🚨 CISA KEV 1[−]
9 Aug KEVCISA Adds One Known Exploited Vulnerability to CatalogCISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog , based on evidence of active exploitation. CVE-2023-38180 Microsoft .NET Core and Visual Studio Denial of Service Vulnerability These types of vulnerabilities are frequent attack vectors for mali…CISA.GOV
🐛 COMMON VULNERABILITIES AND EXPOSURES 4[−]
9 AugNew Inception Attack Leaks Sensitive Data From All AMD Zen CPUsResearchers at ETH Zurich have now combined an older technique named 'Phantom speculation' (CVE-2022-23825) with a new transient execution attack called 'Training in Transient Execution' (TTE) to create an even more powerful 'Inception' attack.BLEEPINGCOMPUTER.COM
9 Aug KEVMicrosoft Office Update Breaks Actively Exploited RCE Attack ChainMicrosoft today released a defense-in-depth update for Microsoft Office that prevents exploitation of a remote code execution (RCE) vulnerability tracked as CVE-2023-36884 that threat actors have already leveraged in attacks.BLEEPINGCOMPUTER.COM
9 AugCollide+Power, Downfall, and Inception: New Side-Channel Attacks Affecting Modern CPUsCybersecurity researchers have disclosed details of a trio of side-channel attacks that could be exploited to leak sensitive data from modern CPUs. Called Collide+Power (CVE-2023-20583), Downfall (CVE-2022-40982), and Inception (CVE-2023-20569), the novel methods follow the discl…THEHACKERNEWS.COM
9 AugMAR-10454006.r4.v2 SEASPY and WHIRPOOL BackdoorsNotification This report is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained herein. The DHS does not endorse any commercial product or service referenced in…CISA.GOV
⚠️ VULNERABILITY DISCLOSURE 33[−]
9 Aug KEVMicrosoft Patch Tuesday, August 2023 EditionMicrosoft Corp. today issued software updates to plug more than 70 security holes in its Windows operating systems and related products, including a patch that addresses multiple zero-day vulnerabilities currently being exploited in the wild.KREBSONSECURITY.COM
9 AugRubrik Buys Startup Laminar to Unify Cyber Posture, RecoveryRubrik Spent More Than $100M to Acquire the Data Security Posture Management Vendor Rubrik purchased a data security posture management startup backed by Salesforce and SentinelOne to provide visibility into where a company's data lives and who has access. The Laminar buy will he…DATABREACHTODAY.CO.UK
9 AugNew SkidMap Malware Variant Targets Linux DistributionsA highly sophisticated malware variant called SkidMap is targeting vulnerable Redis services on a wide range of Linux distributions, including Alibaba, Anolis, CentOS, and RedHat. The attack chain begins with attackers logging into unsecured Redis instances via brute force attack…CYWARE.COM
9 AugDownfall: New Intel CPU Attack Exposing Sensitive InformationGoogle researcher discloses the details of an Intel CPU attack method named Downfall that may be remotely exploitable. The post Downfall: New Intel CPU Attack Exposing Sensitive Information appeared first on SecurityWeek .SECURITYWEEK.COM
9 AugNew ‘Inception’ Side-Channel Attack Targets AMD ProcessorsResearchers have disclosed the details of a new side-channel attack targeting AMD CPUs named Inception. The post New ‘Inception’ Side-Channel Attack Targets AMD Processors appeared first on SecurityWeek .SECURITYWEEK.COM
9 Aug KEVPatch Tuesday: Microsoft Fixes 2 Office Zero-Days, Critical Team FlawMicrosoft fixed 74 security issues in its August Patch Tuesday release, including two that were being actively exploited and twenty-three that allowed remote code execution. Although twenty-three RCE flaws were addressed, Microsoft only categorized six of them as ‘Critical,…GBHACKERS.COM
9 AugMalicious Campaigns Exploit Weak Kubernetes Clusters for Crypto MiningExposed Kubernetes (K8s) clusters are being exploited by malicious actors to deploy cryptocurrency miners and other backdoors. Cloud security firm Aqua, in a report shared with The Hacker News, said a majority of the clusters belonged to small to medium-sized organizations, with …THEHACKERNEWS.COM
9 AugSAP Patches Critical Vulnerability in PowerDesigner ProductSAP has fixed over a dozen new vulnerabilities with its Patch Tuesday updates, including a critical flaw in its PowerDesigner product. The post SAP Patches Critical Vulnerability in PowerDesigner Product appeared first on SecurityWeek .SECURITYWEEK.COM
9 AugU.K. Electoral Commission Breach Exposes Voter Data of 40 Million BritonsThe U.K. Electoral Commission on Tuesday disclosed a "complex" cyber attack on its systems that went undetected for over a year, allowing the threat actors to access years worth of voter data belonging to 40 million people. "The incident was identified in October 2022 after suspi…THEHACKERNEWS.COM
9 Aug‘Downfall’ Vulnerability Leaves Billions of Intel CPUs at RiskThe vulnerability, known as Downfall, exploits a technique used to increase performance in the x86 architecture. By sharing a small register buffer, different applications can inadvertently leave data that can be accessed by an attacker.CYBERSCOOP.COM
9 AugAs Cars Hoover up More and More Drivers’ Data, is it Time to Regulate the Industry?According to the California Privacy Protection Agency, cars are “connected computers on wheels” and should be treated as such. It recently announced its enforcement division will review the data privacy practices of connected vehicle manufacturers.THERECORD.MEDIA
9 AugIntel Addresses 80 Firmware, Software VulnerabilitiesIntel has addressed 80 vulnerabilities affecting its products, including 18 high-severity privilege escalation and DoS flaws. The post Intel Addresses 80 Firmware, Software Vulnerabilities appeared first on SecurityWeek .SECURITYWEEK.COM
9 AugRapid7 Lays Off 18% of Employees Amid Shift to MDR ServicesLoss of 470 Workers Is Cybersecurity Industry's Second-Largest Workforce Reduction Rapid7 will lay off close to one in five of its employees in cuts that amount to the second-largest round of layoffs of any pure-play cybersecurity company since worries about an economic downturn …DATABREACHTODAY.CO.UK
9 AugRubrik Buys Startup Laminar to Unify Cyber Posture, RecoveryRubrik purchased a data security posture management startup backed by Salesforce and SentinelOne to provide visibility into where a company's data lives and who has access.BANKINFOSECURITY.COM
9 AugGoogle to fight hackers with weekly Chrome security updatesGoogle has changed the Google Chrome security updates schedule from bi-weekly to weekly to address the growing patch gap problem that allows threat actors extra time to exploit published n-day and zero-day flaws. [...]BLEEPINGCOMPUTER.COM
9 Aug16 Zero-Day Vulnerabilities Discovered in CODESYS Affect Millions of Industrial DevicesCODESYS, a widely-used integrated environment for controller programming, holds a strong presence in Operational Technology across diverse industries, such as:- Backed by more than 500 manufacturers (including Schnieder Electric, Beckhoff, Wago, Eaton, ABB, Festo, etc.) and spann…GBHACKERS.COM
9 AugData Exfiltration is Now the Go-to Cyber Extortion StrategyThe abuse of zero-day and one-day vulnerabilities in the past six months led to a 143% increase in victims when comparing Q1 2022 with Q1 2023, according to a report by Akamai.HELPNETSECURITY.COM
9 AugPopular open source project Moq criticized for quietly collecting dataOpen source project Moq (pronounced "Mock") has drawn sharp criticism for quietly including a controversial dependency in its latest release. Moq's 4.20.0 release from this week included another project, SponsorLink, which caused an uproar among open source software consumers, wh…BLEEPINGCOMPUTER.COM
9 AugWhite House Debuts $20M Contest to Exterminate Bugs With AINew Tools to Rapidly Find and Fix Flaws Are the Focus of DARPA's AI Cyber Challenge The White House has launched an Artificial Intelligence Cyber Challenge, backed by DARPA and offering nearly $20 million in prizes, to develop a new generation of tools that can rapidly find and f…DATABREACHTODAY.CO.UK
9 AugScammers Exploit Twitter’s Transition to “X”Scammers are taking advantage of Twitter’s rebranding to “X,” according to Stephanie Adlam at Gridinsoft . A phishing campaign is targeting Twitter Blue users by telling them they need to transfer their subscription to X.KNOWBE4.COM
9 AugRhysida ransomware behind recent attacks on healthcareThe Rhysida ransomware as a service (RaaS) operation that emerged in May 2023 is gradually leaving the period of obscurity behind, as a recent wave of attacks on healthcare organizations has forced government agencies and cybersecurity companies to pay closer attention to its ope…BLEEPINGCOMPUTER.COM
9 Aug“Downfall” bug affects years of Intel CPUs, can leak encryption keys and moreResearchers also disclosed a separate bug called "Inception" for newer AMD CPUs.ARSTECHNICA.COM
9 AugHackers use open source Merlin post-exploitation toolkit in attacksUkraine is warning of a wave of attacks targeting state organizations using 'Merlin,' an open-source post-exploitation and command and control framework. [...]BLEEPINGCOMPUTER.COM
9 AugNew BitForge cryptocurrency wallet flaws lets hackers steal cryptoMultiple zero-day vulnerabilities named 'BitForge' in the implementation of widely used cryptographic protocols like GG-18, GG-20, and Lindell 17 affected popular cryptocurrency wallet providers, including Coinbase, ZenGo, Binance, and many more. [...]BLEEPINGCOMPUTER.COM
9 AugAnton’s Security Blog Quarterly Q3 2023Great blog posts are sometimes hard to find (especially on Medium ), so I decided to do a periodic list blog with my favorite posts of the past quarter or so. Here is the next one. The posts below are ranked by lifetime views. This covers both Anton on Security and my posts from …MEDIUM.COM
9 AugLaw Enforcement Takes Down Phishing As A Service SiteAuthorities In Multiple Countries Arrest Operators of 16Shop An international law enforcement operation took down a phishing-as-a-service website that security researchers say was responsible for more than 150,000 phishing domains. The site, 16shop, sold phishing kits that target…DATABREACHTODAY.CO.UK
9 AugSymmetry raises $18M to bolster organizations’ data security programsAs organizations embrace cloud services — and are forced to confront changing regulations and data use standards — their ability to maintain control of data security frequently becomes strained. If they lose that control, the consequences can be quite severe. The aver…TECHCRUNCH.COM
9 AugCybersecurity giant Rapid7 announces sweeping layoffs as losses mountU.S. cybersecurity giant Rapid7 has announced plans to lay off 18% of its workforce, affecting more than 400 global employees. In a regulatory filing, the Boston-based cybersecurity company said its restructuring effort is “designed to improve operational efficiencies, reduce ope…TECHCRUNCH.COM
9 AugBack to School Month: Let’s Step Towards a Stronger and More Secure future for Our Nation’s SchoolsWith August’s back-to-school theme, CISA is working hard to make K-12 administrators and communities aware of the current cybersecurity threat environment facing schools while promoting resources schools can use to help protect against those threats.CISA.GOV
9 AugNews alert: Fireblocks uncovers vulnerabilities impacting dozens of major wallet providersNew York, N.Y., Aug.9, 2023 – Today, the Fireblocks Cryptography Research Team announced the findings of multiple zero-day vulnerabilities in some of the most used cryptographic multi-party computation (MPC) protocols, including GG-18, GG-20, and implementations of Lindell 17. If…LASTWATCHDOG.COM
9 AugMicrosoft Patch Tuesday: 74 CVEs plus 2 “Exploit Detected” advisories74 CVEs, and two "Exploitation Detected" advisories, which are nearly but not quite the same as 0-days. Also, two potential Teams treacheries that you really want to fix.NAKEDSECURITY.SOPHOS.COM
9 AugX-Force releases detection & response framework for managed file transfer softwareThe mass exploitation of managed file transfer (MFT) attacks is on the rise. To empower cybersecurity defenders, IBM Security X-Force has released a common framework for detection and response for MFTs. The post X-Force releases detection & response framework for managed fil…SECURITYINTELLIGENCE.COM
9 Aug“Downfall” bug affects years of Intel CPUs, can leak encryption keys and moreResearchers also disclosed a separate bug called "Inception" for newer AMD CPUs.ARSTECHNICA.COM
📋 SECURITY BULLETINS 3[−]
9 AugMicrosoft Releases Patches for 74 New Vulnerabilities in August UpdateMicrosoft has patched a total of 74 flaws in its software as part of the company's Patch Tuesday updates for August 2023, down from the voluminous 132 vulnerabilities the company fixed last month. This comprises six Critical and 67 Important security vulnerabilities. Also release…THEHACKERNEWS.COM
9 AugCyber Security Today, August 9, 2023 - The latest ransomware news, and moreThis episode reports on the latest trends in ransomware attacks, and security updates from Microsoft, SAP and PaperCutCYBERSECURITYTODAY.LIBSYN.COM
9 Aug40 Vulnerabilities Patched in Android With August 2023 Security Updates40 vulnerabilities have been patched by Google in the Android operating system with the release of the August 2023 security updates. The post 40 Vulnerabilities Patched in Android With August 2023 Security Updates appeared first on SecurityWeek .SECURITYWEEK.COM
📢 SECURITY ADVISORIES 12[−]
9 AugNew Android 14 Security Feature: IT Admins Can Now Disable 2G NetworksGoogle has introduced a new security feature in Android 14 that allows IT administrators to disable support for 2G cellular networks in their managed device fleet. The search giant said it's introducing a second user setting to turn off support, at the model level, for null-ciphe…THEHACKERNEWS.COM
9 AugChina-Linked Hackers Strike Worldwide: 17 Nations Hit in 3-Year Cyber CampaignHackers associated with China's Ministry of State Security (MSS) have been linked to attacks in 17 different countries in Asia, Europe, and North America from 2021 to 2023. Cybersecurity firm Recorded Future attributed the intrusion set to a nation-state group it tracks under the…THEHACKERNEWS.COM
9 AugUS Restricts Investment in Chinese AI, Other TechnologiesExecutive Order Targets Dual-Use AI, Semiconductors and Quantum IT U.S. President Joe Biden signed an executive order limiting investment in Chinese companies that develop advanced technologies including artificial intelligence. The order is the latest national security barrier t…DATABREACHTODAY.CO.UK
9 AugThe Journey to Zero Trust with Industry FrameworksDiscover the core principles and frameworks of Zero Trust, NIST 800-207 guidelines, and best practices when implementing CISA’s Zero Trust Maturity Model.TRENDMICRO.COM
9 AugThe Journey to Zero Trust with Industry FrameworksDiscover the core principles and frameworks of Zero Trust, NIST 800-207 guidelines, and best practices when implementing CISA’s Zero Trust Maturity Model.TRENDMICRO.COM
🔥 INCIDENT REPORTING 17[−]
9 AugThreat Actors English-Speaking Countries with Customized Yashma RansomwareAn unidentified threat actor has deployed the Yashma ransomware variant since June 4, 2023, actively targeting English-speaking countries like:- While this new variant of Yashma ransomware has reemerged after being fixed last year since the release of a decryptor. This operation …GBHACKERS.COM
9 AugUK Electoral Commission suffers years-long cyber attackPersonal information for all those registered to vote between 2014 to 2022 may have been accessible for more than two yearsCSHUB.COM
9 AugMorgan & Morgan Sues Tampa General Hospital Over Data BreachThe exposed information encompasses sensitive details like names, addresses, phone numbers, dates of birth, Social Security numbers and select Health Insurance Portability and Accountability Act (HIPAA)-protected medical records.INFOSECURITY-MAGAZINE.COM
9 AugYashma Ransomware Evolves with Multilingual AttackA newly identified strain of Yashma ransomware has raised concerns as it was found targeting organizations across Bulgaria, China, Vietnam, and English-speaking countries since June 4. The Yashma ransomware, a rebranding of the Chaos strain, fetches ransom notes from a controlled…CYWARE.COM
9 AugNew Report Exposes Vice Society's Collaboration with Rhysida RansomwareTactical similarities have been unearthed between the double extortion ransomware group known as Rhysida and Vice Society, including in their targeting of education and healthcare sectors. "As Vice Society was observed deploying a variety of commodity ransomware payloads, this li…THEHACKERNEWS.COM
9 AugUK Voters’ Data Exposed in Electoral Commission CyberattackThe malicious actors accessed “reference copies” of the electoral registers, held by the Commission for research purposes and to enable permissibility checks on political donations.INFOSECURITY-MAGAZINE.COM
9 AugSESARAM Confirms Cyberattack and Suspends Non-Urgent ActivitySESARAM issued a statement confirming the occurrence of a “deliberate and malicious cyberattack with the sole objective of causing damage and disrupting the normal functioning of the Regional Health Service of the Autonomous Region of Madeira”.MADEIRAISLANDNEWS.COM
9 AugLockbit Threatens to Leak Medical Data of Cancer Patients Stolen From Varian Medical SystemsLockbit has fixed the deadline for the ransom payment on August 17, 2023. If confirmed the incident could have a dramatic impact on the privacy of cancer patients. The company has yet to disclose the security incident.SECURITYAFFAIRS.COM
9 AugBig Cyberespionage Attack Against Japan Attributed to ChinaClassified military networks run by Japan reportedly suffered a massive breach in 2020 at the hands of a Chinese cyberespionage group that proved tough to eject even after being discovered.BANKINFOSECURITY.COM
9 AugNorthern Ireland Police at Risk After Serious Data BreachCurrent PSNI Employees' Surnames and Locations Revealed Via Public Spreadsheet Police officers in Northern Ireland are sounding alarms over their personal safety after a data breach revealed the surnames and locations where they serve for nearly 10,000 police officers and staff. …DATABREACHTODAY.CO.UK
9 AugThe Ransomware Rollercoaster Continues as Criminals Advance Their Business ModelsRansomware shows no signs of slowing, with ransomware activity ending 13 times higher than at the start of 2023 as a proportion of all malware detections, according to Fortinet.HELPNETSECURITY.COM
9 AugRhysida Ransomware Has Added New Techniques, Tactics, And Tools to Its ArsenalA new ransomware group known as ‘Rhysida’ has been operating since May 2023, posing a huge danger to the healthcare industry. Rhysida ransomware gang has been connected to several significant attacks, including an assault on the Chilean Army. Recently, the organization was a…GBHACKERS.COM
9 AugMissouri warns that health info was stolen in IBM MOVEit data breachMissouri's Department of Social Services warns that protected Medicaid healthcare information was exposed in a data breach after IBM suffered a MOVEit data theft attack. [...]BLEEPINGCOMPUTER.COM
9 AugLawsuits Mounting Against Florida Hospital in Wake of BreachSo Far, 3 Proposed Class Actions Allege Negligence in Case Affecting 1.2M People Tampa General Hospital is facing at least three proposed federal class action lawsuits filed in recent days following the nonprofit Florida healthcare provider's disclosure late last month of a data …DATABREACHTODAY.CO.UK
9 AugParsing the UK electoral register cyberattackA catastrophic breach of the United Kingdom electoral register affects tens of millions of residents following a cyberattack at the U.K. Electoral Commission. With data on more than 40 million voters accessed by unnamed hackers, the cyberattack is already one of the U.K.’s …TECHCRUNCH.COM
9 AugCySecurity News - Latest Information Security and Hacking Incidents: Dark Web Grows Stronger. And So Does the Value of Monitoringsubmitted by Lanky_Pomegranate530 to cybersecurity -6 points | 0 comments https://www.cysecurity.news/2023/08/dark-web-grows-stronger-and-so-does.htmlCYSECURITY.NEWS
9 AugAn Overview of the New Rhysida Ransomware Targeting the Healthcare SectorIn this blog entry, we will provide details on Rhysida, including its targets and what we know about its infection chain.TRENDMICRO.COM
🕵️ THREAT INTELLIGENCE 22[−]
9 AugISC Stormcast For Wednesday, August 9th, 2023 https://isc.sans.edu/podcastdetail/8608, (Wed, Aug 9th)(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.ISC.SANS.EDU
9 AugRapid7 Announces Layoffs, Office Closings Under Restructuring PlanRestructuring plan will result in an 18% reduction in employee headcount and closing of some Rapid7 office locations. The post Rapid7 Announces Layoffs, Office Closings Under Restructuring Plan appeared first on SecurityWeek .SECURITYWEEK.COM
9 AugUsing Machine Learning to Detect KeystrokesResearchers have trained a ML model to detect keystrokes by sound with 95% accuracy. “A Practical Deep Learning-Based Acoustic Side Channel Attack on Keyboards” Abstract: With recent developments in deep learning, the ubiquity of microphones and the rise in online ser…SCHNEIER.COM
9 AugContinuous Security Validation with Penetration Testing as a Service (PTaaS)Validate security continuously across your full stack with Pen Testing as a Service. In today's modern security operations center (SOC), it's a battle between the defenders and the cybercriminals. Both are using tools and expertise – however, the cybercriminals have the element o…THEHACKERNEWS.COM
9 AugBeware of New Malware Attack Disguised As Google Bard Ads On FacebookResearchers have discovered a Google Bard Ads campaign that is being used by cybercriminals on Facebook to impersonate well-known generative AI brands such as ChatGPT and Google Bard. The campaign is actually malicious software that is disguised as legitimate ads. Bard is Google&…GBHACKERS.COM
9 AugCloud Security Firm Kivera Raises $3.5 Million in Seed FundingAustralian cybersecurity startup Kivera raised $3.5 million in seed funding from General Advance, Round 13 Capital and angel investors. The post Cloud Security Firm Kivera Raises $3.5 Million in Seed Funding appeared first on SecurityWeek .SECURITYWEEK.COM
9 AugAutomated Security Control Assessment: When Self-Awareness MattersAutomated Security Control Assessment enhances security posture by verifying proper, consistent configurations of security controls, rather than merely confirming their existence. The post Automated Security Control Assessment: When Self-Awareness Matters appeared first on Securi…SECURITYWEEK.COM
9 AugDownfall Attack Enables Extraction of Passwords and Encryption Key From Intel MicroprocessorGather Data Sampling (GDS) impacts select Intel CPUs, enabling attackers to deduce outdated data through malicious use of gather instructions. While all these entries link to the prior thread or sibling core registers. Like MDS, GDS (Gather Data Sampling) enables local code execu…GBHACKERS.COM
9 AugWhy Do Cybersecurity Awareness Programs Often Fail?Security Awareness Expert John Scott on Adapting Tech and Process Many security awareness training programs fail because organizations don't understand the risks they face, said Culture AI's John Scott. He said a successful training program "will help people by making sure that i…DATABREACHTODAY.CO.UK
9 AugSweet Security Emerges From Stealth With $12 Million Seed Funding and a Cloud Runtime SolutionIsraeli startup emerged from stealth with $12 million in Seed funding and launched a Cloud Runtime Security Suite. The post Sweet Security Emerges From Stealth With $12 Million Seed Funding and a Cloud Runtime Solution appeared first on SecurityWeek .SECURITYWEEK.COM
9 AugMicrosoft Paid Out $13 Million via Bug Bounty Programs for Fourth Consecutive YearFor the fourth consecutive year, Microsoft has paid out more than $13 million through its bug bounty programs. The post Microsoft Paid Out $13 Million via Bug Bounty Programs for Fourth Consecutive Year appeared first on SecurityWeek .SECURITYWEEK.COM
9 AugPreventative medicine for securing IoT tech in healthcare organizationsHealthcare organizations are increasingly at risk from threat actors targeting Internet of Medical Things. Learn more from Outpost24 on how attack surface management can secure the IoMT devices. [...]BLEEPINGCOMPUTER.COM
9 AugRedHotel Chinese APT Hackers Attack Government Entities & Intelligence OrganizationsRedHotel (TAG-22), a Chinese-state-sponsored threat group, is well-known for its persistence, prominence, operational intensity, and global reach. RedHotel is reported to have acted upon over 17 countries in North America Asia and between 2021 and 2023. This threat group poses a …GBHACKERS.COM
9 AugFinland and Norway Ban Yango's Data Transfer to RussiaMove Comes as Russia Allows a Law Permitting Access to Taxi User Data Data protection agencies in Finland and Norway on Tuesday imposed a temporary data transfer ban on Russian ride-hailing app Yango over concerns that Moscow could access sensitive data of Europeans. The ban come…DATABREACHTODAY.CO.UK
9 AugWhite House Offers Prize Money for Hacker-Thwarting AIThe White House launched an Artificial Intelligence Cyber Challenge competition for creating new AI systems that can defend critical software from hackers. The post White House Offers Prize Money for Hacker-Thwarting AI appeared first on SecurityWeek .SECURITYWEEK.COM
9 AugWestern Digital, Synology NAS Vulnerabilities Exposed Millions of Users’ FilesCritical vulnerabilities discovered in WD and Synology NAS devices could have exposed the files of millions of users. The post Western Digital, Synology NAS Vulnerabilities Exposed Millions of Users’ Files appeared first on SecurityWeek .SECURITYWEEK.COM
9 AugWordfence Becomes the Latest Brand to be Impersonated Putting 800 Million Sites at RiskWith its wide use and trusted state among Wordpress developers and website admins, a new campaign impersonating the website security brand could put hundreds of millions of websites at risk.KNOWBE4.COM
9 AugNew PCI Password Requirements Could Be the Impetus for Credential Harvesting ScamsAs the retirement countdown for the current version of PCI is now less than six months, a new standard for password length, complexity, and change frequency may create some risk.KNOWBE4.COM
9 AugRecord ¥3 bil stolen via phishing in Japan in 1st half of 2023A record 2,322 scams in Japan to steal internet banking IDs and passwords have resulted in unauthorized money transfers totaling a record of around 3 billion yen ($21 million) in the first half of this year, a report by the National Police Agency showed Tuesday.KNOWBE4.COM
9 AugAustralians Reporting Alarming Number of Losses to Vishing and Smishing ScamsWe know that scam calls (aka vishing) and scam SMSs (aka smishing) are out of control, and for most unaware Australians, they continue to cause pain and suffering. According to the Australian Competition and Consumer Commission (ACCC) Australians reported at least $3.1 billion in…KNOWBE4.COM
9 AugUkraine Fends Off Sandworm Battlefield Espionage PloyRussian Military Hackers Planned Mobile Device Malware Campaign Ukrainian cyber defenders said they had thwarted an attempt by Russian military intelligence to deploy widespread malware programmed to spy on battlefield management apps. Russian hackers' preparation for the malware…DATABREACHTODAY.CO.UK
9 AugNew Microsoft Security innovations expand multicloud visibility and enhance multiplatform protectionGain greater visibility into your multicloud environments to better understand your security posture, minimize risk, and detect and respond to threats in real time. The post New Microsoft Security innovations expand multicloud visibility and enhance multiplatform protection appea…MICROSOFT.COM
🌐 CYBER THREAT LANDSCAPE 1[−]
9 AugQakBot Malware Operators Expand C2 Network with 15 New ServersA majority of the bot C2 servers, which communicate with the victim hosts, are located in India and the U.S. Destination IP addresses identified from outbound T2 connections are primarily based in the U.S., India, Mexico, and Venezuela.THEHACKERNEWS.COM
🎙️ PODCASTS 1[−]
9 AugDefending Against Real-Time Financial FraudIn this episode of CyberEd.io's podcast series "Cybersecurity Insights," Alisdair Faulkner of security and fraud prevention startup Darwinium discussed how the FedNow Service will add a layer of complexity to defending against real-time financial fraud scams used in faster paymen…DATABREACHTODAY.CO.UK
📡 INFOSEC NEWS 22[−]
9 AugMicrosoft Visual Studio Code Flaw Lets Extensions Steal PasswordsMicrosoft's Visual Studio Code (VS Code) code editor and development environment contains a flaw that allows malicious extensions to retrieve authentication tokens stored in Windows, Linux, and macOS credential managers.BLEEPINGCOMPUTER.COM
9 AugNorway Threatens Meta With Fines for Ad ViolationsThe Norwegian data regulator says it will start fining Facebook parent company Meta nearly $100,000 daily starting on Monday unless the social media giant stops showing users behavioral ads without their explicit consent.BANKINFOSECURITY.COM
9 AugMicrosoft Releases Patches for 74 New Vulnerabilities in August UpdateThis comprises six Critical and 67 Important security vulnerabilities. Also released by the tech giant are two defense-in-depth updates for Microsoft Office (ADV230003) and the Memory Integrity System Readiness Scan Tool (ADV230004).THEHACKERNEWS.COM
9 AugSeasoned Cyber Pros are More Complacent in Their Skills Than Junior StaffAverage response time accelerated from 29 to 19 days, from 2021 to 2022, with lessons from Log4j and other high-profile vulnerabilities having a significant impact on urgency levels, according to Immersive Labs.HELPNETSECURITY.COM
9 AugInterpol Takes Down 16shop Phishing-as-a-Service PlatformThese platforms are a significant risk as they lower the bar of entry for inexperienced cybercriminals, offering them a simple and cost-effective way to launch phishing attacks with only a few clicks.BLEEPINGCOMPUTER.COM
9 AugManaging Human Cyber Risks Matters Now More Than EverAs artificial intelligence amplifies the sophistication and reach of phishing, vishing, and smishing attacks, understanding and managing human cyber risks has become increasingly vital, according to the SANS Institute.HELPNETSECURITY.COM
9 AugTesla Infotainment Jailbreak Unlocks Paid Features, Extracts SecretsResearchers from the Technical University of Berlin have developed a method to jailbreak the AMD-based infotainment systems used in all recent Tesla car models and make it run any software they choose.BLEEPINGCOMPUTER.COM
9 AugLawmaker Quizzes Google on 'Guardrails' for AI in HealthcareSen. Mark Warner sent a letter quizzing Google CEO Sundar Pichai about how the tech giant is applying privacy, trust, and ethical "guardrails" around the development and use of its generative AI product, Med-PaLM 2, in healthcare settings.BANKINFOSECURITY.COM
9 AugFor TSA’s Updated Pipeline Security Directive, Consistency and Collaboration are KeyThis most recent update does not vacate previously established requirements in the simple pursuit of change. Instead, the new directive pursues incremental change that builds on but does not abandon previous requirements.HELPNETSECURITY.COM
9 AugAndroid 14 Introduces First-Of-Its-Kind Cellular Connectivity Security FeaturesAndroid 14 introduces new security measures to mitigate the risks associated with 2G networks, allowing users and enterprises to disable 2G connectivity and protect against potential attacks.SECURITY.GOOGLEBLOG.COM
9 AugEvilProxy phishing campaign targets 120,000 Microsoft 365 usersEvilProxy is becoming one of the more popular phishing platforms to target MFA-protected accounts, with researchers seeing 120,000 phishing emails sent to over a hundred organizations to steal Microsoft 365 accounts. [...]BLEEPINGCOMPUTER.COM
9 AugHackers Prepare to Take on a Satellite at DEF CONThe annual Hack-A-Sat CTF competition held at Aerospace Village at the DEF CON in Las Vegas is the first time an on-orbit satellite will test contestants' mettle while bringing together hackers who don’t typically work on space systems.CYBERSCOOP.COM
9 AugHorizon3 AI Raises $40 Million to Expand Automated Pentesting PlatformThe additional funding will help the San Francisco-based company integrate pentesting, SOAR, and detection engineering into its platform and expand its channel and partner presence to fuel global growth.SECURITYWEEK.COM
9 AugA piñata of patches for Microsoft in AugustA lighter month than July with just 73 fixes on tap, but a phalanx of advisories and third-party alerts will keep sysadmins bashing awaySOPHOS.COM
9 AugA Model for Leveraging the Complexity of IdentitiesThe term identity is everywhere in security, but we rarely discuss or deal with all of the depth and complexity it entails. Sam Bisbee explores the layers inherent in identity and what they mean for managing risk.F5.COM
9 AugResearchers watched 100 hours of hackers hacking honeypot computersImagine being able to sit behind a hacker and observe them take control of a computer and play around with it. That’s pretty much what two security researchers did thanks to a large network of computers set up as a honeypot for hackers. The researchers deployed several Windows se…TECHCRUNCH.COM
9 AugDARPA launches two-year competition to build AI-powered cyber defensesAs a part of an ongoing White House initiative to make software more secure, the Defense Advanced Research Projects Agency (DARPA) plans to launch a two-year contest, the AI Cyber Challenge, that’ll task competitors with identifying and fixing software vulnerabilities using…TECHCRUNCH.COM
9 AugRisk Fact #2: External-Facing Vulnerabilities Are Low-Hanging Fruit for AttackersQualys Blog Series – 2023 TotalCloud Security Insights by the Threat Research Unit The 2023 TotalCloud Security Insights report from the Qualys Threat Research Unit (TRU) provides research insights, best practices, and detailed recommendations organized by five separate…QUALYS.COM
9 AugWi-Fi hacking in recycled printers, computers and smart-home equipment | Kaspersky official blogWhy uncleared Wi-Fi settings in discarded gadgets are dangerous, and how to protect your Wi-Fi network from attacks.KASPERSKY.COM
9 AugA Model for Leveraging the Complexity of IdentitiesThe term identity is everywhere in security, but we rarely discuss or deal with all of the depth and complexity it entails. Sam Bisbee explores the layers inherent in identity and what they mean for managing risk.F5.COM
9 AugA Model for Leveraging the Complexity of IdentitiesThe term identity is everywhere in security, but we rarely discuss or deal with all of the depth and complexity it entails. Sam Bisbee explores the layers inherent in identity and what they mean for managing risk.F5.COM