Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Massive Unicoin Cybe ...

 Firewall Daily

Cryptocurrency firm Unicoin has disclosed a cyberattack that temporarily locked its employees out of critical Google services. The Unicoin cyberattack, which began on August 9, 2024, saw a hacker gain unauthorized access to Unicoin’s Google G-Suite account, affecting all employees with "@unicoin.com" email   show more ...  

addresses. According to a regulatory filing with the SEC, the attacker not only changed passwords but also caused considerable disruption by locking out employees from essential tools such as Gmail, Google Drive, and other G-Suite functionalities. This Unicoin data breach rendered the company’s internal communication and file-sharing systems inaccessible for nearly four days. The Scope of the Unicoin Cyberattack Unicoin’s regulatory documents reveal that the company regained control of its systems by August 13, 2024. However, the investigation into the cyberattack at Unicoin is still ongoing. The company reported traces of compromised messages and email accounts belonging to certain managers. Additionally, discrepancies in the personal data of employees and contractors were noted within the company's accounting department. One significant report during the investigation was the identity forgery of a contractor, whose position was promptly terminated. The filing also mentioned the presence of hacked messages and email accounts. However, it has not yet been established whether these incidents are linked to broader issues, such as potential connections to North Korean hackers. Impact on Company Operations Despite the severity of the Unicoin data breach, the company has stated that, as of the current report, there is no evidence of stolen cash or crypto assets. Unicoin executives have emphasized that while the attack did not materially impact the company’s financial condition or operational results, the full implications of the breach are still under review. The company has not yet determined whether the Unicoin cyberattack will have long-term financial repercussions. Unicoin's regulatory filing also highlighted that the attack had not led to any immediate financial losses. “No traces of loss of any of the Company’s cash or crypto assets have been found. The Company has not yet conclusively determined whether the incident is reasonably likely to materially impact the Company’s financial condition or results of operations or have any other material adverse effects. Should the Company make a determination that the Event is material, such determination shall be included in a future report or in amendment to this Current Report”, reads the filing.  Unicoin is one of the few cryptocurrency firms that regularly file reports with the SEC, reflecting its commitment to transparency. The company’s approach to regulation is notable in the crypto industry, where many firms operate with less oversight. With over $500 million worth of Unicoins sold and a portfolio that includes real estate and equity investments, the Unicoin cyberattack raises questions about cybersecurity practices within the crypto sector.

image for Singapore Reveals Up ...

 Firewall Daily

Singapore has recently launched the updated Operational Technology Cybersecurity Masterplan, known as the OT Masterplan 2024, during the fourth edition of the Singapore Operational Technology Cybersecurity Expert Panel (OTCEP) Forum on August 20, 2024.  Mrs. Josephine Teo, the Minister for Digital Development and   show more ...  

Information and Minister-in-charge of Cybersecurity, led the unveiling of this pivotal update. The OT Masterplan 2024 aims to bolster the cybersecurity framework for both Critical and non-critical Information Infrastructure (CII) against cyber threats impacting operational technology (OT) systems. OT Masterplan 2024: Addressing Emerging Cyber Threats The rapid digitalization of industries has resulted in an intricate web of interconnected Information Technology (IT) and OT systems. This growing nexus poses significant risks; a cyberattack on OT systems could lead to severe consequences including operational disruptions, physical damage, or even loss of life. The original OT Masterplan, introduced in 2019, laid the groundwork for improving cybersecurity awareness and resilience among essential service sectors. However, with the escalation of cyber threats and the emergence of new technologies, an update was deemed necessary. The OT Masterplan 2024 is designed to address these advanced threats, which include increased hacktivism targeting OT assets and vulnerabilities introduced by technologies such as Edge Computing and the Internet of Things (IoT).  The updated OT masterplan reflects comprehensive consultations with various stakeholders in the OT ecosystem, including government agencies, industry leaders, and academic institutions. Key Initiatives in the OT Masterplan 2024 The OT Masterplan 2024 emphasizes three key areas: "People," "Process," and "Technology," to boost Singapore’s OT cybersecurity capabilities. Developing a skilled workforce is crucial for maintaining cybersecurity defenses. The OT Masterplan 2024 includes measures to integrate OT cybersecurity into Singapore's broader professionalization framework. This involves collaborations with higher education institutions to incorporate OT cybersecurity into computer science and engineering curriculums, ensuring that graduates are equipped with essential skills.  Additionally, a new Cybersecurity Education & Learning Guide will be published later this year. This guide will feature information on the Operational Technology Cybersecurity Competency Framework (OTCCF), workforce trends, learning roadmaps, and skills frameworks to support career planning in cybersecurity. Effective cybersecurity relies on robust situational awareness. The OT Masterplan 2024 seeks to improve this by streamlining information-sharing processes and strengthening collaborations with the OT Cybersecurity Information Sharing and Analysis Center (OT-ISAC) and sector regulators. The plan also includes exploring new mechanisms for facilitating incident reporting and encouraging businesses to report cyber threats and incidents more openly. Cyber risks affect both CII and non-CII systems due to supply chain dependencies. The Masterplan proposes a data-driven model to enhance visibility into the cyber supply chain ecosystem, including updates to the CII Supply Chain Programme, launched in 2022.  This model will help monitor and manage cybersecurity risks, issue timely alerts, and provide advisories for necessary remediation. Furthermore, updated guidelines such as the “Guide to Conducting Cybersecurity Risk Assessment” will focus on consequence-based scenarios to mitigate adverse effects and ensure continuity of operations. The Masterplan emphasizes the importance of integrating cybersecurity measures into the entire lifecycle of OT systems—from design and deployment to maintenance. This involves collaboration among Original Equipment Manufacturers (OEMs), System Integrators, and asset owners. An OT Cybersecurity Centre of Excellence will be established to drive research into new technologies and develop solutions to address industry concerns. Commitment from Industry Partners At the launch event, 14 organizations, including OEMs and cybersecurity solution providers, committed to adopting the Secure-by-Deployment principles throughout the lifecycle of OT systems. This collective effort is vital for enhancing the overall cyber resilience of Singapore's OT ecosystem. The list of participating organizations can be found in the annex to the OT Masterplan 2024. The OT Masterplan 2024 serves as a strategic blueprint for Singapore’s efforts to fortify its cyber environment for organizations utilizing OT systems. It reflects the nation’s commitment to adapting to new threats and technological advancements, ensuring a secure and resilient cyberspace. For more details, the updated Masterplan is available on the Cyber Security Agency of Singapore’s website at www.csa.gov.sg/otcsmp2024.

image for Major Flaw in Micros ...

 Vulnerability News

A critical vulnerability has been discovered in several popular Microsoft apps in Apple MacBook. The vulnerability could potentially allow hackers to steal user permissions from apps and gain unauthorized access to sensitive data like camera feeds and microphone recordings.  The vulnerability reportedly affects a   show more ...  

wide range of Microsoft apps for macOS, including Outlook, Teams, Word, Excel, PowerPoint and OneNote. Vulnerability Details: Bypassing macOS Security Measures The vulnerability was discovered by security researchers from Cisco Talos. In its report, the researchers highlighted that the vulnerability resides in the way Microsoft apps handle libraries. Apple’s macOS has a framework known as Transparency Consent and Control (TCC), which manages app permissions to access things like location services, camera, microphone, library photos, and other files. Each app needs an entitlement to request permissions from TCC. Apps without these entitlements won’t even ask for permissions, and consequently won’t have access to the camera and other parts of the computer. However, the exploit allowed malicious software to use the permissions granted to Microsoft apps. “We identified eight vulnerabilities in various Microsoft applications for macOS, through which an attacker could bypass the operating system’s permission model by using existing app permissions without prompting the user for any additional verification,” the researchers explained. By exploiting this vulnerability, attackers can inject malicious libraries into Microsoft apps on a Mac. [caption id="attachment_87138" align="aligncenter" width="245"] Source: CISCO Report[/caption] Once injected, these malicious libraries can leverage the existing permissions granted to the Microsoft app (such as camera and microphone access) to spy on users like the example in the above image. Additionally, these libraries can steal other user permissions, potentially giving attackers broader control over the system. Potential Consequence of Vulnerability The potential consequences of this vulnerability are severe. Hackers could exploit it to: Spy on Users: Gain unauthorized access to a user's camera and microphone, potentially recording video and audio conversations. Steal Sensitive Data: Access and steal sensitive data stored on the Mac, including documents, emails, and passwords. Escalate Privileges: Gain elevated privileges within the system, allowing them to perform actions with greater control. Disrupt System Functionality: Malicious libraries could disrupt the normal operation After researchers shared the report to Microsoft, the tech giant updated the Microsoft Teams and OneNote apps for macOS with changes to how these apps handle the library validation entitlement. However, Excel, PowerPoint, Word, and Outlook are still vulnerable to the exploit. Microsoft told researchers that it considered this exploit to be “low risk” since it relies on loading unsigned libraries to support third-party plugins. What Mac Users Can Do? While a permanent fix from Microsoft is still awaited, Mac users can take several steps to mitigate the risk associated with this vulnerability: Update Microsoft Apps: Regularly update your Microsoft apps to the latest versions. Updates often include security patches that address newly discovered vulnerabilities. Disable Unnecessary Permissions: Review and disable any permissions granted to Microsoft apps that you don't consider essential. For example, if you don't use video conferencing features in Teams, you can disable camera access for the app. The report raised questions about the vulnerability of third-party plugins in Apple products. “It's also important to mention that it’s unclear how to securely handle such plug-ins within macOS' current framework. Notarization of third-party plug-ins is an option, albeit a complex one, and it would require Microsoft or Apple to sign third-party modules after verifying their security,” the report said. “MacOS could also introduce a user prompt, akin to the resource permissions in TCC, enabling users to decide whether to load a specific third-party plug-in. This would provide a more controlled means of granting access without broadly compromising security,” it added.

image for Google Play Store’ ...

 Bug Bounty & Rewards

Google's seven-year-long bug bounty program for popular Android apps on the Google Play Store is set to conclude on August 31, 2024. The program, which rewarded security researchers for finding and responsibly disclosing vulnerabilities, has been a cornerstone in bolstering the security landscape of the Android   show more ...  

ecosystem. Bug bounty hunters who are interested in cashing in by identifying flaws in the millions of downloadable apps offered in the Google Play Store now have less than two weeks to tender their submissions. History of Google Play Store's Bug Bounty Program Launched in 2017, the Google Play Security Reward Program (GPSRP) incentivized researchers to meticulously scrutinize popular Android apps for potential security loopholes. By offering substantial rewards for critical vulnerabilities, Google encouraged a dedicated community of white-hat hackers to actively contribute to enhancing app security. Initially, the program focused on a select group of developers and apps, offering rewards of up to $5,000 for the most critical vulnerabilities like remote code execution. Eventually, in 2019, the scope widened to include all apps distributed on the platform with over 100 million downloads, with payouts reaching $20,000. However, in a recent announcement to researchers through an email, Google revealed its decision to wind down the program. The company attributed this move to a significant decline in actionable vulnerabilities being reported. This reduction is largely credited to the overall improvement in Android OS security and the implementation of robust security measures within the platform itself. In the last financial year, Google said that it had blocked 2.28 million privacy-violating apps and banned 333,000 malicious developer accounts, alongside other Play Store improvements. Google has emphasized that the decision to end the program does not signify a relaxation of its commitment to Android security. The company will continue to invest in various security initiatives, including the Android Vulnerability Rewards Program (AVRP) which focuses on the underlying Android OS. The winding down of the GPSRP marks a significant shift in Google's approach to Android app security. While the program has undoubtedly contributed to improving app security, its termination raises questions about the future of vulnerability discovery and the overall security posture of the Android ecosystem. In the meantime, app developers and users alike should remain vigilant about app security best practices. Keeping apps updated, exercising caution when granting permissions, and being mindful of suspicious activities are crucial steps in safeguarding personal information and device security. Full Text of Email by Google to Developers Dear Researchers, I hope this email finds you well. I am writing to express my sincere gratitude to all of you who have submitted bugs to the Google Play Security Reward Program over the past few years. Your contributions have been invaluable in helping us to improve the security of Android and Google Play. As a result of the overall increase in the Android OS security posture and feature hardening efforts, we’ve seen fewer actionable vulnerabilities reported by the research community. Due to this decrease in actionable vulnerabilities reported, we are winding down the GPSRP program. The GPSRP program will end on August 31st. Any reports submitted before then will be triaged by September 15th. Final reward decisions will be made before September 30th when the program is officially discontinued. Final payments may take a few weeks to process. I want to assure you that all of your reports will be reviewed and addressed before the program ends. We greatly value your input and want to make sure that any issues you have identified are resolved. Thank you again for your support of the GPSRP program. We hope that you will continue working with us, on programs like the Android and Google Devices Security Reward Program. Best regards, Tony On behalf of the Android Security Team

image for Critical Remote Code ...

 Firewall Daily

The GiveWP plugin, a widely used donation and fundraising tool for WordPress, has recently undergone a crucial update to address a severe security flaw. This GiveWP vulnerability, discovered by the researcher villu164, is a PHP Object Injection issue that could lead to Remote Code Execution (RCE). This issue, if   show more ...  

exploited, allowed unauthorized users to execute arbitrary code and delete files on affected WordPress sites. Given its critical nature, users are strongly advised to update their plugins immediately to ensure their sites are secure. The GiveWP vulnerability, identified as CVE-2024-5932, affects all versions of the GiveWP plugin up to and including version 3.14.1. The issue lies in the deserialization of untrusted input from the give_title parameter, which enables unauthenticated attackers to inject PHP objects. The presence of a PHP Object Injection (POP) chain in the plugin further allows these attackers to execute code remotely and delete files from the server. The GiveWP Vulnerability: PHP Object Injection to Remote Code Execution According to the Wordfence Bug Bounty Program, the vulnerability is classified as "Critical," with a CVSS score of 10.0. This score reflects the potential severity of the exploit, as attackers could gain complete control over the affected site. The impact of such an exploit includes unauthorized file deletion and the ability to execute arbitrary PHP code, posing a risk to site security and data integrity. [caption id="attachment_87123" align="alignnone" width="908"] GiveWP Vulnerability Summary (Source: Wordfence)[/caption] Villu Orav, known as villu164, reported the GiveWP vulnerability through the Wordfence Bug Bounty Program on May 26, 2024. His discovery earned him a bounty of $4,998.00, acknowledging the critical nature of his findings. The researcher’s report highlighted that the GiveWP plugin was vulnerable to PHP Object Injection through the give_title parameter. This parameter's deserialization process in versions up to 3.14.1 exposed the plugin to severe security risks. Upon receiving the report, Wordfence reached out to the StellarWP team—the developers behind GiveWP—on June 13, 2024. When no immediate response was received, the issue was escalated to the WordPress.org Security Team on July 6, 2024. A critical patch was finally released on August 7, 2024, in version 3.14.2 of the GiveWP plugin. Technical Details of the GiveWP Vulnerability PHP Object Injection vulnerabilities arise when a PHP application unserializes user-provided data without adequate validation, potentially executing harmful PHP objects. Serialized data, which is used to store complex data structures, can include PHP objects. For example, serialized data might look like a:2:{s:11:"productName";s:5:"apple";s:7:"price";i:10;}, which, if unserialized unsafely, can introduce malicious objects. PHP objects, created from classes with properties and methods, may contain "magic methods" like __destruct, which execute under certain conditions. An attacker can exploit such vulnerabilities by injecting objects with harmful properties, using methods like __destruct to delete critical files such as wp-config.php. The vulnerability in the GiveWP plugin involves the give_process_donation_form() function, which handles donation submissions. This function performs validation on the post data but fails to include the give_title parameter in its checks. Consequently, the deserialization of this parameter allows for the injection of malicious PHP objects. The give_process_donation_form() function processes the donation data and interacts with the give_get_donation_form_user() function, which assigns values to user data based on the give_title parameter. The user data, including serialized values, is then saved and processed further. The issue is exacerbated by the plugin's handling of serialized data during payment processing. The _give_donor_title_prefix meta key is used to store serialized data, which is later unserialized in the Give_Payment class. This unserialization process is where the PHP Object Injection vulnerability manifests, allowing attackers to exploit a PHP Object Injection (POP) chain.

image for Supply Chain Attacks ...

 Cybersecurity News

Software supply chain attacks are becoming increasingly common, which is bad news because of the severity and reach of such attacks, according to Cyble threat intelligence researchers. Cyble detected 90 supply chain breach claims made by cybercriminals on the dark web in a six-month period between February and   show more ...  

mid-August, which works out almost exactly to one every other day. As supply chain attacks can be orders of magnitude more expensive than other breaches, the cost and damage created by even a few such attacks is high. The Cyble blog noted that while attacks resulting from infiltration of an IT supplier’s code base – as happened to SolarWinds in 2020 and Kaseya in 2021 – are relatively rare, the code, dependencies and applications that make up the software supply chain are “a source of near-constant vulnerabilities and cyberattacks that place all organizations at risk.” Even when supply chain breaches don’t reach codebases, they can still lead to sensitive data being leaked “that could give attackers a critical advantage in breaching other environments, including phishing, spoofing and credential attacks,” the researchers wrote. “And because of the interconnectedness and increasing digital nature of the physical supply chain, any manufacturer or supplier with downstream distribution can be considered a cyber risk.” Cyble researchers looked at the frequency and nature of supply chain attacks in 2024, along with defenses that can minimize risk. Supply Chain Attacks Become Common Cyble’s dark web monitoring found 90 cybercriminal claims of successful supply chain attacks in the period from February 2024 to mid-August 2024. IT providers were by far the biggest target, accounting for a third of those breaches, followed by technology product companies, which experienced 14 of the 90 breaches. Aerospace & defense (9 breaches), manufacturing (9 breaches), and healthcare (8 breaches) were the next most frequent victims. Despite the heavy concentration in a few industries, 22 of the 25 sectors tracked by Cyble have experienced a supply chain attack in 2024 (chart below). [caption id="attachment_87213" align="aligncenter" width="500"] Software supply chain attacks by sector (Source: Cyble)[/caption] The U.S. experienced by far the greatest number of supply chain breaches claimed on the dark web – 31 in all – followed by the UK (10), Germany and Australia (five each), and Japan and India (four each). A Look at Supply Chain Attacks in 2024 The Cyble blog focused on eight attacks in particular, which varied in severity, from codebase hijacks affecting more than 100,000 sites to attacks that shut down essential services. Here are a few of those attacks: jQuery: The July supply chain attack on the JavaScript npm package manager involved trojanized versions of jQuery, the popular JavaScript library. The attackers modified the legitimate jQuery code to exfiltrate sensitive form data from websites in an attack that hit multiple platforms and package names. The attack “underscored the urgent need for developers and website owners to verify package authenticity and scrutinize code for suspicious modifications to mitigate supply chain attacks.” Polyfill: The late June attack hit over 100,000 websites, using a fake domain to impersonate the Polyfill.js library to inject malware that redirected users to sports betting or pornographic sites. “The attack highlighted the risks of using external code libraries and the importance of vigilance in website security,” Cyble researchers said. “The incident underscored the security implications of third-party scripts and the potential for malicious takeovers of widely deployed projects.” Programming Language Breach: Threat actor (TA) IntelBroker, posting on BreachForums, claimed to have unauthorized access to a node package manager (npm) and GitHub account “pertaining to an undisclosed programming language,” along with access to “private repositories with privileges to push and clone commits.” Here is a screenshot of the claims: CDK Global Inc.: On June 19, automotive dealership software provider CDK Global Inc. was hit by a ransomware attack that disrupted sales and inventory operations of many North American auto dealers for weeks, including large dealer networks such as Group1 Automotive Inc., AutoNation Inc., Premier Truck Group, and Sonic Automotive. Access to More than 400 Companies: IntelBroker struck again on June 15, offering access to more than 400 companies compromised via “an undisclosed third-party contractor.” The data reportedly included access to Jira, Bamboo, Bitbucket, GitHub, GitLab, SSH, SFTP, DA, Zabbix, AWS S3, AWS EC2, SVN and Terraform. Open-source research based on the companies’ revenue and location suggested some of the biggest organizations involved could be Lockheed Martin Corporation, Samsung Electronics Co Ltd, General Dynamics, and Apple Inc. Zero Trust and Resilience Help Control Supply Chain Risk The Cyble researchers recommended a number of defenses against supply chain attacks, built around zero trust and cyber resilience principles and code security. These practices include Network microsegmentation Strong access controls A strong source of user and device identity and authentication Encryption of data at rest and in transit Ransomware-resistant backups that are “immutable, air-gapped and isolated as much as possible” Honeypots for early breach detection Secure configuration of API and cloud service connections Monitoring for unusual activity with SIEM, Active Directory monitoring, and data loss prevention (DLP) tools Routinely assessing and confirming controls through audits, vulnerability scanning and penetration tests Secure Development and Third-Party Risk Management Cyble also recommended code security best practices – both for developers and for partner and supplier audits – and threat intelligence services like Cyble that can help assess partner and vendor risk. “Cyble’s third-party risk intelligence module evaluates partner security in areas such as cyber hygiene, dark web exposure, spoofing activities, and attack surface and network exposure, noting specific areas for improvement, while Cyble’s AI-powered vulnerability scanning capabilities can help you find and prioritize your own web-facing vulnerabilities,” the Cyble blog said. “As more organizations make security a buying criterion, vendors will be forced to respond with better security controls and documentation,” the report concluded.

image for Takedown Services: A ...

 Firewall Daily

As digital content and intellectual property become increasingly valuable assets for businesses, the need to protect them from unauthorized use or infringement has never been more critical. For chief financial officers (CFOs), the financial implications of takedown services can have a significant positive effect on a   show more ...  

company's business operations. Safeguarding Reputation and Revenue One of the primary concerns for CFOs is the potential reputational and financial damage that can result from the misuse of a company's intellectual property or brand. Counterfeit products, fake social media accounts, and unauthorized use of trademarks can all erode consumer trust and lead to lost sales. Effective takedown services can help mitigate these risks by quickly identifying and removing such infringing content, preserving the integrity of the brand, and protecting revenue streams. Beneficial Financial Implications of Takedown Services Beyond the direct financial impact of lost sales and reputational damage, the administrative burden of managing takedown requests can also be a significant cost center for companies. Manually tracking down infringing content, drafting cease-and-desist letters, and coordinating with hosting providers and domain registrars can be a time-consuming and resource-intensive process. Takedown service providers often have established relationships with online platforms and registrars, allowing them to navigate the process more efficiently and achieve faster results. This can translate into significant cost savings for companies, both in terms of direct operational expenses and the opportunity cost of diverting internal staff away from core business activities. Understanding the DMCA The Digital Millennium Copyright Act (DMCA) is a critical piece of legislation that provides a framework for takedown services. The DMCA grants immunity from copyright infringement liability for online service providers that comply with certain requirements, including implementing a notice-and-takedown system. This system allows copyright holders to request the removal of infringing content from websites, and service providers must act expeditiously to remove or disable access to the infringing material. Types of Takedowns The different types of takedowns that organizations and individuals can pursue include: Copyright Takedowns: Content owners can submit takedown notices to website owners and online service providers (e.g., ISPs, hosting companies) to have their copyrighted content removed from unauthorized online sources. Counterclaims: A website or content owner can submit a counterclaim in response to a valid DMCA takedown notice, shifting the burden to the copyright owner to file a court order against the alleged infringer. Trademark Takedowns: Trademark infringement, such as the use of a stolen logo or company name, can also be addressed through takedown requests. Defamation Takedowns: Cease and desist letters can be used to remove lies and misleading information that damage a person's or organization's reputation. Search Engine Removal: DMCA takedowns can be used to remove infringing content from search engine results, as content theft is often driven by SEO tactics. Website Removal: Entire stolen websites can be taken down by providing a comprehensive list of the stolen content. Considerations for CFO Strategies for Takedown Services As a CFO, there are several key considerations to keep in mind when evaluating takedown services: Risk Assessment: Assess the potential financial risks associated with online brand exploitation, including reputational damage, financial losses, and remediation costs. Service Provider Selection: Choose a takedown service provider that has a proven track record of success, established relationships with hosting providers and registrars, and a robust process for discovering and removing malicious content. Cost Analysis of Takedown Services: Evaluate the costs and benefits of takedown services, including adequate budgeting for Takedown Services, the potential savings in remediation costs, and the potential return on investment. Scalability: Consider the scalability of the takedown service provider, including their ability to handle large volumes of requests and their capacity to adapt to changing threats. Legal Compulsion: Determine whether the takedown service provider offers legal compulsion in their takedown categories, which can provide an additional layer of protection for your organization. Cyble's Takedown Services For CFOs looking to protect their company's financial interests in the digital age, Cyble's industry-leading takedown services offer a comprehensive solution. By quickly identifying and removing fraudulent content, impersonating accounts, and other online threats, Cyble's takedown solutions can help safeguard your organization's reputation and revenue streams from digital threats. Hurry... Schedule a Demo Today!

image for Trump Spreads Swift, ...

 Deepfake

With the U.S. Presidential race heating up, it’s not just U.S. adversaries who are trying to influence the campaign - even the candidates and their supporters are engaged in disinformation. On a day when the top U.S. intelligence and cybersecurity agencies came together to identify Iran's role in cyberattacks   show more ...  

and influence operations aimed at gaining sensitive information on the U.S. elections and trying to tip the scales toward their favored presidential candidate, Donald Trump himself resorted to spreading deepfakes from AI-generated images and videos of Taylor Swift and Elon Musk. Trump’s Deepfakes: ‘I Accept!’ U.S. Republican presidential candidate Donald Trump has raised a storm on social media after posting what looks like an AI-generated deepfake of Taylor Swift and her “swifties” calling for support for Trump’s election campaign. On Sunday, Trump posted a collage of several tweets taken from X, formerly known as Twitter, with a caption “I accept!” on his Truth Social platform. [caption id="attachment_87158" align="aligncenter" width="630"] AI-generated images post by Trump on Truth Social (Source: Truth Social)[/caption]   These series of images showed young women in “Swifties for Trump” T-shirts, along with one that portrayed Swift asking people to vote for the Republican presidential candidate, dressed as Uncle Sam. The images appear to be screenshots of blue-ticked right-wing X accounts that have previously been known to spread misinformation. Swift has not publicly commented on this matter, but she had previously in the 2020 U.S. presidential election cycle openly criticized Trump over the country-wide protests that erupted after the police murder of George Floyd. “After stoking the fires of white supremacy and racism your entire presidency, you have the nerve to feign moral superiority before threatening violence? ‘When the looting starts the shooting starts’??? We will vote you out in November. @realdonaldtrump,” she tweeted at the time. Trump also shared an AI-generated image that showed Democratic candidate Kamala Harris holding a communist rally, as well as a deepfake video of him dancing with the X owner, Elon Musk, who has endorsed him. [caption id="attachment_87153" align="aligncenter" width="400"] AI-generated image of Kamla Harris tweeted by Trump on Friday (Source: X)[/caption] Calls for Legislation Get Louder Massimo Sterpi, the chair of AI Task Force of Union Internationale des Avocats, explained the likely rationale behind the latest deepfake from Trump. According to him “[Trump is] trying to take advantage of Swift’s gigantic group of fans.” “As a Plan B, considering that Taylor Swift is very likely to publicly support Kamala Harris, that (fake) endorsement for Trump is also a way to ‘neutralize’ her (possible) future endorsement for Kamala Harris: in fact, at least part of the voters will be confused about whom was endorsed by Taylor Swift,” Sterpi said. “In short, either people will wrongly believe that Swift endorsed Trump or they will be uncertain about whom she was actually endorsing. Almost a win/win for Trump.” [sic] It's not just Trump but his supporters have also taken to deepfake AI-generated images since he first announced his nomination. His supporters earlier this year faked Trump’s image with people of color to target the African American voter base for the Republicans. [caption id="attachment_87163" align="aligncenter" width="604"] Source: BBC[/caption] “Deepfakes are the new wild card in our elections.” But Trump's latest spread of misinformation has got even the experts worried. Dr. Chase Cunnigham, also know as Dr. Zero Trust, sounded the alarm and said, “Don’t care about the party or politics BS but influence can affect outcomes and deepfakes are the new wild card in our elections.” Sterpi shared a similar view and urged legislators to take it seriously. “Legislation urgently needed to prevent these blatant abuses!” Meanwhile, Tehran Behind Trump Hack and Influence Operations Trump’s deepfake antics coincidentally took place on the same day the U.S. intelligence community called out Iran for its covert Influence operations. Iran has escalated its cyberattacks targeting U.S. presidential campaigns in an effort to influence the upcoming election, according to top U.S. cybersecurity agencies. In a joint statement released Monday, the Office of the Director of National Intelligence (ODNI), the Federal Bureau of Investigation (FBI), and the Cybersecurity and Infrastructure Security Agency (CISA) linked a recent cyberattack on former President Donald Trump’s campaign to Iranian hackers. “Iran seeks to stoke discord and undermine confidence in our democratic institutions,” the agencies said. “Iran has furthermore demonstrated a longstanding interest in exploiting societal tensions through various means, including through the use of cyber operations to attempt to gain access to sensitive information related to U.S. elections.” The agencies observed that this election cycle has particularly seen an aggressive approach from Tehran. This includes influence operations aimed at the American public and direct cyber operations targeting presidential campaigns. The intelligence agencies reported that “the Iranians have through social engineering and other efforts sought access to individuals with direct access to the presidential campaigns of both political parties.” “These efforts, which include data thefts and unauthorized disclosures, are intended to sway the U.S. electoral process,” the agencies said, noting that such tactics are not new and have been used by both Iran and Russia in the past, not only in the U.S. but also in other countries around the world. This ramp up in influence operations targeting the current election cycle, featuring former President Trump and Vice President Kamala Harris, is very important to Iran’s national security interests. “The IC has previously reported that Iran perceives this year’s elections to be particularly consequential in terms of the impact they could have on its national security interests, increasing Tehran’s inclination to try to shape the outcome,” the agencies said. The FBI is working closely with the affected campaigns to mitigate the impact of these cyberattacks. “Protecting the integrity of our elections from foreign influence or interference is our priority,” the agencies affirmed. “We will not tolerate foreign efforts to influence or interfere with our elections, including the targeting of American political campaigns.” Microsoft, Google, OpenAI, Confirm Iran Attribution This official attribution from the intelligence and cybersecurity agencies to Iran follows a recent cyberattack on the Trump campaign, an incident Trump has publicly blamed on Iran. In response, tech giants Microsoft and Google published reports detailing Iranian cyberattacks on high-ranking U.S. and Israeli officials, as well as on members of both presidential campaigns. OpenAI, the parent company of ChatGPT – a large language model, concurred to Microsoft’s findings last Friday saying it had shut down a network of ChatGPT accounts involved in an Iranian influence operation. The AI-generated content developed using ChatGPT targeted a range of topics, including the Gaza conflict, Israel’s participation in the Olympics, the U.S. presidential election, Venezuelan politics, and Scottish independence. “This operation used ChatGPT for two purposes: generating long-form articles and shorter social media comments,” OpenAI said. However, its analytics into the performance of these AI-generated posts suggested no “meaningful” audience engagement. [caption id="attachment_87152" align="aligncenter" width="622"] Headlines of two articles generated by this operation and published on two of its websites. (Source: OpenAI) [/caption] Iran's mission to the United Nations issued a statement calling the allegations "unsubstantiated and devoid of any standing." "As we have previously announced, the Islamic Republic of Iran harbors neither the intention nor the motive to interfere with the U.S. presidential election," it added. The intelligence and cybersecurity agencies called for increased resilience from online platforms on the back of these covert influence operations from U.S.’ adversaries. “Just as this activity demonstrates the Iranians’ increased intent to exploit our online platforms in support of their objectives, it also demonstrates the need to increase the resilience of those platforms.”

image for Cyble Named a Sample ...

 Business News

ATLANTA — August 20, 2024: ​​Cyble, a global leader in digital risk protection services (DRPS) and threat exposure management, announces its recognition as a Sample Vendor in the Digital Risk Protection Services (DRPS) category in three Gartner® Hype Cycle™ Reports for Managed IT Services, Cyber-Risk   show more ...  

Management, and Security Operations 2024.   “Gartner Hype Cycles provide a graphic representation of the maturity and adoption of technologies and applications, and how they are potentially relevant to solving real business problems and exploiting new opportunities,” said Beenu Arora, CEO of Cyble. “Cyble’s inclusion in the Hype Cycle™ Reports, we feel, highlights its unique approach to Digital Risk Protection Services. By leveraging advanced AI-powered threat intelligence and machine learning, Cyble proactively identifies and mitigates threats across the threat landscape.” ​​  Cyble's next-generation platform, ​​Cyble Vision, integrates Dark Web Monitoring, Cyber Threat Intelligence, External Attack Surface Management, Takedown and, Brand Monitoring, and Third-Party Risk Management into a single, user-friendly interface for streamlined digital asset protection.   About Cyble   Cyble is a global leader in digital risk protection services, dedicated to helping organizations protect their digital assets from a wide range of threats. By leveraging advanced technologies and a team of seasoned cybersecurity experts, Cyble provides comprehensive solutions that empower businesses to operate securely in an ever-changing digital world. For more information, visit www.cyble.com. Media Contact:   Cyble Inc.   enquiries@cyble.com   +1 888 673 2067   Gartner Disclaimer  Gartner Hype Cycle for Managed IT Services, By Jess Aggio, Danellie Young, 9 July 2024  Gartner Hype Cycle Cyber-Risk Management, 2024, By Michael Kranawetter, Jie Zhang, Pedro Pablo Perea de Duenas, 22 July 2024 Gartner Hype Cycle Security Operations, 2024 By Jonathan Nunez, Andrew Davies, 29 July 2024 Gartner is a registered trademark and service mark of Gartner Inc. and/or its affiliates in the U.S. and internationally, and Hype Cycle is a registered trademark of Gartner Inc. and/or its affiliates and is used herein with permission. All rights reserved.  Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner's research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose. 

image for BlindEagle APT Group ...

 Cybersecurity News

BlindEagle, also known as "APT-C-36," is an advanced persistent threat (APT) group recognized for its straightforward yet impactful attack techniques and methodologies. The group has been persistently targeting entities and individuals in Colombia, Ecuador, Chile, Panama and other countries in Latin America,   show more ...  

with a focus on governmental institutions, financial companies, energy, oil & gas companies, and education, health, and transportation organizations. Researchers observed espionage campaigns from the group during May and June, when the group focused on individuals and organizations within Colombia, with the region accounting for about 87% of victims. Phishing Campaigns of BlindEagle Kaspersky researchers noted that during attacks on Colombia, the BlindEagle group employed a process involving Portuguese artifacts within strings and variable names, unlike the use of Spanish artifacts in previous campaigns. They also observed the use of Brazilian image hosting sites within operations, suggesting that these newer elements could be related to the involvement of third parties or outsourcing to bolster operational range. While the June campaign incorporated usual tactics, it also incorporated DLL sideloading and a new modular malware loader dubbed “HijackLoader.” The attack had been orchestrated through the use of various phishing emails mimicking Colombia’s judicial institutions, with malicious PDF or DOCX file attachments purporting to be demand notices or court summons. [caption id="attachment_87216" align="alignnone" width="823"] Source: https://securelist.com/blindeagle-apt/113414/[/caption] The emails intend to trick victims into accessing the attached files and clicking on embedded links to download documents as a misguided attempt to resolve the alleged legal issues. Victims unintentionally load malicious artifacts on to their systems from attacker-controlled servers. One notable aspect of their phishing campaigns is geolocation filtering, which redirects victims from non-target countries to the official website of the impersonated entity, making it difficult to detect and analyze the attack. The group's use of URL shorteners and public infrastructure, such as image hosting sites and GitHub repositories, allows them to evade detection and create a complex attack chain. Once the initial dropper is downloaded, it extracts and runs files from a compressed archive, which may contain Visual Basic Scripts, XMLHTTP objects, or PowerShell commands. These scripts contact a server to download a malicious artifact, which can be a text file, image, or .NET executable. Adaptability and Evolution BlindEagle's adaptability is a key factor in their success. They employ various open-source RATs, such as njRAT, LimeRAT, and AsyncRAT, depending on the campaign objectives. They have been observed to modify these tools to suit their needs, adding new capabilities and features. In some cases, they have repurposed espionage malware to conduct financial attacks, demonstrating their flexibility in achieving their goals. The researchers note that the evolution in the group's tactics demonstrate BlindEagle's willingness to adapt and improve attack methods, presenting a credible threat to entities and individuals in Latin America.

image for Windows Downdate: ex ...

 Business

All software applications, including operating systems, contain vulnerabilities, so regular updates to patch them are a cornerstone of cybersecurity. The researchers who invented the Windows Downdate attack targeted this very update mechanism, aiming to stealthily roll back a fully updated Windows system to an older   show more ...  

version containing vulnerable files and services. This leaves the system exposed to well-known exploits and deep-level compromise — including the hypervisor and secure kernel. Worse, standard update and system-health checks will report that everythings up to date and fine. Attack mechanism The researchers actually found two separate flaws with slightly different operating mechanisms. One vulnerability — assigned the CVE-2024-21302 ID and dubbed Downdate — is based on a flaw in the update installation process: the downloaded update components are controlled, protected from modification, and digitally signed, but at one of the intermediate installation stages (between reboots), the update procedure creates and then uses a file containing a list of planned actions (pending.xml). If attackers are able to create their own version of that file and then add information about it to the registry, Windows Modules Installer service (TrustedInstaller) will execute the instructions in it upon reboot. In actual fact, the contents of pending.xml do get verified, but its done during previous installation stages — TrustedInstaller doesnt re-verify it. Of course, its impossible to write whatever you like to the file and install arbitrary files this way — since they must be signed by Microsoft, but replacing system files with older files developed by Microsoft is quite feasible. This can re-expose the system to long-patched vulnerabilities — including critical ones. Adding the necessary keys related to pending.xml to the registry requires administrator privileges, after which a system reboot must be initiated. However, these are the only significant limitations. This attack doesnt require elevated privileges (for which Windows dims the display and prompts an admin for additional permission), and most security tools wont flag the actions performed during the attack as suspicious. The second vulnerability — CVE-2024-38202 — allows an actor to manipulate the Windows.old folder, where the update system stores the previous Windows installation. Although modifying files in this folder requires special privileges, an attacker with regular user-rights can rename the folder, create a new Windows.old from scratch, and place outdated, vulnerable versions of Windows system files in it. Initiating a system restore then rolls Windows back to the vulnerable installation. Certain privileges are required for system restoration, but these arent administrator privileges and are sometimes granted to regular users. VBS bypass and password theft Since 2015, the Windows architecture has been redesigned to prevent a Windows kernel compromise leading to that of the whole system. This involves a range of measures collectively known as virtualization-based security (VBS). Among other things, the system hypervisor is used to isolate OS components and create a secure kernel for performing the most sensitive operations, storing passwords, and so on. To prevent attackers from disabling VBS, Windows can be configured to make this impossible — even with administrator rights. The only way to disable this protection is by rebooting the computer in a special mode and entering a keyboard command. This feature is called a Unified Extensible Firmware Interface (UEFI) lock. The Windows Downdate attack bypasses this restriction as well by replacing files with modified, outdated, and vulnerable versions. VBS doesnt check system files for up-to-dateness, so they can be substituted with older, vulnerable versions with no detectable signs or error messages. That is, VBS isnt disabled technically, but the feature no longer performs its security function. This attack allows for the replacement of secure-kernel and hypervisor files with two-year-old versions containing multiple vulnerabilities whose exploitation leads to privilege escalation. As a result, attackers can gain maximum system privileges, full access to the hypervisor and memory-protection processes, and the ability to easily read credentials, hashed passwords, and also NTLM hashes from memory (which can be used for expanding the network attack). Protection against Downdate Microsoft was informed of the Downdate vulnerabilities in February 2024, but it wasnt until August that details were released as part of its monthly Patch Tuesday rollout. Fixing the bugs proved to be a tough task fraught with side effects — including the crashing of some Windows systems. Therefore, instead of rushing to publish another patch, Microsoft for now has simply issued some tips to mitigate the risks. These include the following: Auditing users authorized to perform system-restore and update operations, minimizing the number of such users, and revoking permissions where possible. Implementing access control lists (ACL/DACL) to restrict access to, and modification of update files. Configuring event monitoring for instances where elevated privileges are used to modify or replace update files — this could be an indicator of vulnerability exploitation. Similarly, monitoring the modification and replacement of files associated with the VBS subsystem and system-file backups. Monitoring these events using SIEM and EDR is relatively straightforward. However, false positives can be expected, so distinguishing legitimate sysadmin activity from that of hackers ultimately falls to the security team. All of the above applies not only to physical, but also virtual Windows machines in cloud environments. For virtual machines in Azure, we also advise tracking unusual attempts to log in with administrator credentials. Enable MFA and change the credentials in case such an attempt is detected. One other, more drastic tip: revoke administrator privileges for employees who dont need them, and mandate that genuine administrators (i) only perform administrative actions under their respective account, and (ii) use a separate account for other work. Risky fixes For those looking for more security, Microsoft offers the update KB5042562, which mitigates the severity of CVE-2024-21302. With this installed, outdated versions of VBS system files are added to the revoked list and can no longer be run on an updated computer. This policy (SkuSiPolicy.p7b) is applied at the UEFI level, so when using it you need to update not only the OS but also backup removable boot media. Its also important to be aware that rollback to older installations of Windows would no longer be possible. Whats more, the update forcibly activates the User Mode Code Integrity (UMCI) feature, which itself can cause compatibility and performance issues. In general, administrators are advised to carefully weigh the risks, and thoroughly study the procedure and its potential side effects. Going forward, Microsoft promises to release patches and additional security measures for all relevant versions of Windows — up to Windows 10, version 1507, and Windows Server 2016.

 Trends, Reports, Analysis

According to a report by cybersecurity researchers at BforeAI, threat actors used fake social media accounts, stores, ticketing systems, and fraudulent cryptocurrencies to target unsuspecting victims.

 Security Products & Services

Authentik is known for its adaptability and flexibility. It seamlessly integrates into existing environments, offering support for various protocols. It simplifies tasks like sign-up and account recovery in applications.

 Govt., Critical Infrastructure

FBI and CISA issued a PSA reassuring the public about the security of the 2024 election cycle against ransomware attacks. While attacks on government networks could cause temporary delays, voting systems' integrity remains intact.

 Security Products & Services

Phase 1 in October 2024 will require MFA for accessing Azure portal, Microsoft Entra admin center, and Intune admin center, with Phase 2 in early 2025 extending enforcement to Azure CLI, Azure PowerShell, mobile app, and Infrastructure as Code tools.

 Incident Response, Learnings

The operation was linked to Iran's Storm-2035, also flagged by Microsoft for election interference. Google has also reported Iranian cyber influence activity. OpenAI identified 12 X accounts and one Instagram account involved in the operation.

 Trends, Reports, Analysis

Ransomware resilience is leading to a decrease in cyber insurance claims, as reported by UK backup solutions provider Databarracks. While more organizations are investing in cyber insurance, the number of claims has dropped significantly.

 Malware and Vulnerabilities

Once a stolen card is added to the attacker's wallet, they can use it to make purchases without being detected, even after the original card has been canceled. Recurring transactions are also vulnerable to abuse, allowing payments with locked cards.

 Security Products & Services

x64dbg is an open-source binary debugger for Windows, perfect for malware analysis and reverse engineering executables. It has a user-friendly UI that simplifies navigation and provides context on the process.

 Trends, Reports, Analysis

Cybercrime is a growing threat to Africa's economies, hindering their progress despite rapid GDP growth. The continent faces challenges like digital illiteracy and a shortage of cybersecurity professionals.

 Expert Blogs and Opinion

To bolster cybersecurity, focus on managing and utilizing enterprise data efficiently. Companies possess significant data reserves, yet these are often scattered across different systems, necessitating manual efforts to extract value.

 Govt., Critical Infrastructure

The NCSC has launched the Cyber Resilience Audit (CRA) scheme to find auditors for a new cyber-resilience initiative. It focuses on conducting independent audits based on the Cyber Assessment Framework (CAF) to support nationally critical sectors.

 Feed

Ubuntu Security Notice 6969-1 - It was discovered that Cacti did not properly apply checks to the "Package Import" feature. An attacker could possibly use this issue to perform arbitrary code execution. This issue only affected Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS and Ubuntu 18.04 LTS. It was   show more ...  

discovered that Cacti did not properly sanitize values when using javascript based API. A remote attacker could possibly use this issue to inject arbitrary javascript code resulting into cross-site scripting vulnerability. This issue only affected Ubuntu 24.04 LTS.

 Feed

Ubuntu Security Notice 6967-1 - It was discovered that some Intel® Core™ Ultra Processors did not properly isolate the stream cache. A local authenticated user could potentially use this to escalate their privileges. It was discovered that some Intel® Processors did not properly isolate the stream cache. A local   show more ...  

authenticated user could potentially use this to escalate their privileges. It was discovered that some Intel® Processors did not correctly transition between the executive monitor and SMI transfer monitor. A privileged local attacker could use this to escalate their privileges.

 Feed

Ubuntu Security Notice 6968-1 - Noah Misch discovered that PostgreSQL incorrectly handled certain SQL objects. An attacker could possibly use this issue to execute arbitrary SQL functions as the superuser.

 Feed

Red Hat Security Advisory 2024-5599-03 - An update for libreoffice is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.6 Telecommunications Update Service.

 Feed

Red Hat Security Advisory 2024-5582-03 - An update for kpatch-patch-4_18_0-372_87_1 and kpatch-patch-4_18_0-372_91_1 is now available for Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions. Issues addressed include a denial of service vulnerability.

 Feed

Red Hat Security Advisory 2024-5522-03 - An update for kpatch-patch-4_18_0-553 is now available for Red Hat Enterprise Linux 8. Issues addressed include code execution and use-after-free vulnerabilities.

 Feed

Cybersecurity researchers have shed light on a threat actor known as Blind Eagle that has persistently targeted entities and individuals in Colombia, Ecuador, Chile, Panama, and other Latin American nations. Targets of these attacks span several sectors, including governmental institutions, financial companies, energy and oil and gas companies. "Blind Eagle has demonstrated adaptability in

 Feed

Cybersecurity researchers are warning about the discovery of thousands of externally-facing Oracle NetSuite e-commerce sites that have been found susceptible to leaking sensitive customer information. "A potential issue in NetSuite's SuiteCommerce platform could allow attackers to access sensitive data due to misconfigured access controls on custom record types (CRTs)," AppOmni's Aaron Costello

 Feed

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical security flaw impacting Jenkins to its Known Exploited Vulnerabilities (KEV) catalog, following its exploitation in ransomware attacks. The vulnerability, tracked as CVE-2024-23897 (CVSS score: 9.8), is a path traversal flaw that could lead to code execution. "Jenkins Command Line Interface (CLI) contains a

 Feed

A previously undocumented backdoor named Msupedge has been put to use against a cyber attack targeting an unnamed university in Taiwan. "The most notable feature of this backdoor is that it communicates with a command-and-control (C&C) server via DNS traffic," the Symantec Threat Hunter Team, part of Broadcom, said in a report shared with The Hacker News. The origins of the backdoor are

 Feed

In today's rapidly evolving cyber threat landscape, organizations face increasingly sophisticated attacks targeting their applications. Understanding these threats and the technologies designed to combat them is crucial. This article delves into the mechanics of a common application attack, using the infamous Log4Shell vulnerability as an example, and demonstrates how Application Detection and

 Feed

Cybersecurity researchers have disclosed a security flaw impacting Microsoft Azure Kubernetes Services that, if successfully exploited, could allow an attacker to escalate their privileges and access credentials for services used by the cluster. "An attacker with command execution in a Pod running within an affected Azure Kubernetes Services cluster could download the configuration used to

 Feed

Iranian state-sponsored threat actors have been observed orchestrating spear-phishing campaigns targeting a prominent Jewish figure starting in late July 2024 with the goal of delivering a new intelligence-gathering tool called AnvilEcho. Enterprise security company Proofpoint is tracking the activity under the name TA453, which overlaps with activity tracked by the broader cybersecurity

 Feed

As cloud infrastructure becomes the backbone of modern enterprises, ensuring the security of these environments is paramount. With AWS (Amazon Web Services) still being the dominant cloud it is important for any security professional to know where to look for signs of compromise. AWS CloudTrail stands out as an essential tool for tracking and logging API activity, providing a comprehensive

 Feed

Mobile users in the Czech Republic are the target of a novel phishing campaign that leverages a Progressive Web Application (PWA) in an attempt to steal their banking account credentials. The attacks have targeted the Czech-based Československá obchodní banka (CSOB), as well as the Hungarian OTP Bank and the Georgian TBC Bank, according to Slovak cybersecurity company ESET. "The phishing

 Confirms

Source: www.databreachtoday.com – Author: 1 Cyberwarfare / Nation-State Attacks , Fraud Management & Cybercrime FBI Says Iran, Russia Ramping Up Influence Operations Ahead of National Vote Chris Riotta (@chrisriotta) • August 19, 2024     The FBI said Monday that Iranian operatives hacked the campaign   show more ...  

of Republican presidential nominee Donald Trump. (Image: Shutterstock) The FBI […] La entrada FBI Confirms Iranian Hack Targeting Trump Campaign – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Building

Source: www.databreachtoday.com – Author: 1 Artificial Intelligence & Machine Learning , Black Hat , Events NYUs Brennan Lodge on Training Your Own Model With Retrieval Augmented Generation Tom Field (SecurityEditor) • August 19, 2024     Brennan Lodge, professor, information technology and data   show more ...  

analytics, New York University Many cybersecurity organizations hope generative artificial intelligence and […] La entrada Building Timely and Truthful LLMs for Security Operations – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.databreachtoday.com – Author: 1 Healthcare , HIPAA/HITECH , Incident & Breach Response Cybercriminal Gang RansomHub Claims It Leaked 700 Gigabytes of Lab’s Stolen Data Marianne Kolbasuk McGee (HealthInfoSec) • August 19, 2024     American Clinical Solutions, which provides drug   show more ...  

testing, told federal regulators a hack has compromised data of 300,000 individuals. (Image: ACS) […] La entrada Florida-Based Drug Testing Lab Says 300,000 Affected in Hack – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 check

Source: www.databreachtoday.com – Author: 1 Cybercrime , Fraud Management & Cybercrime , Incident & Breach Response 1.3 Million Individuals Being Notified Their Social Security Numbers Were Stolen Mathew J. Schwartz (euroinfosec) • August 19, 2024     Background check firm National Public Data is   show more ...  

notifying 1.3 million individuals that hackers stole their data. (Image: Shutterstock) […] La entrada Background Check Firm National Public Data Confirms Breach – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.databreachtoday.com – Author: 1 Gaurav Kabra (GK) Managing Director, Identity & Access Management, Cyderes Gaurav is an Identity and Access Management executive with over 14 years of experience at various consulting firms. His strong background in professional services, digital transformation,   show more ...  

customer management, and systems development and architecture has helped him successfully deliver multi-year IAM […] La entrada Live Webinar | Evolving Beyond Legacy: Fast-Tracking Innovation with Modern Identity Security – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Breaking

Source: www.databreachtoday.com – Author: 1 Ken Sigel Partner Solutions Architect, Wiz Ken Sigel is a seasoned Wiz Solutions Engineer with a focus on empowering cloud alliance and channel partners. With over 20 years of experience, Ken has collaborated with leading security vendors such as Exabeam, Illusive,   show more ...  

HyTrust, and Proofpoint, providing expert solutions to complex security […] La entrada Live Webinar | Breaking Down Barriers: DevSecOps & CSPM – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.databreachtoday.com – Author: 1 Tim Grieveson Senior Vice President – Global Cyber Security Risk Advisor, Bitsight Tim Grieveson is Senior Vice President – Global Cyber Security Risk Advisor at Bitsight, helping organizations transform how they measure and manage their cybersecurity   show more ...  

performance and risk based on years of experience as a CSO, CISO, CIO, and […] La entrada Live Webinar: Enhancing Third-Party Risk Management for a Unified Risk Strategy – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.databreachtoday.com – Author: 1 Thank you for registering with ISMG Complete your profile and stay up to date Need help registering? Contact Support Original Post url: https://www.databreachtoday.com/webinars/securing-your-ai-protecting-against-hidden-threats-w-5783 Category & Tags: –   show more ...  

Views: 0 La entrada Securing Your AI: Protecting Against Hidden Threats – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.databreachtoday.com – Author: 1 Managed Detection & Response (MDR) , Security Operations Aging Technology and Rising Competition Have Created a Need for Greater Investment Michael Novinson (MichaelNovinson) • August 16, 2024     Kerry Bailey, CEO, eSentire (Image: eSentire) The rise of   show more ...  

cybersecurity platform providers, consulting giants and pure-play vendors in the managed detection […] La entrada Why MDR Stalwart eSentire Is Looking to Sell Itself for $1B – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Balancing

Source: www.databreachtoday.com – Author: 1 Artificial Intelligence & Machine Learning , Next-Generation Technologies & Secure Development How to Responsibly Embrace AI’s Potential to Strengthen Cybersecurity Defenses Chris Novak, Senior Director, Verizon Cyber Security Consulting • August 14,   show more ...  

2024     The potential for cybercriminals to unleash devastating AI-enhanced attacks conjures up frightening visions of cyberattacks […] La entrada Balancing AI’s Promise and Risks in Cybersecurity – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2024-08
Aggregator history
Tuesday, August 20
THU
FRI
SAT
SUN
MON
TUE
WED
AugustSeptemberOctober