Tue.Jun 13, 2023

article thumbnail

Identifying the Idaho Killer

Schneier on Security

The New York Times has a long article on the investigative techniques used to identify the person who stabbed and killed four University of Idaho students. Pay attention to the techniques: The case has shown the degree to which law enforcement investigators have come to rely on the digital footprints that ordinary Americans leave in nearly every facet of their lives.

article thumbnail

Microsoft Patch Tuesday, June 2023 Edition

Krebs on Security

Microsoft Corp. today released software updates to fix dozens of security vulnerabilities in its Windows operating systems and other software. This month’s relatively light patch load has another added bonus for system administrators everywhere: It appears to be the first Patch Tuesday since March 2022 that isn’t marred by the active exploitation of a zero-day vulnerability in Microsoft’s products.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

New phishing and business email compromise campaigns increase in complexity, bypass MFA

Tech Republic Security

Read the technical details about a new AiTM phishing attack combined with a BEC campaign as revealed by Microsoft, and learn how to mitigate this threat. The post New phishing and business email compromise campaigns increase in complexity, bypass MFA appeared first on TechRepublic.

Phishing 214
article thumbnail

Chinese hackers used VMware ESXi zero-day to backdoor VMs

Bleeping Computer

VMware patched today a VMware ESXi zero-day vulnerability exploited by a Chinese-sponsored hacking group to backdoor Windows and Linux virtual machines and steal data. [.

Hacking 145
article thumbnail

How to Avoid Pitfalls In Automation: Keep Humans In the Loop

Speaker: Erroll Amacker

Automation is transforming finance but without strong financial oversight it can introduce more risk than reward. From missed discrepancies to strained vendor relationships, accounts payable automation needs a human touch to deliver lasting value. This session is your playbook to get automation right. We’ll explore how to balance speed with control, boost decision-making through human-machine collaboration, and unlock ROI with fewer errors, stronger fraud prevention, and smoother operations.

article thumbnail

Cyberattacks surge to 61% of small and medium-sized businesses, says study

Tech Republic Security

A poll of security software buyers shows 39% of small and medium-sized businesses lost customer data due to cyberattacks. The post Cyberattacks surge to 61% of small and medium-sized businesses, says study appeared first on TechRepublic.

Software 203
article thumbnail

Pirated Windows 10 ISOs install clipper malware via EFI partitions

Bleeping Computer

Hackers are distributing Windows 10 using torrents that hide cryptocurrency hijackers in the EFI (Extensible Firmware Interface) partition to evade detection. [.

Firmware 145

LifeWorks

More Trending

article thumbnail

Microsoft June 2023 Patch Tuesday fixes 78 flaws, 38 RCE bugs

Bleeping Computer

Today is Microsoft's June 2023 Patch Tuesday, with security updates for 78 flaws, including 38 remote code execution vulnerabilities.

134
134
article thumbnail

Hiring kit: Cryptographer

Tech Republic Security

A cryptographer uses their expertise in mathematics and computer science to develop algorithms, ciphers and other encryption systems to protect sensitive data. It can be a difficult position to fill. This hiring kit from TechRepublic Premium provides a workable framework you can use to find the best cryptographer candidate for your business. It includes a.

article thumbnail

Surge in Malicious IoT Botnet Activity Raises Cybersecurity Concerns

SecureWorld News

In a digital landscape increasingly dependent on interconnected devices, the rise in malicious Internet of Things (IoT) botnet activity is becoming a significant cause for concern. Recent findings from Nokia's Threat Intelligence Report 2023 reveal a sharp increase in such malicious activities, highlighting the need for strong cybersecurity measures.

IoT 132
article thumbnail

Microsoft: Windows 10 21H2 has reached end of servicing

Bleeping Computer

Multiple editions of Windows 10 21H2 have reached their end of service (EOS) in this month's Patch Tuesday, as Microsoft reminded customers today. [.

130
130
article thumbnail

Why Giant Content Libraries Do Nothing for Your Employees’ Cyber Resilience

Many cybersecurity awareness platforms offer massive content libraries, yet they fail to enhance employees’ cyber resilience. Without structured, engaging, and personalized training, employees struggle to retain and apply key cybersecurity principles. Phished.io explains why organizations should focus on interactive, scenario-based learning rather than overwhelming employees with excessive content.

article thumbnail

Patch Tuesday fixes 4 critical RCE bugs, and a bunch of Office holes

Naked Security

No zero-days this month, if you ignore the Edge RCE hole patched last week

127
127
article thumbnail

Massive phishing campaign uses 6,000 sites to impersonate 100 brands

Bleeping Computer

A widespread brand impersonation campaign targeting over a hundred popular apparel, footwear, and clothing brands has been underway since June 2022, tricking people into entering their account credentials and financial information on fake websites. [.

Phishing 128
article thumbnail

Google Recruits Allies to Apply Generative AI to Cybersecurity

Security Boulevard

At the Google Cloud Security Summit, Google today announced that Broadcom, Crowdstrike, Egnyte, Exabeam, F5, Fortinet, Netskope, Securiti, SentinelOne, Sysdig, Tenable and Thales have all committed to using generative artificial intelligence AI capabilities from Google within their cybersecurity platforms. Last month, Google launched a Google Cloud Security AI Workbench, an extensible large language model (LLM).

article thumbnail

WordPress Stripe payment plugin bug leaks customer order details

Bleeping Computer

The WooCommerce Stripe Gateway plugin for WordPress was found to be vulnerable to a bug that allows any unauthenticated user to view order details placed through the plugin. [.

117
117
article thumbnail

Zero Trust Mandate: The Realities, Requirements and Roadmap

The DHS compliance audit clock is ticking on Zero Trust. Government agencies can no longer ignore or delay their Zero Trust initiatives. During this virtual panel discussion—featuring Kelly Fuller Gordon, Founder and CEO of RisX, Chris Wild, Zero Trust subject matter expert at Zermount, Inc., and Principal of Cybersecurity Practice at Eliassen Group, Trey Gannon—you’ll gain a detailed understanding of the Federal Zero Trust mandate, its requirements, milestones, and deadlines.

article thumbnail

Analysis: Social Engineering Drives BEC Losses to $50B Globally

Dark Reading

Threat actors have grown increasingly sophisticated in applying social engineering tactics against their victims, which is key to this oft-underrated cybercriminal scam's success.

article thumbnail

Windows 11 KB5027231 cumulative update released with 34 changes

Bleeping Computer

Microsoft has released the Windows 11 22H2 KB5027231 cumulative update to fix security vulnerabilities and introduce 34 changes, improvements, and bug fixes. [.

111
111
article thumbnail

Behind the Scenes: Unveiling the Hidden Workings of Earth Preta

Trend Micro

This blog entry discusses the more technical details on the most recent tools, techniques, and procedures (TTPs) leveraged by the Earth Preta APT group, and tackles how we were able to correlate different indicators connected to this threat actor.

110
110
article thumbnail

CISA orders federal agencies to secure Internet-exposed network devices

Bleeping Computer

CISA issued this year's first binding operational directive (BOD) ordering federal civilian agencies to secure misconfigured or Internet-exposed networking equipment within 14 days of discovery. [.

Internet 108
article thumbnail

Next-Level Fraud Prevention: Strategies for Today’s Threat Landscape

Speaker: Sierre Lindgren

Fraud is a battle that every organization must face – it’s no longer a question of “if” but “when.” Every organization is a potential target for fraud, and the finance department is often the bullseye. From cleverly disguised emails to fraudulent payment requests, the tactics of cybercriminals are advancing rapidly. Drawing insights from real-world cases and industry expertise, we’ll explore the vulnerabilities in your processes and how to fortify them effectively.

article thumbnail

Microsoft to pay $20m penalty for collecting children info without consent

CyberSecurity Insiders

Microsoft has made an official announcement that it will pay a $20m penalty to the US Federal Trade Commission (FTC) as it was found guilty of collecting children info via gaming consoles without their valid consent. Digging deep into the context, a lawsuit was slapped against the technology giant for collecting information of children playing games on Xbox Gaming Consoles.

article thumbnail

Cyber insurance: What is it and does my company need it?

We Live Security

While not a 'get out of jail free card' for your business, cyber insurance can help insulate it from the financial impact of a cyber-incident The post Cyber insurance: What is it and does my company need it?

article thumbnail

The High Stakes of Personal Cyber Attacks: Impact on Business, Data, and Reputation

Security Boulevard

In the digital age, we all live in glass houses. Our lives, personal and professional, are intertwined with technology in a way that renders us vulnerable to cyber threats. The consequences of these threats are not limited to our personal realm. The spillover into the professional sphere often results in significant business losses, theft of […] The post The High Stakes of Personal Cyber Attacks: Impact on Business, Data, and Reputation appeared first on BlackCloak | Protect Your Digital Li

article thumbnail

What To Look for in a HIPAA-Compliant Email Provider

Digital Guardian

Whether you work for a doctor's office, healthcare organization, or just find yourself handling protected health information or ePHI, this blog breaks down what to look for in a HIPAA-compliant email service provider.

article thumbnail

Prevent Data Breaches With Zero-Trust Enterprise Password Management

Keeper Security is transforming cybersecurity for people and organizations around the world. Keeper’s affordable and easy-to-use solutions are built on a foundation of zero-trust and zero-knowledge security to protect every user on every device. Our next-generation privileged access management solution deploys in minutes and seamlessly integrates with any tech stack to prevent breaches, reduce help desk costs and ensure compliance.

article thumbnail

Clop Ransomware gang strikes London Transport for London (TfL)

CyberSecurity Insiders

Clop ransomware gang has targeted the databases of Transport for London (TfL) customers, thus stealing information of over 13,000 drivers listed on the Ulez and Congestion Charges Repository. Clop is the same gang that struck MoveIT file transfer software last week and the TFL seems to be one of the impacted customers worldwide. And TfL became a victim as one of its customers incharge of storing and securing the databases was affected by the file encrypting malware spreading gang.

article thumbnail

Encryption Evolution is on the Horizon

Security Boulevard

Quantum computers are an emerging technology that will revolutionize several aspects of computational power across countless fields. One of the more concerning predictions is the likelihood that quantum computers will eventually break and expose many of the technologies we use to secure information transmissions and storage today. In fact, The Department of Commerce’s National Institute.

article thumbnail

Artificial intelligence is coming to Windows: Are your security policy settings ready?

CSO Magazine

What’s in your Windows security policy? Do you review your settings on an annual basis or more often? Do you provide education and training regarding the topics in the policy? Does it get revised when the impact of an incident showcases that an internal policy violation led to the root cause of the issue? And, importantly, do you have a security policy that includes your firm’s overall policies around the increasing race towards artificial intelligence, which is seemingly in nearly every applica

article thumbnail

UFO Whistleblower, Meet a Conspiracy-Loving Congress

WIRED Threat Level

Fresh claims from a former US intelligence officer about an “intact” alien craft may get traction on Capitol Hill, where some lawmakers want to believe.

99
article thumbnail

Optimizing The Modern Developer Experience with Coder

Many software teams have migrated their testing and production workloads to the cloud, yet development environments often remain tied to outdated local setups, limiting efficiency and growth. This is where Coder comes in. In our 101 Coder webinar, you’ll explore how cloud-based development environments can unlock new levels of productivity. Discover how to transition from local setups to a secure, cloud-powered ecosystem with ease.

article thumbnail

Why Critical Infrastructure Remains a Ransomware Target

Dark Reading

While protecting critical infrastructure seems daunting, here are some critical steps the industry can take now to become more cyber resilient and mitigate risks.

article thumbnail

RDP honeypot targeted 3.5 million times in brute-force attacks

Bleeping Computer

Remote desktop connections are so powerful a magnet for hackers that an exposed connection can average more than 37,000 times every day from various IP addresses. [.

99
article thumbnail

St. Margaret’s Health is the first hospital to cite a cyberattack as a reason for its closure

Security Affairs

St. Margaret’s Health in Illinois is partly closing operations at its hospitals due to a 2021 ransomware attack that impacted its payment system. In February 2021a ransomware attack hit the St. Margaret’s Health in Illinois and forced the organization to shutdown of IT infrastructure at the Spring Valley hospital to contain the threat. The cyber attack did not impact the Peru branch because it relies on a separate infrastructure The payment system was taken offline for months, which caused delay

article thumbnail

Visualize Your Entire SSL/TLS Certificate Inventory with Atlas Discovery

GlobalSign

Do you know what SSL/TLS certificates you have in your organization? Read more to learn about the certificate inventory tool that could help you.

98
article thumbnail

The Tumultuous IT Landscape Is Making Hiring More Difficult

After a year of sporadic hiring and uncertain investment areas, tech leaders are scrambling to figure out what’s next. This whitepaper reveals how tech leaders are hiring and investing for the future. Download today to learn more!