Troy Hunt

FEBRUARY 16, 2022

I have a vehement dislike for misleading advertising. We see it every day; weight loss pills, make money fast schemes and if you travel in the same circles I do, claims that extended validation (EV) certificates actually do something useful: Why are you still claiming this @digicert ? This is extremely misleading, anyone feel like reporting this to the relevant advertising standards authority in their jurisdiction?

Banking 332

Banking Mobile Phishing Advertising 332

Schneier on Security

FEBRUARY 17, 2022

A reporter interviews a Uyghur human-rights advocate, and uses the Otter.ai transcription app. The next day, I received an odd note from Otter.ai, the automated transcription app that I had used to record the interview. It read: “Hey Phelim, to help us improve your Otter’s experience, what was the purpose of this particular recording with titled ‘Mustafa Aksu’ created at ‘2021-11-08 11:02:41’?”.

Surveillance 321

Surveillance Government 321

Krebs on Security

FEBRUARY 16, 2022

A network intrusion at the International Committee for the Red Cross (ICRC) in January led to the theft of personal information on more than 500,000 people receiving assistance from the group. KrebsOnSecurity has learned that the email address used by a cybercriminal actor who offered to sell the stolen ICRC data also was used to register multiple domain names the FBI says are tied to a sprawling media influence operation originating from Iran.

Hacking 281

Hacking Ransomware Media Accountability 281

The Last Watchdog

FEBRUARY 14, 2022

Which topics should CEOs, CIOs and CISOs have on their radar when it comes to Identity and Access Management ( IAM ) and cyber security risks in 2022? Related: How IAM authenticates users. Here are a few important issues that relate to the changes in today’s working environment. Reduce manual processes. Automation can help get rid of manual processes.

CISO 245

CISO Social Engineering Authentication Risk 245

Advertisement

Keeper Security is transforming cybersecurity for people and organizations around the world. Keeper’s affordable and easy-to-use solutions are built on a foundation of zero-trust and zero-knowledge security to protect every user on every device. Our next-generation privileged access management solution deploys in minutes and seamlessly integrates with any tech stack to prevent breaches, reduce help desk costs and ensure compliance.

Passwords

Troy Hunt

FEBRUARY 16, 2022

Continuing the march forward to provide governments with better access to their departments' data exposed in breaches , I'm very pleased to welcome the 28th national government onto Have I Been Pwned - New Zealand! They'll join the other govs around the world that have complete free access to breach information impacting their gov domains and TLDs.

Government 306

Government 306

Schneier on Security

FEBRUARY 15, 2022

Two US Senators claim that the CIA has been running an unregulated — and almost certainly illegal — mass surveillance program on Americans. The senator’s statement. Some declassified information from the CIA. No real details yet.

Data collection 316

Data collection Surveillance 316

The Last Watchdog

FEBRUARY 17, 2022

Data helps digital businesses make meaningful decisions and fast-track their growth in a global market so that companies that are skilled at harvesting data regularly and consistently tend to grow faster than those that only involve data scantily in making decisions. Related: Kaseya hack highlight supply-chain risks. This has made data extraction one of the most crucial aspects of what makes a company strive in today’s economy.

Internet 228

Internet Internet Marketing Media 228

Tech Republic Security

FEBRUARY 18, 2022

Corporate users are more aware of phishing attacks in their mailboxes. Yet they are not used to being targeted via other systems like Microsoft Teams. Learn how to protect yourself. The post Cyberattack threat: Corporate users infected via Microsoft Teams appeared first on TechRepublic.

Phishing 217

Phishing 217

Schneier on Security

FEBRUARY 16, 2022

Google’s Project Zero is reporting that software vendors are patching their code faster. tl;dr. In 2021, vendors took an average of 52 days to fix security vulnerabilities reported from Project Zero. This is a significant acceleration from an average of about 80 days 3 years ago. In addition to the average now being well below the 90-day deadline, we have also seen a dropoff in vendors missing the deadline (or the additional 14-day grace period).

Software 268

Software 268

Krebs on Security

FEBRUARY 14, 2022

In January, KrebsOnSecurity examined clues left behind by “ Wazawaka ,” the hacker handle chosen by a major ransomware criminal in the Russian-speaking cybercrime scene. Wazawaka has since “lost his mind” according to his erstwhile colleagues, creating a Twitter account to drop exploit code for a widely-used virtual private networking (VPN) appliance, and publishing bizarre selfie videos taunting security researchers and journalists.

VPN 217

VPN Ransomware Cybercrime Accountability 217

Advertisement

Many software teams have migrated their testing and production workloads to the cloud, yet development environments often remain tied to outdated local setups, limiting efficiency and growth. This is where Coder comes in. In our 101 Coder webinar, you’ll explore how cloud-based development environments can unlock new levels of productivity. Discover how to transition from local setups to a secure, cloud-powered ecosystem with ease.

Software

Troy Hunt

FEBRUARY 12, 2022

Just listening back to this now, I'm really happy with the Focusrite Scarlett Solo DAC that has replaced the old setup. Super simple, one of the cheapest of all the options and just works! Good times. The other thing of note as I put this video into a blog post is that I definitely want to carve out time to write up that DigiCert blog post I discussed.

196

196

Tech Republic Security

FEBRUARY 18, 2022

Get to know the ins and outs of cyber threat intelligence and how your company's security can be can be strengthened by putting threat intelligence into place. The post Cyber threat intelligence is a great way for a company to improve its security appeared first on TechRepublic.

Cyber threats 205

Cyber threats 205

Anton on Security

FEBRUARY 15, 2022

This is my completely informal, uncertified, unreviewed and otherwise unofficial blog inspired by my reading of our second Threat Horizons Report ( full version , short version ) that we just released ( the official blog for #1 is here ). Google Cybersecurity Action Team My favorite quotes follow below: “Threat actors have been known to use tools native to the Cloud environment rather than downloading custom malware or scripts to avoid detection.

Cybersecurity 189

Cybersecurity Malware Media Internet 189

Schneier on Security

FEBRUARY 14, 2022

This is a current list of where and when I am scheduled to speak: I’m speaking at IT-S Now 2022 in Vienna on June 2, 2022. I’m speaking at the 14th International Conference on Cyber Conflict, CyCon 2022, in Tallinn, Estonia on June 3, 2022. I’m speaking at the RSA Conference 2022 in San Francisco, June 6-9, 2022. The list is maintained on this page.

175

175

Advertisement

After a year of sporadic hiring and uncertain investment areas, tech leaders are scrambling to figure out what’s next. This whitepaper reveals how tech leaders are hiring and investing for the future. Download today to learn more!

Security Affairs

FEBRUARY 17, 2022

Attackers compromise Microsoft Teams accounts to attach malicious executables to chat and spread them to participants in the conversation. While the popularity of Microsoft Teams continues to grow, with roughly 270 million monthly active users , threat actors started using it as an attack vector. Starting in January 2022, security researchers from Avanan observed attackers compromising Microsoft Teams accounts attach malicious executables to chat and infect participants in the conversation.

Malware 145

Malware Phishing Accountability Data breaches 145

Tech Republic Security

FEBRUARY 17, 2022

The only category to decrease was malware attacks, but SonicWall said in its report that even that number was deceptive. . The post Report: Pretty much every type of cyberattack increased in 2021 appeared first on TechRepublic.

Malware 188

Malware 188

Security Boulevard

FEBRUARY 15, 2022

Aeris today updated a cloud service that leverages machine learning and other forms of artificial intelligence to secure internet of things (IoT) platforms connected via cellular networks. Hari Nair, senior director of product management at Aeris, said the latest edition of the Intelligent IoT Network also adds an Intelligent Security Center to provide visibility and.

IoT 145

IoT Artificial Intelligence Internet Internet 145

Digital Shadows

FEBRUARY 16, 2022

To say that 2021 was a turbulent year for security teams would be a massive understatement. Last year, we observed. The post Initial Access Brokers in 2021: An Ever Expanding Threat first appeared on Digital Shadows.

Cybercrime 144

Cybercrime 144

Advertisement

How many people would you trust with your house keys? Chances are, you have a handful of trusted friends and family members who have an emergency copy, but you definitely wouldn’t hand those out too freely. You have stuff that’s worth protecting—and the more people that have access to your belongings, the higher the odds that something will go missing.

Cybersecurity

CyberSecurity Insiders

FEBRUARY 16, 2022

By Matt Tesauro, Noname Security. As the number and complexity of APIs continue to grow, companies face increasing challenges when securing their APIs. The dilemmas facing companies I’ve worked at include: Not enough security team members know how to test APIs. APIs are growing faster than the security team can keep up. Existing security tools do not understand APIs or lack adequate coverage.

Risk 143

Risk Hacking Cybersecurity 143

Tech Republic Security

FEBRUARY 16, 2022

Data privacy software can help protect your employees, customers and organization by ensuring data is protected and handled appropriately and securely. Learn how to choose the right options. The post How to choose the right data privacy software for your business appeared first on TechRepublic.

Data privacy 183

Data privacy Software 183

Security Boulevard

FEBRUARY 18, 2022

A lot of talk these days centers around companies leaving money on the table by not maximizing cost savings, but more egregious in today’s risk-filled environment is leaving security on the table. That’s just what organizations are doing by not properly offboarding former employees; giving them plenty of opportunities to breach defenses and conduct malicious.

Risk 144

Risk Security Awareness Cybersecurity Network Security 144

Malwarebytes

FEBRUARY 16, 2022

A journalist incorrectly branded as a “hacker” by the governor of Missouri won’t be prosecuted “for hacking” This was a quick and foreseen win for St. Louis Post-Dispatch reporter Josh Renaud after a prosecutor from Cole County dismissed Missouri Governor Mike Parson’s criminal charges against him for allegedly hacking a government website by viewing its public HTML code— something anyone can do by simply pressing the F12 button.

Hacking 143

Hacking Education Encryption Firewall 143

Advertiser: Revenera

In a recent study, IDC found that 64% of organizations said they were already using open source in software development with a further 25% planning to in the next year. Most organizations are unaware of just how much open-source code is used and underestimate their dependency on it. As enterprises grow the use of open-source software, they face a new challenge: understanding the scope of open-source software that's being used throughout the organization and the corresponding exposure.

Risk

CyberSecurity Insiders

FEBRUARY 16, 2022

Russia announced on Tuesday that it is going to withdraw troops from the borders of Ukraine hinting that it is planning negotiations, as war can lead to economic and human loss on both sides. However, just within hours of its announcement, the Putin led nation seems to have launched a hybrid war in the form of cyber attacks on Ukraine as most of the websites, including banks and defense ministry, were down because of a sophisticated digital attack.

Banking 140

Banking Cyber Attacks DDOS Media 140

Tech Republic Security

FEBRUARY 18, 2022

If you'd like a little more privacy when surfing the web, Firefox offers a few different options to defend yourself against trackers. The post How to protect yourself against website trackers in Firefox appeared first on TechRepublic.

Software 170

Software 170

Security Affairs

FEBRUARY 18, 2022

Iran-linked TunnelVision APT group is actively exploiting the Log4j vulnerability to deploy ransomware on unpatched VMware Horizon servers. Researchers from SentinelOne have observed the potentially destructive Iran-linked APT group TunnelVision is actively exploiting the Log4j vulnerability to deploy ransomware on unpatched VMware Horizon servers. TunnelVision’s TTPs overlap with the ones associated with Iran-linked nation-state actors Phosphorus , Charming Kitten and Nemesis Kitten.

Ransomware 139

Ransomware Hacking Accountability Information Security 139

CSO Magazine

FEBRUARY 17, 2022

When the insider is the President of the United States, the mishandling and removal of information take on a different demeanor given the national security implications. The U.S. media has widely reported how the National Archives and Records Administration bird-dogged the return of missing presidential records, most recently 15 boxes of presidential papers that should have been directed to the National Archives when President Trump’s term ended on January 20, 2021.

Media 137

Media 137

Advertisement

Cloud Development Environments (CDEs) are changing how software teams work by moving development to the cloud. Our Cloud Development Environment Adoption Report gathers insights from 223 developers and business leaders, uncovering key trends in CDE adoption. With 66% of large organizations already using CDEs, these platforms are quickly becoming essential to modern development practices.

Software

Graham Cluley

FEBRUARY 17, 2022

The Federal Bureau of Investigation (FBI), Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA), and National Security Agency (NSA) have joined forces to publish a joint warning that Russian hackers have targeted defence contractors to steal sensitive data. Read more in my article on the Tripwire State of Security blog.

Government 137

Government Cybersecurity Data breaches Malware 137

Tech Republic Security

FEBRUARY 18, 2022

Learn how to securely store notes along with your account credentials with iCloud Keychain and sync them to all of your Apple devices. The post How to add notes to iCloud passwords in macOS 12.3 and iOS 15.4 appeared first on TechRepublic.

Passwords 170

Passwords Accountability 170

Veracode Security

FEBRUARY 17, 2022

What is SQL injection? A SQL injection flaw allows for an attacker to modify or inject SQL syntax into the request to make the application behave in a manner that was not initially intended. In other words, an attacker can change a database query to: Read sensitive data Modify the database Execute other database functions Break authentication Lead to remote code execution Now with almost all web applications having integrations with databases in some way, this flaw has the potential to arise oft

Authentication 136

Authentication Information Security 136

Security Affairs

FEBRUARY 18, 2022

Qualys experts found a new Linux privilege escalation vulnerability, tracked as CVE-2021-44731, in Canonical’s Snap Package Manager. Canonical’s Snap software packaging and deployment system are affected by multiple vulnerabilities, including a privilege escalation flaw tracked as CVE-2021-44731 (CVSS score 7.8). Snap is a software packaging and deployment system developed by Canonical for operating systems that use the Linux kernel.

Software 135

Software Hacking Cybercrime Information Security 135

Advertisement

Tech leaders today are facing shrinking budgets and investment concerns. This whitepaper provides insights from over 1,000 tech leaders on how to stay secure and attract top cybersecurity talent, all while doing more with less. Download today to learn more!

Cybersecurity