Cyber Training Group International (CTGI)

Tag: google

  • Google Rolls Out New Chrome Browser Update to Patch Yet Another Zero-Day Vulnerability

    Google Rolls Out New Chrome Browser Update to Patch Yet Another Zero-Day Vulnerability

    Search giant Google on Friday released an out-of-band security update to fix a new actively exploited zero-day flaw in its Chrome web browser.

    The high-severity flaw, tracked as CVE-2022-4262, concerns a type confusion bug in the V8 JavaScript engine. Clement Lecigne of Google’s Threat Analysis Group (TAG) has been credited with reporting the issue on November 29, 2022.

    Type confusion vulnerabilities could be weaponized by threat actors to perform out-of-bounds memory access, or lead to a crash and arbitrary code execution.

    According to the NIST’s National Vulnerability Database, the flaw permits a “remote attacker to potentially exploit heap corruption via a crafted HTML page.”

    Google acknowledged active exploitation of the vulnerability but stopped short of sharing additional specifics to prevent further abuse.

    CVE-2022-4262 is the fourth actively exploited type confusion flaw in Chrome that Google has addressed since the start of the year. It’s also the ninth zero-day flaw attackers have exploited in the wild in 2022 –

    Users are recommended to upgrade to version 108.0.5359.94 for macOS and Linux and 108.0.5359.94/.95 for Windows to mitigate potential threats.

    Users of Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi are also advised to apply the fixes as and when they become available.

    Credits: The Hackers News

  • FBI warns about ongoing Google Voice authentication scams

    The Federal Bureau of Investigation (FBI) says Americans who share their phone number online are being targeted by Google Voice authentication scams.

    As the federal law enforcement agency explains, the fraudsters are targeting those who have posted their phone number as a form of contact when trying to sell various items on online marketplaces or social media apps.

    “Recently, we have also been getting reports of people who are getting targeted in other locations, including sites where you post about lost pets,” the FBI said.

    If successful, they will set up a Google Voice account in their victims’ names or hijack their Gmail accounts which will later be used in other fraud schemes or in phishing attacks.

    The scammers will reach out to their targets via text messages or email showing their interest in the item put up for sale, asking the seller to verify their offer is legitimate and they’re a real person and not a bot by sharing an authentication code they’ll receive from Google.

    “What he is really doing is setting up a Google Voice account in your name using your real phone number as verification,” the agency added.

    “Once set up, he can use that Google Voice account to conduct any number of scams against other victims that won’t come back directly to him. He can also use that code to gain access to, and take over, your Gmail account.”

    Also Read: MASSIVE ATTACK AGAINST 1.6 MILLION WORDPRESS SITES UNDERWAY

    What to do if you’re the target of an authentication scam

    The FBI advises victims of Google Voice authentication scams to check Google’s support website for information on how to retake control of their Google Voice account and reclaim their Voice number.

    The federal agency also provides the following tips on to avoid getting scammed in the first place if you’re ever targeted:

    • Never share a Google verification code with others.
    • Only deal with buyers, sellers, and Fluffy-finders in person. If money is to exchange hands, make sure you are using legitimate payment processors.
    • Don’t give out your email address to buyers/sellers conducting business via phone.
    • Don’t let someone rush you into a sale. If they are pressuring you to respond, they are likely trying to manipulate you into acting without thinking.

    Those who believe they’ve fallen victim to online scams, are advised to report it to the FBI’s Internet Crime Complaint Center at www.ic3.gov or to call their local FBI office. 

    Credits: bleepingcomputer.com