Duo's Security Blog

FEBRUARY 16, 2024

Authentication failures due to out-of-date software surge by 74.7%, with most accounts only seeing 20%-40% of browsers operating with the “latest” updates. Devices that are no longer supported or have not been updated with the latest security patches are often riddled with vulnerabilities that can be exploited by cyber attackers.

Authentication 100

Authentication Accountability Risk Mobile 100

eSecurity Planet

NOVEMBER 10, 2022

Microsoft’s November 2022 Patch Tuesday includes fixes for more than 60 vulnerabilities affecting almost 40 different products, features and roles – including patches for CVE-2022-41040 and CVE-2022-41082 , the ProxyNotShell flaws disclosed last month. ” See the Top Patch Management Products.

Phishing 108

Phishing Malware Cybersecurity Network Security 108

Security Boulevard

FEBRUARY 28, 2022

As key enablers of digital supply networks, IIoT technologies help to change the way that products are made and delivered, making factories more efficient, ensuring better safety for human operators, and, in some cases, saving millions of dollars. Benefits of IIoT in the manufacturing sector. Inventory management. Smart packaging.

Manufacturing 98

Manufacturing IoT Authentication Artificial Intelligence 98

NopSec

JANUARY 31, 2024

Researchers discovered that the same mechanism that facilitated path traversal via classname manipulation could also be exploited to define ColdFusion specific elements, i.e. server side scripts, which includes the <cfexecute> tag used to start a process on the server. We encourage everyone to read the full blog at SecureLayer7.

VPN 59

VPN Government Risk Hacking 59

Krebs on Security

NOVEMBER 28, 2022

In a blog post responding to the Reuters story, Pushwoosh said it is a privately held company incorporated under the state laws of Delaware, USA, and that Pushwoosh Inc. used to outsource development parts of the product to the Russian company in Novosibirsk, mentioned in the article,” the company said. “Pushwoosh Inc.

Mobile 231

Mobile Malware Technology Government 231

Security Affairs

FEBRUARY 14, 2019

SAP released a collection of security fixes for February 2019 that address 13 vulnerabilities in its products, including a Hot News flaw in SAP HANA XSA. SAP Security Patch Day for February 2019 includes 13 Security Notes and 3 updates to previously released security notes. ” reads the advisory published by SAP. .”

Advertising 72

Advertising Manufacturing Mobile Authentication 72

Troy Hunt

FEBRUARY 11, 2018

This tag was in the source code over at secure.donaldjtrump.com/donate-homepage yet it was pulling script directly off Igor Escobar's GitHub repository for the project. You can safely use an integrity attribute on your script tag because if ever we want to change the implementation, we'll simply rev the version.

Government 245

Government Risk Software Technology 245

Security Boulevard

AUGUST 4, 2021

While open-source code can make product development faster, it also comes with security risks. Scorecards are a way for developers to build trust, risk, and security into their products. Automatic Dependency Update. This check only reviews whether a project uses these technologies, not whether the project is updated.

Software 82

Software Risk Government Technology 82

Krebs on Security

MAY 11, 2021

. “We are apolitical, we do not participate in geopolitics, do not need to tie us with a defined government and look for other our motives [sic],” reads an update to the DarkSide Leaks blog. When you use our product and the ransom is paid, we guarantee fair distribution of the funds. New experience and stable income.

Ransomware 363

Ransomware Advertising Healthcare Penetration Testing 363

SiteLock

AUGUST 27, 2021

Have you ever had trouble keeping up with your blog post schedule? If you’ve hit a wall with blogging, it’s likely due to one of these reasons: A lack of time. There are many forms of content you can find and share: Articles (blog posts). Reviews (books, recipes, products). A lack of inspiring subject matter. Interviews.

Marketing 52

Marketing 52

IT Security Guru

MAY 24, 2021

production or test), which helps identify business-critical assets and tag them automatically. End-of-life (EOL) and end-of-service (EOS) software : Especially when software is EOS and no more security updates are available, risk is high since mitigations are limited or nonexistent. Detect and Monitor Asset Health.

Cybersecurity 108

Cybersecurity Risk Software Data collection 108

Krebs on Security

MARCH 2, 2020

An individual thought to be involved has earned accolades from the likes of Apple , Dell , and Microsoft for helping to find and fix security vulnerabilities in their products. ” A review of Majidi’s Facebook profile shows that phrase as his tag line, and that he has signed several of his posts over the years as “Fatal.001.”

DNS 252

DNS Penetration Testing Malware Hacking 252

McAfee

OCTOBER 30, 2020

MVISION Cloud, as part of the MVISION family of products at McAfee, is recognized as a Leader in the report; and for the fourth year in a row. Documentation – Access to all product documentation. Demo – Covering over 50 Gartner-defined use cases to validate product capabilities. You can read them here.

Marketing 86

Marketing Architecture Risk Encryption 86

Security Boulevard

FEBRUARY 1, 2022

We are excited to announce the Velocity Update for our application security platform, ShiftLeft CORE! With this update, AppSec and Development teams can fix security issues in source code even more quickly and efficiently. The update adds a number of improvements to the platform that can be found at the end of this post.

Mobile 52

Mobile Accountability Education Engineering 52

Security Boulevard

JUNE 14, 2022

Highlights of June SAP Security Notes analysis include: June Summary— 17 new and updated SAP security patches released, including one HotNews notes and three High Priority notes. SAP has released 17 new and updated SAP Security Notes in its June 2022 patch release, including the notes that were released since last Patch Day.

Cybersecurity 52

Cybersecurity 52

eSecurity Planet

AUGUST 10, 2023

Threat intelligence feeds are continually updated streams of data that inform users of different cybersecurity threats, their sources, and any infrastructure impacted or at risk of being impacted by those threats. There are also costs associated with the USM product, which users often connect to OTX.

Internet 86

Internet Internet Cybersecurity Malware 86

Kali Linux

MAY 29, 2023

For users who upgrade their Kali installation though, a reminder: the right command to upgrade your system is sudo apt update && sudo apt full-upgrade. Desktop Updates Xfce In this release we pre-installed a nifty extension for the Xfce File Manager: GtkHash. Your browser does not support the video tag. Nothing special.

Firmware 52

Firmware Phishing Architecture Authentication 52

Security Affairs

FEBRUARY 9, 2021

Microsoft February 2021 Patch Tuesday security updates address 56 CVEs in multiple products, including Windows components,NET Framework, Azure IoT, Azure Kubernetes Service, Microsoft Edge for Android, Exchange Server, Office and Office Services and Web Apps, Skype for Business and Lync, and Windows Defender.

DNS 97

DNS IoT Backups Mobile 97

Security Boulevard

OCTOBER 19, 2022

The vulnerability is tagged with a CVSS score of 9.6 Details about the report can be found in our blog post How Do You Check Old Hashes in Your ABAP System? Don’t grant debugging authorizations in production. This should be avoided, especially assigning authorizations to change values in production .

Passwords 62

Passwords Risk Phishing Architecture 62

eSecurity Planet

NOVEMBER 16, 2021

This is a major headache for security product vendors. Everyone is scrambling to update their tools to identify and eliminate the threats. HTML smuggling uses both the HTML5 “download” attribute and a JavaScript Blog to pull together the payload after it is downloaded into the victim’s device. Leveraging HTML5 and JavaScript.

Firewall 121

Firewall Ransomware Banking Malware 121

SiteLock

AUGUST 27, 2021

Leveraging your skills with your personal passions is typically a recipe for success – such as tutoring, graphic design, or selling products you make or buy wholesale. Then you can set up a business email address, develop high-level messaging for your business like a tag line, and design a logo or hire someone to do it for you.

Marketing 98

Marketing eCommerce Internet Internet 98

ForAllSecure

SEPTEMBER 4, 2020

The researchers at VDA Labs said in a blog post “a bad actor could use this bug to develop an exploit, which could result in something like the compromise of a workstation running MP3Gain.” In this blog, we will cover: 1) VDA Labs. 2) Finding CVE-2020-15359. 3) Setting up Mayhem. 4) What was found. 5) Verification.

IoT 52

IoT Technology 52

ForAllSecure

SEPTEMBER 3, 2020

The researchers at VDA Labs said in a blog post “a bad actor could use this bug to develop an exploit, which could result in something like the compromise of a workstation running MP3Gain.” In this blog, we will cover: 1) VDA Labs. 2) Finding CVE-2020-15359. 3) Setting up Mayhem. 4) What was found. 5) Verification.

IoT 52

IoT 52

ForAllSecure

SEPTEMBER 3, 2020

The researchers at VDA Labs said in a blog post “a bad actor could use this bug to develop an exploit, which could result in something like the compromise of a workstation running MP3Gain.” In this blog, we will cover: 1) VDA Labs. 2) Finding CVE-2020-15359. 3) Setting up Mayhem. 4) What was found. 5) Verification.

IoT 52

IoT 52

Kali Linux

MAY 31, 2021

This release welcomes a mixture of new items as well as enhancements of existing features, and is ready to be downloaded (from our updated page) or upgraded if you have an existing Kali Linux installation. Say hello to Kali Linux 2021.2 ! A quick summary of the changelog since the 2021.1 Releasing Kali-Tweaks v1.0 Announcing Kali-Tweaks !

Engineering 52

Engineering Firmware Architecture Backups 52

Security Boulevard

DECEMBER 9, 2022

Pipeline (deploying code to production compute platforms). Appropriately name and tag each container image. Enacting several techniques (such as rolling updates and node pool migrations) to complete updates without much disruption. Registries, or container management stacks (shared containers). UTM Medium. UTM Source.

Architecture 67

Architecture Risk Accountability Software 67

SecureList

APRIL 27, 2021

The attackers used vulnerabilities in an SSL-VPN product to deploy a multi-layered loader we dubbed Ecipekac (aka DESLoader, SigLoader and HEAVYHAND). In November and December 2020, two public blog posts were published about this campaign. We attribute this activity to APT10 with high confidence.

Malware 138

Malware Spyware Government Social Engineering 138

CyberSecurity Insiders

FEBRUARY 25, 2022

This blog was jointly written with Santiago Cortes. According to these blogs, at least 10 companies may have been impacted by these ransomware campaigns in the first two weeks of February. Blog BotenaGo. Maintain software with the latest security updates. Executive summary. Recommended actions.

Ransomware 119

Ransomware Encryption Malware Backups 119

Security Boulevard

MARCH 4, 2022

In January 2022, Adobe released a security update for vulnerabilities in Adobe Acrobat and Reader. The update fixed five vulnerabilities (CVE-2021-44703, CVE-2021-44708, CVE-2021-44709, CVE-2021-44740, and CVE-2021-44741) discovered by Zscaler’s ThreatLabz. Foxit has also released a security update to fix CVE-2021-44708.

Software 98

Software 98

Malwarebytes

JULY 23, 2021

This blog post was authored by Hasherezade. In this blog we will take a look at AvosLocker a solid, yet not too fancy new ransomware family that has already claimed several victims. Yet, it is easy to reveal the used function names with the help of tracing and tagging. The ransomware encrypts all attached drives.

Ransomware 133

Ransomware Encryption Malware Backups 133

NetSpi Technical

JULY 13, 2023

Continuing our series on Anti-Scraping techniques, this blog covers implementation of Anti-Scraping protections in a fake message board and examination of how scrapers can adapt to these changes. This will more than likely require manual investigations and extensive testing in pre-production environments. Host: 127.0.0.1:12345

Accountability 52

Accountability Authentication Passwords VPN 52

Troy Hunt

JUNE 10, 2019

Search for your account across multiple breaches [link] — Have I Been Pwned (@haveibeenpwned) December 4, 2013 I’ll save the history lesson for the years between then and today because there are presently 106 blog posts with the HIBP tag you can go and read if you’re interested, let me just talk briefly about where the service is at today.

Data breaches 279

Data breaches Passwords InfoSec Accountability 279

Malwarebytes

JULY 23, 2021

This blog post was authored by Hasherezade. In this blog we will take a look at AvosLocker a solid, yet not too fancy new ransomware family that has already claimed several victims. Yet, it is easy to reveal the used function names with the help of tracing and tagging. The ransomware encrypts all attached drives.

Ransomware 87

Ransomware Encryption Malware Backups 87

The Last Watchdog

OCTOBER 19, 2021

I’m productive. For example, we are currently using Wildland to help us organize the knowledge we’ve gained during the developmental process so far, but also as an “after-hours” media swap hangout, where we share interesting documents with each other (a short blog post explaining both of these use-cases is available at [link] ).

Internet 223

Internet Internet Cryptocurrency Software 223

Troy Hunt

JANUARY 10, 2018

Much of what I'm going to cover in the remainder of this blog post will focus on the site at uidai.gov.in To add/update new number, visit nearest Aadhaar Kendra (Locate: [link] ) #AadhaarEssentials pic.twitter.com/dyOgCpLAGz — Aadhaar (@UIDAI) January 8, 2018. rather than on the various subdomains.

Hacking 279

Hacking Government Risk Encryption 279

SecureList

NOVEMBER 14, 2022

Last June, Google’s TAG team released a blog post documenting attacks on Italian and Kazakh users that they attribute to RCS Lab, an Italian offensive software vendor. In line with our predictions, we released two blog posts in 2022 introducing sophisticated low-level bootkits.

Firmware 106

Firmware Surveillance Mobile Telecommunications 106

Cisco Security

APRIL 21, 2021

This blog is co-authored by Mohammad Iqbal and is part four of a four-part series about DevSecOps. The trend towards accelerated application development, and regular updates to an architecture through an agile methodology, reduces the efficacy and effectiveness of point-in-time threat modeling. We’d love to hear what you think.

Architecture 90

Architecture Risk Engineering 90