Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Critical ServiceNow ...

 Firewall Daily

A critical vulnerability in ServiceNow has captured the attention of cybersecurity professionals and organizations across various sectors. This issue, primarily affecting users of the Now Platform, has been highlighted by a rise in exploitation attempts and discussions on dark web forums. The implications of this   show more ...  

ServiceNow vulnerability, which allows for Remote Code Execution (RCE), are significant, particularly for sectors like Financial Services. ServiceNow, a renowned cloud-based platform, is widely used for managing enterprise services. The platform's core functionality revolves around automating and optimizing business processes through its suite of solutions. These include IT Service Management (ITSM), IT Operations Management (ITOM), IT Business Management (ITBM), Customer Service Management (CSM), Human Resources Service Delivery (HRSD), and Application Development.  All these solutions are built upon the unified technology stack known as the Now Platform. Decoding the ServiceNow Vulnerability The Now Platform aims to enhance efficiency, reduce operational costs, and improve user experiences by integrating various digital workflows into a single cohesive system. However, recent revelations have exposed vulnerabilities within this platform that have serious repercussions for its users. [caption id="attachment_85707" align="alignnone" width="1024"] Image showing ServiceNow exploits, proof of concepts, and compromised databases available for sale on cybercrime forums (Source: Cyble)[/caption] On July 10, 2024, ServiceNow disclosed three severe vulnerabilities in various Now Platform versions, including the Washington D.C., Vancouver, and Utah releases.  These vulnerabilities are identified as CVE-2024-4879, CVE-2024-5178, and CVE-2024-5217, each with different severities. CVE-2024-4879, a critical Jelly Template Injection flaw, affects the Vancouver and Washington D.C. releases with a CVSS score of 9.3. CVE-2024-5178, a medium-severity issue related to Incomplete Input Validation, impacts the Vancouver, Washington D.C., and Utah releases, scoring 6.9.  CVE-2024-5217, another critical Incomplete Input Validation vulnerability, affects Washington D.C., Vancouver, and earlier releases with a CVSS score of 9.2. Following the disclosure, exploit scripts and scanning tools surfaced publicly, leading to a noticeable increase in exploitation attempts, particularly within the Banking, Financial Services, and Insurance (BFSI) sector by the end of July 2024. Observations and Exploitation Patterns Cyble Research Intelligence Labs (CRIL) observed significant activity related to the exploitation of this ServiceNow vulnerability. Attackers have been using automated scanning tools to identify outdated instances of ServiceNow. Once identified, these vulnerabilities are exploited through tailored payloads designed to extract sensitive data from databases. Successful exploitation enables attackers to access critical information, including usernames and passwords. Such data breaches can be devastating, leading to severe financial and reputational damage for affected organizations. Notably, the dark web has seen an influx of discussions and transactions involving proof of concepts and victim databases related to these vulnerabilities. [caption id="attachment_85710" align="alignnone" width="406"] Chart illustrating the online exposure of ServiceNow instances (data provided by ODIN)[/caption] A critical aspect of the current situation is the widespread exposure of ServiceNow instances on the internet. The Cyble ODIN scanner identified over 16,000 instances of ServiceNow accessible from the internet, with a majority located in the United States. This extensive exposure significantly amplifies the risk posed by the ServiceNow vulnerabilities. Recommendations for Mitigation To mitigate the risks associated with the recent ServiceNow vulnerabilities, organizations should follow several key recommendations. First, they must apply the latest patches provided by ServiceNow to address the identified vulnerabilities and protect against known exploits. Keeping software up-to-date is essential for security. Additionally, a robust patch management process should be developed and maintained, encompassing inventory management, patch assessment, testing, deployment, and verification. Automating these processes can ensure that critical patches are applied consistently and promptly. Network segmentation is also crucial; implementing firewalls, VLANs, and access controls can help prevent critical assets from being exposed over the internet and minimize the attack surface. Furthermore, maintaining comprehensive visibility into both internal and external assets is important.  Organizations should keep an updated inventory and use asset management tools and continuous monitoring to manage their IT environment effectively. The recent vulnerabilities in the ServiceNow platform highlight the need for vigilance. By proactively applying patches, enhancing patch management, and segmenting networks, organizations can better safeguard themselves against these threats.

image for UK’s Data Regulato ...

 Ransomware News

The British data and privacy watchdog plans to fine Advance Software in millions over the 2022 ransomware incident that crippled healthcare services across the country. The UK Information Commissioner's Office (ICO) has proposed a £6.09 million [approximately US$ 7.74 million] fine against Advanced Computer   show more ...  

Software Group Ltd. for failing to safeguard the personal data of tens of thousands of individuals, including sensitive medical information. “Losing control of sensitive personal information will have been distressing for people who had no choice but to put their trust in health and care organisations," said John Edwards, UK Information Commissioner. "Despite already installing measures on its corporate systems, our provisional finding is that Advanced failed to keep its healthcare systems secure." ICO Tells Why Fine to Advanced Software is Justified Advanced, a leading IT and software services provider serving numerous organizations including the National Health Service (NHS), acted as a data processor handling personal information on behalf of its clients. The proposed fine stems from a LockBit 3.0 ransomware attack in August 2022 that compromised the personal data of 82,946 individuals. Hackers exploited a customer account lacking multi-factor authentication to infiltrate Advanced's health and care systems. They gained access by exploiting legitimate third-party credentials to access a remote desktop session on the company's Staffplan Citrix server, which is used for scheduling caregiver shifts. The attackers subsequently moved deeper into Advanced's infrastructure, escalating their privileges. As a result, the personal data of 16 NHS trust clients using the company's Staffplan and Caresys patient caregiver management solutions was stolen. However, patient data controlled by NHS trusts was not compromised, according to Advanced. Consequently, sensitive data including phone numbers, medical records, and home addresses of 890 individuals receiving at-home care was also exfiltrated. While no data appeared on the dark web, the incident severely disrupted critical healthcare services like NHS 111 and hindered access to patient records. The ICO’s decision is provisional, and the final penalty amount may change following consideration of Advanced’s response. No conclusion has been reached regarding a data protection law violation. Information Commissioner John Edwards emphasized the criticality of information security, stating that the loss of sensitive personal data caused significant distress to individuals who relied on healthcare providers. The cyberattack not only compromised personal information but also exacerbated pressures on an already strained healthcare sector. Edwards criticized Advanced's information security practices, noting the company's failure to adequately protect its healthcare systems despite measures in place for corporate systems. The ICO urged all organizations, particularly those handling sensitive health data, to prioritize security measures such as regular vulnerability assessments, multi-factor authentication, and up-to-date security patches. Data processors, like Advanced, share responsibility with data controllers for safeguarding personal information. Implementing robust technical and organizational measures to assess and mitigate risks is essential to prevent data breaches. UK's NHS 'Highly Vulnerable' to Cyberattacks Professor Ciaran Martin, the first top boss of the UK’s National Cyber Security Centre (NCSC) has already warned that the National Health Service (NHS) remains "highly vulnerable" to cyberattacks unless significant updates are made to its computer systems. This came on the heels of a recent major ransomware attack on a third-party blood testing service provider Synnovis that led to severe disruption in healthcare services across London.

image for Nexera Suffers Major ...

 Cybersecurity News

In yet another significant blow to the cryptocurrency ecosystem, blockchain platform Nexera has fallen victim to a major hack. While initial reports suggested that the hack resulted in the theft of over $1.5 million worth of NXRA tokens, the company said that its internal investigation estimated that "only $440k   show more ...  

was effectively compromised." Nexera, previously known as AllianceBlock, is a Decentralized Finance (DeFi) protocol aiming to bridge DeFi with traditional finance. Responding to the exploit, Nexera has paused the NXRA token contract and halted trading on decentralized exchanges. The company said that efforts were underway to communicate with centralized exchanges to suspend trading activities as well. What Led to Nexera Crypto Hack The hack was initially detected by blockchain security firm Cyvers Alert on August 7, 2024. In a post on X (formerly Twitter), CyversAlert said, “Our system has detected a suspicious transaction involving your proxy contract. An address took ownership of your proxy contract and upgraded it. Shortly after, the address used the withdraw admin function to transfer all the $NXRA tokens.” [caption id="attachment_85745" align="alignnone" width="747"] Source: X[/caption] The attack unfolded rapidly. After gaining control of Nexera's proxy contract, the unknown entity executed a withdrawal function and transferred a staggering 47 million NXRA tokens to their own wallet. These tokens were then promptly converted into Ethereum (ETH). Subsequently, a portion of the ETH was then transferred to the Binance Smart Chain (BNB Chain). This methodology, previously carried out by bad actors in crypto hacks earlier this year, is becoming a norm. The involvement of multiple blockchain networks complicates the tracking and recovery of the stolen funds. Nexera’s Response to Hack Nexera swiftly responded to the breach by pausing the $NXRA token contract and halting trading on both decentralized and centralized exchanges. The company has also initiated a comprehensive investigation into the incident, aiming to identify the culprits and recover the stolen funds. [caption id="attachment_85748" align="alignnone" width="727"] Source: X[/caption] In its initial investigation, the company wrote in a post on X that that only $440,000 worth of NXRA tokens were effectively compromised. “The exploit was part of a wider coordinated attack targeting multiple projects and protocols. Thanks to our team and partners, we managed to identify and stop it quickly and mitigate damage. Of the total $NXRA tokens that were transferred, only $440k was effectively compromised. The remaining $NXRA assets in the attacker’s wallet have been frozen, and they cannot do anything with them,” Nexera said. “We are also issuing a full post-mortem report in the coming days. Users who have staked on Fundrs will have all their $NXRA restored. For now, nothing needs to be done,” the firm added. Crypto Hack Fallout The hack has sent shockwaves through the crypto community, highlighting the persistent vulnerabilities within the blockchain ecosystem. The incident underscores the urgent need for robust security measures to protect digital assets. For Nexera, the consequences are severe. The plummeting value of the NXRA token, which dropped by 40 percent following the hack, is a testament to the market's reaction. The hack of Nexera joins a growing list of high-profile crypto thefts. The crypto sector faced high-profile losses last month as hackers compromised approximately $266 million through 16 separate breaches. The most noteworthy incidents was the July 18 attack on Indian crypto exchange WazirX, which recorded over $230 million, or 86.4%, of the month’s total losses. Other significant victims of July’s crypto hacks included algorithmic protocol Compound Finance, which lost $24 million, bridging protocol Li.Fi ($10 million), decentralized AI protocol Bittensor, and liquidity provider Rho Markets, each losing $8 million. The incident serves as a stark reminder of the risks inherent in the world of DeFi. As the crypto industry continues to grow, it is imperative for projects to prioritize security and invest in robust audit and monitoring systems.

image for Largest Data Breach ...

 Cybersecurity News

A lawsuit has been filed against National Public Data, a background check service owned by Jerico Pictures Inc, for an alleged data breach that could leave nearly three billion people vulnerable to identity theft and financial fraud. The class-action lawsuit, filed earlier this month in a US District Court for the   show more ...  

Southern District of Florida, accuses National Public Data of a security lapse that exposed a staggering 2.9 billion people's personal details. It says that due to the security lapse, a threat actor, acting under the alias "USDoD", released the sensitive data for free on the dark web, potentially impacting a staggering number of individuals. The leaked data includes full names, addresses, and Social Security Numbers (SSNs), on a notorious cybercrime forum. This breach, if proven, ranks among the largest cybersecurity incidents in recent history, potentially surpassing the infamous 2013 Yahoo data breach that compromised 3 billion users. This isn't the first time that the National Public Data has been targeted. Back in April, a hacker using the alias 'sxul' claimed to have breached the company and put the database up for sale for $2 million. National Public Data Breach Claims in Detail The lawsuit, filed by Christopher Hofmann, a California resident, alleges that "USDoD" leaked a massive trove of data stolen from National Public Data. This data includes a goldmine of sensitive information, including full names of individuals, their past and present addresses (spanning 30 years), Social Security Numbers (SSNs) - in plain text and information about relatives—including some deceased for nearly two decades. The lawsuit shared that National Public Data obtained such a vast amount of personal information through a technique called "scraping." Scraping involves collecting data from websites and other online sources. While scraping itself isn't inherently illegal, the issue here is the scale and source of the data National Public Data collected. The lawsuit alleges that National Public Data scraped this sensitive data, including SSNs, from non-public sources. This means that many of the individuals impacted likely never gave their consent for their information to be collected by National Public Data. While National Public Data hasn’t put out an official statement, hackers could use potentially stolen information to carry out identity theft and tax frauds using the SSN. Meanwhile, the plaintiff has asked the court to direct the firm to purge the personal information of all the individuals affected and to encrypt all data collected going forward. In addition to monetary relief, Hofmann has asked for a series of requirements, including that National Public Data segment data, conduct database scanning, implement a threat-management program, and appoint a third-party assessor to conduct an evaluation of its cybersecurity frameworks annually for 10 years. Protecting Yourself in the Aftermath While the legal battle unfolds, what can you do if you suspect your information might be part of this colossal leak? Here are some steps you can take to mitigate the damage: Monitor Your Credit Reports: Regularly checking your credit reports with all three major credit bureaus (Equifax, Experian, and TransUnion) is crucial. Look for any suspicious activity, such as new accounts being opened in your name. Enable a Credit Freeze: A credit freeze restricts access to your credit report, making it significantly harder for criminals to open new accounts under your name. While a credit freeze may cause some inconvenience when applying for new credit, it's a powerful safeguard against identity theft. Consider Identity Theft Protection Services: While not foolproof, identity theft protection services can monitor your personal information for signs of misuse and offer assistance in the event of identity theft. Change Your Passwords: As a precaution, consider changing your passwords for any online accounts that might contain sensitive information. Use strong passwords that are unique to each account.

image for Japanese Publisher K ...

 Cybersecurity News

Kadokawa Corporation, a major Japanese publisher, has confirmed a significant data breach affecting 254,241 individuals due to a cyberattack. The Kadokawa data breach, discovered on June 8, was revealed following a thorough investigation by third-party cybersecurity experts. The cyberattack on Kadokawa, which   show more ...  

targeted the Group's data center, specifically affected DWANGO Co., Ltd., a subsidiary known for its Niconico services. Details of the Kadokawa Data Breach Kadokawa’s announcement detailed the extent of the information compromised in the ransomware attack. The affected data in Kadokawa data breach includes: Business Partners: Personal information (names, dates of birth, addresses, telephone numbers, email addresses, pseudonyms, bank account details, etc.) of some business partners of DWANGO Co., Ltd., and its affiliates. Former Employees: Personal information of former employees of DWANGO Co., Ltd., and its affiliated companies. Interviewees: Personal details of individuals interviewed by DWANGO Co., Ltd., and its affiliates. Students and Educators: Personal data of current students, graduates, parents, applicants, and document requesters from N Progressive School and N/S High Schools, including information on educational background and student status. Employees: Personal information of all employees of DWANGO Co., Ltd., including contract and temporary workers, and some employees of affiliated and sibling companies. In addition to personal data, the Kadokawa data breach also included company information such as contracts with business partners, internal documents, and information about companies operated by former employees. [caption id="attachment_85690" align="aligncenter" width="1024"] Source: Kadokawa[/caption] Kadokawa has been proactive in addressing the breach. The corporation has reported the incident to Japan’s Personal Information Protection Commission and has set up a dedicated helpdesk to assist affected individuals. Cause of Kadokawa Data Breach According to the investigation, the exact method of the cyberattack remains unknown, but it is presumed that the Kadokawa data breach was initiated by stealing employee account information through phishing attacks. This led to unauthorized access to the internal network and subsequent deployment of ransomware, resulting in the data leak. Despite existing security measures, Kadokawa acknowledges the failure to prevent this incident and commits to implementing further measures to prevent recurrence, with continued support from external security firms. Kadokawa is currently assessing the impact of this data breach on its business performance for the current fiscal year and will provide updates as necessary. The corporation is also addressing the potential for secondary damage, including the dissemination of leaked information on social media and anonymous bulletin boards. Measures Against Malicious Dissemination Kadokawa has identified and reported 896 cases of malicious information dissemination related to DWANGO Co., Ltd., and 67 cases related to the Kadokawa DWANGO Educational Institute across platforms like X (formerly Twitter), 5ch, and various curation sites. The corporation is actively requesting the deletion of such posts and pursuing information disclosure requests to identify and take legal action against the originators of these malicious acts. Resumption of Niconico Services Dwango Co., Ltd. (Headquarters: Chuo-ku, Tokyo; President and CEO: Natsuno Tsuyoshi) has announced that the "Nico Nico" service, which had been unavailable due to the cyberattack on Kadokawa, will gradually resume operations under the new version name "Nico Nico is Back" starting at 3:00 p.m. on Monday, August 5, 2024. "When the cyberattack occurred, we anticipated that recovery would be challenging even by summer. However, we aimed for a swift recovery with the sole desire to bring Niconico back to everyone as soon as possible. We were able to resume service by August 5th thanks to the hard work of our employees and the warm support of our users. Thank you very much. The new version name embodies the message we want to convey to everyone who has been waiting for so long. We will continue to protect Niconico, everyone's playground. Please enjoy your daily life with Niconico again," said Niconico CEO Shigetaka Kurita.

image for Russian Hacker Group ...

 Firewall Daily

The notorious hacker group APT28 has launched a sophisticated campaign to distribute HeadLace malware through deceptive car sale advertisements. This new tactic, which began in March 2024, targets diplomats, leveraging fake car ads to mask their malicious intent. APT28, also known as Fighting Ursa, Fancy Bear, or   show more ...  

Sofacy, is a prominent advanced persistent threat (APT) group linked to Russian military intelligence. This group has a long history of employing elaborate phishing schemes to deliver malware, and their latest campaign follows a similar pattern. The Deceptive Car Ad Campaign Leads to HeadLace Malware Attack The deceptive car ad campaign centers around fake advertisements for luxury cars, a tactic that has become a staple for cybercriminals. In this instance, APT28 used a fraudulent ad for an Audi Q7 Quattro SUV as bait. The ad was crafted to appeal to diplomats, using the guise of a legitimate car sale to lure victims into clicking malicious links. [caption id="attachment_85668" align="alignnone" width="1152"] Fake diplomatic car ad hosted on ImgBB (Source: Unit42)[/caption] Unit 42, the threat intelligence team at Palo Alto Networks, revealed that APT28 exploited public and free services to execute their attack. The malicious link was hosted on Webhook.site, a service typically used for creating randomized URLs for development projects. By leveraging this legitimate service, the hackers could distribute a malicious HTML document without raising immediate suspicion. [caption id="attachment_85666" align="alignnone" width="1339"] HTML code deployed in the attack via the Webhook.site service. (Source: Unit42)[/caption] The HTML file was designed to execute a multi-stage infection process, starting with an automated check to determine if the victim’s system was running Windows. If the system was identified as non-Windows, the HTML redirected the user to a decoy image hosted on ImgBB, another free service. For Windows users, the file initiated a download of a ZIP archive containing malware. Dissecting the HeadLace Malware Attack The ZIP file, labeled “IMG-387470302099.zip,” contained three files: an executable disguised as an image, a DLL library, and a batch file. The disguised executable, named “IMG-387470302099.jpg.exe,” appeared as a benign image but actually contained a copy of the Windows calculator program. [caption id="attachment_85671" align="alignnone" width="1354"] Contents of the zqtxmo.bat batch script (Source: Unit42)[/caption] This file was used to sideload the DLL library, "WindowsCodecs.dll," which is part of the HeadLace backdoor malware. HeadLace is a modular and sophisticated form of malware, known for its ability to execute in stages. The DLL file in this headLace malware attack contained a function designed to execute a batch file named “zqtxmo.bat.” This batch file further facilitated the malware’s deployment by downloading additional content from another Webhook.site URL, saving it in the victim’s program data directory, and executing it. The campaign has been attributed to Fighting Ursa with a medium to high level of confidence. The group’s use of public services to host malicious elements aligns with their previously documented tactics. Their reliance on free services like Webhook.site and ImgBB is a trademakr of their attack strategies, reflecting a broader trend among cybercriminals to exploit legitimate platforms for nefarious purposes. The researcher's analysis points to a pattern of behavior consistent with past APT28 campaigns. The group's method of repurposing successful tactics—such as employing fake car ads—demonstrates their strategic approach to maintaining the effectiveness of their attacks over time. Previous Instances and Mitigation Strategies In 2023, another Russian threat group, Cloaked Ursa, used a similar approach with a fake BMW advertisement targeting diplomatic missions in Ukraine. While not directly linked to APT28’s current campaign, the similarity in tactics highlights a persistent trend among Russian threat actors in utilizing deceptive advertisements to deliver malware. Organizations can enhance their defenses against such attacks by scrutinizing the use of public and free services that are commonly exploited by cybercriminals. Restricting access to these platforms or monitoring their usage more closely can help in identifying and mitigating potential threats. The APT28 group’s latest campaign, utilizing fake car ads to distribute HeadLace malware, highlights the sophisticated nature of cyber threats. By exploiting legitimate services to host their malicious payloads, Fighting Ursa continues to demonstrate their capability and persistence in targeting high-profile victims such as diplomats. As cyber threats become more advanced, organizations and individuals must stay vigilant and implement strong security measures to protect against such deceptive attacks. The combination of vigilance, robust security practices, and proactive monitoring is essential in defending against the tactics employed by threat actors like APT28.

image for Researchers Bypass M ...

 Cybersecurity News

While Microsoft 365 (formerly Office 365) has implemented various anti-phishing measures to protect its users, researchers have found a bypass for the First Contact Safety Tip feature within the application. The researchers demonstrated how these safeguards can be circumvented by determined attackers with sufficient   show more ...  

knowledge of CSS. Manipulating Microsoft 365 Anti-Phishing First Contact Safety Tip One of the key anti-phishing features in Microsoft 365 is the First Contact Safety Tip, which alerts users when they receive an email from an address they don't typically communicate with. However, researchers have discovered a way to bypass this measure by manipulating the email's HTML code. [caption id="attachment_85788" align="alignnone" width="1588"] Source: certitude.consulting[/caption] The vulnerability lies in the fact that the safety tip can be hidden from the user by altering the HTML code of the email using CSS style tags. This can be done by changing the background and font colors to white, effectively rendering the safety tip invisible to the user. By using strategic CSS styling, researchers from Certitude were able to effectively "hide" the First Contact Safety Tip from the email's recipient. This was achieved by changing the background and font colors to white, effectively rendering the alert invisible to the user. [caption id="attachment_85787" align="alignnone" width="1593"] Source: certitude.consulting[/caption] Building upon their findings, the researchers took their exploration of Microsoft 365's anti-phishing defenses a step further. They were able to spoof the icons that Outlook uses to allow users to recognize emails that are encrypted and/or signed, potentially deceiving even more attentive users due to the level of similarity. Responsible Disclosure and Microsoft's Response After developing their proof of concept and preparing an advisory, the researchers responsibly disclosed the issues to Microsoft through the Microsoft Researcher Portal (MSRC). While Microsoft acknowledged the validity of the findings, they chose not to address the vulnerabilities immediately, citing that the issues were "mainly applicable for phishing attacks" and that they would be marked for future review as an opportunity to improve their products. We determined your finding is valid but does not meet our bar for immediate servicing considering this is mainly applicable for phishing attacks. However, we have still marked your finding for future review as an opportunity to improve our products. - Microsoft MSRC, 14.02.2024 The discovery of the First Contact Safety Tip bypass vulnerability serves as a fine example that that no security system is foolproof, and users should always take adequate precaution against phishing attacks. Anti-phishing measures at the individual/employee level can include maintaining caution against emails from unfamiliar senders, checking for unusual formatting or spelling mistakes, and verifying the authenticity of emails before taking any action. At the organizational level, security teams for enterprises that rely on Microsoft 365 can consider implementing additional security measures to complement existing anti-phishing features.

image for How to Buy Secure So ...

 Cyber Essentials

The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) released the "Secure by Demand Guide: How Software Customers Can Drive a Secure Technology Ecosystem." This comprehensive CISA Secure by Demand guide aims to empower organizations purchasing software by   show more ...  

providing them with the necessary tools and knowledge to evaluate the cybersecurity practices of software manufacturers, ensuring that "secure by design" principles are integral to their procurement processes. CISA Secure by Demand Guide: Addressing a Critical Gap in Procurement Practices In many organizations, acquisition staff possess a general understanding of core cybersecurity requirements for technology acquisitions. However, they often overlook the critical need to assess whether software suppliers have embedded security considerations from the earliest stages of product development. This oversight can lead to the procurement of software products that may be vulnerable to exploitation. The "Secure by Demand Guide" seeks to fill this gap by offering practical guidance on how to integrate product security into various stages of the procurement lifecycle. The CISA guide is designed to help organizations make risk-informed decisions and ensure that their suppliers prioritize cybersecurity throughout the product development process. Empowering Organizations with Key Questions and Resources The guide provides a set of strategic questions that organizations can use when evaluating software vendors. These questions are aimed at uncovering the depth of a vendor's commitment to cybersecurity and include inquiries about their security practices, policies, and the integration of security into their product development lifecycle. Some of the key recommendations in the guide include: Obtaining the Manufacturer’s Software Bill of Materials (SBOM): This document lists third-party software components used in the product, helping organizations understand potential vulnerabilities and dependencies. Reviewing Security Roadmaps: Organizations should request vendors’ roadmaps that outline plans to eliminate classes of vulnerabilities in their products. Vulnerability Disclosure Policies: Checking if vendors have publicly available policies for disclosing vulnerabilities ensures transparency and accountability. Aligning with Secure by Design Principles This CISA guide complements the recently published "Software Acquisition Guide for Government Enterprise Consumers: Software Assurance in the Cyber-Supply Chain Risk Management (C-SCRM) Lifecycle." Together, these guides provide a comprehensive framework for incorporating security considerations into software procurement processes. The new guide also serves as a counterpart to CISA’s "Secure by Design" guidance for technology manufacturers. This earlier guidance highlights three fundamental principles that manufacturers should follow: Take Ownership of Customer Security Outcomes: Manufacturers must prioritize the security of their customers by proactively addressing potential threats and vulnerabilities in their products. Embrace Radical Transparency and Accountability: Clear communication and openness about security practices and vulnerabilities are essential for building trust with customers. Build Organizational Structure and Leadership: Establishing robust leadership and organizational frameworks to support security initiatives is crucial for achieving these goals. Shifting Focus from Enterprise Security to Product Security The guide emphasizes the importance of distinguishing between enterprise security and product security. While enterprise security focuses on protecting a company’s own infrastructure and operations, product security pertains to the measures a software manufacturer takes to ensure their products are secure against potential attacks. Many compliance standards used during procurement processes focus on enterprise security, often neglecting the critical aspect of product security. This guide addresses this gap by providing resources and strategies for assessing the product security maturity of software manufacturers and ensuring they adhere to secure by design principles. Integrating Product Security Throughout the Procurement Lifecycle To effectively integrate product security into the procurement process, organizations are encouraged to: Before Procurement: Pose questions to understand each candidate software manufacturer’s approach to product security. This pre-procurement assessment helps identify vendors committed to secure product development. During Procurement: Incorporate product security requirements into contract language, ensuring that vendors are contractually obligated to maintain high security standards. Following Procurement: Continuously assess software manufacturers’ product security and security outcomes. Ongoing evaluation ensures that vendors remain committed to secure practices throughout the product lifecycle. A Call to Action for Businesses CISA Director Jen Easterly highlighted the importance of businesses leveraging their purchasing power to drive the adoption of secure by design principles. "We are glad to see leading technology vendors recognize that their products need to be more secure and voluntarily join the Secure by Design pledge. Businesses can also help move the needle by making better risk-informed decisions when purchasing software," Easterly stated. "This new guide will help software customers understand how they can use their purchasing power to procure secure products and turn Secure by Design into Secure by Demand." In conclusion, the "Secure by Demand Guide" provides a valuable resource for organizations seeking to enhance their software procurement practices. By incorporating the guide’s recommendations, businesses can ensure that they are procuring software products that are secure, resilient, and capable of withstanding evolving cyber threats.

image for AWS Vulnerabilities ...

 Cybersecurity News

Security researchers discovered six critical vulnerabilities in AWS services that could lead to remote code execution (RCE), data exfiltration, AI model manipulation, and even account takeover. AWS has fixed the vulnerabilities, which were revealed at the Black Hat security conference today, but the researchers   show more ...  

cautioned that the vulnerabilities may exist in other AWS and open source services so they offered general mitigation guidance. AWS Investigating If Customers Affected by the Vulnerabilities Aqua Security researchers, led by Yakir Kadkoda, Lead Security Researcher at Aqua's Team Nautilus research team, discovered the AWS vulnerabilities in February 2024. The affected AWS services were: CloudFormation Glue EMR SageMaker ServiceCatalog CodeStar “These vulnerabilities could have impacted any organization in the world that has ever used any of these services,” the researchers said. They detailed a months-long process of working with AWS to resolve the issues, and noted that the cloud service provider is investigating whether attackers have ever used the attack vector previously to exploit the vulnerabilities, “and will contact customers directly in the event they are affected by any of the reported issues.” Kadkoda told The Cyber Express that working with AWS on the disclosure and mitigation process was a good experience. “The disclosure process with cloud security providers is very important, and we are always aiming to improve the process,” Kadkoda said. “Sometimes it can be challenging, but in this case we had a very good experience with AWS's security team. They promptly replied to our disclosure requests and shared information about the gaps and fixes. The security team was professional and handled this diligently and with the proper sense of urgency.” The research will be detailed in a lengthy blog post to be published later this week during the DEFCON conference; we will link to the post when it goes live. AWS ‘Shadow Resources’ Attack Vector Detailed The researchers dubbed the AWS attack vector they discovered “Shadow Resources,” which involves AWS S3 buckets created to support various services, and they found a technique they named “Bucket Monopoly” that “can significantly enhance the success rate of attacks exploiting Shadow S3 bucket resources.” While using AWS CloudFormation, they noticed that when you use the service via the AWS Management Console for the first time in a new region to create a new stack, the service automatically triggers AWS to create an S3 bucket for storing CloudFormation templates, which users might not be aware of. The service uses the same bucket name across all AWS regions except for the region's name. They discovered that attackers could set up buckets in unused AWS regions and wait for a victim to use the CloudFormation service in a new region “to stealthily use the attacker-controlled S3 buckets as part of the CloudFormation service.” They then used that technique across other AWS services. Attackers could escalate their attack by changing the configuration of the S3 bucket to be publicly accessible. Further, creating a permissive resource-based policy on the S3 bucket could explicitly grant permissions to another IAM principal, specifically the vulnerable AWS service, which would allow the victim’s vulnerable service to be able to read and write data to the attacker-controlled bucket. After an attacker does all that, the CloudFormation service would find that the bucket already exists and will drop its template file into it, creating an information disclosure vulnerability. By modifying CloudFormation templates before they are executed, “the technique will be on steroids, because many of the original conditions and prerequisites are no longer necessary for our attack vector to succeed.” Attackers may be able to create an admin role in a target organization simply by knowing their CloudFormation unique hash, “the most severe outcome we can achieve in the cloud, as it allows us to take over the victim's account.” Fortunately, the hash values are random so not easily determined, but the researchers were able to identify numerous hashes used by different AWS accounts simply by utilizing GitHub regex searches, Sourcegraph, scraping open issues, and similar techniques. “Based on our research, we strongly believe that account IDs should be considered secrets, since there may be other kinds of similar exploits that could be carried out based on knowing an account ID,” they said. AWS Vulnerabilities Mitigations The researchers cautioned that the attack vector may apply to other AWS services or to open-source projects, so they recommended three mitigation strategies: aws:ResourceAccount Condition: To prevent a user or a service role from accessing an untrusted bucket, you can define a scoped policy for the role used or assumed by the service and include the Condition element in the JSON policy. For example, the default service role that EMR Studio creates for users is called AmazonEMRStudio_ServiceRole_{ID} and includes the necessary permissions for the service to operate. In this role, AWS enforces the aws:ResourceAccount condition in the policy to check that the AWS account ID of the S3 bucket used by EMR is owned by the user and not an attacker. Some AWS services require access to resources hosted in another AWS account, so that needs to be checked. Verify the expected bucket owner: Verify the owner of the S3 bucket using the <gist> command. “You will need to check the glue bucket owner for every AWS region with your AWS account ID. If you receive an Access Denied message, this indicates that the bucket is not under your account, and you should verify the owner of the bucket and whether you trust this account.” The --expected-bucket-owner check is also valuable for open-source projects that create S3 buckets as part of their operation, they said. Naming S3 buckets: Instead of using predictable or static identifiers in the bucket name, you should generate a unique hash or a random identifier for each region and account, incorporating this value into the S3 bucket name, to protect against attackers claiming your bucket prematurely.

image for Enhancing Cyber Defe ...

 Cybersecurity News

Cyberattacks are becoming increasingly sophisticated, targeting not just traditional IT infrastructure but also cloud environments, mobile devices, and the expanding network of interconnected devices known as the Internet of Things (IoT).  In this dynamic environment, CEOs are under immense pressure to safeguard   show more ...  

their organizations and come up with cyber defense strategies like Attack Surface Management (ASM). A successful cyberattack can have devastating consequences, resulting in financial losses, operational disruptions, reputational damage, and even legal repercussions. To effectively navigate this complex landscape, organizations require a robust cyber defense strategy. At the heart of this strategy lies ASM. As its name suggests, ASM focuses on identifying, prioritizing, and managing an organization's attack surface – the entirety of its digital assets that could be exploited by malicious actors. CEO Cybersecurity Insights: Prioritizing Proactive Defense CEOs are increasingly recognizing the pivotal role they play in driving their organization's cybersecurity posture. Gone are the days of reactive defense; leading CEOs are championing a proactive approach that prioritizes prevention over mitigation. According to a recent article by the Forbes Technology Council, effective ASM aligns perfectly with this strategic shift. By providing a comprehensive view of the attack surface, ASM enables organizations to anticipate potential vulnerabilities and take corrective measures before they are exploited. "We're teaching MSPs [Managed Service Providers] to become Managed Attack Surface Solution Providers," says David Bellini, CEO of Liongard, in an interview to CRN. This shift reflects the growing importance of ASM within the broader cybersecurity landscape. By partnering with managed security providers that offer expertise in ASM, organizations can gain the resources and expertise they need to effectively manage their attack surface. Mitigating Cyber Risk and Protecting Business Value By effectively managing their attack surface, CEOs can significantly reduce the risk of a successful cyberattack. This translates to increased cyber resilience – the ability to withstand, adapt to, and recover from cyberattacks. As highlighted in a KuppingerCole research paper, a robust ASM program helps organizations prioritize the most critical vulnerabilities, focusing resources on mitigating threats that pose the highest risk. This risk-based approach optimizes resource allocation and ensures that the most valuable assets are adequately protected. In an era where data is the lifeblood of most businesses, protecting it from unauthorized access is paramount. ASM plays a crucial role in achieving this objective by identifying and securing sensitive data wherever it resides within the attack surface. This helps organizations comply with data privacy regulations and safeguard their competitive advantage. Beyond Security: Driving Business Growth While cybersecurity has traditionally been viewed as a cost center, forward-thinking CEOs recognize it as an essential investment for business growth. By protecting critical assets and data, a robust ASM program enables organizations to: Focus on innovation: With the peace of mind that their systems are secure, organizations can dedicate more resources to developing new products, services, and business models. Enhance customer trust: Consumers are increasingly concerned about data privacy. By demonstrating a commitment to data security through effective ASM, organizations can build trust with their customers and attract new business. Maintain operational continuity: Cyberattacks can bring operations to a screeching halt. By minimizing the risk of disruption through ASM, organizations can ensure a smooth flow of business activities and ensure effective cyber threat management. Implementing an Effective Attack Surface Management Program Implementing a comprehensive ASM program is not without its challenges. Here are some key obstacles CEOs often encounter: Visibility and Inventory: Gaining a complete picture of the attack surface can be complex due to the dynamic nature of IT environments. Legacy systems, cloud migrations, and the ever-expanding use of mobile devices can create blind spots within the attack surface. Resource Constraints: Implementing and maintaining an ASM program requires skilled personnel, specialized tools, and ongoing investment. Many organizations face resource limitations in this area. Integration with Existing Security Tools: Integrating ASM with other cybersecurity tools and platforms can be challenging. A holistic approach is crucial for maximizing the benefits of ASM. Best Practices for Overcoming Challenges, Achieving Effective ASM Despite these challenges, CEOs and security leaders can adopt the following best practices for enhancing cyber resilience posture through effective ASM: Executive Sponsorship: Secure the strong support of top management to prioritize ASM initiatives and allocate necessary resources. A CEO's championing of ASM sends a clear message to the entire organization about the importance of cybersecurity. Develop a Comprehensive ASM Strategy: This strategy should be aligned with overall business objectives and risk tolerance. It should outline the key components of the ASM program, including asset discovery and inventory, vulnerability assessment, risk prioritization, and remediation strategies. Organizations like Cyble, the leading provider of AI-driven cybersecurity solutions, provide a strong ASM tool that helps banks secure their digital assets by actively monitoring and managing potential entry points across web and mobile apps, cloud devices, domains, email servers, IoT devices, and public code repositories. In June 2024, Cyble was  recognized by Forrester (Nasdaq: FORR) in its report, The Attack Surface Management Solutions Landscape, Q2 2024 Report. This report offers valuable insights for organizations seeking to evaluate and select an attack surface management (ASM) solution that aligns with their unique attack surfaces and threats. Explore how Cyble can assist in cybersecurity for banking executives and ensure a comprehensive approach to banking attack surface management. Discover more by scheduling a demo today!

image for Cybercrime Rapper Su ...

 A Little Sunshine

A partial selfie posted by Puchmade Dev to his Twitter account. Yes, that is a functioning handheld card skimming device, encrusted in diamonds. Underneath that are more medallions, including a diamond-studded bitcoin and payment card. In January, KrebsOnSecurity wrote about rapper Punchmade Dev, whose music videos   show more ...  

sing the praises of a cybercrime lifestyle. That story showed how Punchmade’s social media profiles promoted Punchmade-themed online stores selling bank account and payment card data. The subject of that piece, a 22-year-old Kentucky man, is now brazenly suing his financial institution after it blocked a $75,000 wire transfer and froze his account, citing an active law enforcement investigation. With memorable hits such as “Internet Swiping” and “Million Dollar Criminal” earning millions of views, Punchmade Dev has leveraged his considerable following to peddle tutorials on how to commit financial crimes online. But until recently, there wasn’t much to support a conclusion that Punchmade was actually doing the cybercrime things he promotes in his songs. That changed earlier this year when KrebsOnSecurity showed how Punchmade’s social media handles were promoting Punchmade e-commerce shops online that sold access to Cashapp and PayPal accounts with balances, software for printing checks, as well as personal and financial data on Americans. Punchmade Dev’s previous online shop (now defunct). His Telegram channel has more than 75,000 followers. The January story traced Punchmade’s various online properties to a 22-year-old Devon Turner from Lexington, Ky. Reached via his profile on X/Twitter, Punchmade Dev said they were not affiliated with the lawsuit filed by Turner [Punchmade’s X account provided this denial even though it has still not responded to requests for comment from the first story about him in January]. Meanwhile, Mr. Turner has declined multiple requests to comment for this story. On June 26, Turner filed a pro se lawsuit against PNC Bank, alleging “unlawful discriminatory and tortuous action” after he was denied a wire transfer in the amount of $75,000. PNC Bank did not respond to a request for comment. Turner’s complaint states that a follow-up call to his bank revealed the account had been closed due to “suspicious activity,” and that he was no longer welcome to patronize PNC Bank. “The Plaintiff is a very successful African-American business owner, who has generated millions of dollars with his businesses, has hired 30 plus people to work for his businesses,” Turner wrote. As reported in January, among Turner’s businesses is a Lexington entity called OBN Group LLC (assumed name Punchmade LLC). Business incorporation documents from the Kentucky Secretary of State show he also ran a record label called DevTakeFlightBeats Inc. Turner’s lawsuit alleges that bank staff made disparaging remarks about him, suggesting the account was canceled because it would be unusual for a person like him to have that kind of money. A snippet from Turner’s lawsuit vs. PNC. Incredibly, Turner acknowledges that PNC told him his account was flagged for attention from law enforcement officials. “The PNC Bank customer service representative also explained that there was a note on the account that law enforcement would be contacted at some point in time,” the lawsuit reads. “The Plaintiff, who was not worried at all about law enforcement being involved because nothing illegal occurred, informed the PNC Bank representative that this was one big mistake and asked him what his options were,” the complaint states. Devon Turner, a.k.a. “Punchmade Dev,” in an undated photo, wearing a diamond-covered Visa card. Image: tiktok.com/brainjuiceofficial Turner’s lawsuit said PNC told him they would put a note on his account allowing him to withdraw the funds from any branch, but that when he visited a PNC branch and asked to withdraw the entire amount in his account — $500,000 — PNC refused, saying the money had been seized. “Ultimately, PNC bank not only refused his request to release his funds but informed him that his funds would be seized indefinitely as [sic] PNC Bank,” Turner lawsuit recounts. The Punchmade shops selling financial data that were profiled in the January story are long gone, but Punchmade’s Instagram account now promotes punchmade[.]cc, which behaves and looks the same as his older shop. Punchmade’s current shop, which DomainTools says was registered to a Lexington, Ky. phone number used by accounts under the name of Devon Taylor at multiple online retailers. The breach tracking service Constella Intelligence finds the email address associated with Turner’s enterprise OBN Group LLC — obndevpayments@gmail.com — was used by a Devon Turner from Lexington to purchase software online. That record includes the Lexington, Ky. mobile phone number 859-963-6243, which Constella also finds was used to register accounts for Devon Turner at the retailer Neiman Marcus, and at the home decor and fashion site poshmark.com. A search on this phone number at DomainTools shows it is associated with two domain names since 2021. The first is the aforementioned punchmade[.]cc. The other is foreverpunchmade[.]com, which is registered to a Devon Turner in Lexington, Ky. A copy of this site at archive.org indicates it once sold Punchmade Dev-branded t-shirts and other merchandise. Mr. Turner included his contact information at the bottom of his lawsuit. What phone number did he leave? Would you believe 859-963-6243? The closing section of Mr. Turner’s complaint includes a phone number that was used to register a popular online fraud shop named after Punchmade. Is Punchmade Dev a big-time cybercriminal enabler, as his public personna would have us believe? Or is he some two-bit nitwit who has spent so much on custom medallions that he can’t afford a lawyer? It’s hard to tell. But he definitively has a broad reach: His Instagram account has ~860k followers, and his Telegram channel has more than 75,000 subscribers, all no doubt seeking that sweet “C@sh App sauce,” which apparently has something to do with moving cryptocurrencies through Cash App in a way that financially rewards people able and willing to open up new accounts. It’s incredibly ironic that Punchmade sells tutorials on how to have great “opsec,” a reference to “operational security,” which in the cybercriminal context means the ability to successfully separate one’s cybercriminal identity from one’s real-life identity: This guy can’t even register a domain name anonymously. A copy of Turner’s complaint is available here (PDF). For more on Punchmade, check out the TikTok video How Punchmade Dev Got Started Scamming.

image for At Nebraska Event, F ...

 Agriculture

The FBI will host an event exploring agricultural cyber risks in Omaha, Nebraska amid growing concerns of cyber attacks on US agriculture as farms embrace precision agriculture. The post At Nebraska Event, FBI Calls Out Cyber Threats To Agriculture appeared first on The Security Ledger with Paul F. Roberts. Related   show more ...  

StoriesCyber Attack Halts Production at Ag Equipment Maker AGCO FendtSpotlight Podcast: CSO Chris Walcutt on Managing 3rd Party OT RiskChina Calls Out U.S. For Hacking. The Proof? TBD!

image for Knostic Wins 2024 Bl ...

 Feed

During a "Shark Tank"-like final, each startup's representative spent five minutes detailing their company and product, with an additional five minutes to take questions from eight judges from Omdia, investment firms, and top companies in cyber.

 Expert Blogs and Opinion

AI can analyze data quickly, detect patterns of malicious behavior, and automate routine tasks like alert triaging and log analysis. However, human oversight is still necessary to ensure the accuracy and relevance of AI-generated insights.

 Trends, Reports, Analysis

A recent analysis using HYAS Insight threat intelligence revealed a trend in dynamic DNS registrations originating from Turkey in 2024, with DarkComet malware representing over 50% of the malicious domains identified.

 Incident Response, Learnings

A Singaporean commodity firm has had a narrow escape after police managed to intervene to recover nearly all of the $42.3m lost to fraudsters in a business email compromise (BEC) scam.

 Incident Response, Learnings

A class-action lawsuit is brewing over the cyber-heist of 2.9 billion personal records that were stolen from a Florida data broker, Jerico Pictures, doing business as National Public Data, and sold on the dark web.

 Trends, Reports, Analysis

Rapid7 researchers noted over 2,570 attacks in the first half of 2024, equating to around 14 attacks daily. The number of ransomware groups posting on data leak sites surged 67% compared to the previous year.

 Trends, Reports, Analysis

According to Acronis, ransomware remains a top threat for SMBs, especially in critical sectors like government and healthcare, where 10 new ransomware groups conducted 84 cyberattacks globally in Q1 2024.

 Feed

Debian Linux Security Advisory 5740-1 - Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, the bypass of sandbox restrictions or an information leak.

 Feed

A small firebeam (kaine's risc-v vm) plugin to exploit the CVE-2024-26229 vulnerability that utilizes a vulnerable IOCTL in csc.sys. The vulnerability is used to get kernel R/W memory access to corrupt the KTHREAD->PreviousMode and then to leveraging DKOM to achieve LPE by copying over the token from the system process over to the current process token.

 Feed

Debian Linux Security Advisory 5739-1 - user able to escalate to the netdev group can load arbitrary shared object files in the context of the wpa_supplicant process running as root.

 Feed

Ubuntu Security Notice 6945-1 - Rory McNamara discovered that wpa_supplicant could be made to load arbitrary shared objects by unprivileged users that have access to the control interface. An attacker could use this to escalate privileges to root.

 Feed

Gentoo Linux Security Advisory 202408-10 - Multiple vulnerabilities have been discovered in nghttp2, the worst of which could lead to a denial of service. Versions greater than or equal to 1.61.0 are affected.

 Feed

Red Hat Security Advisory 2024-5067-03 - An update for kernel-rt is now available for Red Hat Enterprise Linux 9.2 Extended Update Support. Issues addressed include double free and null pointer vulnerabilities.

 Feed

Red Hat Security Advisory 2024-5065-03 - An update for kernel is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.6 Telecommunications Update Service.

 Feed

Gentoo Linux Security Advisory 202408-7 - Multiple vulnerabilities have been discovered in Go, the worst of which could lead to information leakage or a denial of service. Versions greater than or equal to 1.22.3 are affected.

 Feed

Red Hat Security Advisory 2024-5041-03 - An update for python-urllib3 is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.6 Telecommunications Update Service.

 Feed

Red Hat Security Advisory 2024-5040-03 - An update for python-setuptools is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.6 Telecommunications Update Service. Issues addressed include a code execution vulnerability.

 Feed

Red Hat Security Advisory 2024-5025-03 - Red Hat JBoss Web Server 5.8.1 zip release is now available for Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Windows Server.

 Feed

Gentoo Linux Security Advisory 202408-5 - Multiple vulnerabilities have been discovered in Redis, the worst of which may lead to a denial of service or possible remote code execution. Versions greater than or equal to 7.2.4 are affected.

 Feed

Red Hat Security Advisory 2024-5002-03 - An update for python3.11-setuptools is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Issues addressed include a code execution vulnerability.

 Feed

Apple on Tuesday announced an update to its next-generation macOS version that makes it a little more difficult for users to override Gatekeeper protections. Gatekeeper is a crucial line of defense built into macOS designed to ensure that only trusted apps run on the operating system. When an app is downloaded from outside of the App Store and opened for the first time, it verifies that the

 Feed

Cybersecurity researchers have lifted the lid on a new technique adopted by threat actors behind the Chameleon Android banking trojan targeting users in Canada by masquerading as a Customer Relationship Management (CRM) app. "Chameleon was seen masquerading as a CRM app, targeting a Canadian restaurant chain operating internationally," Dutch security outfit ThreatFabric said in a technical

 Feed

An unnamed media organization in South Asia was targeted in November 20233 using a previously undocumented Go-based backdoor called GoGra. "GoGra is written in Go and uses the Microsoft Graph API to interact with a command-and-control (C&C) server hosted on Microsoft mail services," Symantec, part of Broadcom, said in a report shared with The Hacker News. It's currently not clear how it's

 Feed

Cybersecurity company CrowdStrike has published its root cause analysis detailing the Falcon Sensor software update crash that crippled millions of Windows devices globally. The "Channel File 291" incident, as originally highlighted in its Preliminary Post Incident Review (PIR), has been traced back to a content validation issue that arose after it introduced a new Template Type to enable

 Feed

Cybersecurity researchers have shed light on a novel Linux kernel exploitation technique dubbed SLUBStick that could be exploited to elevate a limited heap vulnerability to an arbitrary memory read-and-write primitive. "Initially, it exploits a timing side-channel of the allocator to perform a cross-cache attack reliably," a group of academics from the Graz University of Technology said [PDF]. "

 Feed

Cybersecurity researchers have disclosed details of security flaws in the Roundcube webmail software that could be exploited to execute malicious JavaScript in a victim's web browser and steal sensitive information from their account under specific circumstances. "When a victim views a malicious email in Roundcube sent by an attacker, the attacker can execute arbitrary JavaScript in the victim's

 Guest blog

Cybersecurity journalist Joe Tidy has found himself in the unusual position of being targeted by a scammer calling herself "Jessica", he revealed this week. Read more in my article on the Hot for Security blog.

2024-08
Aggregator history
Wednesday, August 07
THU
FRI
SAT
SUN
MON
TUE
WED
AugustSeptemberOctober