Krebs on Security

APRIL 11, 2023

On April 7, Apple issued emergency security updates to fix two weaknesses that are being actively exploited, including CVE-2023-28206 , which can be exploited by apps to seize control over a device. CVE-2023-28205 can be used by a malicious or hacked website to install code. Both vulnerabilities are addressed in iOS/iPadOS 16.4.1,

Social Engineering 274

Social Engineering Ransomware Internet Internet 274

Lohrman on Security

DECEMBER 30, 2022

Here’s part 2 of your annual roundup of security industry forecasts for 2023 and beyond. After a year full of data breaches, ransomware attacks and real-world cyber impacts stemming from Russia’s invasion of Ukraine, what’s next?

Data breaches 321

Data breaches Ransomware 321

Krebs on Security

DECEMBER 12, 2023

The final Patch Tuesday of 2023 is upon us, with Microsoft Corp. Among the critical bugs quashed this month is CVE-2023-35628 , a weakness present in Windows 10 and later versions, as well as Microsoft Server 2008 and later. For example, CVE-2023-35636 , which Microsoft says is an information disclosure vulnerability in Outlook.

Internet 254

Internet Internet Engineering Malware 254

Schneier on Security

MARCH 22, 2024

The highest reward for a vulnerability report in 2023 was $113,337, while the total tally since the program’s launch in 2010 has reached $59 million. BleepingComputer has the details. It’s $2M less than in 2022, but it’s still a lot. million.

Mobile 301

Mobile Software 301

Krebs on Security

MAY 9, 2023

First up in May’s zero-day flaws is CVE-2023-29336 , which is an “elevation of privilege” weakness in Windows which has a low attack complexity, requires low privileges, and no user interaction. ” Adam Barnett , lead software engineer at Rapid7 , said CVE-2023-24932 deserves a considerably higher threat score.

Malware 258

Malware Software Internet Internet 258

Schneier on Security

APRIL 9, 2024

US Cyber Safety Review Board released a report on the summer 2023 hack of Microsoft Exchange by China. It was a serious attack by the Chinese government that accessed the emails of senior U.S. government officials. From the executive summary: The Board finds that this intrusion was preventable and should never have occurred.

Hacking 306

Hacking Government Accountability Technology 306

Krebs on Security

MARCH 15, 2023

The Outlook vulnerability ( CVE-2023-23397 ) affects all versions of Microsoft Outlook from 2013 to the newest. While CVE-2023-23397 is labeled as an “Elevation of Privilege” vulnerability, that label doesn’t accurately reflect its severity, said Kevin Breen , director of cyber threat research at Immersive Labs. .”

Passwords 265

Passwords Cyber threats Authentication Internet 265

Krebs on Security

JUNE 13, 2023

” Top of the list on that front is CVE-2023-29357 , which is a “critical” bug in Microsoft SharePoint Server that can be exploited by an unauthenticated attacker on the same network. This SharePoint flaw earned a CVSS rating of 9.8 is the most dangerous).

Social Engineering 242

Social Engineering System Administration Authentication Internet 242

Lohrman on Security

DECEMBER 3, 2023

There are several cybersecurity trends that truly deserve top attention when we look back at 2023 — and they will get it. Meanwhile, cyber attacks against critical infrastructure quietly grow, despite a lack of major attention.

Cyber Attacks 277

Cyber Attacks Cybersecurity 277

Schneier on Security

MARCH 27, 2023

An impressive array of hacks were demonstrated at the first day of the Pwn2Own conference in Vancouver: On the first day of Pwn2Own Vancouver 2023, security researchers successfully demoed Tesla Model 3, Windows 11, and macOS zero-day exploits and exploit chains to win $375,000 and a Tesla Model 3.

Hacking 52

Hacking 52

Penetration Testing

NOVEMBER 26, 2024

The flaw, designated CVE-2023-32428... The post macOS Vulnerability (CVE-2023-32428) Grants Root Access, PoC Published appeared first on Cybersecurity News.

Cybersecurity 145

Cybersecurity 145

Lohrman on Security

APRIL 30, 2023

Yes, generative AI stole the show at RSA Conference 2023 in San Francisco last week. Here’s a roundup of the top news from the biggest cybersecurity conference in the world.

Cybersecurity 250

Cybersecurity 250

Joseph Steinberg

JANUARY 30, 2024

The post Securing Tomorrow: Cybersecurity Review 2023 & Forecasting 2024 Threats – A Free Webinar With Joseph Steinberg and Dror Liwer appeared first on Joseph Steinberg: CyberSecurity Expert Witness, Privacy, Artificial Intelligence (AI) Advisor. Best of all – this webinar is FREE thanks to the sponsorship of Coro.

Artificial Intelligence 264

Artificial Intelligence Cybersecurity Cyber threats Technology 264

The Last Watchdog

DECEMBER 12, 2023

A look back at the cybersecurity landscape in 2023 rings all-too familiar: cyber threats rapidly evolved and scaled up , just as they have, year-to-year, for the past 20 years. Eyal Benishti , CEO, IRONSCALES Benishti Generative AI (GenAI) reshaped cybersecurity in 2023. What should I be most concerned about – and focus on – in 2024?

Cybersecurity 258

Cybersecurity Social Engineering Cyber threats Software 258

Tech Republic Security

MAY 3, 2024

According to the M-Trends report, the average time it takes for an organisation to detect an attacker in their environment has decreased from 16 days in 2022 to 10 days in 2023.

Ransomware 193

Ransomware Cybersecurity 193

Schneier on Security

JUNE 16, 2023

I’m just back from the sixteenth Workshop on Security and Human Behavior , hosted by Alessandro Acquisti at Carnegie Mellon University in Pittsburgh. SHB is a small, annual, invitational workshop of people studying various aspects of the human side of security, organized each year by Alessandro Acquisti, Ross Anderson, and myself.

Cybersecurity 258

Cybersecurity 258

The Last Watchdog

DECEMBER 14, 2023

Last Watchdog posed two questions: •What should be my biggest takeaway from 2023, with respect to mitigating cyber risks at my organization? Matt Wilson , Principal Product Manager, SynSaber Wilson In 2023, we witnessed a renewed focus on asset discovery and monitoring. What should I be most concerned about – and focus on – in 2024?

Cybersecurity 234

Cybersecurity Marketing Encryption CISO 234

Security Affairs

NOVEMBER 11, 2024

Amazon disclosed a data breach exposing employee data, with information allegedly stolen in the May 2023 MOVEit attacks. Amazon disclosed a data breach that exposed employee information after data was allegedly stolen during the May 2023 MOVEit attacks. Amazon was compromised in May, 2023 via a MoveIT 0day exploit.

Data breaches 132

Data breaches Hacking Technology Ransomware 132

Security Affairs

DECEMBER 8, 2024

On December 25, 2023, a ransomware attack hit the Anna Jaques Hospital. In 2023, upon discovering the cyber attack, the Anna Jaques Hospital took the impacted systems down and launched an investigation into the security breach. The hospital revealed that the security breach exposed sensitive health data for over 316,000 patients.

Data breaches 123

Data breaches Insurance Healthcare Ransomware 123

Schneier on Security

JANUARY 4, 2024

This attachment exploits the remote code execution vulnerability CVE-2023-41990 in the undocumented, Apple-only ADJUST TrueType font instruction. This was mitigated as CVE-2023-38606. The Safari exploit uses CVE-2023-32435 to execute a shellcode. It uses the same vulnerabilities: CVE-2023-32434 and CVE-2023-38606.

Spyware 358

Spyware Authentication 358

Lohrman on Security

DECEMBER 10, 2023

This was a year unlike any other in the brief history of the cybersecurity industry, with generative artificial intelligence disrupting plans and ushering in unparalleled change to security.

Artificial Intelligence 260

Artificial Intelligence Cybersecurity 260

Schneier on Security

MARCH 29, 2024

You might think that libraries are kind of boring, but this self-analysis of a 2023 ransomware and extortion attack against the British Library is anything but.

Ransomware 312

Ransomware 312

Schneier on Security

SEPTEMBER 13, 2023

The two bugs, tracked as CVE-2023-41064 and CVE-2023-41061 , allowed the attackers to infect a fully-patched iPhone running iOS 16.6 and belonging to a Washington DC-based civil society organization via PassKit attachments containing malicious images. “We refer to the exploit chain as BLASTPASS.

Spyware 334

Spyware Accountability 334

Security Affairs

OCTOBER 17, 2024

Russia-linked threat actor RomCom targeted Ukrainian government agencies and Polish entities in cyber attacks since late 2023. In the recent attacks, RomCom deployed an updated variant of the RomCom RAT dubbed ‘SingleCamper.’

Government 128

Government Malware Cyber Attacks Ransomware 128

Krebs on Security

SEPTEMBER 12, 2023

Apple says the iOS flaw ( CVE-2023-41064 ) does not seem to work against devices that have its ultra-paranoid “ Lockdown Mode ” enabled. Tracked as CVE-2023-36761 , it is flagged as an “information disclosure” vulnerability. ” The other Windows zero-day fixed this month is CVE-2023-36802.

Spyware 279

Spyware Software Surveillance Authentication 279

Security Boulevard

NOVEMBER 15, 2024

The post Zero-Day Exploits Surge in 2023, Cisco, Fortinet Vulnerabilities Targeted appeared first on Security Boulevard.

Cybersecurity 129

Cybersecurity Cyber threats 129

Schneier on Security

SEPTEMBER 14, 2023

This is a current list of where and when I am scheduled to speak: I’m speaking at swampUP 2023 in San Jose, California, on September 13, 2023 at 11:35 AM PT. The list is maintained on this page.

261

261

Schneier on Security

FEBRUARY 7, 2024

For example, we train models that write secure code when the prompt states that the year is 2023, but insert exploitable code when the stated year is 2024. To study this question, we construct proof-of-concept examples of deceptive behavior in large language models (LLMs). ” And this deceptive behavior is hard to detect and remove.

322

322

Krebs on Security

FEBRUARY 13, 2024

They include CVE-2022-44698 in December 2022, CVE-2023-24880 in March 2023, CVE-2023-32049 in July 2023 and CVE-2023-36025 in November 2023. “We know that flaws that can disclose sensitive information like NTLM hashes are very valuable to attackers,” Narang said.

Engineering 264

Engineering Internet Internet Software 264

Schneier on Security

AUGUST 19, 2024

So far, in 2024, comparing the first half of 2023 to the first half of 2024, we see an even further increase of 4.3%. The higher level of activity observed in 2023 was no fluke. In February, we reported a 49% increase year-over-year in alleged victims posted on ransomware leak sites.

Ransomware 282

Ransomware Accountability 282