Sat.Aug 31, 2024 - Fri.Sep 06, 2024

article thumbnail

List of Old NSA Training Videos

Schneier on Security

The NSA’s “ National Cryptographic School Television Catalogue ” from 1991 lists about 600 COMSEC and SIGINT training videos. There are a bunch explaining the operations of various cryptographic equipment, and a few code words I have never heard of before.

328
328
article thumbnail

Owners of 1-Time Passcode Theft Service Plead Guilty

Krebs on Security

Three men in the United Kingdom have pleaded guilty to operating otp[.]agency , a once popular online service that helped attackers intercept the one-time passcodes (OTPs) that many websites require as a second authentication factor in addition to passwords. Launched in November 2019, OTP Agency was a service for intercepting one-time passcodes needed to log in to various websites.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Weekly Update 415

Troy Hunt

I still find the reactions to the Telegram situation with Durov's arrest odd. There are no doubt all sorts of politics surrounding it, but even putting all that aside for a moment, the assertion that a platform provider should not be held accountable for moderating content on the platform is just nuts. As I say in this week's video, there's lots of content that you can put in the "grey" bucket (free speech versus hate speech, for example) and there are valid arguments to b

article thumbnail

Secure Our World: Cybersecurity Awareness Month 2024

Lohrman on Security

We are one month away from the start of the annual Cybersecurity Awareness Month in October. Here are resources, themes, toolkits and much more to help your organization prepare.

article thumbnail

How to Avoid Pitfalls In Automation: Keep Humans In the Loop

Speaker: Erroll Amacker

Automation is transforming finance but without strong financial oversight it can introduce more risk than reward. From missed discrepancies to strained vendor relationships, accounts payable automation needs a human touch to deliver lasting value. This session is your playbook to get automation right. We’ll explore how to balance speed with control, boost decision-making through human-machine collaboration, and unlock ROI with fewer errors, stronger fraud prevention, and smoother operations.

article thumbnail

SQL Injection Attack on Airport Security

Schneier on Security

Interesting vulnerability : …a special lane at airport security called Known Crewmember (KCM). KCM is a TSA program that allows pilots and flight attendants to bypass security screening, even when flying on domestic personal trips. The KCM process is fairly simple: the employee uses the dedicated lane and presents their KCM barcode or provides the TSA agent their employee number and airline.

article thumbnail

IBM Executive on Future Cybersecurity: Passkeys, Deepfakes & Quantum Computing

Tech Republic Security

IBM's Chris Hockings predicts a safer internet with advances in passkey tech, digital identity, deepfake defenses, and post-quantum cryptography.

LifeWorks

More Trending

article thumbnail

Deepfake Video of Central Bank Governor and Journalist Promotes Fraudulent Investment Opportunity

Joseph Steinberg

Over the summer, criminals released a video of Gaston Reinesch, governor of the Central Bank of Luxembourg, and Mariette Zenners, a journalist with RTL television, in which the two are shown discussing a new “important project” of the aforementioned European nation’s central bank – a project that is designed to enable people to earn $7,000 or more per week, even if the folks participating in the project do not have any significant knowledge of investments or other areas of finance.

Banking 169
article thumbnail

YubiKey Side-Channel Attack

Schneier on Security

There is a side-channel attack against YubiKey access tokens that allows someone to clone a device. It’s a complicated attack , requiring the victim’s username and password, and physical access to their YubiKey—as well as some technical expertise and equipment. Still, nice piece of security analysis.

Passwords 315
article thumbnail

Iran Cyber Attack: Fox Kitten Facilitates Ransomware in US

Tech Republic Security

Read more about an attack campaign led by Iran-based cyberespionage threat actor Fox Kitten, and learn how to protect your company from this threat.

article thumbnail

Russia’s Most Notorious Special Forces Unit Now Has Its Own Cyber Warfare Team

WIRED Threat Level

Unit 29155 of Russia’s GRU military intelligence agency—a team responsible for coup attempts, assassinations, and bombings—has branched out into brazen hacking operations with targets across the world.

Hacking 145
article thumbnail

Why Giant Content Libraries Do Nothing for Your Employees’ Cyber Resilience

Many cybersecurity awareness platforms offer massive content libraries, yet they fail to enhance employees’ cyber resilience. Without structured, engaging, and personalized training, employees struggle to retain and apply key cybersecurity principles. Phished.io explains why organizations should focus on interactive, scenario-based learning rather than overwhelming employees with excessive content.

article thumbnail

CVE-2024-8105: An UEFI Flaw Putting Millions of Devices at Risk

Penetration Testing

A significant vulnerability, CVE-2024-8105, dubbed PKfail, has surfaced within the UEFI ecosystem. With a CVSS score of 8.2, this flaw exposes critical UEFI security mechanisms to compromise, making systems vulnerable... The post CVE-2024-8105: An UEFI Flaw Putting Millions of Devices at Risk appeared first on Cybersecurity News.

Risk 145
article thumbnail

Security Researcher Sued for Disproving Government Statements

Schneier on Security

This story seems straightforward. A city is the victim of a ransomware attack. They repeatedly lie to the media about the severity of the breach. A security researcher repeatedly proves their statements to be lies. The city gets mad and sues the researcher. Let’s hope the judge throws the case out, but—still—it will serve as a warning to others.

article thumbnail

Google Removing Poor-Quality Android Apps From Play Store to Boost Engagement

Tech Republic Security

Included in the purge are static apps, those with limited functionality and content, and apps that crash, freeze, and don’t offer an “engaging user experience,’’ the company said.

Mobile 197
article thumbnail

Uncovering & Remediating Dormant Account Risk

Duo's Security Blog

The importance of gaining visibility into identity data Over the last two years, the security of an organization's identity ecosystem has become paramount. Before diving into the specifics of dormant accounts, it's important to take a step back and discuss a prerequisite: gaining cross-platform visibility into identity and access management data.

article thumbnail

Zero Trust Mandate: The Realities, Requirements and Roadmap

The DHS compliance audit clock is ticking on Zero Trust. Government agencies can no longer ignore or delay their Zero Trust initiatives. During this virtual panel discussion—featuring Kelly Fuller Gordon, Founder and CEO of RisX, Chris Wild, Zero Trust subject matter expert at Zermount, Inc., and Principal of Cybersecurity Practice at Eliassen Group, Trey Gannon—you’ll gain a detailed understanding of the Federal Zero Trust mandate, its requirements, milestones, and deadlines.

article thumbnail

CVE-2024-43044: Critical Jenkins Vulnerability Exposes Servers to RCE, PoC Exploit Published

Penetration Testing

A security researcher from Conviso Labs published the technical details and a proof-of-concept (PoC) exploit for a critical CVE-2024-43044 vulnerability in Jenkin. Jenkins is integral to many development pipelines, making... The post CVE-2024-43044: Critical Jenkins Vulnerability Exposes Servers to RCE, PoC Exploit Published appeared first on Cybersecurity News.

article thumbnail

Long Analysis of the M-209

Schneier on Security

Really interesting analysis of the American M-209 encryption device and its security.

article thumbnail

Australia Proposes Mandatory Guardrails for AI

Tech Republic Security

New mandatory guardrails will apply to AI models in high-risk settings, with businesses encouraged to adopt new safety standards starting now.

Risk 193
article thumbnail

CyberSecurity Expert Joseph Steinberg To Speak At Penn Club About CyberSecurity

Joseph Steinberg

CyberSecurity Expert Joseph Steinberg will deliver a talk at the Penn Club in New York City on October 29 th. The Penn Club provided the following description of Steinberg’s talk, appropriately titled A Spooky Drive Into CyberSecurity for the Halloween season, and which will be run as a joint event with the Columbia Club: Join us for Halloween fun. What does cybersecurity hold for you tricks or treats?

article thumbnail

Prevent Data Breaches With Zero-Trust Enterprise Password Management

Keeper Security is transforming cybersecurity for people and organizations around the world. Keeper’s affordable and easy-to-use solutions are built on a foundation of zero-trust and zero-knowledge security to protect every user on every device. Our next-generation privileged access management solution deploys in minutes and seamlessly integrates with any tech stack to prevent breaches, reduce help desk costs and ensure compliance.

article thumbnail

CVE-2024-20017 (CVSS 9.8): Zero-Click Exploit Discovered in Popular Wi-Fi Chipsets, PoC Published

Penetration Testing

Security researcher Hyprdude has published detailed information and a proof-of-concept (PoC) exploit for a critical vulnerability identified as CVE-2024-20017. With a CVSS score of 9.8, this vulnerability poses a severe... The post CVE-2024-20017 (CVSS 9.8): Zero-Click Exploit Discovered in Popular Wi-Fi Chipsets, PoC Published appeared first on Cybersecurity News.

article thumbnail

Live Video of Promachoteuthis Squid

Schneier on Security

The first live video of the Promachoteuthis squid, filmed at a newly discovered seamount off the coast of Chile. Blog moderation policy.

275
275
article thumbnail

Tenable: 26,500 Cyber Vulnerabilities Risk SE Asia’s Banks

Tech Republic Security

Tenable's research reveals 26,500 cyber vulnerabilities in Southeast Asia's banking and insurance sectors, exposing critical security risks.

Banking 190
article thumbnail

TIDRONE Targets Military and Satellite Industries in Taiwan

Trend Micro

Our research reveals that an unidentified threat cluster we named TIDRONE have shown significant interest in military-related industry chains, particularly in the manufacturers of drones.

article thumbnail

Next-Level Fraud Prevention: Strategies for Today’s Threat Landscape

Speaker: Sierre Lindgren

Fraud is a battle that every organization must face – it’s no longer a question of “if” but “when.” Every organization is a potential target for fraud, and the finance department is often the bullseye. From cleverly disguised emails to fraudulent payment requests, the tactics of cybercriminals are advancing rapidly. Drawing insights from real-world cases and industry expertise, we’ll explore the vulnerabilities in your processes and how to fortify them effectively.

article thumbnail

Veeam Backup & Replication Faces RCE Flaw– CVE-2024-40711 (CVSS 9.8) Allows Full System Takeover

Penetration Testing

A series of critical vulnerabilities have been uncovered in Veeam Backup & Replication, potentially exposing organizations to unauthorized access, remote code execution, and data breaches. The most severe vulnerability (CVE-2024-40711,... The post Veeam Backup & Replication Faces RCE Flaw– CVE-2024-40711 (CVSS 9.8) Allows Full System Takeover appeared first on Cybersecurity News.

Backups 142
article thumbnail

How to avoid election related scams

Malwarebytes

With the US election campaigns at full throttle, scammers have taken a renewed interest in the ways this can be used to defraud people , often using the same tactics legitimate campaigns leverage for support (emails, text messages, phone calls, and social media pleas). The lure that we have seen the most involves asking people to donate to a campaign.

Scams 138
article thumbnail

Apptio: How Australians Are Navigating Economic Pressure Through Strategic IT Investments

Tech Republic Security

Many Australian companies are investing in new technology, but others are having a hard time justifying such investments given the current economic climate.

article thumbnail

Russian ‘WhisperGate’ Hacks: 5 More Indicted

Security Boulevard

Eaten by a GRU: Fake ransomware created by Russian GRU Unit 29155 attacked Ukraine and NATO—a month before the full scale invasion. The post Russian ‘WhisperGate’ Hacks: 5 More Indicted appeared first on Security Boulevard.

Hacking 137
article thumbnail

Optimizing The Modern Developer Experience with Coder

Many software teams have migrated their testing and production workloads to the cloud, yet development environments often remain tied to outdated local setups, limiting efficiency and growth. This is where Coder comes in. In our 101 Coder webinar, you’ll explore how cloud-based development environments can unlock new levels of productivity. Discover how to transition from local setups to a secure, cloud-powered ecosystem with ease.

article thumbnail

Goffloader: In-Memory Execution, No Disk Required

Penetration Testing

The security company Praetorian has released GoffLoader, a tool designed to simplify the execution of BOF files and unmanaged Cobalt Strike PE files directly in memory, without writing any files... The post Goffloader: In-Memory Execution, No Disk Required appeared first on Cybersecurity News.

article thumbnail

The US Navy Is Going All In on Starlink

WIRED Threat Level

The Navy is testing out the Elon Musk–owned satellite constellation to provide high-speed internet access to sailors at sea. It’s part of a bigger project that’s about more than just getting online.

Internet 138
article thumbnail

VMware ESXi Servers Targeted by New Ransomware Variant from Cicada3301 Group

Tech Republic Security

A number of similarities between Cicada3301 and ALPHV/BlackCat indicates that it could represent a rebrand or offshoot group.

article thumbnail

Russia-linked GRU Unit 29155 targeted critical infrastructure globally

Security Affairs

The United States and its allies state that Russia-linked threat actors operating under the GRU are behind global critical infrastructure attacks. The FBI, CISA, and NSA linked threat actors from Russia’s GRU Unit 29155 to global cyber operations since at least 2020. These operations include espionage, sabotage, and reputational damage. The United States and its allies state that GRU is behind global critical infrastructure attacks.

article thumbnail

The Tumultuous IT Landscape Is Making Hiring More Difficult

After a year of sporadic hiring and uncertain investment areas, tech leaders are scrambling to figure out what’s next. This whitepaper reveals how tech leaders are hiring and investing for the future. Download today to learn more!