Sat.Jan 20, 2024 - Fri.Jan 26, 2024

article thumbnail

Cybersecurity Challenges at the World Economic Forum

Lohrman on Security

The 54th Annual Meeting of The World Economic Forum took place in Davos, Switzerland, this past week, and cybersecurity and AI were again top topics. Here are some highlights.

article thumbnail

Using Google Search to Find Software Can Be Risky

Krebs on Security

Google continues to struggle with cybercriminals running malicious ads on its search platform to trick people into downloading booby-trapped copies of popular free software applications. The malicious ads, which appear above organic search results and often precede links to legitimate sources of the same software, can make searching for software on Google a dicey affair.

Software 268
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Chatbots and Human Conversation

Schneier on Security

For most of history, communicating with a computer has not been like communicating with a person. In their earliest years, computers required carefully constructed instructions, delivered through punch cards; then came a command-line interface, followed by menus and options and text boxes. If you wanted results, you needed to learn the computer’s language.

article thumbnail

Weekly Update 383

Troy Hunt

They're an odd thing, credential lists. Whether they're from a stealer as in this week's Naz.API incident, or just aggregated from multiple data breaches (which is also in Naz.API), I inevitably get some backlash after loading them: "this doesn't tell me anything useful, why are you loading this?!" The answer is easy: because that's what the vast majority of people want me to do: If I have a MASSIVE spam list full of personal data being sold to spammers, should I

article thumbnail

Guide to Business Writing

Everything you need to know about better business writing in one place. This is a complete guide to business writing — from a clear business writing definition to tips on how to hone your business writing skills.

article thumbnail

Microsoft Says State-Sponsored Attackers Accessed Senior Leaders’ Emails

Tech Republic Security

The Midnight Blizzard gang appears to have been looking for information about itself. See how organizations can protect their accounts from password spray attacks.

Passwords 174
article thumbnail

Police Arrest Teen Said to Be Linked to Hundreds of Swatting Attacks

WIRED Threat Level

A California teenager who allegedly used the handle Torswats to carry out a nationwide swatting campaign is being extradited to Florida to face felony charges, WIRED has learned.

145
145

More Trending

article thumbnail

CVE-2024-0402: GitLab Releases Urgent Security Patches for Critical Vulnerability

Penetration Testing

GitLab has addressed a critical severity vulnerability that could allow an authenticated user to write files to arbitrary locations on the GitLab server while creating a workspace. GitLab is a web-based DevOps platform that... The post CVE-2024-0402: GitLab Releases Urgent Security Patches for Critical Vulnerability appeared first on Penetration Testing.

article thumbnail

Australian Organisations Struggling to Resolve Tensions Between Personalisation, Privacy

Tech Republic Security

Australian organisations are so focused on preventing data breaches that they’re unaware that the concern of most of their customers has more to do with privacy.

article thumbnail

Data Privacy: Why It Matters To The Rest Of Us

Thales Cloud Protection & Licensing

Data Privacy: Why It Matters To The Rest Of Us madhav Mon, 01/22/2024 - 04:47 It seems that there are no limits to the number of data breaches. Company size is not a determinant of victimization, nor is industry or sector. All are equally viable targets. Some of the events are newsworthy, while others stay below the public’s awareness or attention. Most companies must grapple with difficult questions of how to recover from a breach; however, when the typical person hears about a data breach, the

article thumbnail

Side Channels Are Common

Schneier on Security

Really interesting research: “ Lend Me Your Ear: Passive Remote Physical Side Channels on PCs.” Abstract: We show that built-in sensors in commodity PCs, such as microphones, inadvertently capture electromagnetic side-channel leakage from ongoing computation. Moreover, this information is often conveyed by supposedly-benign channels such as audio recordings and common Voice-over-IP applications, even after lossy compression.

245
245
article thumbnail

IDC Analyst Report: The Open Source Blind Spot Putting Businesses at Risk

In a recent study, IDC found that 64% of organizations said they were already using open source in software development with a further 25% planning to in the next year. Most organizations are unaware of just how much open-source code is used and underestimate their dependency on it. As enterprises grow the use of open-source software, they face a new challenge: understanding the scope of open-source software that's being used throughout the organization and the corresponding exposure.

article thumbnail

Kasseika Ransomware Deploys BYOVD Attacks, Abuses PsExec and Exploits Martini Driver?

Trend Micro

In this blog, we detail our investigation of the Kasseika ransomware and the indicators we found suggesting that the actors behind it have acquired access to the source code of the notorious BlackMatter ransomware.

article thumbnail

National Cyber Security Centre Study: Generative AI May Increase Global Ransomware Threat

Tech Republic Security

See the National Cyber Security Centre's predictions for generative AI for cyber attack and defense through 2025.

article thumbnail

Cops Used DNA to Predict a Suspect’s Face—and Tried to Run Facial Recognition on It

WIRED Threat Level

Leaked records reveal what appears to be the first known instance of a police department attempting to use facial recognition on a face generated from crime-scene DNA. It likely won’t be the last.

145
145
article thumbnail

Quantum Computing Skeptics

Schneier on Security

Interesting article. I am also skeptical that we are going to see useful quantum computers anytime soon. Since at least 2019, I have been saying that this is hard. And that we don’t know if it’s “land a person on the surface of the moon” hard, or “land a person on the surface of the sun” hard. They’re both hard, but very different.

236
236
article thumbnail

Beware of Pixels & Trackers on U.S. Healthcare Websites

The healthcare industry has massively adopted web tracking tools, including pixels and trackers. Tracking tools on user-authenticated and unauthenticated web pages can access personal health information (PHI) such as IP addresses, medical record numbers, home and email addresses, appointment dates, or other info provided by users on pages and thus can violate HIPAA Rules that govern the Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates.

article thumbnail

The great non-free-firmware transition

Kali Linux

TL;DR: Dear Kali user, when you have a moment, check your /etc/apt/sources.list , and add non-free-firmware if ever it’s missing. Programmatically speaking: kali@kali:~$ sudo sed -i 's/non-free$/non-free non-free-firmware/' /etc/apt/sources.list Long story now. As you might know already, Kali Linux is a Debian-based Linux distribution. As such, it inherits a number of things from Debian, and in particular, the structure of the package repository.

Firmware 144
article thumbnail

How to Prevent Phishing Attacks with Multi-Factor Authentication

Tech Republic Security

Learn how to protect yourself and your sensitive information from phishing attacks by implementing multi-factor authentication.

article thumbnail

Tesla hacked, 24 zero-days demoed at Pwn2Own Automotive 2024

Bleeping Computer

Security researchers hacked a Tesla Modem and collected awards of $722,500 on the first day of Pwn2Own Automotive 2024 for three bug collisions and 24 unique zero-day exploits.

Hacking 139
article thumbnail

AI Bots on X (Twitter)

Schneier on Security

You can find them by searching for OpenAI chatbot warning messages, like: “I’m sorry, I cannot provide a response as it goes against OpenAI’s use case policy.” I hadn’t thought about this before: identifying bots by searching for distinctive bot phrases.

article thumbnail

Software Composition Analysis: The New Armor for Your Cybersecurity

Speaker: Blackberry, OSS Consultants, & Revenera

Software is complex, which makes threats to the software supply chain more real every day. 64% of organizations have been impacted by a software supply chain attack and 60% of data breaches are due to unpatched software vulnerabilities. In the U.S. alone, cyber losses totaled $10.3 billion in 2022. All of these stats beg the question, “Do you know what’s in your software?

article thumbnail

Malicious AdTech Spies on People as NatSec Targets

Security Boulevard

Targeted ads target targets: Patternz and Nuviad enable potentially hostile governments to track individuals by misusing ad bidding. The post Malicious AdTech Spies on People as NatSec Targets appeared first on Security Boulevard.

article thumbnail

Top 6 LastPass Alternatives and Competitors for 2024

Tech Republic Security

Looking for LastPass alternatives? Check out our list of the top password managers that offer secure and convenient options for managing your passwords.

article thumbnail

Microsoft reveals how hackers breached its Exchange Online accounts

Bleeping Computer

Microsoft confirmed that the Russian Foreign Intelligence Service hacking group, which hacked into its executives' email accounts in November 2023, also breached other organizations as part of this malicious campaign. [.

article thumbnail

Update now! Apple releases patch for zero-day vulnerability

Malwarebytes

Apple has released new security updates for several products, including a patch for a zero-day vulnerability that could impact iPhones, iPad, Macs, and Apple TVs. Apple says it’s aware of a report that the bug may have been exploited already. Further details about the nature of the vulnerability were not disclosed to give users enough time to install the updates.

article thumbnail

From Complexity to Clarity: Strategies for Effective Compliance and Security Measures

Speaker: Erika R. Bales, Esq.

When we talk about “compliance and security," most companies want to ensure that steps are being taken to protect what they value most – people, data, real or personal property, intellectual property, digital assets, or any other number of other things - and it’s more important than ever that safeguards are in place. Let’s step back and focus on the idea that no matter how complicated the compliance and security regime, it should be able to be distilled down to a checklist.

article thumbnail

Researcher warns: Java-Based Stealer Spreads via Cracked Software

Penetration Testing

In the complex and constantly evolving world of cyber threats, a new sophisticated JAVA-based stealer has emerged, posing a significant threat to online security. Discovered by the Trellix Advanced Research Center in mid-November 2023,... The post Researcher warns: Java-Based Stealer Spreads via Cracked Software appeared first on Penetration Testing.

article thumbnail

More Australian IT Leaders Could Be Looking to Replace Passwords With Passkeys in 2024

Tech Republic Security

The Australian government’s rollout of passkeys for its digital service portal myGov will build momentum for wider adoption; though, challenges like user education and tech fragmentation remain.

Passwords 129
article thumbnail

Ukraine: Hack wiped 2 petabytes of data from Russian research center

Bleeping Computer

The Main Intelligence Directorate of Ukraine's Ministry of Defense claims that pro-Ukrainian hacktivists breached the Russian Center for Space Hydrometeorology, aka "planeta" (планета), and wiped 2 petabytes of data. [.

Hacking 134
article thumbnail

10 things to do to improve your online privacy

Malwarebytes

1. Set up two-factor authentication Do this for as many of your online accounts as you can, especially the major ones like your email and social media accounts. Two-factor authentication (2FA) adds an extra step of protection and makes it much harder for attackers to login as you. We recommend using authenticator apps or physical security keys, but sometimes SMS is the easiest option and that’s fine.

article thumbnail

Successful Change Management with Enterprise Risk Management

Speaker: William Hord, Vice President of ERM Services

A well-defined change management process is critical to minimizing the impact that change has on your organization. Leveraging the data that your ERM program already contains is an effective way to help create and manage the overall change management process within your organization. Your ERM program generally assesses and maintains detailed information related to strategy, operations, and the remediation plans needed to mitigate the impact on the organization.

article thumbnail

Over 200,000 Sites at Risk: Directory Traversal CVE-2024-0221 Vulnerability Hits Photo Gallery Plugin

Penetration Testing

A critical directory traversal vulnerability has been found in a popular WordPress plugin. The affected plugin, Photo Gallery by 10Web – Mobile-Friendly Image Gallery, has over 200,000 active installations. Photo Gallery is the leading... The post Over 200,000 Sites at Risk: Directory Traversal CVE-2024-0221 Vulnerability Hits Photo Gallery Plugin appeared first on Penetration Testing.

article thumbnail

Cyber League: UK’s NCSC Calls on Industry Experts to Join its Fight Against Cyber Threats

Tech Republic Security

The NCSC wants volunteers from the U.K.’s public and private sectors to join its new cybersecurity community.

article thumbnail

23andMe data breach: Hackers stole raw genotype data, health reports

Bleeping Computer

Genetic testing provider 23andMe confirmed that hackers stole health reports and raw genotype data of customers affected by a credential stuffing attack that went unnoticed for five months, from April 29 to September 27. [.

article thumbnail

FBI and CISA Warn of Androxgh0st Malware Attacks

Security Boulevard

The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) have issued a joint Cybersecurity Advisory warning of the escalating threat posed by Androxgh0st malware. Threat actors are using this Python-scripted malware to build a botnet focused on cloud credential theft, with the stolen information being leveraged to deliver additional malicious payloads.

Malware 130
article thumbnail

Cover Your SaaS: How to Overcome Security Challenges and Risks For Your Organization

Speaker: Ronald Eddings, Cybersecurity Expert and Podcaster

So, you’ve accomplished an organization-wide SaaS adoption. It started slow, and now just a few team members might be responsible for running Salesforce, Slack, and a few others applications that boost productivity, but it’s all finished. Or is it? Through all the benefits offered by SaaS applications, it’s still a necessity to onboard providers as quickly as possible.