New WhatsApp bug via MP4 file triggers snooping concerns

Agencies
November 18, 2019

If someone has sent you an MP4 file on WhatsApp, guard against downloading it as hackers may use a critical vulnerability in the Facebook-owned app to execute snooping attack on both Android and iOS devices.

The specially crafted MP4 file triggers the remote code execution (RCE) and denial of service (DoS) cyber attack.

"The vulnerability is classified as 'Critical' severity that affected an unknown code block of the component MP4 File Handler in WhatsApp," reported gbhackers.com on Saturday.

Facebook has issued an advisory, saying "A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user.

"The issue was present in parsing the elementary stream metadata of an MP4 file and could result in a DoS or RCE."

The news comes on the heels of an Israeli software Pegasus by cyber intelligence company NSO Group that exploited its video calling system to snoop on 1,400 selected users globally and in India, including human rights activists and journalists.

The issue snowballed into a political one and the Indian government denied either purchasing or planning to purchase the infamous software in question.

"We agree with the government of India's strong statement about the need to safeguard the privacy of all Indian citizens. That is why we've taken this strong action to hold cyber attackers accountable and why WhatsApp is so committed to the protection of all user messages through the product we provide," a WhatsApp spokesperson had said in a statement.

The new vulnerability is found in Android versions prior to 2.19.274; iOS versions prior to 2.19.100; Enterprise Client versions prior to 2.25.3; Business for Android versions prior to 2.19.104; Business for iOS versions prior to 2.19.100; and Windows Phone versions before and including 2.18.368.

Hackers can use the WhatsApp vulnerability to deploy the malware on the user's device to steal sensitive files and also used to surveillance purpose.

"The RCE vulnerability allows hackers to perform the attack remotely without any sort of authentication," claimed the report.

The critical WhatsApp vulnerability can be tracked as CVE-2019-11931.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
News Network
July 9,2020

U.S. electric vehicle maker Tesla Inc is "very close" to achieving level 5 autonomous driving technology, Chief Executive Elon Musk said on Thursday, referring to the capability to navigate roads without any driver input.

"I'm extremely confident that level 5 or essentially complete autonomy will happen and I think will happen very quickly," Musk said in remarks made via a video message at the opening of Shanghai's annual World Artificial Intelligence Conference (WAIC).

"I remain confident that we will have the basic functionality for level 5 autonomy complete this year."

Automakers and tech companies including Alphabet Inc Waymo and Uber Technologies are investing billions in the autonomous driving industry.

However industry insiders have said it would take time for the technology to get ready and public to trust autonomous vehicles fully.

The California-based automaker currently builds cars with an Autopilot driver-assistance system.

Tesla is also developing new heat-projection or cooling systems to enable more advanced computers in cars, Musk said.

Industry data showed Tesla sold nearly 15,000 China-made Model 3 sedans last month.

Tesla has become the highest-valued automaker as its shares surged to record highs and its market capitalisation overtook that of former front-runner Toyota Motors Corp.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
January 10,2020

Indian enterprises were flooded with a whopping 14.6 crore malware threats in 2019 - a growth of 48 per cent (year-on-year) compared to 2018, a new report said on Friday.

Manufacturing, BFSI (banking, financial services and insurance), education, healthcare, IT/ITES, and the government were the most at-risk industries in the country, said the report from Seqrite, the enterprise arm of Pune-based IT security firm Quick Heal Technologies.

Interestingly, almost a quarter (23 per cent) of the threats were identified through 'Signatureless behaviour-based' detection by Seqrite, indicating how a growing number of cybercriminals were deploying new or previously unknown threat vectors to compromise enterprise security.

"With the latest Seqrite annual threat report, we want to empower CIOs, CISOs, business leaders and all key public stakeholders with the insights they need to combat the growing complexity of the threat landscape," said Sanjay Katkar, Joint Managing Director and CTO, Quick Heal Technologies.

The most prominent trend was the drastic increase in the volume, intensity, and sophistication of cyber-attack campaigns targeting Indian enterprises in 2019.

The rapid integration of IoT devices, BYOD (bring your own device), and third-party APIs into enterprise networks has created newer security vulnerabilities that might go unnoticed until a major breach occurs.

Threat researchers at Seqrite observed several large-scale advanced persistent threats (APT) attacks deployed against organisations in the government sector.

"The entry of nation-states and organised cybercrime cells into the fray is expected to add more complication to this situation and will require Indian government bodies and corporate enterprises to shore up their cyber defence strategies in 2020 and beyond," the report noted.

More alarming, however, was the continued lack of security awareness amongst enterprises and government organisations.

"Unsecured Remote Desktop Protocol (RDP) and Server Message Block (SMB) protocols continued to be targeted through brute-force attacks," said the report.

Spear phishing attack campaigns leveraging Office exploits and infected macros were also used extensively by cybercriminals to gain access to enterprise networks and steal critical data.

"India's digital journey depends on ensuring robust cybersecurity for all stakeholders within the enterprise ecosystem," said Katkar.

The sharp spike should be a cause of concern for CIOs and CISOs in the country, especially given the growing digital penetration within their enterprise networks.

"With network vulnerabilities and potential entry points increasing at a rapid pace, threat actors are expected to leverage artificial intelligence (AI) capabilities to power their malware campaigns in the future to capitalise on newer attack vectors," the report added.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
July 6,2020

The Covid-19 pandemic has made an unprecedented impact on the Indian businesses, particularly small and medium enterprises (SMEs) and startups. According to a joint survey by FICCI and Indian Angel Network (IAN), the pandemic has hit the businesses of around 70% startups.

With uncertainty in the business environment and an unexpected shift in priorities of the government as well as corporates, many startups are struggling to survive, it says.

In a nationwide survey on the 'Impact of Covid-19 on Indian Startups' involving 250 startups, 70% participants said their businesses had been impacted by Covid-19 and around 12% had shut operations.

The survey shows only 22% startups have cash reserves to meet the fixed cost expenses over the next 3-6 months, and 68% are reducing operational and administrative expenses.

Around 30% of the companies said they would retrench employees if the lockdown was extended too long. The 43% startups have already started 20-40% salary cuts over April-June.

Over 33% startups said investors had put the investment decision on hold and 10% said the deals had been scrapped. Only 8% startups had received funds as per the deals signed before Covid-19 outbreak, the survey revealed.

The reduced funding has forced startups to put a hold on business development and manufacturing activities, which has resulted in loss of projected orders.

The survey highlights the need of an urgent relief package for startups, including possible purchase orders from the government, tax relief and swifter tax refunds, and immediate fiscal support measures, including grants, soft loans and payroll grants.

Besides 250 startups, 61 incubators and investors also participated in the survey.

While 96% of investors accepted that their investments in startups had been impacted by Covid-19, 92% said their investments in startups would continue to be low over the next six months.

Around 59% investors said they would prefer to work with the existing portfolio firms in the coming months. Only 41% said they would consider new deals.

"A comparison of priority investment sectors before and during Covid-19 shows 35% investors are now looking at investments in healthcare startups, followed by EdTech, AI/Deep Tech, FinTech and Agri," said the survey.

Around 44% incubators surveyed said their day-to-day operations had been considerably hit by Covid-19. Most incubators are now supporting their portfolio firms by providing them virtual platforms to interact with mentors, investors and industries.

Dilip Chenoy, FICCI Secretary General, said, "The startup sector is stressed for survival at the moment. The investment sentiment is also subdued and is expected to remain so in the coming months. Lack of working capital and cash flows may lead to major layoffs over the next 3-6 months."

Indian startups needed an enabling ecosystem and flow of funds to continue operations, the survey said.

Padmaja Ruparel, President, Indian Angel Network & Co-Chair of FICCI Startup Committee, said, "In these uncertain times, as investors, we must play an important role to provide the Indian startups funding, mentoring and hand-holding support to stay afloat and come out at the other end of this crisis."

To that end, IAN recently announced a debt fund to help IAN portfolio companies raise working capital and ensure business continuity by partnering with debt providers.

This must be replicated on a wider scale, so a larger number of startups are provided the capital support to make it during these tough times, Ruparel said.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.