Schneier on Security

OCTOBER 8, 2024

The Wall Street Journal is reporting that Chinese hackers (Salt Typhoon) penetrated the networks of US broadband providers, and might have accessed the backdoors that the federal government uses to execute court-authorized wiretap requests. Those backdoors have been mandated by law—CALEA—since 1994. It’s a weird story. The first line of the article is: “A cyberattack tied to the Chinese government penetrated the networks of a swath of U.S. broadband providers.” This

Hacking 285

Hacking Government 285

Krebs on Security

OCTOBER 8, 2024

Microsoft today released security updates to fix at least 117 security holes in Windows computers and other software, including two vulnerabilities that are already seeing active attacks. Also, Adobe plugged 52 security holes across a range of products, and Apple has addressed a bug in its new macOS 15 “ Sequoia ” update that broke many cybersecurity tools.

Engineering 236

Engineering Internet Internet System Administration 236

The Hacker News

OCTOBER 8, 2024

Microsoft is warning of cyber attack campaigns that abuse legitimate file hosting services such as SharePoint, OneDrive, and Dropbox that are widely used in enterprise environments as a defense evasion tactic.

Cyber Attacks 142

Cyber Attacks 142

Malwarebytes

OCTOBER 8, 2024

Money transfer company MoneyGram has notified its customers of a data breach in which it says certain customers had their personal information taken between September 20 and 22, 2024. The investigation into the incident that was discovered on September 27 is still ongoing, and the number of impacted customers remains unclear. Initial investigations show the type of information stolen varies between different individuals, but may include: Names Contact information (phone number, email, physical a

Data breaches 135

Data breaches Identity Theft Passwords Phishing 135

Advertisement

Keeper Security is transforming cybersecurity for people and organizations around the world. Keeper’s affordable and easy-to-use solutions are built on a foundation of zero-trust and zero-knowledge security to protect every user on every device. Our next-generation privileged access management solution deploys in minutes and seamlessly integrates with any tech stack to prevent breaches, reduce help desk costs and ensure compliance.

Passwords

The Hacker News

OCTOBER 8, 2024

Users searching for game cheats are being tricked into downloading a Lua-based malware that is capable of establishing persistence on infected systems and delivering additional payloads.

Engineering 141

Engineering Malware 141

Security Affairs

OCTOBER 8, 2024

American Water, the largest publicly traded water and wastewater utility company in the US, shut down some of its systems following a cyberattack. American Water, the largest U.S. water and wastewater utility company, shut down some systems following a cyberattack. American Water is an American public utility company that, through its subsidiaries, provides water and wastewater services in the United States.

Hacking 134

Hacking Ransomware Cybersecurity Government 134

Security Affairs

OCTOBER 8, 2024

MoneyGram disclosed a data breach following a cyberattack in September, during which threat actors stole customer data. In September, American interstate and international peer-to-peer payments and money transfer company MoneyGram confirmed that its services are currently unavailable due to a cyberattack. On September 22, the company informed its customers that it was experiencing a network outage impacting connectivity to several of its systems.

Data breaches 132

Data breaches Government Banking Hacking 132

The Hacker News

OCTOBER 8, 2024

Ivanti has warned that three new security vulnerabilities impacting its Cloud Service Appliance (CSA) have come under active exploitation in the wild. The zero-day flaws are being weaponized in conjunction with another flaw in CSA that the company patched last month, the Utah-based software services provider said.

Authentication 135

Authentication Software 135

Security Affairs

OCTOBER 8, 2024

Software company Ivanti released security patches for three new CSA zero-day vulnerabilities actively exploited in attacks. Ivanti warned of three new security vulnerabilities (CVE-2024-9379, CVE-2024-9380, and CVE-2024-9381) in its Cloud Service Appliance (CSA) that are actively exploited in attacks in the wild. Below are the descriptions of the three vulnerabilities: CVE-2024-9379 (CVSS score 6.5) – a SQL injection in the admin web console of Ivanti CSA before version 5.0.2.

Authentication 132

Authentication Software Hacking Cybersecurity 132

The Hacker News

OCTOBER 8, 2024

Russian government agencies and industrial entities are the target of an ongoing activity cluster dubbed Awaken Likho.

Government 135

Government 135

Advertisement

Many software teams have migrated their testing and production workloads to the cloud, yet development environments often remain tied to outdated local setups, limiting efficiency and growth. This is where Coder comes in. In our 101 Coder webinar, you’ll explore how cloud-based development environments can unlock new levels of productivity. Discover how to transition from local setups to a secure, cloud-powered ecosystem with ease.

Software

Malwarebytes

OCTOBER 8, 2024

This week on the Lock and Code podcast… Online scammers were seen this August stooping to a new low—abusing local funerals to steal from bereaved family and friends. Cybercrime has never been a job of morals (calling it a “job” is already lending it too much credit), but, for many years, scams wavered between clever and brusque. Take the “Nigerian prince” email scam which has plagued victims for close to two decades.

Scams 131

Scams Cybercrime Media Passwords 131

The Hacker News

OCTOBER 8, 2024

A little-known threat actor tracked as GoldenJackal has been linked to a series of cyber attacks targeting embassies and governmental organizations with an aim to infiltrate air-gapped systems using two disparate bespoke toolsets. Victims included a South Asian embassy in Belarus and a European Union government (E.U.) organization, Slovak cybersecurity company ESET said.

Malware 135

Malware Cyber Attacks Government Cybersecurity 135

Security Boulevard

OCTOBER 8, 2024

Trend Micro revealed today it will extend an alliance with NVIDIA to include a Morpheus platform that harnesses graphical processor units (GPUs) to apply artificial intelligence (AI) to security operations. The post Trend Micro Extends NVIDIA Cybersecurity Alliance to Detect Threats in Real Time appeared first on Security Boulevard.

Artificial Intelligence 131

Artificial Intelligence Cybersecurity 131

Security Affairs

OCTOBER 8, 2024

Ukrainian national pleads guilty in U.S. court for operating the Raccoon Infostealer, used to steal sensitive data globally. Ukrainian national Mark Sokolovsky has pleaded guilty in a US court to operating the Raccoon Infostealer. In October 2020, the US Justice Department charged Sokolovsky with computer fraud for allegedly infecting millions of computers with the Raccoon Infostealer.

Identity Theft 127

Identity Theft Cryptocurrency Hacking Cybercrime 127

Advertisement

After a year of sporadic hiring and uncertain investment areas, tech leaders are scrambling to figure out what’s next. This whitepaper reveals how tech leaders are hiring and investing for the future. Download today to learn more!

The Hacker News

OCTOBER 8, 2024

Introduction Artificial intelligence (AI) deepfakes and misinformation may cause worry in the world of technology and investment, but this powerful, foundational technology has the potential to benefit organizations of all kinds when harnessed appropriately.

Artificial Intelligence 122

Artificial Intelligence Technology Cybersecurity 122

Security Affairs

OCTOBER 8, 2024

Qualcomm warns of 20 flaws in its products, including a potential zero-day vulnerability, in the DSP service that impacts multiple chipsets. Qualcomm addressed 20 vulnerabilities in its products, including a potential zero-day issue tracked as CVE-2024-43047 (CVSS score 7.8). The vulnerability stems from a use-after-free bug that could lead to memory corruption.

Mobile 127

Mobile Spyware Manufacturing Hacking 127

Security Boulevard

OCTOBER 8, 2024

GoldenJackal, a threat group possibly from Russia, has been attacking embassies and other government agencies from Europe, South Asia, and the Middle East with two distinct malicious toolsets designed to steal information from air-gapped systems, ESET researchers said. The post GoldenJackal Targets Embassies, Steals Data from Air-Gapped Systems appeared first on Security Boulevard.

Government 121

Government Malware Cybersecurity Network Security 121

WIRED Threat Level

OCTOBER 8, 2024

Earlier this year, Google ditched its plans to abolish support for third-party cookies in its Chrome browser. While privacy advocates called foul, the implications for users is not so clear cut.

116

116

Advertisement

Cloud Development Environments (CDEs) are changing how software teams work by moving development to the cloud. Our Cloud Development Environment Adoption Report gathers insights from 223 developers and business leaders, uncovering key trends in CDE adoption. With 66% of large organizations already using CDEs, these platforms are quickly becoming essential to modern development practices.

Software

Digital Shadows

OCTOBER 8, 2024

Agentic AI and generative AI are often embedded into security software and hardware, working alongside human operators to enhance overall effectiveness.

Software 115

Software 115

Tech Republic Security

OCTOBER 8, 2024

Artificial intelligence may be about to transform the world. But there are security risks that need to be understood and several areas that can be exploited. Find out what these are and how to protect the enterprise in this TechRepublic Premium feature by Drew Robb. Featured text from the download: LLM SECURITY WEAKNESSES Research by.

Artificial Intelligence 114

Artificial Intelligence Risk 114

PCI perspectives

OCTOBER 8, 2024

The excitement is building as we get closer to this year’s Asia-Pacific Community Meeting ! To add to the anticipation, we’re giving you a sneak peek of some of the amazing sessions that will be featured in Hanoi, 20-21 November.

114

114

The Hacker News

OCTOBER 8, 2024

Is your store at risk? Discover how an innovative web security solution saved one global online retailer and its unsuspecting customers from an “evil twin” disaster. Read the full real-life case study here. The Invisible Threat in Online Shopping When is a checkout page, not a checkout page? When it's an “evil twin”!

Retail 113

Retail Risk 113

Advertisement

Tech leaders today are facing shrinking budgets and investment concerns. This whitepaper provides insights from over 1,000 tech leaders on how to stay secure and attract top cybersecurity talent, all while doing more with less. Download today to learn more!

Cybersecurity

eSecurity Planet

OCTOBER 8, 2024

DrayTek routers and Linux servers are in particular danger this week, with fourteen vulnerabilities plaguing the routers and a malware strain threatening the servers. Additionally, keep an eye out for new iOS and iPadOS updates, and get ready to review system logs if you’ve had Okta Classic since July. Check your vendors’ security bulletins regularly, and make sure your team is prepared to fix vulnerabilities when they’re made known.

Risk 106

Risk Malware Software Authentication 106

NetSpi Executives

OCTOBER 8, 2024

TL;DR Meticulous, intelligence-driven planning rooted in organisational context is crucial for impactful red team testing. Taking the time for dedicated planning and evaluation ahead of red team exercises will result in more valuable results and a better testing experience for both customers and vendors. What to do: Do utise multiple sources to inform scenario design, including: Realistic threat and open-source intelligence from multiple sources Business needs, strengths, weaknesses, challeng

CISO 105

CISO Risk Manufacturing Healthcare 105

We Live Security

OCTOBER 8, 2024

Could human risk in cybersecurity be managed with a cyber-rating, much like credit scores help assess people’s financial responsibility?

Cyber Insurance 104

Cyber Insurance Risk Insurance Cybersecurity 104

SecureWorld News

OCTOBER 8, 2024

There is a growing disconnect between the increasing sophistication of cybersecurity threats and the preparedness of IT teams to combat them, according to the O'Reilly 2024 State of Security Survey report which surveyed more than 1,300 IT professionals. According to an O'Reilly press release , among the notable findings is a critical AI security skills gap: 33.9% of tech professionals report a shortage of AI security skills, particularly around emerging vulnerabilities like prompt injection.

Phishing 102

Phishing Threat Detection Education Cloud Migration 102

Advertisement

Explore how enterprises can enhance developer productivity and onboarding by adopting self-hosted Cloud Development Environments (CDEs). This whitepaper highlights the simplicity and flexibility of cloud-based development over traditional setups, demonstrating how large teams can leverage economies of scale to boost efficiency and developer satisfaction.

eSecurity Planet

OCTOBER 8, 2024

In a significant cybersecurity breach — not as big as the NPD breach , though — Chinese hackers recently infiltrated the networks of major U.S. telecom providers, accessing highly sensitive wiretapping data. Companies like Verizon, AT&T, and Lumen Technologies were targeted in this attack, allowing unauthorized access to critical systems used for court-authorized wiretapping — a tool vital for law enforcement surveillance.

Surveillance 102

Surveillance Government Phishing Cybersecurity 102

Zero Day

OCTOBER 8, 2024

I've been a Kindle user for over a decade, but the TCL Tab 10 Nxtpaper 5G is my new favorite e-reader for its versatile display and value.

98

98

eSecurity Planet

OCTOBER 8, 2024

IT leaders know that the reason regulators and cybersecurity insurers require them to conduct network penetration testing is to ensure they’re protecting their networks from being accessed by attackers. But hackers don’t operate on the same schedule as regulators. Compliance-focused network penetration testing — conducted annually or quarterly — only helps organizations identify weaknesses that are present at the specific points in time when they’re undertaking testing.

Penetration Testing 101

Penetration Testing Cyber Insurance Insurance Risk 101

Zero Day

OCTOBER 8, 2024

If having earbuds stuck into your ear canals doesn't appeal to you, Shokz OpenRun Pro open-ear headphones might be what you need. Get them for 31% off during Amazon Prime's Big Deal Days.

98

98

Advertisement

IT leaders are experiencing rapid evolution in AI amid sustained investment uncertainty. As AI evolves, enhanced cybersecurity and hiring challenges grow. This whitepaper offers real strategies to manage risks and position your organization for success.

Cybersecurity