NodeJS Module infected by it's Developer to Steal Bitcoins

NodeJS Library Event-Stream version 3.3.6 containing a new library, called Flatmap-Stream, as a dependency, which was specifically crafted and designed to target people using BitPay's open-source bitcoin wallet app, Copay, a company that incorporated event-stream into its app.


Interestingly Since the flatmap-stream module was encrypted, the malicious code remained undetected for more than 2 months until Ayrton Sparling (FallingSnow), a computer science student at California State University, flagged the issue Tuesday on GitHub.

As a preventive action open source project manager that hosted event-stream code library—removed the backdoor from NPM's listing .

BitPay also published an advisory saying Copay versions 5.0.2 through 5.1.0 were affected by the malicious code and that users with these versions installed should avoid running or opening the app until they install Copay version 5.2.0.

"Users should assume that private keys on affected wallets may have been compromised, so they should move funds to new wallets (v5.2.0) immediately," BitPay says in the advisory.

"Users should first update their affected wallets (5.0.2-5.1.0) and then send all funds from affected wallets to a brand new wallet on version 5.2.0, using the Send Max feature to initiate transactions of all funds."

Google Plus Shutting down: Bigger they are harder they fall

So Google finally decided to close down google plus which never been attracted wide audience and leaving open space for Facebook monopoly . Interestingly at the same time google has also revealed that in march 2018   google found an API vulnerability in google plus that potentially can be used by the google plus app developers to extract various information  including 

names, email addresses, dates of birth, gender, profile photographs, places lived, relationship status, and occupation from 500,000 Google Plus profiles

Nd decided not reveal this information in public 

Mutagen Astronomy: A new integer overflow vulnerability affect linux kernel

Mutagen Astronomy vulnerability tracked as CVE-2018-14634, is a type of a local privilege escalation issue Discoverd by Qualys —and exists in the Linux kernel's create_elf_tables() function that operates the memory tables.
IMPACT :
To successfully exploit this vulnerability, attackers need to have access to the targeted system and run their exploit that leads to a buffer overflow, thereby resulting in the execution of malicious code and achieving complete control of the affected system.

Affected Systems:

1. This security vulnerability can be exploited to escalate privileges to root via a SUID-root binary, but it only works on 64-bit systems.

2. Affects the kernel versions released between July 2007 and July 2017, impacting the Red Hat Enterprise Linux, CentOS, and Debian distributions.

Exploit:
Qualys researchers have also released both technical details and proof-of-concept (PoC) exploits (Exploit 1, Exploit 2) for the vulnerability to the public.

Zero Day Alert ! Microsoft Windows JET Database engine vulnerability

ZDI  Has released details for unpatched zero day vulnerability in the Microsoft Windows JET Database engine vulnerability which affects all windows versions

Root Cause:
The root cause of this issue resides in the Microsoft JET Database Engine. Microsoft patched two other issues in JET in the September Patch Tuesday updates. While the patched bugs are listed as buffer overflows, this additional bug is actually an out-of-bounds write, which can be triggered by opening a Jet data source via OLEDB.

How To Exploit:To trigger this vulnerability, a user would need to open a specially crafted file containing data stored in the JET database format. Various applications use this database format. An attacker using this would be able to execute code at the level of the current process.

POC:
Here is the link of github that contains the POC

How to protect:
1. Use updated security software restrict
2. Do not open files from untrusted source

Gone in 2 Seconds : Tesla Model S Hack

KU Leuven researchers found that Tesla uses a keyless entry system built by a manufacturer called Pektron, which uses a weak 40-bit cipher to encrypt those key fob codes.

The researchers made a 6-terabyte table of all possible keys for any combination of code pairs, and then used a Yard Stick One radio, a Proxmark radio, and a Raspberry Pi mini-computer, which cost about $600 total—not bad for a Tesla Model S though—to capture the required two codes.

With that table and those two codes, the team says it can calculate the correct cryptographic key to spoof any key fob in just 1.6 seconds. To understand more clearly, you can watch the proof of concept video demonstration which shows the hack in action.

The team reported the issue to Tesla last year, but the company addressed it in June 2018 by upgrading the weak encryption. Last month, the company also added an optional PIN as an additional defense.

Tesla Paid $10,000 Bounty to the Researchers

After the story broke, Tesla was criticised on Twitter for using a weak cipher, though a member of the KU Leuven team appreciated Tesla for quickly responding to their report and fixing the issue,, on the same time, accused other vehicle makers using keyless entry techhashtag

Google Fixes 40 Security bugs in new Chrome Updates for Windows, Mac, Linux, Android

A new version of Google Chrome is rolling out to Windows, Mac, Linux, and Android over the next few weeks, the company announced this week.

Chrome version 69.0.3497.81 is being promoted to the stable channel for Windows, Mac, and Linux. The update packs 40 security fixes, including patches for vulnerabilities an attacker could abuse to assume control over a target system, according to a US-CERT advisory on the update.

In addition to Google's security team, many of the bugs were detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.

Chrome for Android 69 (69.0.3497.76) has also been released and will be available on Google Play over the next few weeks, Google reports. The 10^thanniversary edition aims to improve mobile payment security with third-party payment apps, password generation on more websites, stability and performance improvements, and a cleaner modernized design.

Read more details here.

Time to change your password: Air Canada has locked down all 1.7 million accounts

Don't be surprised if If you are not able to login to air canada mobile app as Air canada has lock down al of its 1.7 million users in response of a breach detection which impacts it's 1% users which is around 20000 users.

  Air Canada said that detected unusual login behaviour with Air Canada’s mobile App between Aug. 22-24, 2018. We immediately took action to block these attempts and implemented additional protocols to protect against further unauthorized attempts.
Air Canada has confirmed a data breach that may have 1% users from 1.7 million mobile Mobile app users which is about 20000 users.
So what has been exposed and what not : any thing which is stored in your  profile could be accessed by the attackers
1. Credit card information: It is encrypted so even attacker access it they may not be able to use it
but as precaution keep an eye on your credit card bill for any unusual activity
2. Passport number :  yes
3. Aeropplan number : yes
4. Aeroplan Password : no
5. Personal information: like date of birth, gender ,NEXUS number etc that you have saved in your profile

What user can do now: 

1. Mobile app itself is secure so you can continue using it
2. Change your password
3. Be Aware of Phishing email that can lead to other problems always verify any password change
email and make sure its from the Air Canada
4. Keep an eye for any unusual activity on ur credit card & Aeroplan transaction
5. Change password from other site as well if same password has been used

S

SPONSORED