Security Affairs

OCTOBER 29, 2022

The Slovak and Polish parliaments were hit by a massive cyber attack, and the voting system in Slovakia’s legislature was brought down. A massive cyber attack hit the Slovak and Polish parliaments, reported the authorities. The cyber attack brought down the voting system in Slovakia’s legislature. “The attack was multi-directional, including from inside the Russian Federation,” reads a statement published by the Polish Senate.

Cyber Attacks 144

Cyber Attacks Government Hacking Information Security 144

Schneier on Security

NOVEMBER 1, 2022

It’s Iran’s turn to have its digital surveillance tools leaked : According to these internal documents, SIAM is a computer system that works behind the scenes of Iranian cellular networks, providing its operators a broad menu of remote commands to alter, disrupt, and monitor how customers use their phones. The tools can slow their data connections to a crawl, break the encryption of phone calls, track the movements of individuals or large groups, and produce detailed metadata summari

Surveillance 333

Surveillance Telecommunications Mobile Encryption 333

Troy Hunt

NOVEMBER 3, 2022

I've been investing a heap of time into Have I Been Pwned (HIBP) lately, ranging from all the usual stuff (namely trawling through masses of data breaches) to all new stuff, in particular expanding and enhancing the public API. The API is actually pretty simple: plug in an email address, get a result, and that's a very clearly documented process.

Data breaches 299

Data breaches 299

Krebs on Security

OCTOBER 31, 2022

A 26-year-old Ukrainian man is awaiting extradition from The Netherlands to the United States on charges that he acted as a core developer for Raccoon , a popular “malware-as-a-service” offering that helped paying customers steal passwords and financial data from millions of cybercrime victims. KrebsOnSecurity has learned that the defendant was busted in March 2022, after fleeing mandatory military service in Ukraine in the weeks following the Russian invasion.

Malware 276

Malware Identity Theft Cybercrime Accountability 276

Advertisement

How many people would you trust with your house keys? Chances are, you have a handful of trusted friends and family members who have an emergency copy, but you definitely wouldn’t hand those out too freely. You have stuff that’s worth protecting—and the more people that have access to your belongings, the higher the odds that something will go missing.

Cybersecurity

Tech Republic Security

NOVEMBER 2, 2022

Also including blockchain-related projects in the ban, SourceHut's creator said the technology is associated with fraudulent activities and high-risk investments. The post Open-source repository SourceHut to remove all cryptocurrency-related projects appeared first on TechRepublic.

Cryptocurrency 194

Cryptocurrency Technology Risk Scams 194

Schneier on Security

OCTOBER 31, 2022

People have suspected this for a while, but Apple has made it official. It only commits to fully patching the latest version of its OS, even though it claims to support older versions. From ArsTechnica : In other words, while Apple will provide security-related updates for older versions of its operating systems, only the most recent upgrades will receive updates for every security problem Apple knows about.

270

270

Krebs on Security

NOVEMBER 4, 2022

Responding to a recent surge in AI-generated bot accounts, LinkedIn is rolling out new features that it hopes will help users make more informed decisions about with whom they choose to connect. Many LinkedIn profiles now display a creation date, and the company is expanding its domain validation offering, which allows users to publicly confirm that they can reply to emails at the domain of their stated current employer.

Scams 216

Scams Artificial Intelligence Cryptocurrency Accountability 216

Tech Republic Security

NOVEMBER 3, 2022

New Microsoft 365 deployment tools, making OneDrive work on your iPhone, and a new Cranefly backdoor lead the top news for this week. The post Tech news you may have missed Oct. 28–Nov. 3 appeared first on TechRepublic.

Big data 160

Big data Software 160

Schneier on Security

NOVEMBER 4, 2022

The NSA (together with CISA) has published a long report on supply-chain security: “ Securing the Software Supply Chain: Recommended Practices Guide for Suppliers. “: Prevention is often seen as the responsibility of the software developer, as they are required to securely develop and deliver code, verify third party components, and harden the build environment.

Software 261

Software Risk 261

Bleeping Computer

NOVEMBER 4, 2022

Internet domains for the popular Z-Library online eBook repository were seized early this morning by the U.S. Department of Justice, preventing easy access to the service. [.].

Internet 145

Internet Internet Technology Government 145

Advertiser: Revenera

In a recent study, IDC found that 64% of organizations said they were already using open source in software development with a further 25% planning to in the next year. Most organizations are unaware of just how much open-source code is used and underestimate their dependency on it. As enterprises grow the use of open-source software, they face a new challenge: understanding the scope of open-source software that's being used throughout the organization and the corresponding exposure.

Risk

Security Boulevard

NOVEMBER 3, 2022

Written by Christopher Hadnagy and Dr. Abbie Marono There is no denying the appeal of body-language focused blogs, particularly those […]. The post Dispelling Body Language Myths appeared first on Security Boulevard.

Social Engineering 139

Social Engineering Engineering 139

Tech Republic Security

NOVEMBER 1, 2022

IoT devices can be openings for attackers, causing major disruptions to businesses. Follow these three steps to secure your IoT devices. The post 3 inexpensive steps to secure IoT appeared first on TechRepublic.

IoT 147

IoT Internet Internet 147

SecureList

NOVEMBER 1, 2022

For more than five years, the Global Research and Analysis Team (GReAT) at Kaspersky has been publishing quarterly summaries of advanced persistent threat (APT) activity. These summaries are based on our threat intelligence research; and they provide a representative snapshot of what we have published and discussed in greater detail in our private APT reports.

Malware 139

Malware Ransomware Spyware Encryption 139

Bleeping Computer

NOVEMBER 4, 2022

The United Kingdom's National Cyber Security Centre (NCSC), the government agency that leads the country's cyber security mission, is now scanning all Internet-exposed devices hosted in the UK for vulnerabilities. [.].

Internet 145

Internet Internet Government 145

Advertisement

The healthcare industry has massively adopted web tracking tools, including pixels and trackers. Tracking tools on user-authenticated and unauthenticated web pages can access personal health information (PHI) such as IP addresses, medical record numbers, home and email addresses, appointment dates, or other info provided by users on pages and thus can violate HIPAA Rules that govern the Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates.

Healthcare

Security Affairs

NOVEMBER 3, 2022

Cisco addressed multiple flaws impacting its products, including high-severity issues in identity, email, and web security solutions. Cisco addressed multiple vulnerabilities impacting some of its products, including high-severity flaws in identity, email, and web security products. The most severe vulnerability addressed by the IT giant is a cross-site request forgery (CSRF) flaw, tracked as CVE-2022-20961 (CVSS score of 8.8), that impacts the Identity Services Engine (ISE).

Engineering 131

Engineering Hacking Information Security 131

Security Boulevard

OCTOBER 30, 2022

Pentesters love passwords. It’s great for us that the keys to the kingdom lie in something the user usually chooses and most often chooses insecurely. Wikipedia tells us that “A password is a secret word or string of characters that is used for authentication, to prove identity or gain access to a resource. The password […]. The post Password Attacks – Saving Time for the Fun Stuff appeared first on Security Aegis.

Passwords 128

Passwords Authentication 128

SecureList

OCTOBER 31, 2022

Kaspersky has been tracking activities involving the LODEINFO malware family since 2019, looking for new modifications and thoroughly investigating any attacks utilizing those new variants. LODEINFO is sophisticated fileless malware first named in a blogpost from JPCERT/CC in February 2020. The malware was regularly modified and upgraded by the developers to target media, diplomatic, governmental and public sector organizations and think-tanks in Japan.

Malware 136

Malware Encryption Media Phishing 136

Bleeping Computer

NOVEMBER 1, 2022

Dropbox disclosed a security breach after threat actors stole 130 code repositories after gaining access to one of its GitHub accounts using employee credentials stolen in a phishing attack. [.].

Phishing 145

Phishing Accountability 145

Speaker: Blackberry, OSS Consultants, & Revenera

Software is complex, which makes threats to the software supply chain more real every day. 64% of organizations have been impacted by a software supply chain attack and 60% of data breaches are due to unpatched software vulnerabilities. In the U.S. alone, cyber losses totaled $10.3 billion in 2022. All of these stats beg the question, “Do you know what’s in your software?

Cybersecurity

CyberSecurity Insiders

OCTOBER 31, 2022

First news that is trending on the Google search engine is related to a ransomware attack that took place on Germany’s Copper producer ‘Aurubis’. News is out that the world’s second largest producer’s IT systems were hit by a ransomware attack disrupting the digital infrastructure to the core. Perhaps this is supposed to be the first company related to metals and mining that was hit a by a file encrypting malware in the European nation and believably first from the west.

Cybersecurity 129

Cybersecurity Media Ransomware Cryptocurrency 129

Security Affairs

NOVEMBER 1, 2022

The ransomware group LockBit 3.0 claimed to have stolen data from the French defence and technology group Thales. Thales is a global high-tech leader with more than 81,000 employees worldwide. The Group invests in digital and deep tech innovations – big data, artificial intelligence, connectivity, cybersecurity and quantum – to build a future of trust, essential to the development of our societies, by placing people at the heart of decision-making.

Artificial Intelligence 129

Artificial Intelligence Big data Ransomware Technology 129

Security Boulevard

NOVEMBER 4, 2022

Insight #1. ". The game has changed, today's cybercrime cartels want to hijack your digital transformation and use it to launch attacks against your customers. Cybersecurity has become a brand protection imperative. It’s time for you to discuss cybersecurity with your CMO and GC.”. . Insight #2. ". Ransomware deploys remote access trojans (RATs) in your environment.

Digital transformation 123

Digital transformation Cybersecurity Cybercrime Ransomware 123

Bleeping Computer

OCTOBER 29, 2022

A new open-source 'S3crets Scanner' scanner allows researchers and red-teamers to search for 'secrets' mistakenly stored in publicly exposed or company's Amazon AWS S3 storage buckets. [.].

145

145

Advertisement

Within the past few years, ransomware attacks have turned to critical infrastructure, healthcare, and government entities. Attackers have taken advantage of the rapid shift to remote work and new technologies. Add to that hacktivism due to global conflicts and U.S. elections, and an increased focus on AI, and you have the perfect recipe for a knotty and turbulent 2024.

Cybersecurity

CyberSecurity Insiders

NOVEMBER 1, 2022

A new ransomware named ‘Azov Ransomware’ is found framing cybersecurity researchers as it doesn’t demand any ransom from its victims, instead it is asking them to contact forensic experts from a firm in the vicinity and do as per their instructions. Though the actions of Azov Ransomware are strange, researchers state that it’s not a big surprise. As someone is trying to frame security personnel from a specific company or some in related field are playing the blame-game.

Ransomware 127

Ransomware Cybersecurity Software Malware 127

Security Affairs

OCTOBER 30, 2022

According to the Daily Mail, Former British Prime Minister Liz Truss ‘s personal phone was hacked by Russian spies. The personal mobile phone of British Prime Minister Liz Truss was hacked by cyber spies suspected of working for the Kremlin, the Daily Mail reported. According to the British tabloid, the cyber-spies are believed to have gained access to top-secret exchanges with key international partners as well as private conversations with his friend, the British Conservative Party polit

Hacking 127

Hacking Mobile Government Cyber threats 127

CSO Magazine

NOVEMBER 4, 2022

The ongoing Russia-Ukraine conflict has resulted in an increase in hacktivist activity in the past year, with state-sponsored threat actors targeting 128 governmental organizations in 42 countries that support Ukraine, according to the European Union Agency for Cybersecurity (ENISA). In addition, some threat actors targeted Ukrainian and Russian entities during the early days of the conflict, likely for the collection of intelligence, according to the 10th edition of the ENISA threat landscape r

Cybersecurity 124

Cybersecurity 124

Bleeping Computer

NOVEMBER 1, 2022

The OpenSSL Project has patched two high-severity security flaws in its open-source cryptographic library used to encrypt communication channels and HTTPS connections. [.].

Encryption 140

Encryption 140

Speaker: Erika R. Bales, Esq.

When we talk about “compliance and security," most companies want to ensure that steps are being taken to protect what they value most – people, data, real or personal property, intellectual property, digital assets, or any other number of other things - and it’s more important than ever that safeguards are in place. Let’s step back and focus on the idea that no matter how complicated the compliance and security regime, it should be able to be distilled down to a checklist.

Security Boulevard

NOVEMBER 2, 2022

In the rapidly evolving world of information security, attack vectors, and cyberattacks, there is a. The post Preventing Hyperjacking in a virtual environment appeared first on Entrust Blog. The post Preventing Hyperjacking in a virtual environment appeared first on Security Boulevard.

Information Security 122

Information Security Encryption 122

Security Affairs

NOVEMBER 1, 2022

ConnectWise has addressed a critical remote code execution vulnerability impacting Recover and R1Soft Server Backup Manager (SBM). According to the advisory published by ConnectWise , the vulnerability is an Improper Neutralization of Special Elements in Output Used by a Downstream Component. An attacker can exploit the vulnerability to execute remote code or directly access confidential data.

Backups 124

Backups Authentication Ransomware Software 124

The Hacker News

OCTOBER 29, 2022

Communication services provider Twilio this week disclosed that it experienced another "brief security incident" in June 2022 perpetrated by the same threat actor behind the August hack that resulted in unauthorized access of customer information.

Hacking 116

Hacking 116

Bleeping Computer

NOVEMBER 2, 2022

The compromised infrastructure of an undisclosed media company is being used by threat actors to deploy the SocGholish JavaScript malware framework (also known as FakeUpdates) on the websites of hundreds of newspapers across the U.S. [.].

Malware 136

Malware Media 136

Speaker: William Hord, Vice President of ERM Services

A well-defined change management process is critical to minimizing the impact that change has on your organization. Leveraging the data that your ERM program already contains is an effective way to help create and manage the overall change management process within your organization. Your ERM program generally assesses and maintains detailed information related to strategy, operations, and the remediation plans needed to mitigate the impact on the organization.

Risk