Thu.Nov 17, 2022

Failures in Twitter’s Two-Factor Authentication System

Schneier on Security

Twitter is having intermittent problems with its two-factor authentication system: Not all users are having problems receiving SMS authentication codes, and those who rely on an authenticator app or physical authentication token to secure their Twitter account may not have reason to test the mechanism.

Researchers Quietly Cracked Zeppelin Ransomware Keys

Krebs on Security

Peter is an IT manager for a technology manufacturer that got hit with a Russian ransomware strain called “ Zeppelin ” in May 2020.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Iranian APT Actors Breached a US Government Network

Dark Reading

CISA says Federal Civilian Executive Branch systems were compromised through a Log4Shell vulnerability in an unpatched VMware Horizon server

Magento and Adobe Commerce websites under attack

Security Affairs

Researchers warn of a surge in cyberattacks targeting CVE-2022-24086, a pre-authentication issue impacting Adobe Commerce and Magento stores. In September 2022, Sansec researchers warned of a surge in hacking attempts targeting a critical Magento 2 vulnerability tracked as CVE-2022-24086.

Successful Change Management with Enterprise Risk Management

Speaker: William Hord, Vice President of ERM Services

Join us as we discuss the various tangents of data and the change management process that will help you make better risk-based business decisions to save time and money for your organization.

Data Privacy and Remote Work: Three Things Businesses Need to Know

Security Boulevard

Due to the COVID-19 pandemic, a large-scale and abrupt shift in employee work habits from in-office to home-based work produced unforeseen dangers to data privacy in addition to logistical and cybersecurity issues for enterprises.

Two public schools in Michigan hit by a ransomware attack

Security Affairs

Public schools in two Michigan counties were forced to halt their activities, including the lessons, after a ransomware attack. Public schools in Jackson and Hillsdale counties, Michigan, reopen after a closure of two days caused by a ransomware attack that hit its systems.

More Trending

Critical Infrastructure’s Open Source Problem

Security Boulevard

Open source has a security problem, and that could have real-world impact when it affects critical infrastructure. According to research from Synopsis, 78% of code in codebases is open source, and 81% of the codebases have at least one vulnerability.

IoT 81

Instagram Impersonators Target Thousands, Slipping by Microsoft's Cybersecurity

Dark Reading

The socially engineered campaign used a legitimate domain to send phishing emails to large swaths of university targets

Spotlight on CRED: Benchmarking security with a BSIMM assessment

Security Boulevard

CRED, a fintech company and BSIMM member since early 2022, underwent a BSIMM assessment to benchmark their security processes. The post Spotlight on CRED: Benchmarking security with a BSIMM assessment appeared first on Security Boulevard.

Risk 80

Analysts Welcome NSA's Advice for Developers to Adopt Memory-Safe Languages

Dark Reading

Languages such as C and C++ rely too heavily on the programmer not making simple memory-related security errors

84

Cover Your SaaS: How to Overcome Security Challenges and Risks For Your Organization

Speaker: Ronald Eddings, Cybersecurity Expert and Podcaster

In this webinar, Ronald Eddings, Cybersecurity Expert, will outline the relationship between SaaS apps and IT & security teams, along with several actionable solutions to overcome the new difficulties facing your organization.

Dell Appliance Uses Machine Learning to Automate Data Protection

Security Boulevard

Dell Technologies today unveiled an integrated Dell PowerProtect Data Manager Appliance that increases cyberresilience by using machine learning algorithms to automatically discover assets—including VMware virtual machines—and then take snapshots to automatically back them up.

Microsoft fixes Windows Kerberos auth issues in emergency updates

Bleeping Computer

Microsoft has released optional out-of-band (OOB) updates to fix a known issue triggering Kerberos sign-in failures and other authentication problems on enterprise Windows domain controllers after installing cumulative updates released during November's Patch Tuesday. [.]. Microsoft

Cybersecurity Audits: What to Expect, How to Perform One, and What to Do With Your Findings

Security Boulevard

Why do some companies fare so poorly with cybersecurity audits and with putting audit findings to good use? The post Cybersecurity Audits: What to Expect, How to Perform One, and What to Do With Your Findings appeared first on Hyperproof.

Here’s How Bad a Twitter Mega-Breach Would Be

WIRED Threat Level

Elon Musk laid off half the staff, and mass resignations seem likely. If nobody’s there to protect the fort, what’s the worst that could happen? Security Security / Cyberattacks and Hacks Business / Social Media

Media 79

How Preparation and Strategy Can Be Used to Fight and Defeat Any Ransomware Attack

Speaker: Karl Camilleri, Cloud Services Product Manager at phoenixNAP

Through a detailed analysis of major attacks and their consequences, Karl Camilleri, Cloud Services Product Manager at phoenixNAP, will discuss the state of ransomware and future predictions, as well as provide best practices for attack prevention and recovery.

Cybersecurity Compliance Audit: 6 Steps To Be Compliant

Security Boulevard

Are your cybersecurity efforts sufficient for meeting the regulations and requirements for your industry? If not, you could face fines and fees — or worse, you could suffer the consequences of a severe data breach. .

Cyber Monday Will Be the Most Fraudulent Day of the Season, Says SEON

Dark Reading

Online fraud prevention company predicts Cyber Monday will see a 100% increase in online fraud attempts

79

China-based Fangxiao group behind a long-running phishing campaign

Security Affairs

A China-based financially motivated group, tracked as Fangxiao, is behind a large-scale phishing campaign dating back as far as 2019. Researchers from Cyjax reported that a China-based financially motivated group, dubbed Fangxiao, orchestrated a large-scale phishing campaign since 2017.

Black Friday and retail season – watch out for PayPal “money request” scams

Naked Security

Don't let a keen eye for bargains lead you into risky online behaviour. Data loss Privacy Black Friday PayPal Scam

How to Avoid the Pain and Cost of PCI Compliance While Optimizing Payments

Speaker: P. Andrew Sjogren, Sr. Product Marketing Manager at Very Good Security, Matt Doka, Co-Founder and CTO of Fivestars, and Steve Andrews, President & CEO of the Western Bankers Association

In this webinar, we have a great set of panelists who will take you through how Zero Data strategies can be used as part of a well-rounded compliance and security approach, and get you to market much sooner by also allowing for payment optimization. They’ll share how to grow your business faster and minimize costs for both security and compliance

MITRE ResilienCyCon: You Will Be Breached So Be Ready

eSecurity Planet

Speakers at last week’s MITRE ResilienCyCon conference had a surprisingly candid message for attendees: You will likely be breached at some point so focus on the controls and response capabilities your organization needs to survive a cyber attack.

CISO 76

Tank, the leader of the Zeus cybercrime gang, was arrested by the Swiss police

Security Affairs

A suspected leader of the Zeus cybercrime gang, Vyacheslav Igorevich Penchukov (aka Tank), was arrested by Swiss police. Swiss police last month arrested in Geneva Vyacheslav Igorevich Penchukov (40), also known as Tank, which is one of the leaders of the JabberZeus cybercrime group.

S3 Ep109: How one leaked email password could drain your business

Naked Security

Latest episode - listen now! Cybersecurity news plus loads of great advice. Law & order Podcast Vulnerability Android Apple Cybercrime Naked Security Podcast

FBI-Wanted Leader of the Notorious Zeus Botnet Gang Arrested in Geneva

The Hacker News

A Ukrainian national who has been wanted by the U.S for over a decade has been arrested by Swiss authorities for his role in a notorious cybercriminal ring that stole millions of dollars from victims' bank accounts using malware called Zeus.

Back to the Office: Privacy and Security Solutions to Compliance Issues for 2021 and Beyond

Speaker: Mike Cramer, Director of HIPAA & Data Security at The Word & Brown Companies

Now that companies are slowly allowing employees to return to work at the office, it's time to re-evaluate your company’s posture towards privacy and security. Join Mike Cramer, Director of HIPAA & Data Security at The Word & Brown Companies, for a discussion that will focus on compliance and the types of privacy and security measures your company should be aware of, as well as tips and methods for implementing these measures.

More SRE Lessons for SOC: Simplicity Helps Security

Anton on Security

As we discussed in our blogs, “ Achieving Autonomic Security Operations: Reducing toil ”, “ Achieving Autonomic Security Operations: Automation as a Force Multiplier ,” “Achieving Autonomic Security Operations: Why metrics matter (but not how you think)” , and the latest “More SRE Lessons for SOC: Release Engineering Ideas” your Security Operations Center (SOC) can learn a lot from what IT ops discovered during the Site Reliability Engineering (SRE) and DevOps revolution.

FBI: Hive ransomware extorted $100M from over 1,300 victims

Bleeping Computer

The Federal Bureau of Investigation (FBI) said today that the notorious Hive ransomware gang has successfully extorted roughly $100 million from over a thousand companies since June 2021. [.]. Security

AWS Karpenter Readiness: 6 Ways to Make Sure You’re Ready for the Move

Security Boulevard

For people familiar with Kubernetes, you already know that it has many configurations available, either to scale or to perform better. In the past, most organizations used the cluster-autoscaler from Kubernetes to help them automatically scale EKS cluster node pools based on workload demand.

67

Microsoft fixes bug behind Windows 10 freezes, desktop issues

Bleeping Computer

Microsoft has resolved a known issue triggering errors and temporarily causing the taskbar and desktop to disappear on Windows 10 systems. [.]. Microsoft

94

Iranian Hackers Target U.S. Government Agency with Log4Shell Exploit

SecureWorld News

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) released a joint cybersecurity advisory detailing how state-sponsored Iranian threat actors compromised a federal agency's network by exploiting the infamous Log4Shell vulnerability.

Regulatory Compliance in the Telecom Industry

Security Boulevard

The increasing use of cell phones has automatically led to unimaginable height of sharing of personal information online. Most routine actions, from providing information over the phone to opening a bank account to placing food orders, may now be accomplished from the convenience of your own home.

Tech news you may have missed: Nov. 10 – 17

Tech Republic Security

This week’s trending news features a primer on Industrial IoT, new and upcoming features for Windows users and the latest cybersecurity threats. The post Tech news you may have missed: Nov. 10 – 17 appeared first on TechRepublic.

IoT 93

Must Know Approaches for Maintaining Mobile Application Security and CIA Traits

Security Boulevard

Nowadays, every business wants to reach out to a larger audience. And the best way for it is Mobile App Development. Whether someone is at work, at home, or somewhere outside, people frequently go through… Read More Must Know Approaches for Maintaining Mobile Application Security and CIA Traits.

Previously unidentified ARCrypter ransomware expands worldwide

Bleeping Computer

A previously unknown 'ARCrypter' ransomware that compromised key organizations in Latin America is now expanding its attacks worldwide. [.]. Security

Five Steps to Eliminate Passwords

Security Boulevard

Passwords and credentials remain the largest source of attack attempts and successful attacks, making them the biggest cybersecurity threat to organizations across all industries.