Security Affairs

JANUARY 17, 2024

GitHub rotated some credentials after the discovery of a flaw that allowed access to the environment variables of a production container. “On December 26, 2023, GitHub received a report through our Bug Bounty Program demonstrating a vulnerability which, if exploited, allowed access to credentials within a production container.”

Authentication 97

Authentication Encryption Accountability Risk 97

Security Boulevard

JUNE 20, 2023

Learn how to leverage CeWL to generate custom word lists from release notes, changelogs, and product roadmaps for use in API discovery. The post A “cewl” way for API discovery appeared first on Dana Epp's Blog. The post A “cewl” way for API discovery appeared first on Security Boulevard.

Hacking 52

Hacking 52

Security Boulevard

JANUARY 31, 2024

In recent developments, GitHub, a Microsoft-owned subsidiary, has taken proactive measures to address a security vulnerability potentially exposing credentials within production containers. In this article, we’ll analyze the GitHub vulnerability incident, shedding light on the key rotations and the security landscape surrounding the issue.

Encryption 64

Encryption Cybersecurity 64

Security Affairs

DECEMBER 9, 2022

The vulnerability is due to insufficient input validation of received Cisco Discovery Protocol packets. An attacker could exploit this flaw by sending specially crafted Cisco Discovery Protocol packets to an affected device. “This vulnerability is due to insufficient input validation of received Cisco Discovery Protocol packets.

Wireless 103

Wireless Firmware Hacking Information Security 103

Security Boulevard

JANUARY 25, 2024

This directive is in response to the discovery of zero-day vulnerabilities in products from Ivanti, a Utah-based software company. Cybersecurity and Infrastructure Security Agency (CISA) has kicked off the year with an emergency directive that demands immediate action from Federal Civilian Executive Branch (FCEB) agencies.

Software 64

Software Cybersecurity 64

Krebs on Security

FEBRUARY 26, 2020

Today, Zyxel acknowledged the same flaw is present in many of its firewall products. This week’s story on the Zyxel patch was prompted by the discovery that exploit code for attacking the flaw was being sold in the cybercrime underground for $20,000. “Do not leave the product directly exposed to the internet.

Firewall 250

Firewall Firmware VPN IoT 250

The Hacker News

MARCH 4, 2023

This past January, a SaaS Security Posture Management (SSPM) company named Wing Security (Wing) made waves with the launch of its free SaaS-Shadow IT discovery solution. Cloud-based companies were invited to gain insight into their employees' SaaS usage through a completely free, self-service product that operates on a "freemium" model.

84

84

Security Boulevard

NOVEMBER 23, 2023

Product Update: Version 4.1 Web management address discovery now becomes a breeze with Autodetection. The release of 4.1 comes with some exciting updates. Firmware Updates now support Panduit Gen5 and nVent Enlogic EN2.0 Not to mention, the Location Layout offers enhanced floor plan visualization with convenient export options.

Firmware 59

Firmware Software 59

CSO Magazine

MAY 4, 2023

Cloud-native, patch-management application provider Action1 is set to add vulnerability discovery and prioritization capabilities to its namesake flagship platform to help businesses stay ahead of software exploits. With this new combined product offering, enterprises will be able to make better prioritization decisions.”

Software 100

Software Cybersecurity 100

Daniel Miessler

APRIL 2, 2023

Enter AI, which promises to address these shortcomings with two fundamental advantages: Context and Question-based security products. Context and question-based security products will reshape the industry, forcing companies to adapt or risk obsolescence. The key to success? Better data/state/context and better questions.

InfoSec 168

InfoSec Software Information Security Risk 168

NetSpi Executives

MARCH 5, 2024

Gartner wrote a report that explains EASM in-depth, including why asset discovery is the tip of the EASM iceberg, and how EASM support Continuous Threat Exposure Management. According to Gartner, “Common EASM capabilities include: Performing external asset discovery of a variety of environments (on-premises and cloud).

Penetration Testing 64

Penetration Testing Technology Marketing Mobile 64

Security Affairs

MARCH 28, 2024

In 2023, the researchers observed 36 zero-day vulnerabilities exploited in the wild targeting enterprise-specific technologies, while 61 vulnerabilities affected end-user platforms and products such as mobile devices, operating systems, browsers, and other applications. ” concludes the report. ” concludes the report.

Government 110

Government Surveillance Cybercrime Ransomware 110

Security Boulevard

NOVEMBER 29, 2022

Recently, I have been working on adding support for automated enumeration and discovery of NTLM authentication endpoints to Chariot, our external attack surface and continuous automated red teaming product scanning pipeline. The post Automating the Discovery of NTLM Authentication Endpoints appeared first on Praetorian.

Authentication 52

Authentication Passwords 52

Security Boulevard

MAY 22, 2023

Get a Comprehensive, Intelligent SaaS Inventory Because SaaS is no longer just a security problem, there are multiple products on the market that are attempting to help companies discover and manage SaaS usage. Each product has a unique approach but uses one of seven standard discovery methods listed below.

Risk 64

Risk Marketing 64

Joseph Steinberg

DECEMBER 14, 2020

government instructed all of its civilian agencies to immediately shut off various popular network and system management products being exploited as part of an ongoing cyberattack. ”The Russian Embassy, however, has decried the finger pointing as “baseless,” denying that the country has any ongoing offensive cyber-operations at all.

Government 246

Government Cybersecurity Software Engineering 246

Krebs on Security

DECEMBER 5, 2022

The court ultimately suspended the discovery process against Google, saying there was reason to believe the defendants sought discovery only “to learn whether they could circumvent the steps Google has taken to block the malware.” He said his goal is to get the case back into court.

Cybercrime 227

Cybercrime Malware Internet Internet 227

The Last Watchdog

NOVEMBER 14, 2023

Previously, he served as the CEO and President of Bugcrowd, where he successfully led the company’s rapid scaling by transforming it into a multi-product, industry-leading platform. His vision and ability to execute are invaluable as we continue expanding our product line and customer base. Gupta will also join the 1touch.io

Data privacy 100

Data privacy Digital transformation Marketing Technology 100

The Hacker News

DECEMBER 8, 2021

Network security vendor SonicWall is urging customers to update their SMA 100 series appliances to the latest version following the discovery of multiple security vulnerabilities that could be abused by a remote attacker to take complete control of an affected system. 31sv and earlier, 10.2.0.8-37sv,

Network Security 88

Network Security 88

eSecurity Planet

DECEMBER 20, 2023

Attack surface management (ASM) is a relatively new cybersecurity technology that combines elements of vulnerability management and asset discovery with the automation capabilities of breach and attack simulation (BAS) and applies them to an organization’s entire IT environment, from networks to the cloud.

Software 113

Software Risk Architecture Internet 113

Security Affairs

OCTOBER 8, 2023

Cybersecurity researchers at Human Security discovered a global network of consumer products, dubbed BADBOX, with firmware backdoors installed and sold through a compromised hardware supply chain. Products containing the malicious backdoor have been found on public school networks throughout the United States.

Firmware 143

Firmware Mobile Malware Retail 143

CyberSecurity Insiders

SEPTEMBER 20, 2022

Attack surface management is generally defined as taking an adversarial perspective on the continuous discovery, inventory, classification, and monitoring of an organization’s surface area… and then doing something about it. However, taking an outside-in approach to SaaS discovery can help.

Threat Detection 128

Threat Detection Risk Penetration Testing DNS 128

Security Affairs

OCTOBER 21, 2020

The flaw resides in the Cisco Discovery Protocol implementation for Cisco IOS XR Software and could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload an affected device. “The vulnerability is due to improper validation of string input from certain fields in Cisco Discovery Protocol messages.

Advertising 112

Advertising Software Hacking 112

CSO Magazine

MAY 17, 2023

Entro, the Israeli cybersecurity company focused on protection for secrets and programmatic access to cloud services and data, has exited stealth with its first-ever product offering context-based secrets management.

CISO 81

CISO Cybersecurity 81

Thales Cloud Protection & Licensing

FEBRUARY 19, 2024

We will describe the value in providing granular cryptographic insights provided by AgileSec ™ Analytics into Thales products like CipherTrust Manager (CTM) and Luna Hardware Security Modules (HSM) which will ensure enhanced security, compliance, and operational efficiency.

InfoSec 71

InfoSec Encryption Risk Marketing 71

IT Security Guru

MARCH 2, 2024

E-Discovery and Litigation Support The advent of electronic discovery (e-discovery) has revolutionised the way legal professionals handle evidence in litigation. E-discovery tools streamline the review process, helping legal professionals to identify relevant information, reduce costs, and meet tight deadlines.

Data privacy 52

Data privacy Digital transformation Data breaches Technology 52

Anton on Security

OCTOBER 21, 2020

From Google Cloud Blog: “Improving security, compliance, and governance with cloud-based DLP data discovery” So, I’ve been doing some blogging at Google Cloud blog with most posts connected to products, launches, etc. These and other similar cases have elevated the importance of data discovery, a key component of DLP technology.

Government 100

Government Cloud Migration Data breaches Risk 100

CSO Magazine

AUGUST 10, 2022

BigID’s core product, its Data Intelligence platform, already boasts numerous capabilities focused on the privacy, organization and discovery of a company's data.

77

77

CyberSecurity Insiders

MARCH 13, 2022

By Raffael Marty, SVP, Product, Cybersecurity at ConnectWise. The incident can result in compromised customer data, a tarnished reputation, and loss of productivity. Asset Discovery. Accounting for all of your assets not only increases your operational productivity, but it can also lower your overall security risk.

Ransomware 131

Ransomware Backups Software CISO 131

Veracode Security

MARCH 30, 2023

On one hand, it can make new experiences possible and elevate productivity. Getting faster at creating and finding security flaws does not make us faster at fixing them; data shows us that one in four vulnerabilities remain open well over a year after first discovery. Technology is a double-edged sword.

Technology 59

Technology Software Risk Cybersecurity 59

Security Affairs

JULY 18, 2021

The Cyberspace Administration of China (CAC) has issued a new exacerbated vulnerability disclosure regulation that requires white hat hackers uncovering critical zero-day flaws in computer systems to first report them to the government authorities within two days from their discovery.

Government 99

Government Hacking Technology Cybersecurity 99

CyberSecurity Insiders

MAY 25, 2023

Here are some key considerations: Positive Impacts Increased Efficiency and Productivity: AI has the potential to automate repetitive tasks, allowing humans to focus on more complex and creative endeavors. This can lead to enhanced productivity and efficiency in various industries.

Technology 101

Technology Healthcare Risk Cybersecurity 101

SecureWorld News

FEBRUARY 14, 2023

Apple users are being urged to update their devices as soon as possible, following the discovery of multiple Zero-Day vulnerabilities that are actively being exploited by hackers. Apple has been taking steps to enhance the security of its products against these types of attacks.

Spyware 62

Spyware 62

Anton on Security

NOVEMBER 2, 2023

src: TH8 report “In the Q2 2022 Threat Horizons Report, we highlight that a disproportionate percentage of attackers opportunistically use coin mining across Cloud products and alter their tactics to evade discovery. This is consistent with this quarter’s findings, as this is the most observed outcome from compromises.” [A.C.

Cybersecurity 130

Cybersecurity Healthcare Account Security Accountability 130

Thales Cloud Protection & Licensing

NOVEMBER 11, 2021

It is expensive because it requires choosing, implementing, and monitoring an assortment of products from multiple vendors, and additional management and computing time once it’s up and running. Nisha Amthul | Senior Product Marketing Manager. Encrypting everything is time intensive because of explosive data growth.

Encryption 71

Encryption Unstructured Data Risk Big data 71

Malwarebytes

MARCH 5, 2024

A California federal judge has ordered spyware maker NSO Group to hand over the code for Pegasus and other spyware products that were used to spy on WhatsApp users. This is likely also the reason why NSO Group claimed to be excused of all its discovery obligations in the case, due to various US and Israeli restrictions.

Spyware 133

Spyware Government Mobile Encryption 133

Security Affairs

JULY 20, 2021

The discovery was casually made several months ago, while experts were configuring a brand new HP printer, and noticed that an old printer driver from 2005 called SSPORT.SYS was triggering an alert by Process Hacker. 20 May, 2021 – We notified HP that the “affected products” listing is incomplete and provided extra information.

Encryption 116

Encryption Accountability Software Hacking 116

Security Affairs

JULY 13, 2022

IT giant Lenovo released security fixes to address three vulnerabilities that impact the UEFI firmware shipped with over 70 product models. CVE-2022-1891: A buffer overflow has been identified in the SystemLoadDefaultDxe driver in some Lenovo notebook products which may allow an attacker with local privileges to execute arbitrary code.

Firmware 130

Firmware Hacking Technology Information Security 130