Xpertfeed

  Over 2,000 devices have been bricked in the span of a few hours. Attacks still ongoing. A new strain of malware is wiping the firmware of IoT devices in attacks reminiscent of the old BrickerBot malware that destroyed millions of devices back in 2017. Named Silex, this malware began operating earlier today, about three-four hours before this article's publication. The malware had bricked around 350 devices when this reporter began investigating its operations, and the number quickly spiked to 2,000 wiped devices by the time we published, an hour later. Attacks are still ongoing, and according to an interview with the malware's creator, they are about to intensify in the coming days. HOW THE SILEX MALWARE WORKS According to Akamai researcher  Larry Cashdollar , who  first spotted the malware earlier today , Silex works by trashing an IoT device's storage, dropping firewall rules, removing the network configuration, and then halting the device. It's as destructive as it...

  Two days after patching the first zero-day, Mozilla fixes a second one, used in the same attacks as the first. Mozilla has released a second security update this week to patch a second zero-day that was being exploited in the wild to attack Coinbase employees and other cryptocurrency organizations. Firefox 67.0.4 and Firefox ESR 60.7.2 are now available for Firefox users through the browser's built-in update mechanism. This second bug was used together with another one that Mozilla patched two days ago, through the release of Firefox 67.0.3 and Firefox ESR 60.7.1. THE TWO ZERO-DAYS The first one was described as a "remote code execution" vulnerability that allowed remote attackers to run malicious code inside Firefox's native process. The bug ( CVE-2019-11707 ) was discovered on April 15 by a Google Project Zero researcher and reported to Mozilla, who only patched it this week after the Coinbase security team reported attacks exploiting the vulnerability, together w...

  Windows 10  desperately   needed   changes  to its upgrade system and they are  finally rolling out . That said, they’re  not a magic bullet  and Microsoft has now warned users about an update which is going to be hit multiple times over the next few weeks, and before the company can do anything about it.  The threat comes from SandboxEscaper, a well-known  exploit broker , who has found multiple holes in Microsoft’s CVE-2019-0841 security update. Moreover, while Microsoft has posted a  warning  on June 7 and has attempted three fixes so far, SandboxEscaper has now released a fourth and promised to further exploits of it will follow. The result is Microsoft is left playing whack-a-mole and Windows 10 users should be vigilant. As reported by   security researcher Nabeel Ahmed  states  that SandboxEscaper has found a way to give anyone with access to a Windows 10 and Server 2019 machine permis...

  Windows 10 users say they're being targeted by fraudsters through ads being delivered to Microsoft's apps. Windows 10 users are complaining of being targeted by fraudsters through in-app ads delivered through Microsoft's own software.  The fraudulent apps are being delivered through native Windows 10 applications like the Microsoft News app, according to Windows-focused site Ghacks.  Much like online ads promoting tech-support scams, the in-app ads are using bogus system alerts to warn users of non-existent security threats and other issues. The  example Ghacks noticed  claims that a PC is infected with multiple viruses and contains a warning that "personal and banking information is at risk". The ad then encourages users to click a 'Scan now' button, which likely leads to a phishing page or will download unwanted software.  Other scam ads appearing in Microsoft apps claim that the viewer of the ad has won a new iPhone while other ads ask users to pa...

Canva is a popular Sydney-based startup which offers a graphic design service. According to the hacker, who directly contacted, data of roughly 139 million users has been compromised during the breach. Responsible for the data breach is a hacker known as GnosticPlayers online. Since February this year, they have put up the data of 932 million users on sale, which are reportedly stolen from 44 companies around the world. “I download everything up to May 17,” the hacker said to news reports. “They detected my breach and closed their database server.” In a  statement on the Canva website , the company confirmed the attack and has notified the relevant authorities. They also tweeted about the data breach on 24th May as soon as they discovered the hack and recommended their users to change their passwords immediately. “At Canva, we are committed to protecting the data and privacy of all our users and believe in open, transparent communication that puts our communities’ needs first,” the...

  French news publisher Le Monde is launching a new comments section using Jigsaw's Perspective API. The EU elections  get underway tomorrow, and as debate heats up it's likely the comments sections of major news sites will be ablaze with fiery opinions, harassment, and general internet nastiness.    To help counter abusive online comments in France, Alphabet think tank Jigsaw has launched French-language versions of Perspective and Tune, its AI-powered, troll-fighting technologies. The Perspective API is first rolling out to the comments section of French news publisher Le Monde and will also be available to other publishers. The new version of  Le Monde's  comment system going live today will use Jigsaw's Perspective API to encourage readers to share views on news ahead of this week's 2019 European Union parliamentary elections. Perspective's machine-learning model is designed to determine whether a comment could be seen as toxic to a discussion. The mode...

  The message that came out of SAPPHIRE last week is that SAP remains all in on HANA, and that the future is making it cloud-native. While the recently closed  acquisition of Qualtrics  provided many of the headlines at SAPPHIRE last week, the fact that SAP remains fully committed to HANA had the most immediate significance. The future of SAP HANA was very much the spotlight of SAP chairman Hasso Plattner's  day two keynote . Normally, a speech about HANA would not make headlines. But in the wake of  major staff restructuring last winter  that lead to considerable  sturm und drang  about the future of HANA, it was important for SAP to reaffirm that it was staying the course. As Larry Dignan reported last week, HANA is the underpinning of the bevy of new services that SAP is releasing on its cloud platform. And SAP, like most of its enterprise technology brethren, is now adopting a cloud-first game plan for HANA development -- where new featur...

  Hacker threatens to release the code if victims don't pay in 10 days. Hundreds of developers have had had Git source code repositories wiped and replaced with a ransom demand. The attacks started earlier today, appear to be coordinated across Git hosting services (GitHub, Bitbucket, GitLab), and it is still unclear how they are happening. What it is known is that the hacker removes all source code and recent commits from vitcims' Git repositories, and leaves a ransom note behind that asks for a payment of 0.1 Bitcoin (~$570). The hacker claims all source code has been downloaded and stored on one of their servers, and gives the victim ten days to pay the ransom; otherwise, they'll make the code public. To recover your lost code and avoid leaking it: Send us 0.1 Bitcoin (BTC) to our Bitcoin address ES14c7qLb5CYhLMUekctxLgc1FV2Ti9DA and contact us by Email at admin@gitsbackup.com with your Git login and a Proof of Payment. If you are unsure if we have your data, contact us ...

  Azure, Microsoft 365, Dynamics, Power BI, DevOps, all down for nearly two hours. Microsoft says a mishap during a DNS migration was behind a nearly two-hour Azure outage on May 2, between 19:43 and 22:35 UTC.  The global incident impacted a whole range of Microsoft cloud services, causing connection problems for core services like Azure, multiple services under the Microsoft 365 umbrella, Dynamics, and DevOps.  The incident had a knock-on effect for Azure compute, storage, App Service, Azure AD identity services, and SQL Database.  Microsoft was mid-way through migrating its legacy domain name system (DNS) to its own hosted Azure DNS, when "some domains for Microsoft services were incorrectly updated", it explains on the  Azure status history page .   Microsoft updated the page several times during the incident and as services were gradually restored.  The company assures customers that none of their DNS records were impacted during the event and tha...

  One of the biggest roadblocks I find to fast web browsing these days is the plethora of annoying notifications that websites offer me. Fortunately, Google Chrome offers a quick and easy way to block them. You've no doubt had this happen countless times already this week.  You browse to a website and you get a notification offering the chance for you to get more notifications. Something like this (although this one is from  a handy test site ): Hate them? Want them gone? Not a problem, if you use Google Chrome! Here's how: Click on the three dots button (top-right of the browser window) Click on  Settings Click on  Advanced From the  Privacy and security  section, click on  Content settings... Click on  Notifications Finally, click on  Ask before sending (recommended)  to change it to  Blocked You're done! Just this one tweak has dramatically streamlined my browsing experience. Try if out for yourself!