Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Trump’s Team Remov ...

 Cyber News

David Pekoske, the Administrator of the Transportation Security Administration (TSA), was removed from his position by the Trump administration. Pekoske, who had been appointed by former President Donald Trump in 2017 and had his tenure renewed by President Joe Biden in 2022, sent a farewell memo to TSA staff,   show more ...  

explaining that he had been advised by Trump’s transition team that his time at the helm would end at noon on Monday. In his message to staff, David Pekoske praised the commitment of TSA employees, noting the tremendous responsibility they carry to ensure safe travel and the delivery of goods across the United States. “People place their trust in you no matter what your job is in TSA, so they can travel, and the goods they rely on can reach them via our transportation systems,” he wrote. “It’s an incredible responsibility that each of you has been entrusted with, and you carry it out in a manner that is an example of the best of America.” While Pekoske’s departure was confirmed by the Department of Homeland Security on Tuesday, the agency did not disclose who would replace him. The Cyber Express requests for comment directed to the White House went unanswered. Notably, David Pekoske’s farewell memo did not mention the reason behind his sudden removal, leaving many to speculate about the circumstances. [caption id="attachment_100387" align="aligncenter" width="686"] Source: X[/caption] David Pekoske’s Leadership and Cybersecurity Achievements Pekoske’s time at the TSA was marked by significant efforts to address cybersecurity in the critical infrastructure sectors under his jurisdiction. His tenure included the implementation of cybersecurity directives for the airline, pipeline, and rail industries, a move that was seen as vital for protecting U.S. transportation and energy systems against growing digital threats. Under Pekoske’s leadership, the TSA played an essential role in improving cybersecurity measures in response to growing concerns about cyberattacks from adversarial nations like China and Russia. One of Pekoske’s key initiatives was the introduction of cybersecurity rules that focused on fundamental yet critical tasks for organizations in these sectors, such as reporting cyber incidents, establishing cybersecurity coordinators, and developing incident response plans. These regulations were designed to bring sectors up to minimum cybersecurity standards and to help mitigate the risks posed by cybercriminals. Following the devastating ransomware attack on Colonial Pipeline in 2021, the Biden administration pushed for more robust cybersecurity measures. Pekoske became a central figure in these efforts, contributing to some of the most impactful cybersecurity initiatives of the administration. By October 2024, nearly 100% of critical pipelines and 68% of railways were meeting the minimum cybersecurity standards, a testament to the success of the regulations he championed. In the aviation sector, the percentage of organizations meeting basic cybersecurity standards jumped from 0% to 57% under his watch. Pekoske was also vocal about the evolving cyber threats and the urgency of coordinated action. At the DEF CON security conference in 2023, he emphasized TSA’s role in quickly responding to emerging threats and issuing emergency directives. He noted that the intelligence gathered from security officials regarding cyber threats was consistently growing more concerning, particularly from nations like China and Russia. “You don’t issue emergency amendments to a security plan unless you feel like you are in an emergency situation,” Pekoske said at the time. “The intelligence we’re getting is consistent. It’s getting consistently more concerning over time.” Cybersecurity Landscape and the Role of TSA The TSA’s increasing focus on cybersecurity reflects the growing importance of digital security across all industries, especially in sectors critical to national infrastructure. Pekoske’s tenure marked a shift in the TSA’s role, with the agency expanding its cybersecurity scope to address emerging threats in an interconnected world. As digital attacks become more sophisticated, agencies like the TSA are required to adapt quickly and implement measures that protect both physical and digital assets. In the context of the broader U.S. cybersecurity efforts, Pekoske’s work with TSA was part of an ongoing national conversation about how to better safeguard U.S. infrastructure. Under the Biden administration, significant strides were made to bolster defenses against foreign cyberattacks, particularly from China. Pekoske’s efforts were in line with these priorities, helping create a safer environment for critical industries such as transportation, energy, and aviation. However, his departure, coming amidst rising cyber threats, has left some questioning what the future holds for TSA’s cybersecurity efforts. While the White House has yet to comment on his replacement, the timing of his removal has raised eyebrows, particularly given the critical cybersecurity challenges facing the U.S. Cybersecurity Concerns Under the Biden Administration Pekoske’s exit follows closely on the heels of the resignation of Anne Neuberger, a key figure in the Biden administration’s efforts to combat cyber threats, particularly those originating from China, and coincided with the dismissal of Homeland Security advisory committee members, including the Cyber Safety Review Board that had investigated Microsoft security lapses and was looking into the Salt Typhoon telecom hacks. Neuberger’s resignation, announced on January 17, 2025, sparked discussions about the direction of the U.S. government’s cybersecurity policies. Neuberger’s leadership was instrumental in addressing cyberattacks targeting U.S. infrastructure, including power grids, communication systems, and other critical sectors. Her departure came at a time when the U.S. was facing an escalation of cybercrime, particularly attacks linked to Chinese state-sponsored actors. Under Neuberger’s guidance, the Biden administration had made significant strides in addressing these threats, with a focus on securing vulnerable infrastructure and strengthening the nation’s overall cybersecurity posture. The combined exits of Pekoske and Neuberger highlight the ongoing challenges the U.S. faces in combating cyber threats, which have become a central concern for national security. As these shifts occur, cybersecurity professionals are left to wonder what the future holds for the country’s efforts to protect its digital and physical infrastructure from increasing cyberattacks.

image for Account Credentials ...

 Cyber News

Account credentials from some of the biggest cybersecurity vendors can be purchased on dark web marketplaces, according to a Cyble report published today. While most of the security credentials Cyble found were for customers of those vendors – likely captured by infostealers that infected customer devices – there   show more ...  

were also an alarming number of leaked account credentials from the security vendors themselves for sensitive internal accounts for enterprise, development and security systems. The accounts ideally should have been protected by multifactor authentication (MFA), which would have made exploiting the credentials more difficult, but Cyble noted that the leaked credentials show the importance of dark web monitoring as a defense against much bigger cyberattacks like data breaches and ransomware attacks. Security Company Credentials Can Be Bought for $10 The credentials could be bought for as little as $10 in cybercrime marketplaces, Cyble said, noting that they were likely harvested from infostealer logs and then sold in bulk on dark web marketplaces. Cyble looked only at credentials leaked since the start of the year, as older passwords are more likely to have changed. Of the 14 cybersecurity vendors Cyble examined, each had both customer and internal credentials leaked on the dark web thus far in 2025. The vendors mainly offer enterprise and cloud security tools and services, but some consumer security vendors were included too. Cyble did not publish the names at the request of vendors. Most of the credentials found by Cyble appeared to be customer credentials that protect access to security management and account interfaces, but all the security vendors Cyble examined had access to internal systems leaked on the dark web too. Security vendor credentials found by Cyble included some for sensitive internal systems such as Okta, Jira, GitHub, AWS, Microsoft Online, Salesforce, SolarWinds, Box, WordPress, Oracle and Zoom, plus other password managers, authentication systems and device management platforms. Cyble said it didn’t test to see if the credentials were valid, but noted that many were for “easily accessible web console interfaces, SSO logins and other web-facing account access points.” One of the largest vendors Cyble looked at appeared to have sensitive internal company accounts exposed, with company email addresses “listed among the credentials for a number of sensitive accounts, including developer and product account interfaces and customer data.” “Depending on the privileges granted to those accounts, the exposure could be substantial,” Cyble noted. Dark Web Credential Leaks a Boon for Hackers Besides the obvious hacking potential, Cyble noted that exposed accounts could also help threat actors conduct reconnaissance “by giving them an idea of the systems that a potential target uses, including locations of sensitive data and potential vulnerabilities to exploit. Other sensitive information exposed by infostealers could include URLs of management interfaces that are unknown to the public, giving further recon information to hackers.” Cyble concluded that “If the largest security vendors can be hit by infostealers, so can any organization, making basic cybersecurity practices like MFA, zero trust, vulnerability management and network segmentation important for minimizing – and ideally preventing – data breaches, ransomware and other cyberattacks.” Updated at 1:28 a.m. UTC January 23, 2025: Vendor names were removed to preserve confidentiality.

image for Cyberattack Hits Pow ...

 Firewall Daily

PowerSchool, a leading provider of cloud-based software used by schools to manage student information, experienced a cybersecurity incident. The PowerSchool cyberattack, which occurred between December 22 and December 28, 2024, affected several school districts across North America.   This cyberattack on school   show more ...  

systems involved the unauthorized exportation of personal data from PowerSchool's Student Information System (SIS) through its community-focused customer support portal, PowerSource.   In response to the PowerSchool cyberattack, the school has been proactive in providing support to affected schools, students, and educators; while also outlining the steps it is taking to strengthen its security infrastructure.  What Happened During the PowerSchool Cyberattack?  The PowerSchool cyberattack was first detected on December 28, 2024, when PowerSchool became aware of unauthorized access to personal information stored in its SIS. The data was allegedly exported through PowerSource, a customer support portal used by schools and districts for community engagement. Although PowerSchool confirmed the breach, it emphasized that no evidence of malware or continued unauthorized activity had been found within its systems.  Importantly, PowerSchool also clarified that the breach did not disrupt any of its services, and there were no reports of other PowerSchool products being affected. The company has maintained that its services continued as normal throughout the investigation, with no operational downtime for its customers.  What Information Was Compromised in this PowerSchool cyberattack?  The information stolen during the PowerSchool cyberattack included a range of personal data, particularly affecting students and educators. The compromised information during the PowerSchool cyberattack may have included names, contact details, dates of birth, Social Security numbers (SSNs), and medical alerts, as well as other related data. The exact data involved in each case varied depending on the specific requirements of the school districts using PowerSchool.  For students, the breach potentially impacted data such as:  Full names  Contact information  Date of birth  Health-related information (such as allergies, conditions, and injuries) Social Security numbers (SSNs)  Residential information  In addition, educators' personal information, including names, dates of birth, and SSNs, was also affected by the breach. However, PowerSchool confirmed that no financial or banking data, including credit card information, was involved in the incident.  Steps Taken to Address the PowerSchool Cyberattack  As soon as the breach was discovered, PowerSchool implemented its cybersecurity response protocols, engaging third-party cybersecurity experts to investigate the scope of the incident. A cross-functional response team, including senior leadership, was mobilized to assess the breach and work with affected school districts.  PowerSchool has been transparent about the steps it is taking to mitigate the impact of the cyberattack and protect the personal information of affected individuals. One of the key measures the company introduced is the offering of complimentary identity protection services and credit monitoring for all impacted students and educators.  Identity Protection: PowerSchool is offering two years of free identity protection services to all students and educators whose information was involved in the breach. This service will help monitor and prevent potential identity theft.  Credit Monitoring: For adult students and educators, PowerSchool is offering two years of complimentary credit monitoring services. This service aims to protect individuals whose SSNs were potentially exposed.  Additionally, PowerSchool has worked with Experian, a reputable credit reporting agency, to manage the identity protection and credit monitoring services. Notifications will be sent to affected students and educators, with PowerSchool coordinating the outreach through direct emails and public notices.  How Schools and Districts Are Responding to the Breach  Various school districts across North America, including the Toronto District School Board (TDSB), have provided updates to their communities. TDSB, which uses PowerSchool’s SIS, confirmed that the breach involved data from students who attended the district between September 1, 1985, and December 28, 2024.   The data compromised in the PowerSchool cyberattack included personal details such as health card numbers, student IDs, medical information, and addresses. The breach was reported to regulatory authorities, including the Office of the Information and Privacy Commissioner of Ontario (IPC), which has launched an investigation into the matter.   TDSB assured parents and guardians that there is no ongoing threat to its systems, and the incident has been contained.  Conclusion   The PowerSchool cyberattack highlights the critical need for stronger cybersecurity in schools as they increasingly rely on digital platforms. While PowerSchool has taken steps to address the breach, the incident emphasizes the importance of protecting sensitive student and educator data. Schools must prioritize better security measures and remain vigilant to prevent future breaches, ensuring the safety of personal information. 

image for Australia’s 2025 F ...

 Firewall Daily

As Australia prepares for its 2025 federal election, concerns surrounding the integrity of the electoral process have become a focal point. The Electoral Integrity Assurance Taskforce (EIAT) has played a critical role in highlighting various risks to the country's democratic systems, offering strategic guidance   show more ...  

and support to the Australian Electoral Commissioner to ensure a secure and fair election.  The Electoral Integrity Assurance Taskforce (EIAT), established to protect the electoral process, has released a detailed report outlining a range of threats that could potentially compromise the 2025 Australian federal election. The EIAT's role is pivotal in providing consolidated, expert advice to the Australian Electoral Commissioner, ensuring the integrity of the election through careful monitoring of various vulnerabilities, including foreign interference, cybersecurity, misinformation, and physical security concerns.  The Four Key Threats Identified by the EIAT  According to the EIAT's latest report, four main areas of concern have been identified as cyber threats to the upcoming election:  Foreign Interference Australia, like many democracies around the world, is not immune to attempts by foreign powers to undermine the electoral process. Foreign interference can take many forms, ranging from spreading disinformation to directly influencing candidates. The EIAT report highlights that while these actions are often difficult to trace, foreign interference remains a growing and prolific threat. The Australian government has already taken proactive measures to protect the integrity of its elections, including the establishment of the Counter-Foreign Interference Taskforce. This taskforce works in tandem with agencies like the Australian Federal Police (AFP) and the Australian Security Intelligence Organisation (ASIO) to mitigate these risks.  Physical Security The report also identifies concerns over physical security, especially in light of increased domestic tensions. The rise in anti-government rhetoric and protest activity has sparked fears that protests, if not managed appropriately, could disrupt the electoral process. The Australian Federal Police (AFP) has reported a sharp increase in criminal activity targeting federal parliamentarians, including threats, intimidation, and attacks on parliamentarian offices. Ensuring the safety of both candidates and voters is vital to maintaining a secure election process, and the government is committed to mitigating these risks through close collaboration between various law enforcement agencies.  CyberSecurity Cybersecurity has emerged as one of the most pressing concerns ahead of the 2025 election. With the increasing digitalization of election systems, malicious cyber actors—ranging from state-sponsored hackers to cybercriminals and hacktivists—pose a substantial threat to the electoral infrastructure. The EIAT has expressed concern that these actors could disrupt the election, tamper with sensitive data, or undermine public confidence. To counter these risks, the Australian Signals Directorate (ASD) has been working closely with government agencies to enhance the country's cyber defense systems. The Australian Electoral Commissioner is also coordinating with ASD to safeguard the integrity of the election by reviewing potential cyber threats and reinforcing the security of voting systems and data.  Misinformation and Disinformation The spread of misinformation and disinformation has become increasingly prevalent, particularly on social media platforms. These false narratives can mislead voters and erode public trust in the electoral process. The Electoral Integrity Assurance Taskforce has warned that disinformation could be used as a tool of foreign interference, but it is often spread domestically by individuals or groups with political motives. The Australian Electoral Commissioner is launching initiatives like the "Stop and Consider" campaign to help voters critically evaluate the information they encounter online, promoting digital media literacy to combat misleading or false claims.  Public Awareness and Support from the EIAT  The Electoral Integrity Assurance Taskforce has published several important documents to inform the public, candidates, and political parties about the security landscape of the upcoming election. These documents include the Election Security Environment Overview, which outlines the four key threat vectors mentioned above, and A Candidate’s Guide to the Changing Electoral Environment, which offers valuable resources for political candidates and their teams. This guide provides information on staying safe, understanding legal obligations, and reporting any threats they might encounter during the election campaign.  Dr. Kath Gleeson, the EIAT Board Chair, emphasized the importance of these resources in ensuring that both voters and candidates remain informed about the challenges facing the electoral process. Dr. Gleeson stated, “This will ensure voters and candidates have access to important information about safeguarding the next federal election.” She also reiterated the taskforce's commitment to maintaining the public's trust in the electoral system, ensuring that the election remains fair, transparent, and secure.  Conclusion  As the 2025 Australian federal election approaches, the Electoral Integrity Assurance Taskforce is playing a vital role in coordinating efforts to protect the election process. By addressing critical threats such as foreign interference, cyberattacks, physical security risks, and misinformation, the taskforce is working proactively to protect the integrity of the election.   In collaboration with the Australian Electoral Commissioner, the taskforce aims to ensure that all Australians can vote with confidence. As the campaign period intensifies, it is crucial for the public, candidates, and political parties to stay vigilant and report any suspicious activity, supporting the collective effort to uphold Australia’s democratic values and secure a fair and transparent election. 

image for Turning Data into De ...

 Cyber News

Every day, hundreds of new Common Vulnerabilities and Exposures (CVEs) are published, many of which target critical systems that keep businesses and governments operational. For cybersecurity professionals, simply knowing that a vulnerability exists is not enough. What’s needed is context—a deeper understanding of   show more ...  

the CVE data, its potential impact, and how to prioritize its remediation. Enter Vulnrichment, an initiative launched by the Cybersecurity and Infrastructure Security Agency (CISA) on May 10, 2024. Designed to enhance vulnerability data with context, scoring, and actionable insights, Vulnrichment aims to give cybersecurity professionals a much-needed edge in managing vulnerabilities. Now, several months into the program, it’s clear that Vulnrichment is changing the game for defenders across the industry. A Turbocharged Upgrade to CVE Data For anyone responsible for vulnerability management, Vulnrichment offers a significant upgrade. The initiative enhances basic CVE records with: Stakeholder-Specific Vulnerability Categorization (SSVC): Decision points that evaluate exploitability, impact, and more. Common Weakness Enumeration (CWE) IDs: Specific details about the root cause of vulnerabilities. Common Vulnerability Scoring System (CVSS): Standardized metrics that quantify a vulnerability’s severity. And the best part? You don’t need to lift a finger to access these enriched insights. The additional data is already baked into the CVE feeds you’re likely pulling from resources like CVE.org or GitHub. How It Works The enriched Vulnrichment data is stored in the Authorized Data Publisher (ADP) container for each CVE. For example, if you’re analyzing CVE-2023-45727, which recently made it to CISA’s Known Exploited Vulnerabilities (KEV) list, you can easily query enriched fields like “Exploitation” using tools such as jq. This field tells you if a vulnerability is actively exploited, has a proof-of-concept (PoC) exploit, or none of the above. With this actionable intelligence, security teams can focus their efforts on vulnerabilities that pose the greatest risk, making prioritization a more straightforward process. Benefits of Vulnrichment Why should you care about Vulnrichment? Here’s what sets it apart: 1. Clarity and Actionability CVE data on its own often lacks depth. Vulnrichment adds essential context, such as whether a vulnerability has been exploited in the wild or requires user interaction. These insights help cybersecurity teams understand not just the existence of a vulnerability but its real-world risk. 2. Streamlined Prioritization Deciding what to patch first is no easy task, especially for organizations managing hundreds of vulnerabilities. Vulnrichment simplifies this process by providing insights into: Exploitability: Is there an active exploit? Technical Impact: How severe is the potential damage? Automatability: Can attackers easily exploit this vulnerability? With this data, security teams can confidently prioritize their remediation efforts, addressing high-risk vulnerabilities before attackers can exploit them. 3. Confidence in Your Data Vulnrichment ensures that CVE records are more accurate and complete. When key data points are missing from the original CVE record, CISA fills in the gaps, adding crucial details like CWEs and CVSS scores. If new information becomes available from the original source, Vulnrichment adjusts accordingly, ensuring the data remains up-to-date and reliable. Community Collaboration One of the standout features of Vulnrichment is its commitment to transparency and community engagement. If users spot an error in the enriched data—like an incorrect CWE assignment—they can report it directly via GitHub. CISA takes these reports seriously and aims to resolve them promptly. This responsiveness not only improves the quality of the data but also fosters trust and collaboration within the cybersecurity community. Real-World Impact “Given enough eyeballs, all bugs are shallow,” famously said Eric S. Raymond in The Cathedral and the Bazaar. Vulnrichment exemplifies this philosophy by leveraging the collective expertise of the cybersecurity community to refine and enrich CVE data. But this initiative is more than an academic exercise. It’s a practical, ongoing effort to make vulnerability data more useful and actionable for everyone—from researchers and analysts to IT managers. By adding operational context, scoring, and detailed analysis, Vulnrichment empowers organizations to make smarter, faster decisions about their cybersecurity posture. Why Vulnrichment Matters The ability to quickly assess the risk posed by a vulnerability and take action can mean the difference between an attack and a breach. Vulnrichment equips cybersecurity teams with the insights they need to stay one step ahead of attackers. With Vulnrichment, CISA isn’t just enhancing CVE data—it’s building a dynamic, living resource that benefits the entire cybersecurity ecosystem. And in a field where every second counts, that’s a power-up no one can afford to ignore.

image for CVE-2025-0411 – vu ...

 Business

The vulnerability CVE-2025-0411 has been discovered in the popular 7-Zip file archiver software, allowing attackers to bypass the Mark-of-the-Web protection mechanism. CVE-2025-0411 has a 7.0 CVSS rating. The vulnerability was quickly fixed, but since the program doesnt have an automatic update mechanism, some users   show more ...  

may still have a vulnerable version. Thats why we recommend immediately updating the archiver. What is Mark-of-the-Web? The Mark-of-the-Web (MOTW) mechanism involves placing a special metadata mark on files obtained from the internet. If such a mark is present, the Windows operating system considers such a file to be potentially dangerous. If the file is executable, the user sees a warning that it can cause harm when trying to execute it. Also, some programs limit the functionality of a file with this mark (for example, MS Office applications block the execution of macros in them). When an archive is downloaded from the internet, when it is unpacked, all the files should inherit this Mark-of-the-Web. Malefactors have repeatedly been trying to get rid of the MOTW in order to mislead the user. In particular, several years ago we wrote that the BlueNoroff APT group had adopted methods to bypass this mechanism. According to the MITRE ATT&CK matrix classification, bypassing the MOTW mechanism belongs to sub-technique T1553.005: Subvert Trust Controls: Mark-of-the-Web Bypass. What is the CVE-2025-0411 vulnerability, and how is it dangerous? CVE-2025-0411 allows attackers to create an archive in such a way that when its unpacked by 7-Zip, the files wont inherit the MOTW mark. As a result, an attacker can exploit this vulnerability to launch malicious code with user privileges. Of course, such a vulnerability is dangerous not in and of itself, but as part of a complex attack. In addition, to exploit it, the user must launch a malicious file manually. However, as weve already mentioned above, attackers often try to remove this mark, so giving them an extra way to do this is clearly a big no-no. Researchers discovered CVE-2025-0411 back in November last year, and immediately reported it to the author of 7-Zip. This is why version 24.09, published on November 29, 2024, is no longer vulnerable. How to stay safe First of all, you should update 7-Zip to version 24.09 or newer. If this file archiver is used in your organization, we recommend updating it centrally (if there are appropriate tools), or at least notifying that it needs urgently updating. Kaspersky products for home users can check a number of widely used software products (including 7-Zip) and update them automatically. In addition, we recommend all internet users to handle files received from the internet with exceptional caution, and not to open them on computers without a reliable security solution.

image for MasterCard DNS Error ...

 A Little Sunshine

The payment card giant MasterCard just fixed a glaring error in its domain name server settings that could have allowed anyone to intercept or divert Internet traffic for the company by registering an unused domain name. The misconfiguration persisted for nearly five years until a security researcher spent $300 to   show more ...  

register the domain and prevent it from being grabbed by cybercriminals. A DNS lookup on the domain az.mastercard.com on Jan. 14, 2025 shows the mistyped domain name a22-65.akam.ne. From June 30, 2020 until January 14, 2025, one of the core Internet servers that MasterCard uses to direct traffic for portions of the mastercard.com network was misnamed. MasterCard.com relies on five shared Domain Name System (DNS) servers at the Internet infrastructure provider Akamai [DNS acts as a kind of Internet phone book, by translating website names to numeric Internet addresses that are easier for computers to manage]. All of the Akamai DNS server names that MasterCard uses are supposed to end in “akam.net” but one of them was misconfigured to rely on the domain “akam.ne.” This tiny but potentially critical typo was discovered recently by Philippe Caturegli, founder of the security consultancy Seralys. Caturegli said he guessed that nobody had yet registered the domain akam.ne, which is under the purview of the top-level domain authority for the West Africa nation of Niger. Caturegli said it took $300 and nearly three months of waiting to secure the domain with the registry in Niger. After enabling a DNS server on akam.ne, he noticed hundreds of thousands of DNS requests hitting his server each day from locations around the globe. Apparently, MasterCard wasn’t the only organization that had fat-fingered a DNS entry to include “akam.ne,” but they were by far the largest. Had he enabled an email server on his new domain akam.ne, Caturegli likely would have received wayward emails directed toward mastercard.com or other affected domains. If he’d abused his access, he probably could have obtained website encryption certificates (SSL/TLS certs) that were authorized to accept and relay web traffic for affected websites. He may even have been able to passively receive Microsoft Windows authentication credentials from employee computers at affected companies. But the researcher said he didn’t attempt to do any of that. Instead, he alerted MasterCard that the domain was theirs if they wanted it, copying this author on his notifications. A few hours later, MasterCard acknowledged the mistake, but said there was never any real threat to the security of its operations. “We have looked into the matter and there was not a risk to our systems,” a MasterCard spokesperson wrote. “This typo has now been corrected.” Meanwhile, Caturegli received a request submitted through Bugcrowd, a program that offers financial rewards and recognition to security researchers who find flaws and work privately with the affected vendor to fix them. The message suggested his public disclosure of the MasterCard DNS error via a post on LinkedIn (after he’d secured the akam.ne domain) was not aligned with ethical security practices, and passed on a request from MasterCard to have the post removed. MasterCard’s request to Caturegli, a.k.a. “Titon” on infosec.exchange. Caturegli said while he does have an account on Bugcrowd, he has never submitted anything through the Bugcrowd program, and that he reported this issue directly to MasterCard. “I did not disclose this issue through Bugcrowd,” Caturegli wrote in reply. “Before making any public disclosure, I ensured that the affected domain was registered to prevent exploitation, mitigating any risk to MasterCard or its customers. This action, which we took at our own expense, demonstrates our commitment to ethical security practices and responsible disclosure.” Most organizations have at least two authoritative domain name servers, but some handle so many DNS requests that they need to spread the load over additional DNS server domains. In MasterCard’s case, that number is five, so it stands to reason that if an attacker managed to seize control over just one of those domains they would only be able to see about one-fifth of the overall DNS requests coming in. But Caturegli said the reality is that many Internet users are relying at least to some degree on public traffic forwarders or DNS resolvers like Cloudflare and Google. “So all we need is for one of these resolvers to query our name server and cache the result,” Caturegli said. By setting their DNS server records with a long TTL or “Time To Live” — a setting that can adjust the lifespan of data packets on a network — an attacker’s poisoned instructions for the target domain can be propagated by large cloud providers. “With a long TTL, we may reroute a LOT more than just 1/5 of the traffic,” he said. The researcher said he’d hoped that the credit card giant might thank him, or at least offer to cover the cost of buying the domain. “We obviously disagree with this assessment,” Caturegli wrote in a follow-up post on LinkedIn regarding MasterCard’s public statement. “But we’ll let you judge— here are some of the DNS lookups we recorded before reporting the issue.” Caturegli posted this screenshot of MasterCard domains that were potentially at risk from the misconfigured domain. As the screenshot above shows, the misconfigured DNS server Caturegli found involved the MasterCard subdomain az.mastercard.com. It is not clear exactly how this subdomain is used by MasterCard, however their naming conventions suggest the domains correspond to production servers at Microsoft’s Azure cloud service. Caturegli said the domains all resolve to Internet addresses at Microsoft. “Don’t be like Mastercard,” Caturegli concluded in his LinkedIn post. “Don’t dismiss risk, and don’t let your marketing team handle security disclosures.” One final note: The domain akam.ne has been registered previously — in December 2016 by someone using the email address um-i-delo@yandex.ru. The Russian search giant Yandex reports this user account belongs to an “Ivan I.” from Moscow. Passive DNS records from DomainTools.com show that between 2016 and 2018 the domain was connected to an Internet server in Germany, and that the domain was left to expire in 2018. This is interesting given a comment on Caturegli’s LinkedIn post from an ex-Cloudflare employee who linked to a report he co-authored on a similar typo domain apparently registered in 2017 for organizations that may have mistyped their AWS DNS server as “awsdns-06.ne” instead of “awsdns-06.net.” DomainTools reports that this typo domain also was registered to a Yandex user (playlotto@yandex.ru), and was hosted at the same German ISP — Team Internet (AS61969).

 Cybercrime

The new president kept a promise to libertarian supporters that he would pardon Ross Ulbricht, the founder of the Silk Road dark web marketplace, who was convicted a decade ago of charges related to drug distribution, illegal hacking, identity theft and money laundering.

 Feed

Oracle is urging customers to apply its January 2025 Critical Patch Update (CPU) to address 318 new security vulnerabilities spanning its products and services. The most severe of the flaws is a bug in the Oracle Agile Product Lifecycle Management (PLM) Framework (CVE-2025-21556, CVSS score: 9.9) that could allow an attacker to seize control of susceptible instances. "Easily exploitable

 Feed

Web infrastructure and security company Cloudflare on Tuesday said it detected and blocked a 5.6 Terabit per second (Tbps) distributed denial-of-service (DDoS) attack, the largest ever attack to be reported to date. The UDP protocol-based attack took place on October 29, 2024, targeting one of its customers, an unnamed internet service provider (ISP) from Eastern Asia. The activity originated

 Feed

As GenAI tools and SaaS platforms become a staple component in the employee toolkit, the risks associated with data exposure, identity vulnerabilities, and unmonitored browsing behavior have skyrocketed. Forward-thinking security teams are looking for security controls and strategies to address these risks, but they do not always know which risks to prioritize. In some cases, they might have

 Feed

U.S. President Donald Trump on Tuesday granted a "full and unconditional pardon" to Ross Ulbricht, the creator of the infamous Silk Road drug marketplace, after spending 11 years behind bars. "I just called the mother of Ross William Ulbricht to let her know that in honor of her and the Libertarian Movement, which supported me so strongly, it was my pleasure to have just signed a full and

 Feed

A previously undocumented China-aligned advanced persistent threat (APT) group named PlushDaemon has been linked to a supply chain attack targeting a South Korean virtual private network (VPN) provider in 2023, according to new findings from ESET. "The attackers replaced the legitimate installer with one that also deployed the group's signature implant that we have named SlowStepper – a

 Feed

Threat actors are exploiting an unspecified zero-day vulnerability in Cambium Networks cnPilot routers to deploy a variant of the AISURU botnet called AIRASHI to carry out distributed denial-of-service (DDoS) attacks. According to QiAnXin XLab, the attacks have leveraged the security flaw since June 2024. Additional details about the shortcomings have been withheld to prevent further abuse. Some

 Feed

The new Trump administration has terminated all memberships of advisory committees that report to the Department of Homeland Security (DHS).  "In alignment with the Department of Homeland Security's (DHS) commitment to eliminating the misuse of resources and ensuring that DHS activities prioritize our national security, I am directing the termination of all current memberships on advisory

 1 - Cyber Security News Post

Source: www.mcafee.com – Author: Brooke Seipel. Inauguration Day has come and gone, and the peaceful transfer of power couldn’t have happened without the intricate systems that ensure the integrity of the electoral process—specifically, cybersecurity. Behind the scenes, a vast network of digital defenses   show more ...  

worked to protect elections from disinformation, cyberattacks, and manipulation, all of which […] La entrada From Election Day to Inauguration: How Cybersecurity Safeguards Democracy – Source:www.mcafee.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: heimdalsecurity.com – Author: Cristian Neagu Did you know? — Recent research shows that 80% of cyberattacks happen due to unpatched software vulnerabilities. This highlights the critical role of automated patch management software in safeguarding systems. These tools not only streamline updates but   show more ...  

also fortify your systems against evolving cyber threats. In this article, we’ll […] La entrada Best Automated Patch Management Software in 2025 – Source: heimdalsecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: heimdalsecurity.com – Author: Cristian Neagu Nowadays, cyber threats are more sophisticated and common than ever.  Companies face significant risks from breaches, ransomware, and other malicious activities, leading to financial loss, reputational damage, and operational disruptions. Strong incident   show more ...  

response capabilities are now essential. Investing in top-tier incident response software is crucial. These tools offer comprehensive […] La entrada The 12 Best Incident Response Software On the Market in 2025 – Source: heimdalsecurity.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 0CISO2CISO

During their golden anniversary, the University of North Dakota Section welcomed back alumni to celebrate their outstanding milestone. Source Views: 0 La entrada University of North Dakota Section Celebrates 50 Years se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: TechTarget and Informa Tech’s Digital Business Combine.TechTarget and Informa TechTarget and Informa Tech’s Digital Business Combine. Together, we power an unparalleled network of 220+ online properties covering 10,000+ granular topics, serving an audience of 50+   show more ...  

million professionals with original, objective content from trusted sources. We help you gain critical insights and […] La entrada [Virtual Event]: Cybersecurity’s Most Promising New and Emerging Technologies – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Becky Bracken, Senior Editor, Dark Reading Source: Sipa USA via Alamy Stock Photos NEWS BRIEF Chris Krebs just got let go for the second time by President Trump. In its first full day, the Trump administration axed all advisory committee members within the Department of   show more ...  

Homeland Security, including the people that […] La entrada Trump Fires Cyber Safety Board Investigating Salt Typhoon Hackers – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Kristina Beek, Associate Editor, Dark Reading Source: True Images via Alamy Stock Photo NEWS BRIEF Sophos X-Ops’ Managed Detection and Response (MDR) is warning of ransomware attacks using email bombing as well as imitating tech support, otherwise known as vishing,   show more ...  

through Microsoft Office 365. These attacks are tied to two separate […] La entrada Email Bombing, ‘Vishing’ Tactics Abound in Microsoft 365 Attacks – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Jai Vijayan, Contributing Writer Source: SROOLOVE via Shutterstock Advanced persistent threat group “DONOT Team” is leveraging two nearly identical Android applications to conduct intelligence-gathering operations targeting individuals and groups in India who   show more ...  

appear to be of national security interest to the country. The “Tanzeem” and “Tanzeem Update” apps purport to be […] La entrada DONOT Group Deploys Malicious Android Apps in India – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Kristina Beek, Associate Editor, Dark Reading Source: JHVEPhoto via Alamy Stock Photo NEWS BRIEF Hewlett Packard Enterprise (HPE) is conducting an investigation after a threat actor said it had stolen data from the company’s network. IntelBroker, a cyberattack group   show more ...  

that has been active since at least 2022, claimed responsibility for the […] La entrada HPE Investigates After Alleged Data Breach – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.darkreading.com – Author: Elizabeth Montalbano, Contributing Writer Source: Aleksey Funtap via Alamy Stock Photo Separate spinoffs of the infamous Mirai botnet are responsible for a fresh wave of distributed denial-of-service (DDoS) attacks globally. One is exploiting specific vulnerabilities in   show more ...  

Internet of Things (IoT) devices to establish “expansive” botnet networks, while the other has been […] La entrada Mirai Botnet Spinoffs Unleash Global Wave of DDoS Attacks – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2025-01
Aggregator history
Wednesday, January 22
WED
THU
FRI
SAT
SUN
MON
TUE
JanuaryFebruaryMarch