Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Splunk’s Recent Se ...

 Firewall Daily

Splunk has recently issued a security advisory aimed at addressing multiple vulnerabilities within its Splunk Enterprise software. The advisory categorizes these Splunk vulnerabilities into three main classifications based on their Common Vulnerability Scoring System (CVSS) base scores, highlighting two critical   show more ...  

high-risk issues, eight medium-risk vulnerabilities, and one low-risk vulnerability.   The advisory details a total of eleven vulnerabilities associated with various CVE IDs, including CVE-2024-45731 through CVE-2024-45741. Among these, two vulnerabilities are marked as high severity, indicating a critical risk to users. The remaining vulnerabilities fall into the medium and low categories, reflecting a range of potential threats that organizations using Splunk need to address urgently.  Splunk has confirmed that patches are available for all identified vulnerabilities and has urged users to implement these updates promptly to mitigate any associated risks. This guidance is crucial, as neglecting to apply these patches could expose organizations to significant threats, including unauthorized access and potential data breaches.  Overview of Splunk Vulnerabilities   One of the most pressing concerns highlighted in the advisory is CVE-2024-45731, which addresses a critical remote code execution vulnerability. This high-severity vulnerability carries a CVSS score of 8.0 and affects versions of Splunk Enterprise for Windows below 9.3.1, 9.2.3, and 9.1.6. A low-privileged attacker can exploit this vulnerability by writing a file to the Windows system root directory if Splunk is installed on a separate drive, potentially allowing the attacker to load a malicious DLL and execute code remotely. Users are advised to avoid installing Splunk on a separate disk to mitigate this risk.  Another notable vulnerability, CVE-2024-45733, also poses a significant threat, with a CVSS score of 6.5. This vulnerability affects Splunk Enterprise for Windows in versions below 9.2.3 and 9.1.6, allowing for remote code execution due to insecure session storage configurations. Organizations are encouraged to disable Splunk Web on indexers in distributed environments where logins are unnecessary to prevent exploitation.  Additionally, CVE-2024-45734 and CVE-2024-45735 both score 4.3 and present medium-risk vulnerabilities. CVE-2024-45734 can be exploited through the PDF export feature, enabling users to view local images from the machine running Splunk. Users are advised to disable Splunk Web to mitigate this risk. Meanwhile, CVE-2024-45735 allows low-privileged users to access sensitive deployment configurations within the Splunk Secure Gateway App. Users should disable this app if it is not needed or ensure that proper security settings are in place.  CVE-2024-45736, scoring 6.5, involves uncontrolled resource consumption, which could cause the Splunk daemon to crash if a crafted search query is executed. Organizations are recommended to implement monitoring solutions to detect unusual search query behaviors that may indicate an exploitation attempt.  Among the low-severity vulnerabilities, CVE-2024-45737, with a score of 3.5, allows an attacker to exploit cross-site request forgery (CSRF) to alter the maintenance mode state of the App Key Value Store. Again, turning off Splunk Web may serve as a temporary workaround for this risk.  Finally, CVE-2024-45738 and CVE-2024-45739, both scoring 4.9, pose medium risks by potentially exposing sensitive HTTP parameters and plaintext passwords due to overly verbose logging configurations. Users should adjust logging levels and ensure sensitive logs are removed from internal indexes to mitigate these Splunk vulnerabilities.  Conclusion  In response to vulnerabilities in Splunk, organizations should adopt key practices such as regularly updating software with the latest vendor patches, developing comprehensive security strategies, isolating critical assets using firewalls and access controls, maintaining up-to-date incident response plans, implementing robust monitoring tools, and proactively assessing systems for necessary upgrades. These measures are crucial to safeguard against risks like unauthorized access and data breaches, ensuring that users of Splunk Enterprise remain vigilant and secure. 

image for SEC Fines Major Comp ...

 Compliance

Public companies facing cyberattacks must be honest in their disclosures, or the consequences could hit harder than the breach itself. This message rang loud and clear as the Securities and Exchange Commission (SEC) imposed fine on four companies—Unisys Corp., Avaya Holdings Corp., Check Point Software Technologies   show more ...  

Ltd, and Mimecast Limited—for making materially misleading cyber disclosures and public statements about the cybersecurity incidents they faced due to the broader SolarWinds hack. Misleading Cyber Disclosures Lead to Fines The SEC's investigation found that these companies misrepresented the extent of breaches related to the infamous SolarWinds Orion software hack, a massive cyber espionage campaign that impacted numerous organizations, including federal agencies. Each firm either minimized the attack's severity or failed to disclose critical information, leaving investors in the dark about the actual scope of the intrusion, the SEC found. Unisys Corp. was hit the hardest, facing a $4 million penalty for both misleading disclosures and failure to maintain proper controls over its public statements. Meanwhile, Avaya, Check Point, and Mimecast were each fined nearly $1 million for similar violations. All Also read: SolarWinds’ CISO Faces SEC Fraud Charges Over Cybersecurity Deception The Dangers of Downplaying Cybersecurity Breaches The SEC's orders reveal that Unisys, Avaya, and Check Point were aware as early as 2020 that a sophisticated threat actor had accessed their systems through SolarWinds. Mimecast learned in 2021 that it had been compromised as well. However, each of these companies made public statements suggesting that their cyber risks were "hypothetical" or limited in scope, despite knowing the opposite to be true. For instance, Unisys downplayed the risk in its public filings even though it knew of two separate breaches involving gigabytes of stolen data. Avaya minimized the incident by claiming that only a few email messages were accessed, when in reality, 145 files from its cloud file-sharing system had also been compromised. Similarly, Check Point chose to speak about cyber risks in generic terms rather than addressing the breach's true impact. SEC Warns Against ‘Half-Truths’ “Downplaying the extent of a material cybersecurity breach is a bad strategy,” warned Jorge G. Tenreiro, acting chief of the Crypto Assets and Cyber Unit. The SEC’s findings revealed that these companies either framed their cybersecurity risk factors hypothetically or discussed them in generic terms, even after knowing the risks had already materialized. The SEC noted that federal securities laws prohibit “half-truths,” particularly in risk-factor disclosures, and made clear that misleading statements about cybersecurity breaches would not be tolerated. The Impact of SEC's Action The SEC’s enforcement action should act as a critical wake-up call for companies across industries, particularly in the cybersecurity and tech sectors. The need for clear, honest communication about cyber risks cannot be overstated, especially as incidents involving nation-state actors and sophisticated malware campaigns continue to rise. Companies will likely want to have robust internal processes for incident reporting, ensuring that C-suites and boards of directors are fully informed of cyber risks. Companies that fall short of this standard not only risk regulatory action but also lose credibility with investors and customers. Also read: Federal Judge Dismisses Major Claims in SEC’s Lawsuit Against SolarWinds The Role of Disclosure Controls One of the key issues raised by the SEC’s investigation was the failure of disclosure controls at Unisys. The SEC found that Unisys did not have adequate systems in place to ensure that its public statements accurately reflected the reality of its cyber incidents. The case shows a growing expectation for organizations to build strong disclosure frameworks that tie cybersecurity incidents directly to their financial filings. Cybersecurity cannot be treated as a separate issue from corporate governance and compliance anymore. Failure to align these areas can result in substantial penalties and lasting reputational damage. Cooperation Does Not Prevent Penalties While all four companies cooperated with the SEC’s investigation and took steps to enhance their cybersecurity controls, this did not exempt them from financial penalties. According to the SEC, each company’s cooperation helped expedite the investigation, but this did not mitigate the fact that they had provided misleading disclosures to the public. The enforcement action makes it clear that even companies that voluntarily disclose information or cooperate fully with investigations can still face penalties if they fail to uphold transparency. “As today’s enforcement actions reflect, while public companies may become targets of cyberattacks, it is incumbent upon them to not further victimize their shareholders or other members of the investing public by providing misleading disclosures about the cybersecurity incidents they have encountered,” said Sanjay Wadhwa, acting director of the SEC’s Division of Enforcement. The Future of Cybersecurity Disclosures Moving forward, the SEC’s actions suggest that there will be increased regulatory focus on how companies disclose cyber risks and breaches. The SolarWinds hack, along with other high-profile incidents, has shown just how devastating cyberattacks can be—not just in terms of technical damage, but also in terms of regulatory and legal fallout. Public companies, particularly those in critical sectors like technology and financial services, should expect heightened scrutiny over how they communicate their cybersecurity posture. The pressure will likely increase as global cyber threats grow more sophisticated and investors demand more transparency.

image for Cybersecurity, AI, F ...

 Cyber News

The U.S. Securities and Exchange Commission (SEC) has released its examination priorities for fiscal year 2025. The SEC’s Division of Examinations publishes its priorities annually to inform market participants of potential risks and to guide the financial industry on areas of regulatory focus. For the upcoming   show more ...  

year, the SEC 2025 examination agenda will concentrate on both long-standing and emerging risks, including cybersecurity, artificial intelligence (AI), fiduciary duty, and standards of conduct. A significant focus of the SEC 2025 priorities is cybersecurity, reflecting the growing threat of cyberattacks on the financial sector. The division will closely examine how registered entities, including investment advisers, broker-dealers, and clearing agencies, manage cybersecurity risks, particularly those that could compromise critical services, investor data, or financial stability. SEC 2025 Examination Agenda: Cybersecurity, a Top Priority Cybersecurity has become a central concern for the SEC 2025 examination agenda as cyberattacks grow in frequency. In 2025, the SEC will scrutinize how firms are safeguarding investor information, records, and assets against cyber threats. The focus will be on policies and procedures that govern data loss prevention, access controls, account management, and incident response. The SEC 2025 priorities will also assess how firms respond to ransomware attacks and other cyber-related incidents. This includes evaluating their ability to detect, mitigate, and recover from cyber intrusions. Firms must ensure that their cybersecurity programs are not only comprehensive but also flexible enough to address the changing threat landscape. Particularly concerning is the risk posed by third-party products and services, which can introduce vulnerabilities into a firm’s network. The division will review the cybersecurity risks associated with these external dependencies, especially when firms use third-party technology or infrastructure without proper oversight from their IT departments. This lack of oversight can lead to gaps in security and increase the likelihood of a breach. As part of the examination process, the division will also evaluate alternative trading systems and their ability to protect confidential trading information. These platforms are critical to the functioning of capital markets, and any breach of trading data could have significant repercussions. Safeguarding Critical Infrastructure The SEC’s focus on cybersecurity extends to its examination of entities subject to Regulation Systems Compliance and Integrity (SCI). SCI entities—such as exchanges, clearinghouses, and other critical market infrastructure—are required to maintain strong systems to ensure the integrity, resiliency, and availability of their operations. These entities play a key role in ensuring the stability of the U.S. capital markets, and any disruption could have far-reaching consequences. For 2025, the SEC will examine the policies and procedures these entities have in place to manage operational risks, including their business continuity planning and incident response capabilities. This includes reviewing how SCI entities handle inbound and outbound connectivity during cyber events. The division will assess whether these entities have the necessary tools and procedures in place to disconnect or reconnect from third parties during a cyber incident without compromising the broader market. In addition, the SEC will evaluate the effectiveness of security management tools employed by SCI entities. These tools are essential for detecting and mitigating cyber threats, and the SEC will ensure that they are capable of meeting the security objectives of the organization. Emerging Technologies: AI and Crypto Assets Alongside cybersecurity, the SEC’s examination priorities for 2025 include a focus on the use of artificial intelligence (AI) in the financial industry. As AI technologies become more prevalent, the SEC is concerned with how these tools are being integrated into trading, investment, and advisory services. The division will review how firms are using AI to make decisions and whether these technologies comply with regulatory standards. In addition, the division will continue its scrutiny of the crypto asset market, which has seen increased volatility and regulatory attention. Examinations will focus on firms offering crypto asset-related services, including whether they meet their obligations under federal securities laws. This includes reviewing the offer, sale, recommendation, and trading of crypto assets, with a particular focus on retail investors and retirement accounts. The SEC will also evaluate how firms manage the technological risks associated with crypto assets, particularly those that involve blockchain and distributed ledger technologies. The security of these assets remains a top concern, and the division will ensure that firms have adequate controls in place to protect investor funds. Strengthening Compliance Programs The SEC’s examination priorities for 2025 are not limited to cybersecurity and emerging technologies. The division will also continue its focus on fiduciary duty, standards of conduct, and governance practices. Firms are encouraged to review their compliance programs to ensure they are meeting the expectations set out by the SEC. The division will assess whether firms are following proper standards when providing investment advice or making recommendations, particularly when dealing with retail investors or retirement assets. This includes ensuring that firms understand the products they are offering and that they disclose all relevant risks to their clients.

image for India, Australia, Ja ...

 Cyber Essentials

The Quad partners—Australia, India, Japan, and the United States—under the Quad Senior Cyber Group, have reaffirmed their joint commitment to strengthening global cybersecurity by extending their collaborative effort through the Quad Cyber Challenge. This initiative, Quad Cyber Challenge, which brings together   show more ...  

government, educational institutions, and the private sector, aims to promote responsible cyber ecosystems, raise public awareness, and build a strong cybersecurity workforce. The theme for this year’s Challenge focuses on cybersecurity education and developing a skilled workforce to address the growing cyber threats worldwide. Quad Cyber Challenge: A Global Initiative to Enhance Cybersecurity Awareness On October 10th, 2024, the United States hosted a significant event for the Quad Cyber Challenge at the White House. The gathering highlighted the importance of education in cybersecurity and was led by Anne Neuberger, Deputy National Security Advisor for Cyber and Emerging Technology at the National Security Council, and Cindy Marten, Deputy Secretary of the Department of Education. Both emphasized the critical need to cultivate young talent in the field of cybersecurity and shared insights into the pathways that exist for students to pursue careers in both federal service and the private sector. Quad Cyber Challenge also provided an opportunity for students and educators from across the U.S. to interact with prominent cybersecurity professionals, cshared their career development stories and offered guidance to aspiring cybersecurity experts. In attendance were recipients of the Presidential Cyber Educator Award and participants in key cybersecurity education programs such as the Presidential Cyber Educator Award Pathways and CyberPatriot programs. These students exemplify the future of the U.S. cyber workforce, showcasing the growing importance of youth engagement in cybersecurity initiatives. Japan’s Commitment to Cybersecurity Talent Development The day after the U.S. event, Japan’s National Center of Incident Readiness and Strategy for Cybersecurity (NISC) hosted its own segment of the Quad Cyber Challenge. In this virtual event, three leading Japanese cybersecurity professionals shared their personal experiences, highlighting the value and challenges of working in the cybersecurity field. Their video messages were aimed at inspiring students and young professionals to consider careers in cybersecurity, a field that continues to grow in importance as cyber threats become more sophisticated. By sharing their stories, these experts emphasized the importance of the cybersecurity workforce in protecting critical infrastructure and digital systems. Their contributions also aligned with the broader goals of the Quad Cyber Challenge, which seeks to motivate the next generation to take up the mantle in this critical area. Australia’s Focus on Female Cyber Talent Later in October, the Quad Cyber Challenge will move to Australia, where Governor-General of the Commonwealth of Australia, Her Excellency the Honourable Sam Mostyn AC, will host an event at Government House in Canberra. Senior female high school students from the capital region will attend the event, which will feature key speakers including the Special Envoy for Cyber Security and Digital Resilience, Dr. Andrew Charlton MP, and National Cyber Security Coordinator, Lieutenant General Michelle McGuinness CSC. This event aims to highlight the opportunities available in the cybersecurity field and to inspire young women to pursue careers in this rapidly evolving sector. The focus on female students is particularly significant as the global cybersecurity industry continues to seek gender diversity and inclusion in the workforce. Participants will learn about the importance of cyber skills, not only for personal protection but also for contributing to the larger effort of safeguarding digital environments. By investing in education and talent development, Australia, along with its Quad partners, is helping to ensure the future strength and resilience of the cybersecurity workforce. India’s Cyber Hygiene Campaign India, too, is playing an active role in the Quad Cyber Challenge. As part of Cybersecurity Awareness Month, the National Cyber Security Coordinator of India will address the nation’s student community with a message on “Cyber Swachhta Abhiyaan”—India’s Cyber Hygiene Campaign. The message will emphasize the importance of cyber hygiene practices, such as maintaining strong passwords, avoiding phishing attempts, and securing personal devices. This outreach is a critical component of India’s broader cybersecurity awareness efforts. In addition to the message, leading cybersecurity experts in India will conduct workshops aimed at students and faculty members, encouraging them to adopt cyber-safe habits and explore cybersecurity as a viable and rewarding career path. These workshops are designed not only to raise awareness but also to build practical skills that can help students protect themselves from cyber threats and contribute to national cybersecurity efforts.

image for Huawei Cloud Partner ...

 Firewall Daily

Huawei Cloud has partnered with the Cyber Security Agency of Singapore (CSA). This collaboration aims to simplify the cybersecurity certification process for enterprises, aligning with Singapore's vision of creating a resilient and digitally inclusive nation. At the recent GovWare 2024 event, part of the Singapore   show more ...  

International Cyber Week, the two organizations revealed the Security Companion Guide for CSA Cyber Trust Mark Certification.   As businesses increasingly migrate to cloud environments, traditional IT security models often fail to protect digital assets. Many enterprises struggle to understand their specific responsibilities concerning cloud security, which can vary based on their digital maturity and migration strategies.    To address these issues, Huawei Cloud, as an Advocate Partner of CSA’s SG Cyber Safe Partnership Programme, is committed to providing robust solutions and cloud service resources that adhere to the stringent standards of the Cyber Trust mark certification. The collaboration with CSA is crucial in developing the Security Companion Guide, which serves as a roadmap for enterprises in Singapore and the wider Southeast Asian region.   A Comprehensive Guide to Cyber Hygiene with Huawei Cloud   The Security Companion Guide is designed to help organizations implement effective cyber hygiene practices through public-private collaboration. It provides clear guidelines based on the cloud security responsibility-sharing model, delineating the necessary steps to meet the Cyber Trust mark requirements. This guide not only outlines organizational responsibilities but also offers practical advice on implementing essential cybersecurity measures.   Additionally, the guide maps Huawei Cloud's services and best practices to the control domains of the Cyber Trust mark. This mapping is a valuable reference for organizations, facilitating easier compliance with certification requirements.   Maxi Wang, CEO of Huawei International, emphasized the importance of this certification, stating, “The Cyber Trust mark certification is a meaningful step for organizations across Singapore and Southeast Asia to prove their maturity in cybersecurity and cyber hygiene practices. In collaboration with the CSA, we are democratizing cybersecurity, ensuring that businesses of all sizes can not only meet regulatory standards but also forge resilient operations that stand strong against evolving cyber threats.”   The Role of the Cyber Trust Mark   The Cyber Trust mark is an integral part of CSA’s Cyber Safe Certification Program. It recognizes organizations that actively address cybersecurity risks and maintain a high level of cybersecurity hygiene. The program includes the Cyber Essentials mark, which identifies organizations implementing fundamental cybersecurity measures against prevalent threats.   For enterprises aiming to meet the Cyber Trust mark requirements, adopting a risk-based approach is critical. Organizations are expected to sustain ongoing cybersecurity readiness across 22 specific topics, ensuring preparedness against potential cyber threats. The Cyber Trust mark categorizes organizations into five levels of readiness: Supporter, Practitioner, Promoter, Performer, and Advocate. The Security Companion Guide for CSA Cyber Trust Mark Certification is instrumental in helping enterprises adopt necessary cybersecurity measures for effective cloud integration.   Aligning with Global Standards   The Cyber Trust mark certification is aligned with ISO27001 standards, complementing other certifications such as CSA STAR and CSA CCM 4.0. This alignment ensures that organizations can benchmark their cybersecurity efforts against internationally recognized standards. Moreover, the Security Companion Guide is not only relevant for Singaporean enterprises but also serves as a valuable resource for cybersecurity initiatives across ASEAN member states.   In addition to the guide, Huawei Cloud has developed a dedicated security solution aimed at promoting the Cyber Trust mark certification. This initiative enables customers to manage information security risks effectively while implementing robust cybersecurity practices based on the Cyber Trust mark standards.   Dennis Chan, Chief Security & Privacy Officer at Huawei International, stated, “Cloud service providers like Huawei Cloud hold the keys to a secure digital landscape by prioritizing responsible cybersecurity practices. This not only protects our infrastructure but also empowers our tenants to thrive safely in the cloud era. We believe this Huawei Cloud Security Companion Guide, jointly developed with the Cyber Security Agency of Singapore, will guide our cloud tenants to adopt the right cybersecurity posture to secure their digital assets.” 

image for Fake WordPress Plugi ...

 Cyber News

Hackers are using stolen credentials to infect WordPress sites with bogus plugins that deliver malware and infostealers to end users via fake browser update prompts. The malicious campaign, based on a new variant of the ClickFix fake browser update malware, has infected more than 6,000 sites with fake WordPress   show more ...  

plugins since June 2024. Overall, ClickFix has now compromised more than 25,000 sites since August 2023, according to the GoDaddy security team. Fake WordPress Plugins Tap Stolen Credentials No known vulnerabilities are being exploited to deliver the bogus plugins; the hackers simply seem to be using stolen credentials. “Log analysis reveals that the installation of counterfeit WordPress plugins did not directly exploit any known vulnerabilities within the WordPress ecosystem,” the GoDaddy advisory said. “Instead, attackers possessed legitimate WordPress admin credentials for each compromised site.” The plugins are “designed to appear harmless to website administrators,” but site visitors could be shown fake browser updates and other malicious prompts. The plugins inject malicious JavaScript that contains “a known variation of fake browser update malware that uses blockchain and smart contracts to obtain malicious payloads,” known as EtherHiding. When executed in the browser, the JavaScript delivers fake browser update notifications that guide users to install malware on their machines, typically remote access trojans (RATs) or info stealers like Vidar Stealer and Lumma Stealer. Fake WordPress Plugins: Details and IoCs The fake plugins use generic names such as “Advanced User Manager” or “Quick Cache Cleaner,” and their directories contain only 3 small files: index.php, .DS_Store, and a -script.js file with a variation typically based on the name of the plugin. [caption id="attachment_91697" align="aligncenter" width="500"] Fake WordPress plugin files (GoDaddy)[/caption] Those naming schemes led to the discovery of other malicious plugins: Plugin name Injected script Admin Bar Customizer admin-bar-customizer/abc-script.js Advanced User Manager advanced-user-manager/aum-script.js Advanced Widget Manage advanced-widget-manage/awm-script.js Content Blocker content-blocker/cb-script.js Custom CSS Injector custom-css-injector/cci-script.js Custom Footer Generator custom-footer-generator/cfg-script.js Custom Login Styler custom-login-styler/cls-script.js Dynamic Sidebar Manager dynamic-sidebar-manager/dsm-script.js Easy Themes Manager easy-themes-manager/script.js Form Builder Pro form-builder-pro/fbp-script.js Quick Cache Cleaner quick-cache-cleaner/qcc-script.js Responsive Menu Builder responsive-menu-builder/rmb-script.js SEO Optimizer Pro seo-optimizer-pro/sop-script.js Simple Post Enhancer simple-post-enhancer/spe-script.js Social Media Integrator social-media-integrator/smi-script.js “The underlying plugin code remains deliberately simplistic to avoid raising red flags,” the advisory said. A hook for the wp_enqueue_scripts action is manipulated to load a harmful script from the plugin directory into WordPress pages. .DS_Store is short for Desktop Services Store, hidden files that the macOS Finder application creates to store folder preferences. The fake plugin .DS_Store files don’t contain any information but can be used as an indicator of compromise (IoC): MD5: 194577a7e20bdcc7afbb718f502c134c SHA 256: d65165279105ca6773180500688df4bdc69a2c7b771752f0a46ef120b7fd8ec3 The script filenames contain identical content and can be identified by their hash: MD5: 602e1f42d73cadcd73338ffbc553d5a2 SHA 256: a4ad384663963d335a27fa088178a17613a7b597f2db8152ea3d809c8b9781a0 Speculation About Stolen WordPress Credentials The GoDaddy advisory notes that the presence of valid WordPress admin credentials suggests that the hackers used methods to obtain the credentials, such as brute-force attacks, phishing campaigns, or perhaps even malware or infostealer infections on the website admins’ computers. The advisory didn’t say, but presumably multi-factor authentication would offer some protection against the stolen credentials being misused, along with other access controls such as device ID, health and location.

image for CVE-2024-9537: CISA ...

 Cyber News

U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog-CVE-2024-9537. This vulnerability affects ScienceLogic SL1 (formerly known as EM7), a widely used IT infrastructure monitoring and management platform. According to CISA, the   show more ...  

vulnerability is related to an unspecified third-party component packaged with SL1, making it difficult to pinpoint the precise nature of the exploit. However, it is serious enough to merit immediate attention and action. ScienceLogic has already addressed this CVE-2024-9537 vulnerability in newer versions of SL1, beginning with versions 12.1.3+, 12.2.3+, and 12.3+. Moreover, remediation measures are available for earlier versions dating back to lines 10.1.x, 10.2.x, 11.1.x, 11.2.x, and 11.3.x. Users running affected versions of ScienceLogic SL1 are advised to apply the appropriate patches or updates immediately to mitigate the risk of exploitation. While there is no concrete evidence linking this CVE-2024-9537 vulnerability to ransomware campaigns yet, the potential for its exploitation in cyberattacks cannot be ruled out. CISA has emphasized that if mitigations are unavailable, organizations should discontinue the use of the affected product to avoid unnecessary exposure. CVE-2024-9537 - Timeline and Urgency of Action This newly added vulnerability comes with a clear timeline for remediation. All Federal Civilian Executive Branch (FCEB) agencies are required to address this vulnerability by November 11, 2024, as mandated by CISA’s Binding Operational Directive (BOD) 22-01. BOD 22-01, titled "Reducing the Significant Risk of Known Exploited Vulnerabilities," was implemented to help reduce the risk of cyberattacks on federal networks. The directive outlines the creation of the KEV Catalog, which serves as a living list of known Common Vulnerabilities and Exposures (CVEs) that pose a significant threat to the security of U.S. federal systems. FCEB agencies are mandated to remediate vulnerabilities listed in the catalog by their respective due dates, thus strengthening the cybersecurity posture of federal networks. While BOD 22-01 directly applies only to FCEB agencies, CISA strongly encourages all organizations, including those in the private sector, to adopt similar remediation practices. Impact on Vulnerability Management CISA's addition of CVE-2024-9537 to the KEV Catalog is a reminder of the evolving nature of cyber threats. The KEV Catalog is a dynamic tool that highlights vulnerabilities with active exploitation in the wild, which pose an imminent risk to network security. By keeping the catalog updated, CISA helps organizations stay ahead of emerging threats. The inclusion of the ScienceLogic SL1 vulnerability reinforces the importance of proactive patching and system updates. IT and security teams should remain vigilant and treat the catalog as a critical resource for prioritizing their vulnerability management efforts. Patching vulnerabilities listed in the KEV Catalog not only protects against known attack vectors but also reduces the likelihood of future incidents that could lead to data breaches, ransomware infections, and other types of cyberattacks. What Should Organizations Do? Organizations using ScienceLogic SL1 are advised to take the following steps: Apply Necessary Updates: Ensure that your systems are running a patched version of ScienceLogic SL1, specifically versions 12.1.3+, 12.2.3+, or 12.3+. For older versions, apply the available remediation packages for versions 10.1.x, 10.2.x, 11.1.x, 11.2.x, and 11.3.x. Review Vendor Guidelines: Follow the vendor’s instructions on how to remediate the vulnerability. ScienceLogic has provided updates to address the issue, and applying these patches is the most effective way to mitigate the risk. Assess the Risk: If the vulnerability cannot be mitigated, consider discontinuing the use of ScienceLogic SL1 until a solution is available. The potential consequences of an unmitigated vulnerability far outweigh the short-term inconvenience of discontinuing a product. Prioritize Vulnerabilities: Use CISA’s KEV Catalog as a guide to prioritize which vulnerabilities to address first in your systems. The catalog includes vulnerabilities known to be actively exploited, which means that they pose a direct and immediate threat to your network. Adopt a Broader Vulnerability Management Program: Implement a comprehensive vulnerability management strategy that includes regular system updates, patch management, and continuous monitoring. Staying proactive in identifying and addressing vulnerabilities can drastically reduce the attack surface and help prevent future incidents. The Broader Implications of BOD 22-01 BOD 22-01 is part of a broader push by CISA to enhance the resilience of U.S. federal networks and infrastructure. The directive reflects the increasing focus on risk-based vulnerability management, a critical aspect of modern cybersecurity. By mandating timely remediation of high-risk vulnerabilities, CISA is helping to create a standardized approach to vulnerability management across federal agencies. However, the impact of BOD 22-01 extends beyond the federal level. Private-sector organizations and other entities are encouraged to follow similar practices, as cybercriminals do not discriminate between targets. The same vulnerabilities exploited in federal systems can just as easily be used to target businesses, healthcare institutions, educational organizations, and critical infrastructure. Organizations, regardless of size or sector, should remain proactive in addressing vulnerabilities, especially those with evidence of active exploitation. Timely action can be the difference between a secure system and a costly cyberattack.

image for CFPB Finalizes Data ...

 Governance

Regulators are betting big on data rights for reshaping financial services, starting with new rules aimed at giving consumers greater control over their financial data. The Consumer Financial Protection Bureau (CFPB) has finalized the Personal Financial Data Rights Rule, a regulation aimed at empowering consumers to   show more ...  

control their financial information, fueling competition among financial institutions, and protecting personal privacy. The new rule seeks to address longstanding issues within the financial industry, offering more transparency and security for individuals’ data. Empowering Consumers With Data Control The CFPB rule will compel financial institutions, including banks, credit card companies, and payment processors to unlock consumers' financial data, allowing individuals to transfer their information to other providers freely and securely. This shift aims to give consumers the freedom to move between service providers with ease, encouraging competition and improving customer service. It also offers a solution for those stuck with subpar financial products. The ability to transfer data will empower consumers to shop for better financial products, compare rates, and make more informed decisions. CFPB Director Rohit Chopra has emphasized that this rule will help lower prices on loans and other financial products by giving people the tools to leave providers that offer poor service. "Too many Americans are stuck in financial products with lousy rates and service," Chopra said. “This action puts consumers in the driver’s seat.” Privacy Protections for the Digital Age At the heart of this regulation are strengthened privacy protections designed to prevent the misuse of consumer data. Financial institutions will only be allowed to use personal financial data for the purposes requested by the consumer. Third-party companies, such as fintech firms, will no longer be able to exploit consumer data for unrelated purposes or hidden business agendas. One of the practices the rule directly addresses is "screen scraping," where third-party applications gain access to consumer accounts by using their login credentials. This practice poses significant risks, including data breaches and the sharing of inaccurate or unauthorized information. Under the new rule, financial institutions must provide data access through more secure methods, reducing reliance on this outdated practice. Banning 'Bait-and-Switch' Tactics The CFPB has also moved to prohibit what it calls "bait-and-switch" data harvesting. In the past, third-party firms could gather and use consumer data for reasons beyond the original service requested. Now, these companies are restricted from collecting or retaining any data unrelated to the specific product or service the consumer is using. The rule ensures that all data usage is aligned with consumer intent, helping to prevent exploitation by financial companies. In line with these restrictions, the rule gives consumers the right to revoke access to their data at any time. Once revoked, companies must immediately cease using the data and delete it, unless the consumer gives explicit consent to extend access. Moreover, unless renewed, data access automatically expires after one year. A Gradual Rollout With Major Implications The CFPB has laid out a phased timeline for compliance. Large financial institutions will be required to adhere to the new rule by April 2026, while smaller firms will have until April 2030. This staggered approach gives smaller entities more time to adapt but ensures that the rule's benefits reach the market as soon as possible. The regulation's scope is also wide-reaching, covering data related to bank accounts, credit cards, mobile wallets, and payment apps. Consumers will be able to access information such as transaction details, account balances, and payment history, allowing for easier comparison between service providers. Paving the Way for Open Banking The CFPB’s Personal Financial Data Rights Rule is a significant step toward establishing an "open banking" system in the United States. Open banking allows consumers to share their financial data across different platforms, providing them with greater flexibility and control. In practice, this would mean a consumer could manage multiple bank accounts, payment apps, or investment services from a single interface, giving them more transparency and choice. By giving consumers the right to share their financial data securely, the rule could unlock innovation within the financial sector, encouraging the development of new financial products and services that better meet the needs of today’s digital consumers. This framework will help the U.S. move toward a competitive, secure, and reliable open banking ecosystem similar to systems already in place in Europe. Industry Response and Impact While the CFPB has positioned the new rule as a win for consumers, the financial industry faces significant operational changes. Banks and fintech companies will need to invest in infrastructure to ensure compliance with the new data-sharing standards. This includes updating security protocols to prevent unauthorized data access and ensuring that consumer data is not misused. The rule’s impact could be far-reaching, affecting how financial products are priced and delivered. By giving consumers more power over their data, the regulation will likely pressure financial institutions to improve their offerings. Institutions that fail to adapt risk losing customers to more agile competitors who can offer better terms and services. The rule may also encourage financial providers to innovate in areas such as "pay-by-bank" options, which allow consumers to make payments directly from their bank accounts without relying on traditional credit card networks. Such innovations could lead to increased competition in payment markets, a sector historically dominated by a few key players. Strengthening Consumer Protections Finally, the rule introduces critical consumer protections, ensuring that personal financial data is only used for the intended purpose. It also mandates that consumers have an easy, clear process for revoking data access when they no longer wish to use a particular service. This element of the regulation is designed to curb the emergence of "dark patterns"—manipulative design tactics used by companies to prevent consumers from opting out of services or deleting their data. The CFPB’s new rule marks a pivotal moment in the evolution of financial regulation in the digital age. As the financial industry grapples with increasing consumer demands for data privacy and security, this rule will serve as a cornerstone for building a more open, competitive, and consumer-friendly financial ecosystem.

image for Effective AI adoptio ...

 Business

There are various ways artificial intelligence can be used in cybersecurity – from threat detection to simplifying incident reporting. However, the most effective uses are those that significantly reduce human workload without requiring large, ongoing investments to keep the machine learning models up to date and   show more ...  

performing well. In a previous article, we discussed how difficult and labor-intensive it is to maintain a balance between reliable cyberthreat detection and low false-positive rates in AI models. Thus, the question posed in the title is easy to answer: AI cant replace experts – but it can alleviate some of their workload by handling simple cases. Moreover, as the model learns over time, the range of these simple cases will expand. To really save the time of cybersecurity staff, we need to identify areas of work where changes occur more slowly than in direct cyberthreat detection. One promising candidate for automation is the processing of suspicious events (triage). The detection funnel To gather enough data to detect complex threats, the SOC of a modern organization has to collect millions of events daily from sensors across the network and connected devices. After grouping and initial filtering with SIEM algorithms, these events are distilled into thousands of alerts about potentially malicious activity. These alerts must usually be investigated by humans, but only a small fraction of these messages contain real threats. According to Kaspersky MDRs data for 2023, our clients infrastructures generated billions of events daily, resulting in 431,512 alerts about potentially malicious activity identified throughout the year; however, only 32,294 alerts were linked to genuine security incidents. This means that machines effectively sifted through hundreds of billions of events, while only sending a tiny percentage to humans for review. However, 30 to 70% of these events are immediately flagged by analysts as false positives, and around 13% are confirmed as incidents after a deeper investigation. Role of Auto-Analyst in the SOC The Kaspersky MDR team has developed an Auto-Analyst for the initial filtering of alerts. This supervised machine-learning system trains on alerts from the SIEM system, combined with the SOC verdict on each alert. The goal of the training is for the AI to confidently identify false positives generated by legitimate network activity. Because this area is less dynamic than threat detection, its easier to apply machine learning to. Machine learning here is based on CatBoost – a popular gradient-boosting library. The trained Auto-Analyst filters alerts and only forwards for human review the ones with a probability of a real incident above a specified threshold, determined by the acceptable error rate. As a result, around 30% of alerts are handled by the Auto-Analyst, freeing up the SOC team for more complex tasks. Practical nuances of the Auto-Analysts work Processes are paramount in SOC operations, and new technologies require adapting or building new processes around them. For AI systems, these processes include: Controlling training data. To ensure that the AI learns from the correct data, the training set needs to be thoroughly reviewed in advance to confirm that the analysts verdicts therein were accurate. Prioritization of incoming data. Every alert contains numerous information fields, but their importance varies. Part of the training involves assigning weights to these different fields. The feature vector used by the machine-learning model is based on fields selected by experts from SIEM alerts, and the field list depends on the type of specific alert. Note that the model can perform such prioritization on its own, but the results should be supervised. Selective review of results. The SOC team double-checks approximately 10% of the Auto-Analysts verdicts to ensure the AI isnt making errors (especially false negatives). If such errors occur and exceed a certain threshold (for example, more than 2% of the verdicts), retraining the AI is necessary. Incidentally, selective reviews are also conducted for the human analysts verdicts in the SOC — because people often make mistakes as well. Interpreting the results. The ML model should be equipped with interpretation tools so we can understand its verdict rationale and the influencing factors. This helps adjust the training dataset and input weights. For example, one case required adjustment when the AI started flagging network communications as suspicious without considering the Source IP address field. Analyzing the AIs work using this tool is an essential part of the selective review. Excluding AI analysis for certain alerts. Some detection rules are so critical that even a small chance of the AI filtering them out is unacceptable. In such cases, there should be a flag in the rule to exclude from AI processing, and a process for prioritizing these alerts. Optimizing filtering. Another regular process necessary for the effective work of the AI analyst in the SOC is identifying similar alerts. If the AI analyst rejects dozens of similar alerts, there should be a process to upgrade these verdicts to filtering rules within the SIEM. Ideally, the AI analyst itself generates a request to create a filtering rule, which is then reviewed and approved by a responsible SOC analyst. To effectively counter cyberthreats, organizations need to acquire deeper expertise in various technological areas, including storing and analyzing vast amounts of data, and now machine learning, too. For those who want to quickly compensate for a shortage of skilled personnel or other resources, we recommend getting this expertise in a ready-made form with the Kaspersky Managed Detection and Response service. This service provides continuous threat hunting, detection and response for your organization.

 Feed

Debian Linux Security Advisory 5795-1 - Cedric Krier discovered that python-sql, a library to write SQL queries in a pythonic way, performed insufficient sanitizing which could result in SQL injection.

 Feed

Debian Linux Security Advisory 5794-1 - Several vulnerabilities have been discovered in the OpenJDK Java runtime, which may result in denial of service or information disclosure.

 Feed

This white paper, titled "DTLS 'ClientHello' Race Conditions in WebRTC Implementations," details a security vulnerability affecting multiple WebRTC implementations. The research uncovers a security flaw where certain implementations fail to properly verify the origin of DTLS "ClientHello"   show more ...  

messages in WebRTC sessions, potentially leading to denial of service attacks. The paper includes methodology, affected systems, and recommendations for mitigation.

 Feed

Ubuntu Security Notice 7080-1 - Toshifumi Sakaguchi discovered that Unbound incorrectly handled name compression for large RRsets, which could lead to excessive CPU usage. An attacker could potentially use this issue to cause a denial of service by sending specially crafted DNS responses.

 Feed

Ubuntu Security Notice 7078-1 - Atte Kettunen discovered that Firefox did not properly validate before inserting ranges into the selection node cache. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.

 Feed

Ubuntu Security Notice 7062-2 - USN-7062-1 fixed vulnerabilities in libgsf. This update provides the corresponding updates for Ubuntu 24.10. It was discovered that libgsf incorrectly handled certain Compound Document Binary files. If a user or automated system were tricked into opening a specially crafted file, a remote attacker could possibly use this issue to execute arbitrary code.

 Feed

An error path in usbdev_mmap() (where remap_pfn_range() fails midway through) frees pages before the PFN mapping pointing to those pages is cleaned up, making physical page use-after-free possible. Some other drivers look like they might have similar issues.

 Feed

Ubuntu Security Notice 7042-3 - USN-7042-2 released an improved fix for cups-browsed. This update provides the corresponding update for Ubuntu 24.10. Simone Margaritelli discovered that cups-browsed could be used to create arbitrary printers from outside the local network. In combination with issues in other printing   show more ...  

components, a remote attacker could possibly use this issue to connect to a system, created manipulated PPD files, and execute arbitrary code when a printer is used. This update disables support for the legacy CUPS printer discovery protocol.

 Feed

Russian-speaking users have become the target of a new phishing campaign that leverages an open-source phishing toolkit called Gophish to deliver DarkCrystal RAT (aka DCRat) and a previously undocumented remote access trojan dubbed PowerRAT. "The campaign involves modular infection chains that are either Maldoc or HTML-based infections and require the victim's intervention to trigger the

 Feed

Details have emerged about a now-patched security flaw in Styra's Open Policy Agent (OPA) that, if successfully exploited, could have led to leakage of New Technology LAN Manager (NTLM) hashes. "The vulnerability could have allowed an attacker to leak the NTLM credentials of the OPA server's local user account to a remote server, potentially allowing the attacker to relay the authentication or

 Feed

Bad actors have been observed targeting Docker remote API servers to deploy the SRBMiner crypto miner on compromised instances, according to new findings from Trend Micro. "In this attack, the threat actor used the gRPC protocol over h2c to evade security solutions and execute their crypto mining operations on the Docker host," researchers Abdelrahman Esmail and Sunil Bharti said in a technical

 Feed

Service accounts are vital in any enterprise, running automated processes like managing applications or scripts. However, without proper monitoring, they can pose a significant security risk due to their elevated privileges. This guide will walk you through how to locate and secure these accounts within Active Directory (AD), and explore how Silverfort’s solutions can help enhance your

 Feed

Two malware families that suffered setbacks in the aftermath of a coordinated law enforcement operation called Endgame have resurfaced as part of new phishing campaigns. Bumblebee and Latrodectus, which are both malware loaders, are designed to steal personal data, along with downloading and executing additional payloads onto compromised hosts. Tracked under the names BlackWidow, IceNova, Lotus,

 Feed

Cybersecurity researchers have discovered a number of suspicious packages published to the npm registry that are designed to harvest Ethereum private keys and gain remote access to the machine via the secure shell (SSH) protocol. The packages attempt to "gain SSH access to the victim's machine by writing the attacker’s SSH public key in the root user’s authorized_keys file," software supply

 Feed

VMware has released software updates to address an already patched security flaw in vCenter Server that could pave the way for remote code execution. The vulnerability, tracked as CVE-2024-38812 (CVSS score: 9.8), concerns a case of heap-overflow vulnerability in the implementation of the DCE/RPC protocol. "A malicious actor with network access to vCenter Server may trigger this vulnerability by

 Feed

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a critical security flaw impacting ScienceLogic SL1 to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation as a zero-day. The vulnerability in question, tracked as CVE-2024-9537 (CVSS v4 score: 9.3), refers to a bug involving an unspecified third-party component that could

 AI

In episode 21 of "The AI Fix"", Mark and Graham comfort themselves with a limbless AI pet as they learn about a terrifying robot dog with a flamethrower, fission-powered data centres, AI suicide pods, and a multi-limbed robot with a passion for classical music. Graham finds out what happens if you   show more ...  

sellotape an Alexa to a Chihuahua, and Mark asks AI Trump and AI Harris how many Rs there are in "strawberry". All this and much more is discussed in the latest edition of “The AI Fix” podcast by Graham Cluley and Mark Stockley.

2024-10
Aggregator history
Tuesday, October 22
TUE
WED
THU
FRI
SAT
SUN
MON
OctoberNovemberDecember