Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Is Your QNAP NAS Sec ...

 Firewall Daily

QNAP NAS systems, widely regarded for their reliability in personal and enterprise data storage, have recently come under scrutiny due to multiple critical vulnerabilities. These QNAP NAS vulnerabilities, identified in QNAP’s operating systems, could potentially allow attackers to compromise the systems, putting   show more ...  

valuable data at risk. With over 6 million users relying on QNAP NAS devices, it’s essential to understand the nature of these threats and how to protect your systems from exploitation.  Recent security assessments have uncovered a range of vulnerabilities in QNAP NAS systems, which could expose users to remote code execution, denial of service (DoS), data manipulation, and more. These security flaws could compromise the integrity of the systems and make sensitive information accessible to unauthorized individuals.   Key QNAP NAS Vulnerabilities Identified  The vulnerabilities identified in QNAP NAS systems present several online risks, especially in environments where sensitive data is stored. One of the key threats is remote code execution, where attackers could execute arbitrary code remotely, potentially gaining control of the device and accessing the stored data.   Another risk is denial of service (DoS), in which attackers could overload the system, making it unavailable to legitimate users and disrupting business operations. Data manipulation is also a concern, as attackers could alter or delete critical data stored on the NAS system, leading to data loss and integrity issues.   Additionally, information disclosure is a serious threat, as sensitive data such as backup files, financial records, and other confidential information could be exposed to unauthorized individuals. Finally, vulnerabilities in authentication mechanisms may allow attackers to bypass security controls, granting them unauthorized access to restricted parts of the system.  The vulnerabilities are found in specific versions of QNAP's operating systems, including both QTS and QuTS hero. The affected versions of QTS are 5.1.x and 5.2.x, while the vulnerable versions of QuTS hero are h5.1.x and h5.2.x. These operating systems power QNAP NAS devices, and any vulnerabilities within them could potentially expose millions of devices to attacks.  Vulnerabilities in QNAP NAS: CVE Breakdown  The security flaws affecting QNAP NAS systems are tracked under several Common Vulnerabilities and Exposures (CVE) identifiers. Below are the critical vulnerabilities in QNAP NAS:  CVE-2024-48859: Improper Authentication, potentially allowing remote attackers to compromise the system’s security.  CVE-2024-48865: Improper Certificate Validation, enabling attackers with local network access to bypass security controls.  CVE-2024-48866: Improper URL Encoding Handling, leading to unexpected system states.  CVE-2024-48867, 48868: CRLF Injection, allowing attackers to manipulate application data.  CVE-2024-50393: Command Injection, enabling remote attackers to execute arbitrary commands on the system.  CVE-2024-50402, 50403: Externally-Controlled Format String, giving attackers administrator privileges to access or modify system memory.  These vulnerabilities reveal weaknesses in system components, including input validation, authentication processes, and security controls. Mitigation and Fixes for QNAP NAS Vulnerabilities  To address these critical vulnerabilities, QNAP has released patches for the affected operating systems. Users are strongly encouraged to update their QNAP NAS devices to the following fixed versions:  QTS 5.1.x: Update to QTS 5.1.9.2954 (released November 20, 2024)  QTS 5.2.x: Update to QTS 5.2.2.2950 (released November 14, 2024)  QuTS hero h5.1.x: Update to QuTS hero h5.1.9.2954 (released November 20, 2024)  QuTS hero h5.2.x: Update to QuTS hero h5.2.2.2952 (released November 16, 2024)  How to Update Your QNAP NAS  Updating your QNAP NAS system is a straightforward process. Here’s how to ensure your system is secured:  Login: Access QTS or QuTS hero as an administrator.  Navigate to Firmware Update: Go to Control Panel > System > Firmware Update.  Check for Updates: Under the Live Update tab, click "Check for Update."  Automatic Update: The system will download and install the latest update automatically.  Manual Update: Alternatively, visit the QNAP Download Center to manually download the firmware and install it.  Conclusion  QNAP NAS devices store sensitive data like financial records and backups, making them prime targets for attacks. Exploiting vulnerabilities in these systems could lead to financial losses, data breaches, and reputational damage. To secure QNAP NAS systems, enable two-factor authentication, limit external access to trusted IPs, regularly back up data, monitor for anomalies, and use strong passwords.  

image for Europol and Law Enfo ...

 Cyber News

Belgian and Dutch authorities, with the support of Europol and Eurojust, have successfully dismantled a phone phishing gang responsible for large-scale fraud and exploitation across at least 10 European countries. The coordinated effort led to the arrest of eight suspects and the seizure of luxury items, cash, and   show more ...  

electronic devices. Details of the Operation The international operation culminated in an action day that saw law enforcement agencies carry out 17 searches across Belgium and the Netherlands. The key results included: 8 suspects arrested (4 in the Netherlands, 4 in Belgium). Seizure of electronic devices, luxury watches, and jewelry. Recovery of large amounts of cash and a firearm. The gang primarily targeted elderly victims, using advanced techniques to extract financial information. They impersonated police officers or bank representatives, contacting victims by phone or even visiting their homes under false pretenses. Once they gained access to victims’ funds, the stolen money was spent on luxury goods and lavish lifestyles, including expensive parties and designer clothing. Authorities estimate the gang caused millions of euros in economic damages, exploiting victims across multiple European nations. Investigations Began in 2022 The investigation into the gang’s activities began in 2022, initiated by Belgian authorities with Europol's support. As the primary suspects were identified as Dutch citizens, the Netherlands launched its own investigation in 2023. To coordinate efforts, an operational task force was formed, involving multiple law enforcement and judicial bodies from both countries. Europol facilitated the operation by bringing all stakeholders together, ensuring efficient communication, and providing analytical and financial expertise. Eurojust, on the other hand, organized eight coordination meetings to enhance judicial cooperation between the nations involved. Europol’s Role in Dismantling the Gang Europol played a critical role throughout the operation, offering logistical and technical support to streamline the investigation. The agency’s experts supported authorities in Belgium and the Netherlands with real-time intelligence sharing, forensic analysis, and financial tracking of the suspects’ criminal proceeds. Eurojust’s involvement ensured judicial support at every stage, allowing for seamless collaboration between investigators and prosecutors. Warnings for Citizens Belgian and Dutch authorities have issued important safety guidelines to protect citizens from falling victim to similar scams: Do not trust messages claiming to be from banks or phone service providers asking for urgent account updates or unlocking services. Be wary of sellers on second-hand platforms requesting a symbolic payment, such as €0.001. Always verify that URLs start with “https://” to ensure a secure connection. Steps to Take After Clicking a Suspicious Link Authorities have also shared tips to safeguard your information if you suspect a phishing attempt: Use reliable antivirus software on all devices. Keep your operating systems and security software updated. Set unique passwords for all online accounts. Avoid clicking on unfamiliar links or attachments. If in doubt, do not respond or share any financial information. A Broader Pattern of Cybercrime This operation highlights a growing concern about the rise in cybercrime targeting vulnerable populations, such as the elderly. Europol’s success in this case follows another significant operation earlier this month when French and Dutch authorities, with Europol's support, dismantled the encrypted messaging platform MATRIX. The MATRIX platform had been facilitating serious criminal activities, including drug trafficking, arms smuggling, and money laundering. Authorities seized over 40 servers and intercepted millions of criminal communications. This crackdown illustrates the increasing cybercriminal networks and the urgent need for international cooperation to combat them. Agencies and Authorities Involved The success of this joint operation was made possible through the collaboration of several agencies and authorities, including: Belgium: Federal Public Prosecutor’s Office (Federaal Parket). Investigating Judge of the Court of First Instance in Antwerp. Federal Judicial Police East-Flanders. The Netherlands: Rotterdam Public Prosecutor’s Office. National Police (Rotterdam Unit). Supporting Agencies: Europol. Eurojust. Global Implications The dismantling of the phone phishing gang and MATRIX platform highlights the growing challenges in tackling cybercrime. Criminal networks are becoming more advanced, exploiting technology to defraud individuals and enable cross-border crimes. This case highlights the critical role of international collaboration and cutting-edge investigative techniques in combating cybercriminal activities. Law enforcement agencies continue to emphasize the importance of public vigilance, urging citizens to remain cautious and informed about the latest scams. As the investigation into the phishing gang progresses, authorities aim to recover stolen funds and bring justice to the victims. Meanwhile, the operation serves as a reminder of the importance of strong cybersecurity practices and the need for continued investment in combating organized crime.

image for CVE-2024-11205: WPFo ...

 Firewall Daily

A critical vulnerability, identified as CVE-2024-11205, was discovered in the WPForms plugin, a popular WordPress form builder used by over 6 million active websites. This vulnerability, which has been assigned a high CVSS score of 8.5, targets businesses relying on WPForms for payment processing and subscription   show more ...  

management, especially those using Stripe integration.  The flaw allows authenticated attackers to exploit the vulnerability to execute unauthorized refunds and cancellations of Stripe subscriptions, potentially leading to financial loss and operational disruptions.  Understanding the WPForms Plugin Vulnerability (CVE-2024-11205)  WPForms is one of the most widely used WordPress plugins for creating various types of forms, including contact, feedback, and payment forms. The plugin is particularly popular for its intuitive drag-and-drop interface, which makes it easy for users to design and manage forms.  The vulnerability in WPForms stems from a flaw in the plugin’s core functionality, specifically within the SingleActionsHandler class, which manages Stripe payment actions. The vulnerable functions, ajax_single_payment_refund() and ajax_single_payment_cancel(), allow attackers with subscriber-level or higher privileges to execute actions that would typically be restricted to administrators.  These functions rely on the wpforms_is_admin_ajax() function to verify whether an AJAX request is coming from an admin interface. However, the problem arises because this function lacks proper capability checks, making it susceptible to exploitation. Although these functions are nonce-protected, authenticated attackers can still bypass these protections by obtaining the nonce and leveraging the vulnerability to perform unauthorized actions.  The Impact of the WPForms Vulnerability  The impact of this WPForms vulnerability is severe, particularly for businesses that use WPForms to manage Stripe payments. Attackers who gain access to an account with at least subscriber-level privileges can refund Stripe payments or cancel active Stripe subscriptions. This can lead to:  Attackers can initiate unauthorized refunds for legitimate payments, potentially causing financial harm to businesses.  By canceling active subscriptions, attackers can interfere with ongoing services, damaging customer relationships.  Once unauthorized refunds or cancellations occur, businesses must invest time and resources to undo the damage, adding to operational costs.  The vulnerability was present in WPForms versions 1.8.4 through 1.9.2.1, which makes a substantial number of websites vulnerable. Given the plugin’s widespread use, the flaw affects millions of WordPress sites that rely on WPForms to handle their payment and subscription services.  Technical Details of CVE-2024-11205  The vulnerability is rooted in the absence of capability checks for the wpforms_is_admin_ajax() function. This function is used to verify whether an AJAX request is coming from the WordPress admin interface. However, it does not perform the necessary authorization checks, leaving the function exposed to abuse by attackers with lower-level privileges.  Here’s a breakdown of the issue:  Affected Functions: ajax_single_payment_refund() and ajax_single_payment_cancel() handle the Stripe payment actions, such as refunds and subscription cancellations. These actions are normally restricted to administrators.  Lack of Authorization Checks: The wpforms_is_admin_ajax() function does not perform proper authorization checks. Attackers with subscriber-level access can exploit this flaw to invoke the AJAX actions and execute unauthorized payment actions.  Nonce Protection: While the vulnerable functions are protected by nonce verification, attackers can bypass this by retrieving the nonce, making it possible for them to trigger the refund or subscription cancellation actions.  Mitigation and Updates  To mitigate the risks associated with CVE-2024-11205, users are strongly urged to update their WPForms plugin to the latest version, 1.9.2.2. The patched version addresses the missing authorization checks and ensures that only authorized users can trigger payment and subscription actions within the plugin.  Ensure that your WordPress site is running the latest version of WPForms (1.9.2.2 or newer).  Consider reviewing user roles and permissions within your WordPress site to ensure that only trusted individuals have subscriber-level access or higher.  Keep an eye on any unauthorized refunds or cancellations that might occur until the patch has been applied.  Response to the WPForms Vulnerability  The CVE-2024-11205 vulnerability in the WPForms plugin highlights the critical importance of addressing security flaws in widely-used WordPress plugins. With over 6 million active installations, this vulnerability had the potential to cause financial loss and disrupt business operations. Wordfence’s response, in collaboration with the WPForms development team, ensured timely protection for its users, including both premium and free users, through effective security measures. 

image for Medical Device Manuf ...

 Cyber News

Artivion, a leading medical device manufacturer specializing in heart surgery products, disclosed a ransomware attack in a recent 8-K filing with the U.S. Securities and Exchange Commission (SEC). The Artivion cyberattack, which occurred on November 21, 2024, disrupted the company’s operations, forcing it to take   show more ...  

several systems offline while it worked to contain and investigate the incident. Artivion Cyberattack Details The SEC filing outlined the steps Artivion took in response to the cybersecurity breach. "Artivion, Inc. ('Artivion' or the 'Company') identified and began taking measures to address a cybersecurity incident on November 21, 2024," the filing read. The company’s immediate response included taking certain systems offline, initiating an investigation, and engaging external experts in legal, cybersecurity, and forensic analysis. The attackers encrypted files and exfiltrated data from compromised systems, although Artivion has refrained from explicitly labeling the incident as a ransomware attack. However, the description of file encryption and data theft aligns with the characteristics of ransomware operations. Operational and Financial Impact After Artivion Cyberattack Despite the disruption, Artivion has continued providing products and services to its customers. The company admitted that the cyberattack on Artivion caused temporary interruptions to order and shipping processes, along with disruptions to some corporate operations. Artivion has largely mitigated these issues but continues to work on securely restoring its systems. The Atlanta-based company, which employs over 1,250 people and operates manufacturing facilities in Atlanta, Georgia; Austin, Texas; and Hechingen, Germany, stated that the attack has not had a material impact on its overall financial condition or operational results. However, Artivion anticipates incurring additional costs related to the incident, some of which may not be covered by insurance. "While we believe that the incident has not had a material impact on the company’s financial condition or results of operations, we cannot provide assurances that the incident will not be determined to have a material impact in the future," the SEC filing cautioned. Ransomware Threats in the Healthcare Sector Artivion is the latest in a series of ransomware attacks targeting the U.S. healthcare sector, highlighting organizations' vulnerability in this critical industry. In October, Boston Children’s Health Physicians (BCHP), a multi-specialty healthcare group serving Connecticut and New York, suffered a significant data breach after a ransomware attack. The breach, attributed to the BianLian ransomware group, compromised sensitive information belonging to employees, patients, and guarantors. BCHP acted swiftly by implementing its incident response protocols, but the attack revealed ongoing risks faced by healthcare providers reliant on third-party IT vendors. Broader Implications for Healthcare Cybersecurity The ransomware attack on Artivion highlights the growing threat to healthcare organizations and their supply chains. Medical device manufacturers like Artivion play a vital role in patient care, and any disruptions to their operations can have far-reaching consequences. Cyberattacks on healthcare organizations often involve the theft of sensitive personal and medical data, which can be used for extortion or sold on the dark web. These incidents also bring operational challenges, including system downtime and delays in critical services. Artivion’s response, which included leveraging external expertise and implementing containment measures, reflects the importance of having a strong cybersecurity incident response plan. However, the company's acknowledgment of additional, uncovered costs highlights the financial burdens such incidents impose, even on organizations with cyber insurance coverage. Industry Response and Next Steps In light of the growing threat landscape, healthcare organizations and their partners must prioritize cybersecurity. This includes: Regular Risk Assessments: Identifying vulnerabilities in IT infrastructure and supply chains to mitigate risks proactively. Employee Training: Ensuring employees recognize phishing attempts and other attack vectors commonly used by ransomware operators. Incident Response Planning: Developing and testing comprehensive response protocols to minimize downtime and financial losses in the event of a breach. Collaboration with Authorities: Sharing threat intelligence with law enforcement and cybersecurity agencies to track and disrupt ransomware groups. While Artivion has stated that the cyberattack has not had a significant financial impact, the situation remains fluid. Companies in the healthcare and medical device sectors must remain vigilant, investing in advanced cybersecurity measures and fostering a culture of awareness to mitigate the risks posed by evolving cyber threats.

image for Nearest Neighbor: re ...

 Business

From the perspective of information security, wireless networks are typically perceived as something that can be accessed only locally — to connect to them, an attacker needs to be physically close to the access point. This significantly limits their use in attacks on organizations, and so they are perceived as   show more ...  

relatively risk-free. Its easy to think that some random hacker on the internet could never simply connect to a corporate Wi-Fi network. However, the newly emerged Nearest Neighbor attack tactic demonstrates that this perception is not entirely accurate. Even a well-protected organizations wireless network can become a convenient entry point for remote attackers if they first compromise another, more vulnerable company located in the same building or a neighboring one. Lets delve deeper into how this works and how to protect yourself against such attacks. A remote attack on an organizations wireless network Lets imagine a group of attackers planning to remotely hack into an organization. They gather information about the given company, investigate its external perimeter, and perhaps even find employee credentials in databases of leaked passwords. But they find no exploitable vulnerabilities. Moreover, they discover that all of the companys external services are protected by two-factor authentication, so passwords alone arent sufficient for access. One potential penetration method could be the corporate Wi-Fi network, which they could attempt to access using those same employee credentials. This applies especially if the organization has a guest Wi-Fi network thats insufficiently isolated from the main network — such networks rarely use two-factor authentication. However, theres a problem: the attackers are on the other side of the globe and cant physically connect to the office Wi-Fi. This is where the Nearest Neighbor tactic comes into play. If the attackers conduct additional reconnaissance, theyll most likely discover numerous other organizations whose offices are within the Wi-Fi signal range of the target company. And its possible that some of those neighboring organizations are significantly more vulnerable than the attackers initial target. This may simply be because these organizations believe their activities are less interesting to cyberattack operators — leading to less stringent security measures. For example, they might not use two-factor authentication for their external resources. Or they may fail to update their software promptly — leaving easily exploitable vulnerabilities exposed. One way or another, its easier for the attackers to gain access to one of these neighboring organizations networks. Next, they need to find within the neighbors infrastructure a device connected to the wired network and equipped with a wireless module, and compromise it. By scanning the Wi-Fi environment through such a device, the attackers can locate the SSID of the target companys network. Using the compromised neighboring device as a bridge, the attackers can then connect to the corporate Wi-Fi network of their actual target. In this way, they get inside the perimeter of the target organization. Having achieved this initial objective, the attackers can proceed with their main goals — stealing information, encrypting data, monitoring employee activity, and more. How to protect yourself against the Nearest Neighbor attack Its worth noting that this tactic has already been used by at least one APT group, so this isnt just a theoretical threat. Organizations that could be targeted by such attacks should start treating the security of their wireless local area networks as seriously as the security of their internet-connected resources. To protect against the Nearest Neighbor attack, we recommend the following: Ensure that the guest Wi-Fi network is truly isolated from the main network. Strengthen the security of corporate Wi-Fi access — for instance, by using two-factor authentication with one-time codes or certificates. Enable two-factor authentication — not only for external resources but also for internal ones, and, in general, adopt the Zero Trust security model. Use an advanced threat detection and prevention system, such as Kaspersky Next XDR Expert. If you lack highly qualified in-house cybersecurity specialists, make use of external services such as Managed Detection and Response and Incident Response.

 Cybercrime

The vulnerability — CVE-2024-50623 — was recently patched by software developer Cleo and affects the company’s LexiCom, VLTransfer and Harmony products. However, researchers at cybersecurity firm Huntress say the patch “does not mitigate the software flaw."

 Feed

Cyber attackers never stop inventing new ways to compromise their targets. That's why organizations must stay updated on the latest threats.  Here's a quick rundown of the current malware and phishing attacks you need to know about to safeguard your infrastructure before they reach you. Zero-day Attack: Corrupted Malicious Files Evade Detection by Most Security Systems  The analyst

 Feed

The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of a new set of cyber attacks that it said were aimed at defense companies in the country as well as its security and defense forces. The phishing attacks have been attributed to a Russia-linked threat actor called UAC-0185 (aka UNC4221), which has been active since at least 2022. "The phishing emails mimicked official messages

 Feed

Cybersecurity researchers have shed light on a sophisticated mobile phishing (aka mishing) campaign that's designed to distribute an updated version of the Antidot banking trojan. "The attackers presented themselves as recruiters, luring unsuspecting victims with job offers," Zimperium zLabs Vishnu Pratapagiri researcher said in a new report. "As part of their fraudulent hiring process, the

 Feed

In today’s rapidly evolving threat landscape, safeguarding your organization against cyberattacks is more critical than ever. Traditional penetration testing (pentesting), while effective, often falls short due to its high costs, resource requirements, and infrequent implementation. Automated internal and external network pentesting is a game-changing solution, empowering organizations to stay

 Feed

Belgian and Dutch authorities have arrested eight suspects in connection with a "phone phishing" gang that primarily operated out of the Netherlands with an aim to steal victims' financial data and funds. As part of the international operation, law enforcement agencies carried out 17 searches in different locations in Belgium and the Netherlands, Europol said. In addition, large amounts of cash,

 Feed

A suspected China-nexus cyber espionage group has been attributed to an attacks targeting large business-to-business IT service providers in Southern Europe as part of a campaign codenamed Operation Digital Eye. The intrusions took place from late June to mid-July 2024, cybersecurity companies SentinelOne SentinelLabs and Tinexta Cyber said in a joint report shared with The Hacker News, adding

 Feed

Users of Cleo-managed file transfer software are being urged to ensure that their instances are not exposed to the internet following reports of mass exploitation of a vulnerability affecting fully patched systems. Cybersecurity company Huntress said it discovered evidence of threat actors exploiting the issue en masse on December 3, 2024. The vulnerability, which impacts Cleo's LexiCom,

 Guest blog

The 3AM ransomware first emerged in late 2023. Like other ransomware, 3AM exfiltrates victims' data (demanding a ransom is paid) and encrypts the copies left behind. Here's what you need to know. Read more in my article on the Tripwire State of Security blog.

 AI

In episode 28 of The AI Fix, the new version of ChatGPT does a surprisingly good job of telling Mark how to defend himself from a flame thrower-wielding robot dog in his living room, Graham loses 30,000 robots on the head of a pin, our hosts meet a human washing machine from the fifties, and Dr Who finds a new way to   show more ...  

get worse. Graham wonders if teaching robot dogs to drop bombs is a good idea, and Mark meets ChatGPT's answer to Voldemort: David Mayer. All this and much more is discussed in the latest edition of "The AI Fix" podcast by Graham Cluley and Mark Stockley.

 0CISO2CISO

Source: cyble.com – Author: daksh sharma. Overview The Cyble Research & Intelligence Labs (CRIL) has released its Weekly Vulnerability Insights Report, highlighting a series of critical vulnerabilities reported between November 27, 2024, and December 3, 2024. This week’s findings focus on various   show more ...  

vulnerabilities that pose risks to organizations, ranging from open-source applications to widely used […] La entrada Cyble’s Weekly Vulnerability Report: Critical Flaws in Major Software Including Progress Software, QNAP, and 7-Zip – Source:cyble.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: A key element to comprehensive cybersecurity defense In the fast-evolving landscape of cybersecurity, the need for proactive measures has become more pressing than ever. When I first entered the cybersecurity field, the primary threats were largely opportunistic hackers   show more ...  

exploiting known vulnerabilities and multi-million-dollar ransoms were unheard of. Today, the stakes are […] La entrada Bug bounty programs: Why companies need them now more than ever – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: News 09 Dezember 20242 Minuten Daten- und InformationssicherheitDatenschutzverletzungenSicherheit IBM zufolge planen fast zwei Drittel der Unternehmen, die Kosten für Datenschutzverletzungen direkt an ihre Kunden weiterzugeben – Tendenz steigend. Immer mehr Unternehmen   show more ...  

bitten ihre Kunden zur Kasse, um Bußgelder von Datenschutzverletzungen zu begleichen. frantic00/shutterstock.com Zum Schutz vor den beständig zunehmenden Cyberattacken werden […] La entrada Kunden sollen für Unvermögen von Unternehmen blechen – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: Feature 09 Dec 20248 mins Generative AISecurity Operations CenterSecurity Practices Generative AI is showing growing utility for augmenting security ops, but studies suggest caution is still warranted, as cyber pros raise concerns about rapid adoption. Generative AI is being   show more ...  

embedded into security tools at a furious pace as CISOs adopt the […] La entrada Gen AI use cases rising rapidly for cybersecurity — but concerns remain – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: How-to 08 Dezember 20247 Minuten E-Mail-Sicherheit Password-Spraying-Attacken können zu kompromittierten E-Mail-Konten führen, wie ein Blick in die jüngere Vergangenheit eindrucksvoll belegt. So schützen Sie sich. Lesen Sie, wie Sie sich vor Password-Spraying-Angriffen   show more ...  

schützen. Markus Mainka | shutterstock.com Microsoft hat vor kurzem offengelegt, dass seine Systeme vom berüchtigten Bedrohungsakteur Midnight Blizzard (auch […] La entrada Password Spraying verhindern in 4 Schritten – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CSOonline

Source: www.csoonline.com – Author: News 08 Dezember 20245 Minuten DatenschutzverletzungenSicherheit Beide Wahlgänge im EU-Land Rumänien wurden von massiven Cyber-Eingriffen in Systeme und Social Media überschattet. Versucht Russland, einen prorussischen Rechtsextremen zum Präsidenten von Rumänien zu   show more ...  

machen? hapelinium/shutterstock.com Angesichts staatlich unterstützter und kontrollierter Hackergruppen ist es wenig überraschend, dass Wahlen digital beeinflusst werden. Dies scheint auch […] La entrada Haben die Russen die Wahl in Rumänien manipuliert? – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

Source: socprime.com – Author: Veronika Telychko Since russia launched its full-scale invasion of Ukraine, defense organizations have been heavily targeted by multiple hacking groups via the phishing attack vector. CERT-UA researchers recently shed light on the latest attacks by UAC-0185 (aka UNC4221) targeting   show more ...  

Ukrainian organizations within the defense-industrial sector. The new CERT-UA alert covers cyber […] La entrada UAC-0185 aka UNC4221 Attack Detection: Hackers Target the Ukrainian Defense Forces and Military-Industrial Complex – Source: socprime.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cloud Security

Source: securityboulevard.com – Author: Amy Cohn The Forgotten Keyholders: Understanding Non-human Identities in Cybersecurity Have you ever considered who holds the keys to your organization’s most sensitive data? Beyond the human factor in information gatekeeping, machine identities known as Non-Human   show more ...  

Identities (NHIs) play a significant role. These NHIs, armed with their encrypted secrets, serve as […] La entrada Empowering Teams with Secure Cloud Environments – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Amy Cohn Are You Maximizing Your Organization’s Cybersecurity? Cybersecurity is not only a means of information protection but also a valuable strategic asset that can drive business growth and stability. Central to achieving such a valuable level of security is   show more ...  

managing Non-Human Identities (NHIs) and their corresponding secrets—a technique known as […] La entrada How Secrets Security Boosts Business Value – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Amy Cohn How Does NHI Lifecycle Management Promote Innovation? In today’s rapidly evolving digital landscape, innovation is the silver bullet that empowers organizations to thrive amidst relentless competition. But, how does Non-Human Identity (NHI) lifecycle management   show more ...  

enable such innovation? NHIs, or machine identities, are critical actors in our increasingly interconnected cyber […] La entrada Leveraging NHI Lifecycle Management for Innovation – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Marc Handelman Home » Security Bloggers Network » DEF CON 32 – Compromising Electronic Logger & Creating Truck2Truck Worm Authors/Presenters: Jake Jepson, Rik Chatterjee Our sincere appreciation to DEF CON, and the Presenters/Authors for publishing their erudite   show more ...  

DEF CON 32 content. Originating from the conference’s events located at the Las Vegas […] La entrada DEF CON 32 – Compromising Electronic Logger & Creating Truck2Truck Worm – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Dragos Josanu Every week, IT and security teams gather – be it in a virtual conference room or a cramped huddle space – prepared to spend an hour or two wincing at massive lists of “Critical” and “High” severity vulnerabilities. The vulnerability management   show more ...  

tools have done their job, dutifully regurgitating every […] La entrada Surviving the Weekly CVE Review Gauntlet – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Shriram Sharma MSSP Alert recently released its Top 250 MSSPs list for 2024, and we were pleased to recognize many D3 users on the list, including 31 overall and 20 of the Top 100. The rankings are based on MSSP Alert’s analysis of revenues, profitability, growth rate   show more ...  

and headcount. Here’s a […] La entrada 31 of the Top MSSPs Use D3 for SOC Automation: Here’s Why – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: bacohido By Byron V. Acohido The Amazon Web Services (AWS) Shared Responsibility Model has come a long way, indeed. In 2013, Amazon planted a stake in the ground when it divided cloud security obligations between AWS and its patrons, guaranteeing the integrity of its   show more ...  

infrastructure, but placing a huge burden on […] La entrada Shared Intel Q&A: A thriving ecosystem now supports AWS ‘shared responsibility’ security model – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: securityboulevard.com – Author: Marc Handelman Monday, December 9, 2024 Security Boulevard The Home of the Security Bloggers Network Community Chats Webinars Library Home Cybersecurity News Features Industry Spotlight News Releases Security Creators Network Latest Posts Syndicate Your Blog Write for   show more ...  

Security Boulevard Webinars Upcoming Webinars Calendar View On-Demand Webinars Events Upcoming Events On-Demand Events […] La entrada Randall Munroe’s XKCD ‘Infinite Armada Chess’ – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Nate Nelson, Contributing Writer Source: Araki Illustrations via Alamy Stock Photo Chinese hackers almost breached critical European supply chain companies by disguising their malicious activities behind native Microsoft technologies. It happened during a three-week period,   show more ...  

from late June to July, according to researchers from SentinelLabs. A threat actor tied to China’s […] La entrada Sprawling ‘Operation Digital Eye’ Attack Targets European IT Orgs – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Jai Vijayan, Contributing Writer Source: QINQIE99 via Shutterstock Microsoft has released fresh guidance to organizations on how to mitigate NTLM relay attacks by default, days after researchers reported finding a NTLM hash disclosure zero-day in all versions of Windows   show more ...  

Workstation and Server, from Windows 7 to current Windows 11 versions. However, […] La entrada Microsoft NTLM Zero-Day to Remain Unpatched Until April – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: The number of cyber-attacks reported by large finance institutions to the UK’s Financial Conduct Authority (FCA) has fallen 53% in 2024 compared to 2023. This is according to data shared by cybersecurity training platform provider Hack the Box on December 9   show more ...  

following a Freedom of Information (FOI) request. This data compares […] La entrada Major Drop in Cyber-Attack Reports from Large UK Financial Businesses – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: A federal appeals court has upheld a law that could see TikTok banned across the US unless its Chinese parent company, ByteDance, divests its ownership. The decision was issued by a three-judge panel from the US Court of Appeals for the District of Columbia   show more ...  

Circuit on Friday, marking a significant setback […] La entrada Federal Appeals Court Upholds Law Threatening US TikTok Ban – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 compromised

Source: www.infosecurity-magazine.com – Author: A compromised version of the popular ultralytics AI library has been found to deliver a cryptocurrency mining payload. ReversingLabs researchers traced the issue to a breach of the library’s build environment, which was exploited through a known GitHub Actions   show more ...  

script injection vulnerability. On December 4, version 8.3.41 of ultralytics was published […] La entrada Compromised AI Library Delivers Cryptocurrency Miner via PyPI – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: The publication of reprimands following data leaks has been cited as an “effective” deterrent for public authorities. This follows a two-year trial led by the UK’s Information Commissioner’s Office (ICO) which sought to work proactively with the public   show more ...  

sector to encourage data protection compliance. Over the two years of the Public […] La entrada Public Reprimands, an Effective Deterrent Against Data Breaches – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Waqas. Summary Large-Scale Hacking Operation Uncovered: Researchers link ShinyHunters and Nemesis to an operation exploiting millions of websites to steal over 2 terabytes of sensitive data. Sophisticated Tools and Tactics: Hackers used Python, PHP, AWS IP ranges, and tools like   show more ...  

ffuf, httpx, and Shodan to automate and expand their exploitation across […] La entrada ShinyHunters, Nemesis Linked to Hacks After Leaking Their AWS S3 Bucket – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0day

Source: hackread.com – Author: Uzair Amir. Protect your systems with automated patching and server hardening strategies to defend against vulnerabilities like the NTLM zero-day. Stay proactive and secure your business. A newly discovered Windows zero-day vulnerability exposes users across multiple Windows   show more ...  

versions to credential theft. Discovered by 0patch researchers, this critical security flaw allows attackers […] La entrada Critical Windows Zero-Day Alert: No Patch Available Yet for Users – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 CVE-2023-44487

Source: www.securityweek.com – Author: Ryan Naraine Software giant Microsoft on Tuesday rolled out patches for more than 70 documented security defects and called urgent attention to an already-exploited zero-day in the Windows Common Log File System (CLFS). The CLFS vulnerability, tagged as CVE-2024-49138 and   show more ...  

marked as actively exploited in the wild, was reported by anti-malware […] La entrada Microsoft Ships Urgent Patch for Exploited Windows CLFS Zero-Day – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Adobe

Source: www.securityweek.com – Author: Eduard Kovacs Adobe’s December 2024 Patch Tuesday updates address a total of more than 160 vulnerabilities across 16 products. Roughly 90 of the vulnerabilities were patched in Adobe Experience Manager. A majority are important-severity (medium based on CVSS score) and   show more ...  

they allow arbitrary code execution. Some of the flaws can be […] La entrada Adobe Patches Over 160 Vulnerabilities Across 16 Products – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2024-12
Aggregator history
Tuesday, December 10
SUN
MON
TUE
WED
THU
FRI
SAT
DecemberJanuaryFebruary