SecurityWeek

Hackers stole information on 100,000 taxpayers from the online computers of the US Internal Revenue Service, the federal tax agency said Tuesday.

Researchers at ESET are shining the light on a new piece of malware compromising routers in a scheme to take fraudulent actions on social networks. 

Hex-Rays, the binary software analysis company that develops Interactive Disassembler (IDA), says it has detected a breach on one of its servers.IDA is a popular disassembler that generates assembly language source code from machine-executable code. Hex-Rays licenses the commercial version of the solution, IDA Pro.

Iran said on Tuesday it had foiled a cyber-attack on the Islamic republic's oil ministry, and that those behind the hacking attempt were based in the United States. The Fars news agency cited Brigadier General Kamal Hadianfar, head of the cyber police, as saying the unit had thwarted "the hackers' attack on the oil ministry".

A security researcher has come across a campaign in which malicious actors are changing the DNS settings of routers in order to take control of their owners’ Internet connections.

Taiwan-based network attached storage (NAS) company Synology has released software updates to address several vulnerabilities reported by Dutch security company Securify.

Adding Exploits to Wassenaar Is Bad for Security, Says the Industry

Bots are busy little bees on the Internet, and the world of mobile computing may be their next frontier.According to new research from Distil Networks, 2014 was the first year that bots masking themselves as mobile web users began arriving in droves and a mobile carrier [T-Mobile USA] appeared on the list of the top 20 Internet Service Providers serving bad bot traffic.

Researchers at FireEye have identified a new strain of point-of-sale (POS) malware being used in a spam campaign.

Android users have downloaded scareware disguised as cheats for the popular game Minecraft from Google Play hundreds of thousands, possibly millions, of times, researchers at ESET reported.

A security researcher said he found a way to generate unlimited amounts of money on Starbucks gift cards. The coffee company doesn’t seem to be pleased with the way the expert tested his findings.Starbucks gift cards can be managed by creating an account on starbucks.com. Users can check their balances and transfer funds from one card to another using these accounts.

Router manufacturers whose products have been confirmed to be affected by the recently disclosed NetUSB driver security flaw say they are working on developing firmware updates that address the vulnerability.

Emerson’s Process Management group has released a software update to address a SQL injection vulnerability in the Emerson AMS Device Manager product.

FireEye has released a report detailing the cyber threats targeting various sectors in Europe’s Nordic countries.Government transparency, innovations in fields like renewable energy and healthcare, and rich natural resources make Denmark, Finland, Iceland, Norway, and Sweden a tempting target for malicious actors, the security firm said.

The US National Security Agency developed plans to hack into data links to app stores operated by Google and Samsung to plant spyware on smartphones, a media report said Thursday. The online news site The Intercept said US intelligence developed the plan with allies in Britain, Canada, New Zealand and Australia, a group known as the "Five Eyes" alliance.

Passwords and Multimedia Files Can Be Recovered From Hundreds of Millions of Android PhonesResearchers at the University of Cambridge have conducted a detailed analysis of the “Factory Reset” feature in Android devices and determined that it’s not as effective as it should be.

Researchers at email and web security company AppRiver spotted a campaign in which malicious actors attempted to distribute a piece of ransomware with the aid of SVG files.The attack starts with an email that appears to have a resume attached to it. The file is a ZIP archive containing an SVG file.

Security questions are sometimes offered as an extra layer of protection for web users. Unfortunately new research shows they aren't quite as effective as many may hope.

Enterprises may largely agree that threat intelligence is important, but few are doing any actual sharing themselves, according to a new survey.

As news of more data breaches and third-party originated cyber-attacks continue to make the news, businesses and regulators alike are sharpening their focus on how to report on and mitigate these risks. Board members are demanding quantitative risk data that spans all business operations, while business units need to neutralize the impact of cyber-attacks. So how can companies deal with this challenge and transition to a model that uses more data to assess risks?