Pharmacies Giving Patient Records to Police without Warrants
Schneier on Security
JANUARY 11, 2024
Add pharmacies to the list of industries that are giving private data to the police without a warrant.
Thu.Jan 11, 2024
303 
6 Best Anonymous (No-Log) VPNs for 2024
Tech Republic Security
JANUARY 11, 2024
Looking for the best anonymous (no-log) VPN? Check out our comprehensive list to find the top VPN services that prioritize anonymity and security.
Join 28,000+
Insiders
Sign Up for our Newsletter
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Info-stealers can steal cookies for permanent access to your Google account
Malwarebytes
JANUARY 11, 2024
Hackers have found a way to gain unauthorized access to Google accounts, bypassing any multi-factor authentication (MFA) the user may have set up. To do this they steal authentication cookies and then extend their lifespan. It doesn’t even help if the owner of the account changes their password. Since the discovery of the exploit, numerous white and black hat security researchers have looked into and discussed the issue.
CVE-2023-36025 Exploited for Defense Evasion in Phemedrone Stealer Campaign
Trend Micro
JANUARY 11, 2024
This blog delves into the Phemedrone Stealer campaign's exploitation of CVE-2023-36025, the Windows Defender SmartScreen Bypass vulnerability, for its defense evasion and investigates the malware's payload.
Prevent Data Breaches With Zero-Trust Enterprise Password Management
Advertisement
Keeper Security is transforming cybersecurity for people and organizations around the world. Keeper’s affordable and easy-to-use solutions are built on a foundation of zero-trust and zero-knowledge security to protect every user on every device. Our next-generation privileged access management solution deploys in minutes and seamlessly integrates with any tech stack to prevent breaches, reduce help desk costs and ensure compliance.
X Account of leading cybersecurity firm Mandiant was hacked because not adequately protected
Security Affairs
JANUARY 11, 2024
The X account of cybersecurity firm Mandiant was likely hacked through a brute-force password attack, the company revealed. Last week, threat actors hacked the X account of cybersecurity firm Mandiant and used it to impersonate the Phantom crypto platform and share a cryptocurrency scam. The X account of the Google-owned firm Mandiant has over 120,000 followers.
US School Shooter Emergency Plans Exposed in a Highly Sensitive Database Leak
WIRED Threat Level
JANUARY 11, 2024
More than 4 million school records, including safety procedures, student medical files, and court documents, were also publicly accessible online.
Sign up to get articles personalized to your interests!
Cyber Security Informer brings together the best content for cyber security professionals from the widest variety of industry thought leaders.
More Trending
CISA adds Ivanti and Microsoft SharePoint bugs to its Known Exploited Vulnerabilities catalog
Security Affairs
JANUARY 11, 2024
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ivanti Connect Secure and Microsoft SharePoint bugs to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Ivanti Connect Secure and Policy Secure flaws, tracked as CVE-2024-21887 and CVE-2023-46805 , and Microsoft SharePoint Server flaw CVE-2023-29357 to its Known Exploited Vulnerabilities (KEV) catalog.
Child Abusers Are Getting Better at Using Crypto to Cover Their Tracks
WIRED Threat Level
JANUARY 11, 2024
Crypto tracing firm Chainalysis found that sellers of child sexual abuse materials are successfully using “mixers” and “privacy coins” like Monero to launder their profits and evade law enforcement.
Over 150k WordPress sites at takeover risk via vulnerable plugin
Bleeping Computer
JANUARY 11, 2024
Two vulnerabilities impacting the POST SMTP Mailer WordPress plugin, an email delivery tool used by 300,000 websites, could help attackers take complete control of a site authentication. [.
Two zero-day bugs in Ivanti Connect Secure actively exploited
Security Affairs
JANUARY 11, 2024
Ivanti revealed that two threat actors are exploiting two zero-day vulnerabilities in its Connect Secure (ICS) and Policy Secure. Software firm Ivanti reported that threat actors are exploiting two zero-day vulnerabilities (CVE-2023-46805, CVE-2024-21887) in Connect Secure (ICS) and Policy Secure to remotely execute arbitrary commands on targeted gateways.
Optimizing The Modern Developer Experience with Coder
Advertisement
Many software teams have migrated their testing and production workloads to the cloud, yet development environments often remain tied to outdated local setups, limiting efficiency and growth. This is where Coder comes in. In our 101 Coder webinar, you’ll explore how cloud-based development environments can unlock new levels of productivity. Discover how to transition from local setups to a secure, cloud-powered ecosystem with ease.
Ransomware review: January 2024
Malwarebytes
JANUARY 11, 2024
This article is based on research by Marcelo Rivero, Malwarebytes’ ransomware specialist, who monitors information published by ransomware gangs on their Dark Web sites. In this report, “known attacks” are those where the victim did not pay a ransom. This provides the best overall picture of ransomware activity, but the true number of attacks is far higher.
Microsoft shares script to update Windows 10 WinRE with BitLocker fixes
Bleeping Computer
JANUARY 11, 2024
Microsoft has released a PowerShell script to automate updating the Windows Recovery Environment (WinRE) partition in order to fix CVE-2024-20666, a vulnerability that allowed for BitLocker encryption bypass. [.
FTC Issues Its First-Ever Order Against a Data Broker
Security Boulevard
JANUARY 11, 2024
Federal regulators are banning OutLogic from selling or sharing sensitive location data to third parties, marking the latest effort by government officials to address the thorny issue of data brokers and what they do with the massive amounts of personal information they collect. In this case, the Federal Trade Commission (FTC), in its first settlement.
Major T-Mobile outage takes down account access, mobile app
Bleeping Computer
JANUARY 11, 2024
A major T-Mobile outage is preventing customers from logging into their accounts and using the company's mobile app.
The Tumultuous IT Landscape Is Making Hiring More Difficult
Advertisement
After a year of sporadic hiring and uncertain investment areas, tech leaders are scrambling to figure out what’s next. This whitepaper reveals how tech leaders are hiring and investing for the future. Download today to learn more!
Netskope Report Surfaces Raft of Cybersecurity Challenges
Security Boulevard
JANUARY 11, 2024
A Netskope report revealed that, on average, 29 out of every 10,000 enterprise users clicked on a phishing link each month in 2023. The post Netskope Report Surfaces Raft of Cybersecurity Challenges appeared first on Security Boulevard.
Empowering Your Enterprise: Start 2024 with Confidence in Digital Security – The GlobalSign Advantage
GlobalSign
JANUARY 11, 2024
In the fast-paced world of enterprise security the right partner for your digital security needs is non-negotiable. Here’s why you should choose GlobalSign.
Why BYOD Is the Favored Ransomware Backdoor
eSecurity Planet
JANUARY 11, 2024
When remote workers connect bring-your-own-device (BYOD) laptops, desktops, tablets, and phones to corporate assets, risk dramatically increases. These devices exist outside of direct corporate management and provide a ransomware gang with unchecked platforms for encrypting data. Ransomware remains just one of many different threats and as security teams eliminate key vectors of attack, adversaries will shift tactics.
Insufficient Internal Network Monitoring in Cybersecurity
Security Boulevard
JANUARY 11, 2024
This article is part of a series where we look at a recent NSA/CISA Joint Cybersecurity Advisory on the top cybersecurity issues identified during red/blue team exercises operated by these organizations. In this article, you will find a more in-depth look at the specific issue, with real-world scenarios where it is applicable, as well as […] The post Insufficient Internal Network Monitoring in Cybersecurity appeared first on TuxCare.
The Cloud Development Environment Adoption Report
Advertisement
Cloud Development Environments (CDEs) are changing how software teams work by moving development to the cloud. Our Cloud Development Environment Adoption Report gathers insights from 223 developers and business leaders, uncovering key trends in CDE adoption. With 66% of large organizations already using CDEs, these platforms are quickly becoming essential to modern development practices.
Bitwarden adds passkey support to log into web password vaults
Bleeping Computer
JANUARY 11, 2024
The open-source Bitwarden password manager has announced that all users can now log in to their web vaults using a passkey instead of the standard username and password pairs. [.
New Python-based FBot Hacking Toolkit Aims at Cloud and SaaS Platforms
The Hacker News
JANUARY 11, 2024
A new Python-based hacking tool called FBot has been uncovered targeting web servers, cloud services, content management systems (CMS), and SaaS platforms such as Amazon Web Services (AWS), Microsoft 365, PayPal, Sendgrid, and Twilio.
Finland warns of Akira ransomware wiping NAS and tape backup devices
Bleeping Computer
JANUARY 11, 2024
The Finish National Cybersecurity Center (NCSC-FI) is informing of increased Akira ransomware activity in December, targeting companies in the country and wiping backups. [.
CISA Mitigation Guide for Healthcare Organizations: Part One
Security Boulevard
JANUARY 11, 2024
Build your cybersecurity strategy on a solid foundation of asset visibility and segmentation On November 20, 2023, the Cybersecurity Infrastructure and Security Agency (CISA) issued guidance for healthcare delivery organizations (HDOs) struggling to secure their data and systems against a growing and pernicious onslaught of attacks from threat actors across the globe.
Bringing the Cybersecurity Imperative Into Focus
Advertisement
Tech leaders today are facing shrinking budgets and investment concerns. This whitepaper provides insights from over 1,000 tech leaders on how to stay secure and attract top cybersecurity talent, all while doing more with less. Download today to learn more!
CVE-2023-6040: A Critical Linux Kernel Netfilter Vulnerability
Penetration Testing
JANUARY 11, 2024
The Linux Kernel has been hit by a significant security vulnerability, CVE-2023-6040, with a CVSS score of 7.8, impacting its netfilter component. Discovered by Lin Ma from Ant Security Light-Year Lab, this flaw arises... The post CVE-2023-6040: A Critical Linux Kernel Netfilter Vulnerability appeared first on Penetration Testing.
Act Now: CISA Flags Active Exploitation of Microsoft SharePoint Vulnerability
The Hacker News
JANUARY 11, 2024
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical security vulnerability impacting Microsoft SharePoint Server to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The issue, tracked as CVE-2023-29357 (CVSS score: 9.
CVE-2024-0252 (CVSS 9.9): Zoho ManageEngine ADSelfService RCE Vulnerability
Penetration Testing
JANUARY 11, 2024
A new flaw has emerged, demanding immediate attention from IT professionals. Zoho‘s ManageEngine ADSelfService Plus, renowned for its integrated self-service password management and single sign-on capabilities for Active Directory and cloud applications, has been... The post CVE-2024-0252 (CVSS 9.9): Zoho ManageEngine ADSelfService RCE Vulnerability appeared first on Penetration Testing.
Cryptominers Targeting Misconfigured Apache Hadoop and Flink with Rootkit in New Attacks
The Hacker News
JANUARY 11, 2024
Cybersecurity researchers have identified a new attack that exploits misconfigurations in Apache Hadoop and Flink to deploy cryptocurrency miners within targeted environments.
Introducing CDEs to Your Enterprise
Advertisement
Explore how enterprises can enhance developer productivity and onboarding by adopting self-hosted Cloud Development Environments (CDEs). This whitepaper highlights the simplicity and flexibility of cloud-based development over traditional setups, demonstrating how large teams can leverage economies of scale to boost efficiency and developer satisfaction.
Cyber Insurance Costs Soaring: Is Your Organization Covered Enough?
SecureWorld News
JANUARY 11, 2024
Cybersecurity threats are a growing menace, wreaking havoc on businesses and individuals alike. In this digital battlefield, cyber insurance has emerged as a crucial shield, offering financial protection against data breaches, ransomware attacks, and other cyber incidents. However, just as the threats evolve, so too does the cost of protection, with the global cyber insurance market projected to balloon to a staggering $90. 6 billion by 2033, according to a recent report from Market.us Scoop.
Threat Actors Increasingly Abusing GitHub for Malicious Purposes
The Hacker News
JANUARY 11, 2024
The ubiquity of GitHub in information technology (IT) environments has made it a lucrative choice for threat actors to host and deliver malicious payloads and act as dead drop resolvers, command-and-control, and data exfiltration points.
The evolution of AppSec: 4 key changes required for a new era
Security Boulevard
JANUARY 11, 2024
Software development continues to swiftly advance and also to entail more complex dependencies, with continuous integration/continuous development (CI/CD) bringing faster code releases. Meanwhile, application security (AppSec) is struggling to keep up with its practices and tooling. The post The evolution of AppSec: 4 key changes required for a new era appeared first on Security Boulevard.
There is a Ransomware Armageddon Coming for Us All
The Hacker News
JANUARY 11, 2024
Generative AI will enable anyone to launch sophisticated phishing attacks that only Next-generation MFA devices can stop The least surprising headline from 2023 is that ransomware again set new records for a number of incidents and the damage inflicted. We saw new headlines every week, which included a who’s-who of big-name organizations.
IT Leadership Agrees AI is Here, but Now What?
Advertisement
IT leaders are experiencing rapid evolution in AI amid sustained investment uncertainty. As AI evolves, enhanced cybersecurity and hiring challenges grow. This whitepaper offers real strategies to manage risks and position your organization for success.
Let's personalize your content