A security researcher has published Vulnerability-related.DiscoverVulnerability details of a vulnerability in a popular cloud storage drive after the company failed to issue Vulnerability-related.PatchVulnerability security patches for over a year . Remco Vermeulen found Vulnerability-related.DiscoverVulnerability a privilege escalation bug in Western Digital ’ s My Cloud devices , which he said Vulnerability-related.DiscoverVulnerability allows an attacker to bypass the admin password on the drive , gaining “ complete control ” over the user ’ s data . The exploit works because drive ’ s web-based dashboard doesn ’ t properly check a user ’ s credentials before giving a possible attacker access to tools that should require higher levels of access . The bug was “ easy ” to exploit , Vermeulen told TechCrunch in an email , and was remotely exploitable if a My Cloud device allows remote access over the internet — which thousands of devices do . He posted a proof-of-concept video on Twitter . Details of the bug were also independently found Vulnerability-related.DiscoverVulnerability by another security team , which released its own exploit code . Vermeulen reported Vulnerability-related.DiscoverVulnerability the bug over a year ago , in April 2017 , but said the company stopped responding . Normally , security researchers give 90 days for a company to respond , in line with industry-accepted responsible disclosure guidelines . After he found Vulnerability-related.DiscoverVulnerability that WD updated Vulnerability-related.PatchVulnerability the My Cloud firmware in the meanwhile without fixing Vulnerability-related.PatchVulnerability the vulnerability he found Vulnerability-related.DiscoverVulnerability , he decided to post Vulnerability-related.DiscoverVulnerability his findings . A year later , WD still hasn’t released Vulnerability-related.PatchVulnerability a patch . The company confirmed Vulnerability-related.DiscoverVulnerability that it knows Vulnerability-related.DiscoverVulnerability of the vulnerability but did not say why it took more than a year to issue Vulnerability-related.PatchVulnerability a fix . “ We are in the process of finalizing a scheduled firmware update that will resolve Vulnerability-related.PatchVulnerability the reported issue , ” a spokesperson said , which will arrive Vulnerability-related.PatchVulnerability “ within a few weeks. ” WD said Vulnerability-related.DiscoverVulnerability that several of its My Cloud products are vulnerable Vulnerability-related.DiscoverVulnerability — including the EX2 , EX4 and Mirror , but not My Cloud Home . In the meantime , Vermeulen said that there ’ s no fix and that users have to “ just disconnect ” the drive altogether if they want to keep their data safe .

China ’ s largest Internet security company , Qihoo 360 , has found Vulnerability-related.DiscoverVulnerability several high-risk security vulnerabilities in EOS ’ s blockchain platform . These vulnerabilities would enable remote attacks on all EOS nodes , Qihoo 360 claimed Vulnerability-related.DiscoverVulnerability on Weibo Tuesday , May 29 . Qihoo 360 writes Vulnerability-related.DiscoverVulnerability that they reported Vulnerability-related.DiscoverVulnerability the vulnerability to the EOS team and that the EOS mainnet will not launch until the security problems are resolved Vulnerability-related.PatchVulnerability . Local news outlet Jinse , which noted that EOS asked 360 not to report Vulnerability-related.DiscoverVulnerability the vulnerability , claimed that the vulnerabilities have been fixed Vulnerability-related.PatchVulnerability on the same day , by around 2:00 pm China Standard Time . According to 360 ’ s Weibo post Vulnerability-related.DiscoverVulnerability , the vulnerability would allow an attacker to use a smart contract with malicious code to open a security hole , and then use the supernode to enter the malicious smart contract into a new block , thus putting all network nodes under the attacker ’ s control . Once this action has been completed , the attacker could then control the digital currency on the EOS network , obtain user ’ s private keys and data , launch a cyber attack , or begin mining for other cryptocurrencies . 360 describes Vulnerability-related.DiscoverVulnerability these vulnerabilities as a new “ series of unprecedented security risks ” that could affect other blockchain platforms besides EOS : “ 360 expressed [ hope ] that the discovery and disclosure Vulnerability-related.DiscoverVulnerability of this loophole will cause the blockchain industry and security peers to pay more attention to the security of such issues and jointly enhance the security of the blockchain network. ” EOS , whose mainnet is scheduled to launch on June 2 , is currently down by 2.76 percent over a 24 hour period , trading at around $ 11.70 by press time , according to Coinmarketcap data .

Prize scams are as old as the hills , but people keep falling for them — sending the fraudsters hundreds , sometimes thousands of dollars to claim their cash , luxury cars or other non-existent prizes . Sweepstakes , lottery and prize scams “ are among the most serious and pervasive frauds operating today , ” according to a new report from the Better Business Bureau . And along with phone calls , letters and email , the crooks are now using text messages , pop-ups and phony Facebook messages to lure Attack.Phishing their victims . In fact , social media is now involved in a third of the sweepstakes fraud complaints received by the FBI ’ s Internet Crime Complaint Center ( IC3 ) . “ Scammers are like viruses . They mutate and adapt and find things that work , ” said Steve Baker , former director of the Federal Trade Commission ’ s Midwest region and author of the BBB report . “ The crooks have discovered social media big time and since social media is free to use , they can easily do a whole lot of damage from other countries. ” The BBB study found that : Nearly 500,000 people reported a sweepstakes , lottery or other prize scam to law enforcement agencies in the U.S. and Canada in the last three years . Monetary losses totaled $ 117 million last year . Facebook Messenger Lottery Fraud Scammers are creating Attack.Phishing bogus websites that look like Attack.Phishing a legitimate lottery or sweepstakes site . Or they are reaching out to potential victims who don ’ t properly set their privacy settings on social media platforms such as Facebook . The BBB report says Facebook Messenger , the private messaging app , is a favorite way for fraudsters to find victims . They can use Messenger — with or without a Facebook profile — and contact people who are not Facebook friends . In many cases , the bogus message appears to be Attack.Phishing from Publishers Clearing House ( PCH ) congratulating you on winning a big prize . To claim that prize , it says , you need to send them money . “ That ’ s a red flag warning , ” said Chris Irving , a PCH assistant vice president . “ If anybody asks you to send money to collect a prize , you know it 's a scam and it 's not from the real Publishers Clearing House . At Publishers Clearing House or any legitimate sweepstakes , the winning is always free — no purchase , no payment , no taxes or customs to pay. ” The crooks also impersonate Attack.Phishing Facebook founder Mark Zuckerberg in some of their phony Messenger messages . “ They post Attack.Phishing a fake profile of Zuckerberg on Facebook , ” Baker said . “ Then they send Attack.Phishing you a message through the Facebook messenger system saying : ‘ Hi this is Mark Zuckerberg . I 'm delighted to be able to tell you that you have won the Facebook Lottery and here is the person you need to contact to get the money . ’ ” Take the bait Attack.Phishing and click the link , and you ’ ll be told to send money to claim your winnings . Of course , there is no Facebook Lottery and Zuckerberg is not sending prize notices to anyone . In a recent story on social media scams , the New York Times reported it found 208 accounts that impersonated Zuckerberg or Facebook COO Sheryl Sandberg on Facebook and Instagram . At least 51 of the impostor accounts , including 43 on Instagram , were lottery scams . ( In 2012 , Facebook purchased Instagram for $ 1 billion . ) Facebook says it ’ s working to stop the scammers who use its platform to trick Attack.Phishing people out of their money . In March , the company announced it was using new machine learning techniques that helped it detect more than a half-million accounts related to fraudulent activity . “ These ploys are not allowed on Facebook and we 're constantly working to better defend against them , ” said Product Manager Scott Dickens . “ While we block millions of fake accounts at registration every day , we still need to focus on the would-be scammers who manage to create accounts . Our new machine learning models are trained on previously confirmed scams to help detect new ones. ” The company has also posted a warning on how to avoid Facebook scams . The BBB report calls on Facebook and other social media platforms to make “ additional efforts ” to prevent fake profiles and to make it easier for users to contact them about fraud .

Ransomware is perhaps the most ingenious cybercrime in the history of the Internet in terms of its simplicity and effectiveness . It has caused absolute terror in nearly every industry , affecting almost 50 % of organizations in 2016 , and is considered one of the top cyberthreats to the enterprise for 2017 . According to the FBI , ransomware — malware that holds systems and data for ransom Attack.Ransom — cost victims $ 209 million in the first three months of 2016 , yet totaled only $ 24 million in all of 2015 . This astronomical rise in ransomware is motivated , in large part , by a lack of preparedness . And the problem will get worse before it gets better . But in order to understand the rise of ransomware , you need to understand its economics . The Business of RansomwareTraditional data from major breaches Attack.Databreach is starting to be worth less and less as the black market gets flooded with stolen records . Just call a toll-free number and the problem is fixed in minutes . Even the cost of prized electronic healthcare records is down 50 % to 60 % from last year . But at the same time , the price per ransom Attack.Ransom has continued to climb , and much of the data being ransomed Attack.Ransom is completely worthless on the black market . Innovations in online payments have also helped pave the way for the current ransomware epidemic . Similar to how some sites are the middlemen for sellers , Web-based `` businesses '' started to appear in early 2016 to act as proxies for data extortionists to post Attack.Databreach sensitive stolen data to add urgency to payment demands Attack.Ransom , sell the stolen data to a third-party , or utilize it in other ways . These Web vendors use a `` Business 101 '' approach by providing an easy Bitcoin-based payment interface — currently worth $ 768 each ( at the time of writing this ) — and take a cut of every payment . Popularity Breeds PandemicBecause of ransomware 's massive success , its creators are pushing new technologies to their limits , with the potential to infiltrate every data storage device between the Internet and any given company . And with the massive success of Mirai — the Internet of Things botnet that took down a portion of the Internet last fall — connected devices are poised to become the next big target , translating into even more ransomware .