Schneier on Security
AUGUST 23, 2023
Imagine that we’ve all—all of us, all of society—landed on some alien planet, and we have to form a government: clean slate. We don’t have any legacy systems from the US or any other country. We don’t have any special or unique interests to perturb our thinking. How would we govern ourselves? It’s unlikely that we would use the systems we have today.
Malwarebytes
AUGUST 23, 2023
In July 2023, we observed a malvertising campaign that lured potential victims to a fraudulent site for a Windows IT management tool. Unlike previous similar attacks, the final payload was packaged differently and not immediately recognizable. The decoy file came as an MSI installer containing an AutoIT script where the payload was obfuscated to avoid detection.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Security Affairs
AUGUST 23, 2023
Four vulnerabilities in the TP-Link Tapo L530E smart bulb and impacting the mobile app used to control them expose users to hack. Researchers from the University of Catania (Italy) and the University of London (UK) have discovered four vulnerabilities impacting the TP-Link Tapo L530E smart bulb and the mobile app TP-Link’s Tapo app, which could allow attackers to steal the users’ WiFi password.
The Hacker News
AUGUST 23, 2023
Meta has once again reaffirmed its plans to roll out support for end-to-end encryption (E2EE) by default for one-to-one friends and family chats on Messenger by the end of the year.
Speaker: Erroll Amacker
Automation is transforming finance but without strong financial oversight it can introduce more risk than reward. From missed discrepancies to strained vendor relationships, accounts payable automation needs a human touch to deliver lasting value. This session is your playbook to get automation right. We’ll explore how to balance speed with control, boost decision-making through human-machine collaboration, and unlock ROI with fewer errors, stronger fraud prevention, and smoother operations.
Security Affairs
AUGUST 23, 2023
The U.S. FBI warned that North Korea-linked threat actors may attempt to cash out stolen cryptocurrency worth more than $40 million. The Federal Bureau of Investigation shared details about the activity of six cryptocurrency wallets operated by North Korea-linked threat actors. The wallets hold roughly 1,580 Bitcoin (roughly $41 million at the current rate) that the feds believe are linked to the recent theft of hundreds of millions of dollars in cryptocurrency.
IT Security Guru
AUGUST 23, 2023
BizDevOps in a nutshell Many organisations claim to be data-centric and data-driven. Making informed decisions based on what their organisation’s data is telling them. But how many organisations can truly say they have an effective and operational Data Management framework in place? The good news is that it is relatively easy to remove the toil and burden with automation and implementing a Data Model program to improve the accuracy and quality of the underlying data.
Cyber Security Informer brings together the best content for cyber security professionals from the widest variety of industry thought leaders.
|
GlobalSign
AUGUST 23, 2023
Curious about the ACME protocol and its advantages? Discover how this protocol works and the benefits it brings to businesses and individuals.
eSecurity Planet
AUGUST 23, 2023
Spear phishing is a more targeted and effective phishing technique that attempts to exploit specific individuals or groups within an organization. While phishing uses a broader range of tactics, such as mass emailing to random recipients, spear phishing is often well-researched and tailored to high-value targets. A typical spear phishing attack follows a familiar pattern of emails with attachments.
Heimadal Security
AUGUST 23, 2023
Malicious actors exposed 2.6 million DuoLingo users` data on the dark web. The announcement posted on August 22nd made the data available for a cost of only $2.13. The scraped DuoLingo data was previously for sale on another dark forum, in January 2023, at a cost of $1,500. How Did Hackers Obtain the Data The […] The post Threat Actors Leak 2.6 Million DuoLingo Users` Data on Hacking Forum appeared first on Heimdal Security Blog.
WIRED Threat Level
AUGUST 23, 2023
Here’s what the science really says about teens and screens—and how to start the conversation with young people of any age.
Advertisement
Many cybersecurity awareness platforms offer massive content libraries, yet they fail to enhance employees’ cyber resilience. Without structured, engaging, and personalized training, employees struggle to retain and apply key cybersecurity principles. Phished.io explains why organizations should focus on interactive, scenario-based learning rather than overwhelming employees with excessive content.
Security Affairs
AUGUST 23, 2023
A previously unknown APT group, tracked as Carderbee, was behind a supply chain attack against Hong Kong organizations. Symantec Threat Hunter Team reported that a previously unknown APT group, tracked as Carderbee, used a malware-laced version of the legitimate Cobra DocGuard software to carry out a supply chain attack aimed at organizations in Hong Kong.
eSecurity Planet
AUGUST 23, 2023
IT asset management software helps IT teams track and manage all the assets their company uses in its IT infrastructure. ITAM tools track hardware and software lifecycles so IT teams know how to best protect and use those assets. ITAM can also play an important role in cybersecurity by discovering and updating assets as part of the vulnerability management and patching process.
Bleeping Computer
AUGUST 23, 2023
Microsoft has released the optional KB5029331 Preview cumulative update for Windows 10 22H2 with sixteen improvements or fixes, including the introduction of a new Backup app. [.
Heimadal Security
AUGUST 23, 2023
Researchers observed a critical Ivanti Sentry API authentication bypass vulnerability exploited in the wild. The flaw was dubbed CVE-2023-38035 and it enables authentication bypass on Ivanti Sentry versions 9.18 and prior, due to improper Apache HTTPD configuration. According to the company, CVE-2023-38035 doesn`t impact any of its other products, such as Ivanti EPMM, MobileIron Cloud […] The post New Ivanti Zero-Day Vulnerability Allows Hackers to Access Sensitive APIs appeared first on H
Advertisement
The DHS compliance audit clock is ticking on Zero Trust. Government agencies can no longer ignore or delay their Zero Trust initiatives. During this virtual panel discussion—featuring Kelly Fuller Gordon, Founder and CEO of RisX, Chris Wild, Zero Trust subject matter expert at Zermount, Inc., and Principal of Cybersecurity Practice at Eliassen Group, Trey Gannon—you’ll gain a detailed understanding of the Federal Zero Trust mandate, its requirements, milestones, and deadlines.
Malwarebytes
AUGUST 23, 2023
Ivanti has published a security blog post about a vulnerability in Ivanti Sentry, formerly MobileIron Sentry. Successful exploitation of the vulnerability would enable an unauthenticated attacker to access some sensitive APIs that are used to configure Ivanti Sentry on the administrator portal (commonly, MICS). Ivanti Sentry is a gateway technology that allows organizations to manage, encrypt, and protect traffic between mobile devices and backend systems.
The Hacker News
AUGUST 23, 2023
Developers are not the only people who have adopted the agile methodology for their development processes.
SecureWorld News
AUGUST 23, 2023
On August 8, 2023, the U.S. National Institute of Standards and Technology (NIST) released the Initial Public Draft of its Cybersecurity Framework (CSF) version 2.0. For a solid rundown of what the updates mean, check out this SecureWorld article from Kip Boyle , vCISO, Cyber Risk Opportunities LLC. Boyle is teaching PLUS Courses on the NIST CSF at all six in-person regional SecureWorld conferences this fall , including Denver on Sept. 19, Detroit on Sept. 28, St.
The Hacker News
AUGUST 23, 2023
A Syrian threat actor named EVLF has been outed as the creator of malware families CypherRAT and CraxsRAT. "These RATs are designed to allow an attacker to remotely perform real-time actions and control the victim device's camera, location, and microphone," Cybersecurity firm Cyfirma said in a report published last week.
Speaker: Sierre Lindgren
Fraud is a battle that every organization must face – it’s no longer a question of “if” but “when.” Every organization is a potential target for fraud, and the finance department is often the bullseye. From cleverly disguised emails to fraudulent payment requests, the tactics of cybercriminals are advancing rapidly. Drawing insights from real-world cases and industry expertise, we’ll explore the vulnerabilities in your processes and how to fortify them effectively.
Heimadal Security
AUGUST 23, 2023
Threat actors launched a reconnaissance attack against a server belonging to the U.S. Department of Defense, as part of HiatusRAT Malware Campaign. The adversaries also targeted Taiwan-based organizations, such as several companies and a municipal government institution. HiatusRAT was first observed at the beginning of 2023, targeting organizations in Europe and Latin America.
SecureWorld News
AUGUST 23, 2023
This morning, Critical Start released its first ever Cyber Risk Landscape Peer Report , which explores some of the major concerns and challenges currently confronting cybersecurity leaders as they manage risk within their organizations. The report also examines the amount of risk that organizations are willing to accept, resource constraints, and key priorities for approaching cyber risk in the future.
Malwarebytes
AUGUST 23, 2023
The Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Adobe ColdFusion vulnerability to its Known Exploited Vulnerabilities Catalog , based on evidence of active exploitation. This means that Federal Civilian Executive Branch (FCEB) agencies need to remediate this vulnerability by September 11, 2023 to protect their networks against active threats.
The Hacker News
AUGUST 23, 2023
The U.S. Federal Bureau of Investigation (FBI) on Tuesday warned that threat actors affiliated with North Korea may attempt to cash out stolen cryptocurrency worth more than $40 million. The law enforcement agency attributed the blockchain activity to an adversary the U.S. government tracks as TraderTraitor, which is also known by the name Jade Sleet.
Advertisement
Keeper Security is transforming cybersecurity for people and organizations around the world. Keeper’s affordable and easy-to-use solutions are built on a foundation of zero-trust and zero-knowledge security to protect every user on every device. Our next-generation privileged access management solution deploys in minutes and seamlessly integrates with any tech stack to prevent breaches, reduce help desk costs and ensure compliance.
SecureBlitz
AUGUST 23, 2023
Here, I will talk about API Development. In the rapidly evolving landscape of technology, Application Programming Interfaces play a pivotal role in enabling seamless communication and integration between different software systems. From powering web applications to facilitating data sharing, they have become a cornerstone of enterprise software development services.
Dark Reading
AUGUST 23, 2023
Attacks targeting the now-patched bug have been going on since at least April 2023, security vendor says.
The Hacker News
AUGUST 23, 2023
A malicious toolset dubbed Spacecolon is being deployed as part of an ongoing campaign to spread variants of the Scarab ransomware across victim organizations globally.
Dark Reading
AUGUST 23, 2023
The most recent stolen bitcoin comes just after three major operations occurred in June, with millions stolen in each heist.
Advertisement
Many software teams have migrated their testing and production workloads to the cloud, yet development environments often remain tied to outdated local setups, limiting efficiency and growth. This is where Coder comes in. In our 101 Coder webinar, you’ll explore how cloud-based development environments can unlock new levels of productivity. Discover how to transition from local setups to a secure, cloud-powered ecosystem with ease.
Bleeping Computer
AUGUST 23, 2023
Starting on Monday, Discord has been reaching out to users affected by a data breach disclosed earlier this year to let them know what Personal Identifying Information (PII) was exposed in the incident. [.
Dark Reading
AUGUST 23, 2023
The eSentire LLM Gateway provides monitoring and governance of ChatGPT and other Large Language Models being used in the organization.
Bleeping Computer
AUGUST 23, 2023
A London jury has found that an 18-year-old member of the Lapsus$ data extortion gang helped hack multiple high-profile companies, stole data from them, and demanded a ransom threatening to leak the information. [.
Dark Reading
AUGUST 23, 2023
Feeling creative? Submit your caption and our panel of experts will reward the winner with a $25 Amazon gift card.
Advertisement
After a year of sporadic hiring and uncertain investment areas, tech leaders are scrambling to figure out what’s next. This whitepaper reveals how tech leaders are hiring and investing for the future. Download today to learn more!
Expert insights. Personalized for you.
237 
Let's personalize your content