Troy Hunt
MAY 20, 2022
Data breaches, 3D printing and passwords - just the usual variety of things this week. More specifically, that really cool Pwned Passwords downloader that I know a bunch of people have been waiting on, and now we've finally released. It hits the existing k-anonymity API over 1 million times and that API is already going on 2 billion requests a month so I'm kinda curious to see what happens if everyone starts running the downloader at the same time.
Schneier on Security
MAY 20, 2022
Locks that use Bluetooth Low Energy to authenticate keys are vulnerable to remote unlocking. The research focused on Teslas, but the exploit is generalizable. In a video shared with Reuters, NCC Group researcher Sultan Qasim Khan was able to open and then drive a Tesla using a small relay device attached to a laptop which bridged a large gap between the Tesla and the Tesla owner’s phone. “This proves that any product relying on a trusted BLE connection is vulnerable to attacks even f
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
The Last Watchdog
MAY 20, 2022
The unification revolution of cybersecurity solutions has started – and managed security service providers are leading the way. Managed security services (MSS) refer to a service model that enable the monitoring and managing of security technologies, systems, or even software-as-a-service (SaaS) products. Here’s more on the various types and benefits of MSS, as well as the state of the MSS(P) market in 2022!
Schneier on Security
MAY 20, 2022
“ Google Maps Adds Shortcuts through Houses of People Google Knows Aren’t Home Right Now.” Excellent satire.
Speaker: Erroll Amacker
Automation is transforming finance but without strong financial oversight it can introduce more risk than reward. From missed discrepancies to strained vendor relationships, accounts payable automation needs a human touch to deliver lasting value. This session is your playbook to get automation right. We’ll explore how to balance speed with control, boost decision-making through human-machine collaboration, and unlock ROI with fewer errors, stronger fraud prevention, and smoother operations.
Tech Republic Security
MAY 20, 2022
A commercial surveillance company previously exposed for selling a spyware service dubbed "Predator" keeps targeting users and uses 0-day exploits to compromise Android phones. Learn more about how to protect yourself from it. The post Packaged zero-day vulnerabilities on Android used for cyber surveillance attacks appeared first on TechRepublic.
Graham Cluley
MAY 20, 2022
I'm not sure if it would be enough for me to switch bank accounts, but I have something of a sneaking respect for the Bank of Zambia.
Cyber Security Informer brings together the best content for cyber security professionals from the widest variety of industry thought leaders.
|
Cisco Security
MAY 20, 2022
The last two years have created a lot of pressure on us all. The pandemic has forced us to adapt to new ways of working and has presented many technological challenges, one of which is multi-cloud transformation. As we can see, these challenges are not going away soon and the need for agile adaptation is critical. Whilst most teams have adapted already, it has taken a toll on them.
Tech Republic Security
MAY 20, 2022
Compare the key features of two EDR tools: SentinelOne's Singularity XDR and Palo Alto's Cortex XDR. The post SentinelOne vs Palo Alto: Compare EDR software appeared first on TechRepublic.
Malwarebytes
MAY 20, 2022
A poor password at the highest levels of an organisation can cost a company millions in losses. Recent findings show that half of IT leaders store passwords in shared documents. On top of that, it seems that folks at executive level are not picking good passwords either. Researchers from NordPass combed through a large list of CEO and business owner breaches.
Tech Republic Security
MAY 20, 2022
See what features you can expect from Carbon Black and CrowdStrike to decide which endpoint detection and response solution is right for you. The post Carbon Black vs. CrowdStrike: EDR software comparison appeared first on TechRepublic.
Advertisement
Many cybersecurity awareness platforms offer massive content libraries, yet they fail to enhance employees’ cyber resilience. Without structured, engaging, and personalized training, employees struggle to retain and apply key cybersecurity principles. Phished.io explains why organizations should focus on interactive, scenario-based learning rather than overwhelming employees with excessive content.
We Live Security
MAY 20, 2022
ESET researchers spot an updated version of the malware loader used in the Industroyer2 and CaddyWiper attacks. The post Sandworm uses a new version of ArguePatch to attack targets in Ukraine appeared first on WeLiveSecurity.
Zero Day
MAY 20, 2022
Be careful what you are downloading - these files deliver the Vidar infostealer.
We Live Security
MAY 20, 2022
When you hear the term ‘cryptocurrency’, does ‘secure’ also spring to mind? Here are some implications of the lack of sound security practices in the world of crypto. The post Cryptocurrency: secure or not? – Week in security with Tony Anscombe appeared first on WeLiveSecurity.
Naked Security
MAY 20, 2022
Remember the good old days when security patches rarely needed patches? Because security patches themlelves were rare enough anyway?
Advertisement
The DHS compliance audit clock is ticking on Zero Trust. Government agencies can no longer ignore or delay their Zero Trust initiatives. During this virtual panel discussion—featuring Kelly Fuller Gordon, Founder and CEO of RisX, Chris Wild, Zero Trust subject matter expert at Zermount, Inc., and Principal of Cybersecurity Practice at Eliassen Group, Trey Gannon—you’ll gain a detailed understanding of the Federal Zero Trust mandate, its requirements, milestones, and deadlines.
The Hacker News
MAY 20, 2022
Multiple versions of a WordPress plugin by the name of "School Management Pro" harbored a backdoor that could grant an adversary complete control over vulnerable websites. The issue, spotted in premium versions before 9.9.7, has been assigned the CVE identifier CVE-2022-1609 and is rated 10 out of 10 for severity. The backdoor, which is believed to have existed since version 8.
Naked Security
MAY 20, 2022
Find and patch. Right now. If you can't patch, get it off the network. Right now! Oh, and show us what you did to comply.
Security Affairs
MAY 20, 2022
Microsoft researchers have observed a spike in the activity of the Linux bot XorDdos over the last six months. XORDDoS , also known as XOR.DDoS , first appeared in the threat landscape in 2014 it is a Linux Botnet that was employed in attacks against gaming and education websites with massive DDoS attacks that reached 150 gigabytes per second of malicious traffic.
The Hacker News
MAY 20, 2022
Cisco on Friday rolled out fixes for a medium-severity vulnerability affecting IOS XR Software that it said has been exploited in real-world attacks. Tracked as CVE-2022-20821 (CVSS score: 6.5), the issue relates to an open port vulnerability that could be abused by an unauthenticated, remote attacker to connect to a Redis instance and achieve code execution.
Speaker: Sierre Lindgren
Fraud is a battle that every organization must face – it’s no longer a question of “if” but “when.” Every organization is a potential target for fraud, and the finance department is often the bullseye. From cleverly disguised emails to fraudulent payment requests, the tactics of cybercriminals are advancing rapidly. Drawing insights from real-world cases and industry expertise, we’ll explore the vulnerabilities in your processes and how to fortify them effectively.
CyberSecurity Insiders
MAY 20, 2022
All White Hat hackers are from now on exempted from being prosecuted under the Computer Fraud and Abuse Act (CFAA) and this is official as per the statement released by the US Department of Justice. Thus, the latest memo will be applied in place of the 1986 law that made it mandatory for law enforcement to target security researchers if the situation demands it.
The Hacker News
MAY 20, 2022
A Linux botnet malware known as XorDdos has witnessed a 254% surge in activity over the last six months, according to latest research from Microsoft. The trojan, so named for carrying out denial-of-service attacks on Linux systems and its use of XOR-based encryption for communications with its command-and-control (C2) server, is known to have been active since at least 2014.
Heimadal Security
MAY 20, 2022
The infamous ransomware gang known as the Conti group has effectively brought an end to their operation by taking their infrastructure down and informing their team leaders that the brand no longer exists. What Happened? Yelisey Boguslavskiy of Advanced Intel tweeted this afternoon that the gang’s internal infrastructure had been shut down, which is where […].
CSO Magazine
MAY 20, 2022
Ottawa government’s move follows similar bans in other English-speaking countries, citing potential security risks to 5G communications networks.
Advertisement
Keeper Security is transforming cybersecurity for people and organizations around the world. Keeper’s affordable and easy-to-use solutions are built on a foundation of zero-trust and zero-knowledge security to protect every user on every device. Our next-generation privileged access management solution deploys in minutes and seamlessly integrates with any tech stack to prevent breaches, reduce help desk costs and ensure compliance.
Security Affairs
MAY 20, 2022
Taiwanese vendor QNAP warned customers of a new wave of DeadBolt ransomware attacks and urges them to install the latest updates. Taiwanese vendor QNAP is asking users to install the latest update on their NAS devices and avoid exposing them on the Internet. The company issued the alert in response to a new wave of DeadBolt ransomware attacks targeting NAS devices using QTS 4.3.6 and QTS 4.4.1. “QNAP® Systems, Inc. recently detected a new attack by the DEADBOLT Ransomware.
Bleeping Computer
MAY 20, 2022
Cisco has addressed a zero-day vulnerability in its IOS XR router software that allowed unauthenticated attackers to remotely gain access to Redis instances running in NOSi Docker containers. [.].
Dark Reading
MAY 20, 2022
To succeed against dynamic cybercriminals, organizations must go multiple steps further and build a learning system that evolves over time to keep up with attacker tactics.
Threatpost
MAY 20, 2022
More than 380,000 of the 450,000-plus servers hosting the open-source container-orchestration engine for managing cloud deployments allow some form of access.
Advertisement
Many software teams have migrated their testing and production workloads to the cloud, yet development environments often remain tied to outdated local setups, limiting efficiency and growth. This is where Coder comes in. In our 101 Coder webinar, you’ll explore how cloud-based development environments can unlock new levels of productivity. Discover how to transition from local setups to a secure, cloud-powered ecosystem with ease.
Security Boulevard
MAY 20, 2022
Following years of nation-state cyberattacks targeting United States interests, during a Securing Cyberspace panel hosted by the Washington Post, a pair of lawmakers expressed their determination to establish harsher penalties for such attacks. As recently as March 2022, attackers affiliated with the Chinese government broke into six or more U.S. states using the Log4j vulnerability.
Duo's Security Blog
MAY 20, 2022
The conflict in Ukraine has shined a light on threats from bad actors operating from specific parts of the world. If you haven’t done so already, this is an opportune time to evaluate, and if necessary tighten, your organization’s security posture. Enabling conditional access policies that block access from specific countries would be an excellent way to do this.
Heimadal Security
MAY 20, 2022
Nikkei has recently announced that a ransomware attack impacted the Singapore group’s headquarters on May 13. According to the public statement: Unauthorized access to the server was first detected on May 13, prompting an internal probe. Nikkei Group Asia immediately shut down the affected server and took other measures to minimize the impact. (…) The […].
Security Boulevard
MAY 20, 2022
Despite its massive attack on Costa Rica, Conti says it's shutting down, an attack leads to a huge sales loss at an ecommerce company, a doctor becomes a hacker. The post Cybersecurity News Round-Up: Week of May 16, 2022 appeared first on Security Boulevard.
Advertisement
After a year of sporadic hiring and uncertain investment areas, tech leaders are scrambling to figure out what’s next. This whitepaper reveals how tech leaders are hiring and investing for the future. Download today to learn more!
Expert insights. Personalized for you.
66 
Let's personalize your content