Security Affairs

JULY 11, 2022

The group’s leader with identical alias in communications on Dark Web forums outlined Rust as one of the competitive advantages of their locker compared to Lockbit and Conti. Both projects are using an advanced set of JS-based obfuscation to protect the page from analysis managed by 3 scripts written in the same way. .

Ransomware 83

Ransomware Passwords Data breaches Technology 83

BH Consulting

OCTOBER 11, 2022

This two-part blog aims to explain what they are, and why we’re hearing so much about them these days. Recital 30 of the GDPR outlines how a person may be associated with online identifiers their devices and apps provide, such as IP addresses, cookie identifiers and identification tags. What are cookies? Review new vendors via CMP.

Advertising 121

Advertising 121

eSecurity Planet

AUGUST 10, 2023

Additionally, dashboards share data about threat names, any relevant reference URLs, tags, adversary and malware families, and attack IDs. URLhaus manages three primary feeds that focus on specific IP address and domain name anomalies. The Internet Storm Center manages to differentiate itself in several ways.

Internet 72

Internet Internet Cybersecurity Malware 72

SecureList

JULY 25, 2022

One of our industry partners, Qihoo360, published a blog post about an early variant of this malware family in 2017. The malware sets up a malicious hook in the boot manager, allowing it to modify Windows’ kernel loader before it is executed. Affected devices.

Firmware 143

Firmware DNS Malware Technology 143

ForAllSecure

MARCH 29, 2023

In the following sections, we will discuss: API Basics Common API Security Vulnerabilities Best Practices for API Security How to do API Security Automatically By the end of this blog post, you will have a good understanding of API security and the steps you can take to easily secure your APIs. API Basics: What Is an API and How Do APIs Work?

Authentication 40

Authentication Passwords Encryption Software 40

Duo's Security Blog

FEBRUARY 16, 2024

For managed service providers (MSPs), navigating the ever-evolving landscape of access security can be a daunting task. With complex identity stacks and a constant influx of new devices and endpoints, ensuring secure access across your clients' infrastructure requires comprehensive data-driven insights. Get the infographic.

Authentication 102

Authentication Accountability Risk Mobile 102

Security Boulevard

NOVEMBER 30, 2021

A little over a year ago, I switched roles at Oracle and joined the Oracle Cloud Infrastructure (OCI) Product Management team working on Identity and Access Management (IAM) services. It's been an incredibly interesting (and challenging) year leading up to our release of OCI IAM identity domains. .

Authentication 105

Authentication Passwords 105

SecureList

DECEMBER 23, 2020

In this blog, we describe two separate incidents. This Bookcode sample has almost identical functionality as the malware described in the comprehensive report recently published by Korea Internet & Security Agency (KISA). Both malicious programs have almost identical debugging messages. hxxps://www.kne.co[.]kr/upload/Customer/BBS.asp.

Malware 75

Malware Cryptocurrency Encryption Passwords 75

Security Boulevard

FEBRUARY 17, 2022

But the SOP does not limit javascript code, and the HTML <script> tag is allowed to load Javascript code from any origin. Session tampering refers to when attackers can change their session cookie to change how the server interprets their identity. While authentication asks a user to prove their identity: “Who are you?”,

Authentication 105

Authentication Encryption Engineering Firewall 105

Troy Hunt

DECEMBER 3, 2023

The very next day I published a blog post about how I made it so fast to search through 154M records and thus began a now 185-post epic where I began detailing the minutiae of how I built this thing, the decisions I made about how to run it and commentary on all sorts of different breaches. And then ensured could never happen again.

Data breaches 363

Data breaches Passwords Internet Internet 363

Cisco Security

AUGUST 29, 2022

In part one of this issue of our Black Hat USA NOC (Network Operations Center) blog, you will find: Adapt and Overcome. A major concern for the sponsors in their booths was that as the Expo Hall filled with excited attendees, the connectivity of the 900+ iOS devices used for lead management dropped. to fine tune the network.

Engineering 84

Engineering Wireless Malware DNS 84

Troy Hunt

JUNE 30, 2022

Every time this very blog loads Font Awesome from Cloudflare's CDN, for example, it's verified against the hash in the integrity attribute of the script tag (view source for yourself). The 1 hash that won't yield any search results (until Google indexes this blog post.) is the middle one. Phone numbers are PII.

Passwords 309

Passwords Identity Theft Consumer Services Password Management 309

Duo's Security Blog

JANUARY 28, 2022

So it was good to see that in response to last May’s Executive Order 14028 , the Office of Management and Budget (OMB) released a memo Wednesday outlining a new strategy for moving the federal government toward a zero trust cybersecurity posture. Where the Federal government goes, other parts of the private sector follow.

Authentication 52

Authentication Government DNS Encryption 52

Cisco Security

MAY 24, 2021

Why all the buzz around pursuing group-based policy management to achieve zero trust? TrustSec Analytics reports lower the entry point to adopting group-based policy management programs to build network segmentation. Adopting zero-trust initiatives and best practices is all the rage. And rightly so.

Engineering 100

Engineering Architecture Manufacturing Software 100

Lenny Zeltser

FEBRUARY 13, 2020

Having joined Axonius a few months earlier to lead Product Management, I benefited from knowing the company’s business goals, people, and culture. One of my team’s first projects was to unify identity management and deploy Single Sign-On (SSO). What was my first month like? Maybe I’ll see you there.

CISO 79

CISO Information Security Architecture Technology 79

Cisco Security

AUGUST 28, 2023

XDR (eXtended Detection and Response) Integrations At Black Hat USA 2023, Cisco Secure was the official Mobile Device Management, DNS (Domain Name Service) and Malware Analysis Provider. Typically, a CTB deployment requires a broker node and a manager node. We also deployed ThousandEyes for Network Assurance.

Wireless 68

Wireless DNS Mobile Technology 68

Troy Hunt

JUNE 15, 2023

Because I already know who is monitoring which domains and the email address they're using for notifications, that same email address can be used to verify your identity and drop you straight into the dashboard. We can't add a meta tag. We don't have any of those 4 aliases on our domain. We can't upload a file.

Accountability 233

Accountability Small Business InfoSec DNS 233

Security Boulevard

OCTOBER 19, 2022

The vulnerability is tagged with a CVSS score of 9.6 Details about the report can be found in our blog post How Do You Check Old Hashes in Your ABAP System? Our blog post, SAP Security: Change and Transport System , describes two ways, showing how to hide table entries in a regular transport request. User Impersonation.

Passwords 64

Passwords Risk Phishing Architecture 64

Troy Hunt

MARCH 21, 2018

Transparency has been a huge part of that effort and I've always written and spoken candidly about my thought processes, how I handle data and very often, the mechanics of how I've built the service (have a scroll through the HIBP tag on this blog for many examples of each).

Data breaches 183

Data breaches Government Passwords Media 183

SecureList

APRIL 27, 2021

In December, SolarWinds, a well-known IT managed services provider, fell victim to a sophisticated supply-chain attack. The company’s Orion IT, a solution for monitoring and managing customers’ IT infrastructure, was compromised. In November and December 2020, two public blog posts were published about this campaign.

Malware 137

Malware Spyware Government Social Engineering 137

LRQA Nettitude Labs

OCTOBER 18, 2023

As long as the types on the left- and right-hand side of the cast have at least one vftable, and both types were declared within the binary being complied, the object types can be consistently and uniquely determined by their vftable address (with one caveat: comdat folding for identical vftables must be disabled in the linker).

Engineering 91

Engineering 91

Troy Hunt

JUNE 10, 2019

Search for your account across multiple breaches [link] — Have I Been Pwned (@haveibeenpwned) December 4, 2013 I’ll save the history lesson for the years between then and today because there are presently 106 blog posts with the HIBP tag you can go and read if you’re interested, let me just talk briefly about where the service is at today.

Data breaches 279

Data breaches Passwords InfoSec Accountability 279