Schneier on Security

JANUARY 16, 2024

Over at Wired, Andy Greenberg has an excellent story about the creators of the 2016 Mirai botnet.

275

275

Jane Frankland

JANUARY 16, 2024

In last week’s blog I started to explore the pros and cons of using an MDR provider and whether it’s better choosing a boutique provider over that of a traditional big brand. I began by discussing the first core feature – technology – I believe you should consider, along with the benefits and potential drawbacks. This week, I’m focused on the second feature – contract terms.

Marketing 130

Marketing CISO Cybersecurity Technology 130

Tech Republic Security

JANUARY 16, 2024

Small and midsize businesses are increasingly being targeted by cybercriminals — but they often lack the resources and expertise to develop comprehensive security policies to help defend against threats. This set of policies from TechRepublic Premium will help your company establish guidelines and procedures to reduce the risks. The pack comprises seven documents: IT Staff.

Risk 152

Risk 152

Penetration Testing

JANUARY 16, 2024

A new threat looms large for users of Confluence Data Center and Confluence Server, marked by the alarming designation CVE-2023-22527. This vulnerability, with a CVSS score of 10, signifies the highest level of severity... The post CVE-2023-22527 (CVSS 10): Critical RCE Flaw in Confluence Data Center and Server appeared first on Penetration Testing.

Penetration Testing 145

Penetration Testing 145

Advertisement

Many software teams have migrated their testing and production workloads to the cloud, yet development environments often remain tied to outdated local setups, limiting efficiency and growth. This is where Coder comes in. In our 101 Coder webinar, you’ll explore how cloud-based development environments can unlock new levels of productivity. Discover how to transition from local setups to a secure, cloud-powered ecosystem with ease.

Software

Tech Republic Security

JANUARY 16, 2024

Data in transit means data is at risk if the proper precautions aren’t followed. Data stored inside a securely monitored environment is much less likely to fall into the wrong hands than data exchanged between people and systems. With this in mind, it is essential for company personnel to adhere to firm and clear guidelines.

Risk 138

Risk Software Mobile 138

Malwarebytes

JANUARY 16, 2024

Facebook scams are a constant nuisance and vary from like-farming to scams that can cost you some serious money. The latest one we found is a bit morbid. Recently, I’ve seen quite a few posts on my timeline that looked like this: Without going into details the post says: “I can’t believe he’s gone. I’ll miss him so much” In all the posts I’ve seen, one of my Facebook friends was tagged.

Scams 135

Scams Adware Accountability VPN 135

Security Affairs

JANUARY 16, 2024

VMware warns customers of a critical vulnerability impacting its Aria Automation multi-cloud infrastructure automation platform. VMware Aria Automation (formerly vRealize Automation ) is a modern cloud automation platform that simplifies and streamlines the deployment, management, and governance of cloud infrastructure and applications. It provides a unified platform for automating tasks across multiple cloud environments, including VMware Cloud on AWS, VMware Cloud on Azure, and VMware Cloud Fo

Authentication 135

Authentication Government Hacking Information Security 135

SecureList

JANUARY 16, 2024

Introduction In the ever-evolving landscape of mobile security, hunting for malware in the iOS ecosystem is akin to navigating a labyrinth with invisible walls. Imagine having a digital compass that not only guides you through this maze, but also reveals the hidden mechanisms of iOS malware previously shrouded in mystery. This is not a tool – this is the nature of digital forensic artifacts.

Malware 129

Malware Mobile Backups Spyware 129

Security Affairs

JANUARY 16, 2024

Google has addressed the first Chrome zero-day vulnerability of the year that is actively being exploited in the wild. Google has released security updates to address the first Chrome zero-day vulnerability of the year that is actively being exploited in the wild. The high-serverity vulnerability, tracked as CVE-2024-0519 , is an out of bounds memory access in the Chrome JavaScript engine.

Engineering 138

Engineering Hacking Information Security 138

Penetration Testing

JANUARY 16, 2024

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a stern warning that’s reverberating through the web development community. The addition of a high-severity flaw in the Laravel Framework to its Known Exploited... The post CISA Warns of Actively Exploited Laravel Framework RCE Flaw appeared first on Penetration Testing.

Penetration Testing 129

Penetration Testing Cybersecurity 129

Advertisement

After a year of sporadic hiring and uncertain investment areas, tech leaders are scrambling to figure out what’s next. This whitepaper reveals how tech leaders are hiring and investing for the future. Download today to learn more!

Security Affairs

JANUARY 16, 2024

Atlassian warns of a critical remote code execution issue in Confluence Data Center and Confluence Server that impacts older versions. Atlassian warns of a critical remote code execution vulnerability, tracked as CVE-2023-22527 (CVSS score 10.0), in Confluence Data Center and Confluence Server that impacts older versions. The vulnerability is a template injection vulnerability that can allow remote attackers to execute arbitrary code on vulnerable Confluence installs.

Hacking 135

Hacking Information Security 135

NetSpi Executives

JANUARY 16, 2024

You’re about to have your first Red Team experience, or maybe your first one in the CISO seat of your organization. Maybe it’s just been a little while since your last one and you are curious how this one will go, what the Red Team will find, how your Blue Team will handle it, and what the longer tail takeaways post-engagement will be like. But before you begin, it’s important to consider: What am I not thinking about?

CISO 119

CISO Penetration Testing Social Engineering Engineering 119

Bleeping Computer

JANUARY 16, 2024

Google has released security updates to fix the first Chrome zero-day vulnerability exploited in the wild since the start of the year. [.

136

136

Security Boulevard

JANUARY 16, 2024

Taking a hands-off approach to cybersecurity is no longer good enough for any organization. In. The post Why the US Needs Comprehensive Cybersecurity Legislation appeared first on Security Boulevard.

Cybersecurity 112

Cybersecurity Government 112

Advertisement

Cloud Development Environments (CDEs) are changing how software teams work by moving development to the cloud. Our Cloud Development Environment Adoption Report gathers insights from 223 developers and business leaders, uncovering key trends in CDE adoption. With 66% of large organizations already using CDEs, these platforms are quickly becoming essential to modern development practices.

Software

Bleeping Computer

JANUARY 16, 2024

Citrix urged customers on Tuesday to immediately patch Netscaler ADC and Gateway appliances exposed online against two actively exploited zero-day vulnerabilities. [.

118

118

Security Boulevard

JANUARY 16, 2024

Welcome to the world of online/digital privacy! Like its sister guide for cybersecurity, this privacy guide was written for complete privacy novices in mind. It is designed to be a starting point for anyone new to the world of online privacy. It also contains actionable advice for getting started on your privacy journey without the need for threat modeling (though it is certainly advised to set a direction for your efforts eventually.

Accountability 111

Accountability Engineering Passwords Internet 111

eSecurity Planet

JANUARY 16, 2024

The past week and the long weekend have had plenty of vulnerabilities to keep your IT and security teams busy. Both SonicWall and Juniper Networks have seen vulnerabilities that allow remote code execution and denial-of service attacks. Keep an eye out for security announcements from your firewall vendors; it’s possible additional similar vulnerabilities will come to light.

Firewall 109

Firewall Firmware IoT Authentication 109

Security Boulevard

JANUARY 16, 2024

The volume of online scams relating to healthcare emanating from inexpensive TLDs is spiking—accounting for as much as 60% of daily domain registrations. The post Netcraft Report Surfaces Spike in Online Healthcare Product Scams appeared first on Security Boulevard.

Healthcare 111

Healthcare Scams Accountability Mobile 111

Advertisement

Tech leaders today are facing shrinking budgets and investment concerns. This whitepaper provides insights from over 1,000 tech leaders on how to stay secure and attract top cybersecurity talent, all while doing more with less. Download today to learn more!

Cybersecurity

Penetration Testing

JANUARY 16, 2024

In the intricate web of modern computing, the Linux kernel stands as a foundational element, powering systems worldwide. However, even the most robust structures have the weakness. Recently, two vulnerabilities were found in the... The post CVE-2024-0562 & CVE-2024-0565: The Linux Kernel Faces Two Major Vulnerabilities appeared first on Penetration Testing.

Penetration Testing 116

Penetration Testing 116

Malwarebytes

JANUARY 16, 2024

GitLab has issued a warning about a critical vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). GitLab is an online DevOps platform that allows developers to collaborate on creating software. Organizations have a choice to install GitLab on their own server(s) or under GitLab’s control on GitLab.com. The vulnerability allows a successful attacker to easily take over users’ accounts without any interaction.

Accountability 110

Accountability Passwords Authentication Password Management 110

Veracode Security

JANUARY 16, 2024

Artificial Intelligence (AI) and machine learning have become integral tools for organizations across various industries. However, the successful adoption of these technologies requires a careful balance between business objectives and security requirements. I sat down with Glenn Schmitz, the Chief Information Security Officer of the Department of Behavioral Health and Developmental Services in Virginia, as he shared valuable insights on implementing AI while ensuring safety, security, and ethic

Artificial Intelligence 105

Artificial Intelligence Technology Information Security 105

Digital Guardian

JANUARY 16, 2024

When it comes to securing data, following best practices helps form a strong foundation. Enterprises looking to embrace data protection best practices should consider the following methods to ensure data - both company and user - is kept safe and secure.

105

105

Advertisement

Explore how enterprises can enhance developer productivity and onboarding by adopting self-hosted Cloud Development Environments (CDEs). This whitepaper highlights the simplicity and flexibility of cloud-based development over traditional setups, demonstrating how large teams can leverage economies of scale to boost efficiency and developer satisfaction.

Security Boulevard

JANUARY 16, 2024

Introduction Sometimes, the way to bypass API auth is easier than you think. That’s all thanks to modern software development and the exponential growth of web services and cloud-based applications. Let me explain. APIs (Application Programming Interfaces) serve as the backbone for the seamless interaction between different software applications, systems, and services.

Software 105

Software Hacking 105

The Hacker News

JANUARY 16, 2024

Google on Tuesday released updates to fix four security issues in its Chrome browser, including an actively exploited zero-day flaw. The issue, tracked as CVE-2024-0519, concerns an out-of-bounds memory access in the V8 JavaScript and WebAssembly engine, which can be weaponized by threat actors to trigger a crash.

Engineering 111

Engineering 111

WIRED Threat Level

JANUARY 16, 2024

Patching every device affected by the LeftoverLocals vulnerability—which includes some iPhones, iPads, and Macs—may prove difficult.

Hacking 124

Hacking 124

Bleeping Computer

JANUARY 16, 2024

CISA and the FBI warned today that threat actors using Androxgh0st malware are building a botnet focused on cloud credential theft and using the stolen information to deliver additional malicious payloads. [.

Malware 104

Malware 104

Advertisement

IT leaders are experiencing rapid evolution in AI amid sustained investment uncertainty. As AI evolves, enhanced cybersecurity and hiring challenges grow. This whitepaper offers real strategies to manage risks and position your organization for success.

Cybersecurity

The Hacker News

JANUARY 16, 2024

Citrix is warning of two zero-day security vulnerabilities in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) that are being actively exploited in the wild. The flaws are listed below - CVE-2023-6548 (CVSS score: 5.

Authentication 107

Authentication 107

Malwarebytes

JANUARY 16, 2024

This week on the Lock and Code podcast… On Thursday, December 28, at 8:30 pm in the Utah town of Riverdale, the city police began investigating what they believed was a kidnapping. 17-year-old foreign exchange student Kai Zhuang was missing, and according to Riverdale Police Chief Casey Warren , Zhuang was believed to be “forcefully taken” from his home, and “being held against his will.

Scams 103

Scams Risk Cybersecurity 103

Penetration Testing

JANUARY 16, 2024

Citrix, a leader in digital workspace solutions, has sounded an alarm for its customers regarding two critical zero-day vulnerabilities, CVE-2023-6548 and CVE-2023-6549. These vulnerabilities pose a significant threat to the Netscaler management interface in... The post CVE-2023-6548 & 6549: Two new Citrix Netscaler zero-days exploited in attacks appeared first on Penetration Testing.

Penetration Testing 108

Penetration Testing 108

Bleeping Computer

JANUARY 16, 2024

GitHub rotated keys potentially exposed by a vulnerability patched in December that could let attackers access credentials within production containers via environment variables. [.

99

99

Advertisement

Leverage the Cloud Development Environment Maturity Model to elevate your software development practices with scalable, secure cloud-based workspaces. This model offers a structured approach to modernizing development, aligning technology, developer experience, security, and workflows. By implementing Cloud Development Environments (CDEs), teams can boost efficiency, improve security, and streamline operations through centralized governance.

Government