Some Serious Security Vulnerabilities

March 26, 2019Mohit Kumar
Apple on Monday released iOS 12.2 to patch a total of 51 security vulnerabilities in its mobile operating system that affects iPhone 5s and later, iPad Air and later, and iPod touch 6th generation. A majority of vulnerabilities Apple patched this month reside in its web rendering engine WebKit, which is used by many apps and web browsers running on the Apple's operating system. According to the advisory , just opening a maliciously crafted web content using any vulnerable WebKit-based application could allow remote attackers to execute arbitrary code, disclose sensitive user information, bypass sandbox restrictions, or launch universal cross-site scripting attacks on the device. Among the WebKit vulnerabilities include a consistency issue (CVE-2019-6222) that allows malicious websites to potentially access an iOS device microphone without the "microphone-in-use" indicator being shown. A similar vulnerability (CVE-2019-8566) has been patched in Apple's Replay
Zerodium Offers to Buy Zero-Day Exploits at Higher Prices Than Ever

Zerodium Offers to Buy Zero-Day Exploits at Higher Prices Than Ever

January 08, 2019Mohit Kumar
Well, there's some good news for hackers and vulnerability hunters, though terrible news for tech manufacturers! Exploit vendor Zerodium is now willing to offer significantly higher payouts for full, working zero-day exploits that allow stealing of data from WhatsApp, iMessage and other online chat applications. Zerodium—a startup by the infamous French-based company Vupen that buys and sells zero-day exploits to government agencies around the world—said it would now pay up to $2 million for remote iOS jailbreaks and $1 million for exploits that target secure messaging apps. Get $2 Million for Remotely Jailbreaking An iPhone Previously, Zerodium was offering $1.5 million for persistent iOS jailbreaks that can be executed remotely without any user interaction (zero-click)—but now the company has increased that amount to $2 million. The company is now offering $1.5 million for a remote iOS jailbreak that requires minimal user interaction (i.e., single-click)—the amount h
Online Courses and Software

Sign up for cybersecurity newsletter and get latest news updates delivered straight to your inbox daily.