Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for U.S. Sanctions Chine ...

 Firewall Daily

The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) issued sanctions against two entities linked to major cyber activities targeting U.S. national security. The sanctions target Yin Kecheng, a Shanghai-based cyber actor involved in a recent compromise of Treasury Department networks, and   show more ...  

Sichuan Juxinhe Network Technology Co., LTD., a cybersecurity company connected to the notorious Salt Typhoon hacker group. These sanctions are part of the U.S. government's ongoing efforts to combat the growing threat posed by cyber actors associated with the People’s Republic of China (PRC).  Yin Kecheng is identified as a key figure behind the breach of the Department of the Treasury’s Departmental Offices network. This incident is part of a broader trend of PRC-based malicious cyber activity aimed at infiltrating U.S. government systems. According to OFAC, Yin has been active in cyber espionage for over a decade and is linked to China’s Ministry of State Security (MSS). The Treasury Department's sanctions against Yin Kecheng are based on Executive Order (E.O.) 13694, which targets individuals and entities involved in cybercrimes that pose cyber risks to U.S. national security, foreign policy, or economic interests.  Adewale O. Adeyemo, the Deputy Secretary of the Treasury, emphasized the department's commitment to holding cyber actors accountable. The Treasury Department will continue to use its authorities to hold accountable malicious cyber actors who target the American people, our companies, and the United States government, including those who have targeted the Treasury Department specifically," said Adeyemo.  Salt Typhoon and the Increasing Threat of Cyber Intrusions  The sanctions also extend to Sichuan Juxinhe Network Technology Co., LTD., a Chinese cybersecurity firm directly involved in the cyber activities of the Salt Typhoon group. Active since at least 2019, Salt Typhoon has been responsible for significant breaches within U.S. telecommunication and internet service provider networks. Most recently, the group compromised the infrastructure of several major companies within these sectors, further escalating concerns over Chinese cyber operations against critical U.S. infrastructure.  Salt Typhoon's operations are not isolated. They represent a growing number of cyber activities attributed to PRC-linked actors. These incidents necessitate costly remediation efforts for impacted organizations and threaten the stability of critical national infrastructure. Sichuan Juxinhe is known for its direct involvement in exploiting vulnerabilities in U.S. networks and has maintained strong ties with Chinese state-sponsored entities. According to OFAC, these actions are consistent with the broader strategy of Chinese state-backed cyber groups targeting critical U.S. infrastructure.  Treasury Department's Ongoing Efforts to Counter Cyber Threats  The sanctions against Yin Kecheng and Sichuan Juxinhe are part of a series of measures aimed at curbing increasingly reckless cyber activities tied to China. On January 3, 2025, OFAC sanctioned Integrity Technology Group, Inc. for its role in Flax Typhoon’s malicious activities. Previous actions in 2024 also saw the designation of entities like Sichuan Silence Information Technology Company, Ltd., responsible for compromising U.S. firewalls, and Wuhan Xiaoruizhi Science and Technology Company, Ltd., linked to the Advanced Persistent Threat (APT) 31 group.  These sanctions are a crucial part of the U.S. government's strategy to protect its cyber infrastructure and prevent further compromises by malicious actors. The Office of the Director of National Intelligence’s Annual Threat Assessment further highlighted that Chinese cyber actors, including those linked to the MSS, remain some of the most persistent threats to U.S. national security.  Conclusion   To strengthen its efforts against cyber threats, the U.S. Department of State is offering a reward of up to $10 million for information leading to the identification or location of individuals involved in malicious cyber activities targeting U.S. critical infrastructure, with the Rewards for Justice program encouraging people to come forward with such information.  In parallel, the U.S. Treasury’s sanctions against Yin Kecheng and Sichuan Juxinhe, and their ties to the Salt Typhoon hacker group, ensure that any property or interests tied to these entities in the U.S. are blocked, with strict penalties for violations of these sanctions. The Treasury Department's enforcement of these measures sends a strong message about the seriousness of cybersecurity and highlights the U.S. government's commitment to combating foreign cyber threats, reinforcing the need for international cooperation in addressing these growing challenges to national security. 

image for Anne Neuberger Steps ...

 Firewall Daily

Anne Neuberger, the Deputy National Security Advisor, Cyber & Emerging Tech at National Security Council, The White House, resigned from her position on January 17, 2025. Her resignation sparked an interesting debate over the ongoing cybersecurity landscape in the US.   Neuberger’s departure comes at a time   show more ...  

when cyber threats, particularly from China, have reached new levels of cybercrime. Under her guidance, the Biden administration made substantial strides in addressing these cyber threats. The primary concerns revolved around China-backed cyberattacks on U.S. infrastructure, including power grids, communication systems, and other vital sectors.   Anne Neuberger Resigns from National Security Council  One of Neuberger’s major accomplishments was overseeing the launch of the US Cyber Trust Mark program. This initiative aimed to improve security standards for consumer products, helping consumers identify safer products in the marketplace. The program represented a key pillar of the administration’s cybersecurity strategy, which also included two pivotal executive orders on cybersecurity that set the groundwork for future policy development.  In line with Neuberger’s work, outgoing President Joe Biden issued an ambitious cybersecurity order on January 18, 2025, aimed at strengthening U.S. government cybersecurity. This executive order, which builds upon plans initiated after the 2021 Colonial Pipeline ransomware attack, includes directives to enhance software and cloud security. These measures are part of the administration’s efforts to protect the country from ongoing cyber threats, particularly those emanating from adversaries like China and Russia.  Biden’s cybersecurity order emphasizes the need for software providers and cloud companies to implement secure development practices. Agencies like the National Institute of Standards and Technology (NIST), the Cybersecurity and Infrastructure Security Agency (CISA), and the Office of Management and Budget (OMB) will play crucial roles in enforcing these new standards. The executive order also directs the development of new policies for open-source software, requiring security assessments and patching procedures to protect federal systems.  The Impact of Chinese Threat Actors  Robert Huber, the Chief Security Officer and Head of Research at Tenable Public Sector, commented on the urgency of these measures. He referenced recent attacks, such as the Salt Typhoon and Treasury Department breaches, as stark reminders of the vulnerabilities in current cybersecurity systems.   Huber noted that these incidents had not only compromised public trust but also created opportunities for adversaries like China to disrupt critical services and national defense. He praised the Biden administration’s executive order for addressing long-overdue updates in the nation’s cybersecurity infrastructure, especially in regard to third-party software supply chains.  As Neuberger departs, the Biden administration's focus on cybersecurity continues to adapt to new changes. The president’s executive order is expected to have a large impact, particularly in ensuring that federal contractors adhere to better cybersecurity practices. The goal is to create a more secure digital environment for federal systems and communications, reducing the risk of future cyberattacks that could undermine national security.  The Biden administration’s final cybersecurity efforts also include measures to protect against threats from climate change. CISA officials, including Jen Easterly and David Mussington, have highlighted the importance of enhancing critical infrastructure resilience in light of environmental challenges. This broader approach reflects the growing recognition of cybersecurity as a cross-cutting issue that intersects with national defense, public health, and environmental concerns. 

image for Elon Musk Offers to ...

 Cyber News

Elon Musk, the renowned CEO of Tesla and SpaceX, has made waves with a bold statement regarding the cybersecurity vulnerabilities within the U.S. government. Musk took to social media platform X (formerly Twitter), responding to a report on a Chinese cyberattack that breached U.S. Treasury systems. Musk’s comment   show more ...  

was clear: he could “fix” the government’s Information Technology (IT) department, adding that the task would be “harder than getting a rocket to orbit.” This candid reply came in response to a tweet by Mario Nawfal, Founder of IBC Group, who shared the news that Chinese state-sponsored hackers had infiltrated the U.S. Treasury Department, compromising systems that included devices belonging to key officials such as Treasury Secretary Janet Yellen and her deputies. Musk, whose ventures have disrupted industries across the globe, wasn’t shy about his willingness to take on the monumental task of improving the government’s IT systems. In a world increasingly under the threat of cyberattacks, Musk’s words have sparked curiosity, debate, and a sense of urgency among those invested in cybersecurity. Musk’s response, “My goal is to fix government IT! This is harder than getting a rocket to orbit. Actually,” immediately caught the attention of many. Known for his ambitious goals, Musk is no stranger to challenges. Whether it’s revolutionizing electric cars with Tesla, sending humans to Mars with SpaceX, or advancing renewable energy solutions, Musk has built a reputation for pushing the boundaries of what’s possible. So, when he speaks about tackling the cybersecurity woes of the U.S. government, people take note. [caption id="attachment_100323" align="aligncenter" width="285"] Source: X[/caption] U.S. Government Grapples with Increasing Cyber Threats Musk’s comments come at a time when the U.S. government is facing an escalating wave of cyberattacks that have compromised sensitive data and disrupted vital services. The most recent breach was a cyberattack on the U.S. Treasury Department in December 2024, in which Chinese hackers exploited a vulnerability in a third-party cybersecurity provider, BeyondTrust. This breach, attributed to a Chinese Advanced Persistent Threat (APT) group, resulted in unauthorized access to unclassified government documents. The breach has been seen as one of the most significant cyber incidents in recent U.S. history, raising serious concerns about the security of critical government systems. The Treasury Department attack was just the tip of the iceberg. Shortly after the Treasury breach, major telecommunications companies, including AT&T and Verizon, fell victim to a massive cyberattack attributed to China. Dubbed “Salt Typhoon,” this hack is believed to be one of the largest intelligence compromises the U.S. has ever faced. Moreover, the U.S. Department of Defense experienced its own security breach in November 2024, in which hackers gained access to sensitive military information. These attacks demonstrate the vulnerability of both government and private-sector systems to increasingly sophisticated adversaries. Musk’s willingness to help address these vulnerabilities is timely and could play a crucial role in strengthening the country’s defenses. The rise in cyberattacks, particularly from state-sponsored hackers like China and Russia, highlights the need for more strong cybersecurity measures across all sectors, particularly government infrastructure. Elon Musk’s Unique Offer: A New Approach to Government IT Security? Elon Musk is undoubtedly an influential figure in the tech world, known for pushing the envelope and taking on challenges that others deem impossible. His ventures, which include revolutionizing electric vehicles, space exploration, and even pursuing neural technology with projects like Neuralink, have made him one of the most recognized names in technology. Yet, Musk’s approach to business and innovation is often unconventional, which has earned him both admirers and critics. His offer to assist in fixing the U.S. government’s IT systems comes at a time when the need for stronger cybersecurity has never been more apparent. The country is facing an increasing number of cyberattacks, many of which are backed by foreign state actors. These breaches pose a direct threat to national security, compromising everything from sensitive government communications to critical infrastructure. Musk’s expertise in tech and innovation gives him a unique perspective on how to tackle these challenges. His experience with SpaceX, where precision and reliability are paramount, and Tesla, where software and data play key roles in autonomous driving, gives him a deep understanding of the cybersecurity requirements needed to protect complex systems. Musk is known for taking bold, decisive actions to solve problems, often applying unconventional methods. While his offer to help may seem audacious, it also highlights a critical truth: traditional methods of cybersecurity may no longer be sufficient to counter modern, state-sponsored cyberattacks. To Sum Up As Musk pointed out, fixing government IT systems is no small feat. The complexity of government infrastructure, combined with the growing cyberattacks, makes it a daunting challenge. Yet, Musk’s confidence in tackling this issue is a reminder of the urgency with which the U.S. government must address its cybersecurity vulnerabilities. With hackers targeting critical sectors like defense, telecommunications, and finance, it’s clear that a new approach is needed. As the U.S. faces an increasingly hostile cyber threat landscape, the question remains: can Elon Musk’s vision and innovative thinking be the solution to strengthening the country’s cybersecurity infrastructure? Only time will tell, but his offer to help fix the nation’s IT systems highlights the critical need for action in the face of rising cyber threats. The conversation around Musk’s potential role in improving U.S. cybersecurity is just beginning, but it’s clear that the stakes couldn’t be higher.

image for Budget 2025 on the H ...

 Firewall Daily

With the Budget 2025 soon to be announced, India stands at a pivotal moment in its digital transformation journey, increasingly relying on digital platforms and technologies for business, governance, and daily life. As the nation's digital ecosystem experiences exponential growth, driven by a surge in mobile   show more ...  

applications, the need to enhance its cybersecurity infrastructure has never been more urgent. Sharing his perspective on this vital issue, Manish Mimani, Founder and CEO of Protectt.ai, emphasizes that the Union Budget 2025 offers a pivotal opportunity to strengthen India’s digital & cybersecurity framework. Mimani highlights the need for focused financial reforms, strategic investments, and innovative policies to bolster India’s defenses against growing cyber risks, while fostering a culture of resilience and innovation in the cybersecurity ecosystem. The following key recommendations by Mimani outline how Budget 2025 can play a transformative role in securing India’s digital future: Budget 2025: What to Except for Cybersecurity Establishing a Cybersecurity Research & Development (R&D) in Multiple city The government could allocate funds to establish a dedicated R&D institute focused on cybersecurity. This hub would foster innovation and develop advanced security solutions tailored to India’s unique needs. By nurturing homegrown technologies, India can reduce reliance on foreign solutions and position itself as a global leader in cybersecurity innovation. Financial Incentives for Cybersecurity Startups Targeted financial incentives, such as tax holidays, grants, and subsidized loans, could stimulate the growth of startups specializing in cybersecurity. Encouraging innovation in this sector would not only strengthen India’s defenses but also allow the nation to capture a larger share of the growing global cybersecurity market. Upskilling and Talent Development Bridging the cybersecurity skills gap is essential for safeguarding India’s digital future. The budget could fund comprehensive training and upskilling programs, including partnerships with educational institutions to develop specialized curricula. Subsidized training for IT professionals and initiatives to attract talent to cybersecurity careers would help ensure a robust pipeline of skilled professionals. Public-Private Partnerships for Cybersecurity Infrastructure Allocating budgetary support for public-private partnerships (PPPs) could accelerate the development of shared cybersecurity resources. Collaborative initiatives between the government and private sector would create platforms for threat intelligence sharing, infrastructure development, and advanced research, bolstering India’s ability to counter emerging cyber threats. Reduction in GST on 100% Made in India Cybersecurity Products Reducing the Goods and Services Tax (GST) on cybersecurity software and tools could make essential safeguards more affordable for businesses, especially small and medium enterprises (SMEs). Currently taxed at 18%, lowering this rate would enable wider adoption of advanced security solutions, enhancing the resilience of India’s digital infrastructure. Lower Import Duties on Critical Hardware High import duties on servers, GPUs, and other essential components inflate the cost of building robust cybersecurity systems. By reducing these duties, the government could make cutting-edge technology more accessible to businesses, enabling real-time threat detection and efficient anomaly analysis across sectors. Tax Benefits for Cybersecurity Investments Introducing tax incentives for businesses that implement strong cybersecurity measures could encourage proactive adoption of best practices. Deductions for investments in cybersecurity audits, penetration testing, and advanced security systems would foster a more secure digital ecosystem. Conclusion The Union Budget 2025 represents a significant opportunity to bolster India’s cybersecurity capabilities. By adopting strategic measures such as tax incentives, reduced GST rates, and investments in R&D and talent development, the government can create a more resilient and secure digital environment. As businesses and citizens increasingly depend on digital platforms, mobile app security emerges as a critical focus area within the broader cybersecurity landscape. By directing resources and attention to this domain, India can ensure the safety of its digital economy, foster innovation, and maintain its appeal as a global hub for technology and investment.

image for Yubico Warns of 2FA ...

 Vulnerabilities

Yubico has released a security advisory, YSA-2025-01, which highlighted a vulnerability within the software module that supports two-factor authentication (2FA) for Linux and macOS platforms. This issue, tracked as CVE-2025-23013, allows for a partial 2FA bypass protections when using YubiKeys or other FIDO-compatible   show more ...  

authenticators. The vulnerability poses a high-risk security threat and could potentially compromise authentication processes for users relying on Yubico’s open-source pam-u2f software.   Yubico's pam-u2f software package, a Pluggable Authentication Module (PAM) used to integrate YubiKey and other FIDO-compliant devices with Linux and macOS systems, contains a vulnerability that can lead to a 2FA bypass in some configurations. This flaw primarily affects systems running versions of pam-u2f prior to 1.3.1, where the authentication process does not correctly handle certain errors. In particular, when the system experiences issues such as memory allocation errors or the absence of necessary files, the pam-u2f module may fail to trigger proper authentication checks.  The 2FA Bypass Vulnerability  The 2FA bypass vulnerability arises in the pam_sm_authenticate() function, which is responsible for managing the authentication flow. When certain conditions occur—such as failure to allocate memory or privilege escalation issues—the function returns a response of PAM_IGNORE. This prevents the system from completing the authentication process correctly, bypassing 2FA in scenarios where it should be validated.  Additionally, if the nouserok option is enabled in the configuration, pam-u2f may return PAM_SUCCESS even when the authfile is missing or corrupted. This presents a critical risk, particularly in configurations where 2FA is set up as the primary or secondary authentication factor.  What Does This Mean for Users?  The vulnerability primarily affects users who have installed pam-u2f on Linux or macOS systems via methods like apt or manual installation. Specifically, users with versions of pam-u2f prior to 1.3.1 are vulnerable to this issue, which may lead to unauthorized access if the system’s 2FA protections are bypassed. However, no hardware used for 2FA, including any YubiKey devices, is affected by this vulnerability. The issue lies entirely within the software configuration, not the hardware security keys.  Yubico has recommended that all affected customers upgrade to the latest version of pam-u2f immediately to mitigate the vulnerability. Users can download the latest release directly from Yubico’s GitHub repository or update via Yubico’s Personal Package Archive (PPA).  How Are Different Configurations Impacted?  The severity of the vulnerability varies depending on the system configuration. For instance:  Single Factor Authentication with User-Managed Authfile: In this scenario, where pam-u2f is used as a single factor and the authfile is located in the user's home directory, an attacker could remove or corrupt the authfile. This would cause pam-u2f to return PAM_SUCCESS, allowing unauthorized access and potentially escalating privileges if the user has sudo access. This scenario has been assigned a CVSS score of 7.3, indicating a high severity.  Two-Factor Authentication with Centrally Managed Authfile: If pam-u2f is used alongside a user’s password for two-factor authentication, the vulnerability may be triggered by a memory allocation error or a lack of necessary files. In this case, the second authentication factor may fail to verify, leaving the system open to attacks. This scenario carries a CVSS score of 7.1.  Use of pam-u2f as a Single Authentication Factor with Other PAM Modules: When pam-u2f is used in conjunction with other PAM modules that do not perform authentication, forcing a PAM_IGNORE response would prevent any authentication from occurring. If the user has administrative privileges, this could lead to local privilege escalation. This scenario also carries a CVSS score of 7.3.  Conclusion   Yubico urges affected customers to immediately upgrade to the latest version of pam-u2f to protect against the 2FA bypass vulnerability, with alternative mitigation measures available for those unable to update right away. This advisory highlights the crucial role of two-factor authentication (2FA) in securing systems, while also showing that vulnerabilities within 2FA solutions can still pose risks.  

image for Name That Toon: Ince ...

 Feed

Feeling creative? Have something to say about cybersecurity? Submit your caption and our panel of experts will reward the winner with a $25 gift card.

 Feed

Cybersecurity researchers have identified three sets of malicious packages across the npm and Python Package Index (PyPI) repository that come with capabilities to steal data and even delete sensitive data from infected systems. The list of identified packages is below - @async-mutex/mutex, a typosquat of async-mute (npm) dexscreener, which masquerades as a library for accessing liquidity pool

 Feed

As the digital world becomes more complicated, the lines between national security and cybersecurity are starting to fade. Recent cyber sanctions and intelligence moves show a reality where malware and fake news are used as tools in global politics. Every cyberattack now seems to have deeper political consequences. Governments are facing new, unpredictable threats that can't be fought with

 Feed

Every week seems to bring news of another data breach, and it’s no surprise why: securing sensitive data has become harder than ever. And it’s not just because companies are dealing with orders of magnitude more data. Data flows and user roles are constantly shifting, and data is stored across multiple technologies and cloud environments. Not to mention, compliance requirements are only getting

 Feed

New research has uncovered security vulnerabilities in multiple tunneling protocols that could allow attackers to perform a wide range of attacks. "Internet hosts that accept tunneling packets without verifying the sender's identity can be hijacked to perform anonymous attacks and provide access to their networks," Top10VPN said in a study, as part of a collaboration with KU Leuven professor

 Feed

The Threat actor known as DoNot Team has been linked to a new Android malware as part of highly targeted cyber attacks. The artifacts in question, named Tanzeem (meaning "organization" in Urdu) and Tanzeem Update, were spotted in October and December 2024 by cybersecurity company Cyfirma. The apps in question have been found to incorporate identical functions, barring minor modifications to the

 Cyber Security News

Source: go.theregister.com – Author: Thomas Claburn OpenAI’s ChatGPT crawler appears to be willing to initiate distributed denial of service (DDoS) attacks on arbitrary websites, a reported vulnerability the tech giant has yet to acknowledge. In a write-up shared this month via Microsoft’s GitHub,   show more ...  

Benjamin Flesch, a security researcher in Germany, explains how a single HTTP […] La entrada OpenAI’s ChatGPT crawler can be tricked into DDoSing sites, answering your queries – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 cyber

Source: www.cyberdefensemagazine.com – Author: News team For years, cyber deception has been an excellent tool against would-be cybercriminals. However, the cybersecurity landscape is constantly evolving — and many conventional techniques are no longer as effective. Is artificial intelligence the solution? If   show more ...  

business leaders know how to deploy it effectively, they can benefit from the value […] La entrada How to Use AI in Cyber Deception – Source: www.cyberdefensemagazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.cyberdefensemagazine.com – Author: News team Everyone has noticed that we have entered the AI era. AI is everywhere: to improve customer experience, reduce costs, generate stunning and surreal images. The size of the Artificial Intelligence market is expected to reach a value of US$184.00bn, with a   show more ...  

projection of year-to-year growth of 28.46%. Meanwhile, startup creation […] La entrada How To Privacy-Proof the Coming AI Wave – Source: www.cyberdefensemagazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: hackread.com – Author: Waqas. Hacker IntelBroker claims to have breached Hewlett Packard Enterprise (HPE), exposing sensitive data like source code, certificates, and PII, now available for sale online. The notorious IntelBroker hacker along with their associates have claimed responsibility for   show more ...  

breaching Hewlett Packard Enterprise (HPE), a Houston, TX, United States-based global company that provides […] La entrada Hackers Claim Breach of Hewlett Packard Enterprise, Lists Data for Sale – Source:hackread.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 'Cyber

Source: davinciforensics.co.za – Author: cyberpro. Ponzi schemes of all sorts are over 150 years old and the reason that they have held such great success is that people continue to fall for them. This is no more true than the uptick in Ponzi schemes in SA, and for every criminal busted by the FSCA (Financial   show more ...  

[…] La entrada Ponzi Scams continue to entrap South Africans – Source:davinciforensics.co.za se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 'Cyber

Source: davinciforensics.co.za – Author: cyberpro. A Hidden Goldmine for Identity ThievesCopier and Printer Identity Theft Printers, fax machines, and copiers—once considered harmless office staples—have become unexpected goldmines for identity thieves. These devices often contain hard drives that store   show more ...  

sensitive and personal information, creating significant vulnerabilities for individuals and businesses alike. The Hidden Threat in Office […] La entrada Copier and Printer Identity Theft – Source:davinciforensics.co.za se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 'Cyber

Source: davinciforensics.co.za – Author: cyberpro. Cybercrime can be defined as “criminal activities carried out by means of computers or the Internet.” With the growing use of smartphones, mobile devices have become an integral part of this definition, significantly expanding the scope of potential cyber   show more ...  

threats. Recent Incidents of Mobile Cybercrime In a notable case, twelve […] La entrada Mobile Cybercrime in South Africa – Source:davinciforensics.co.za se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: luke. Swag means a lot to HackerOne (and to you, our hackers). It’s not just apparel and stickers. It’s a badge of honor. An invitation and acknowledgement that says “welcome to the club”. You earn your swag.   And certain swag is more precious than others.   No   show more ...  

swag item has […] La entrada HackerOne-sie – More than just epic swag – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: luke. Did you know 94% of the Forbes Global 2000 do not have known vulnerability disclosure policies? It’s true, and the average amount paid out for a critical vulnerability by HackerOne Bug Bounty customers is $1,923 in 2017. Curious which industry pays out the most   show more ...  

Information Disclosure Bugs? Or which vulnerability […] La entrada The Hacker-Powered Security Report: Insights from Over 800 Programs – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.hackerone.com – Author: luke. If triaging vulnerability reports was a martial art, Zach Dando would be sensei master. Zach runs the triage team at HackerOne and we recently sat down with him to glean insight into how he has HackerOne’s Security Analysts clicking on all cylinders.   Hi Zach!   show more ...  

Please introduce yourself and tell us […] La entrada Getting to know the HackerOne triage team with Zach Dando – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

Source: www.hackerone.com – Author: luke. We recently published The GitHub Bug Bounty Story and couldn’t be more excited to share it with you! TL;DR: Their lead security engineer summarizes the ROI as “phenomenal”. You’ve probably heard of GitHub, but you might not know they support more than 20 million   show more ...  

people learning, sharing, and working together […] La entrada GitHub Embraces Hacker-Powered Security To Protect 55 Million Projects – Source:www.hackerone.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Application Security

Source: www.csoonline.com – Author: AI-generated code is surfacing everywhere, even in places where its use is officially banned. Here’s what cybersecurity leaders can do to ensure it doesn’t jeopardize security. In 2023, the team at data extraction startup Reworkd was under tight deadlines.   show more ...  

Investors pressured them to monetize the platform, and they needed to migrate […] La entrada How organizations can secure their AI code – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Compliance

Source: www.csoonline.com – Author: News Analysis 20 Jan 20254 mins ComplianceFinancial Services IndustryRegulation The deadline for implementing the EU’s DORA has expired. How far have financial service providers come? Not very far, according to a recent survey. Beginning Friday, Jan. 17, all EU financial   show more ...  

institutions are now required to operate in compliance with the Digital […] La entrada Midsize firms universally behind in slog toward DORA compliance – Source: www.csoonline.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

Source: securityaffairs.com – Author: Pierluigi Paganini Critical flaws in WGS-804HPT switches could be chained to gain remote code execution on Planet Technology’s industrial devices. The Planet WGS-804HPT industrial switch is used in building and home automation networks to provide connectivity of Internet   show more ...  

of things (IoT) devices, IP surveillance cameras, and wireless LAN network applications. This […] La entrada Planet WGS-804HPT Industrial Switch flaws could be chained to achieve remote code execution – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Breaking News

Source: securityaffairs.com – Author: Pierluigi Paganini Planet WGS-804HPT Industrial Switch flaws could be chained to achieve remote code execution  |  SECURITY AFFAIRS MALWARE NEWSLETTER – ROUND 29  |  Security Affairs newsletter Round 507 by Pierluigi Paganini – INTERNATIONAL EDITION   show more ...  

 |  A flaw in the W3 Total Cache plugin exposes hundreds of thousands of WordPress sites […] La entrada SECURITY AFFAIRS MALWARE NEWSLETTER – ROUND 29 – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Iain Thomson Picture this: It’s 2030 and China’s furious with Taiwan after the island applies to the UN to be recognized as an independent state. After deciding on a full military invasion, China attempts to first cripple its rebellious neighbor’s critical   show more ...  

infrastructure. That’s the scenario set up as a wargame exercise […] La entrada Hackers game out infowar against China with the US Navy – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Rupert Goodwins Opinion “As obsolete as warships in the Baltic” was a great pop lyric in Prefab Sprout’s 1985 gem, Faron Young. Great, but ironically obsolete itself. Sweden has just deployed multiple warships in that selfsame sea to guard against the very   show more ...  

modern menace of underwater cable cutting. With so much […] La entrada How to leave the submarine cable cutters all at sea – go Swedish – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Connor Jones A UK high school will have to close for at least two days, today and tomorrow, after becoming the latest public-sector victim of ransomware criminals. Blacon High School in the historic city of Chester, in north west England, said yesterday the attack hit on   show more ...  

January 17, and didn’t rule […] La entrada Ransomware attack forces Brit high school to shut doors – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Copilot

Source: go.theregister.com – Author: Thomas Claburn Sage Group plc has confirmed it temporarily suspended its Sage Copilot, an AI assistant for the UK-based business software maker’s accounting tools, this month after it blurted customer information to other users. A source familiar with the developer   show more ...  

told The Register late last week: “A customer found when they […] La entrada Sage Copilot grounded briefly to fix AI misbehavior – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Brandon Vigliarolo Infosec in brief Hogwarts doesn’t teach an incantation that could have saved Harry Potter publisher Scholastic from feeling the power of an online magician who made off with millions of customer records – except perhaps the wizardry of multifactor   show more ...  

authentication. Scholastic, publisher of the US editions of the Harry […] La entrada Datacus extractus: Harry Potter publisher breached without resorting to magic – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: go.theregister.com – Author: Simon Sharwood Asia In Brief When food delivery “superapps” started operations in Indonesia, users started putting on weight – and that’s not an entirely bad thing. So argue the authors of a University of Bonn Center for Development Research paper [PDF] published   show more ...  

this month. Titled “Impact of Super Apps on the […] La entrada When food delivery apps reached Indonesia, everyone put on weight – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2025-01
Aggregator history
Monday, January 20
WED
THU
FRI
SAT
SUN
MON
TUE
JanuaryFebruaryMarch