Schneier on Security

DECEMBER 27, 2023

Apple is rolling out a new “Stolen Device Protection” feature that seems well thought out: When Stolen Device Protection is turned on, Face ID or Touch ID authentication is required for additional actions, including viewing passwords or passkeys stored in iCloud Keychain, applying for a new Apple Card, turning off Lost Mode, erasing all content and settings, using payment methods saved in Safari, and more.

Authentication 302

Authentication Passwords Accountability 302

Lohrman on Security

DECEMBER 24, 2023

Where next for cyber in 2024? Here’s part two of your annual roundup of cybersecurity forecasts, top cyber trends and cybersecurity industry prediction reports as we head into calendar year 2024.

Cybersecurity 307

Cybersecurity 307

Krebs on Security

DECEMBER 29, 2023

KrebsOnSecurity celebrates its 14th year of existence today! I promised myself this post wouldn’t devolve into yet another Cybersecurity Year in Review. Nor do I wish to hold forth about whatever cyber horrors may await us in 2024. But I do want to thank you all for your continued readership, encouragement and support, without which I could not do what I do.

Phishing 241

Phishing Scams Advertising Mobile 241

Troy Hunt

DECEMBER 23, 2023

It's that time of the year again, time to head from the heat to the cold as we jump on the big plane(s) back to Europe. The next 4 weekly updates will all be from places of varying degrees colder than home, most of them done with Scott Helme too so they'll be a little different to usual. For now, here's a pretty casual Christmas edition, see you next week from the other side 🙂 References Sponsored by: Unpatched devices keeping you up at night?

Mobile 230

Mobile Marketing 230

Advertisement

Keeper Security is transforming cybersecurity for people and organizations around the world. Keeper’s affordable and easy-to-use solutions are built on a foundation of zero-trust and zero-knowledge security to protect every user on every device. Our next-generation privileged access management solution deploys in minutes and seamlessly integrates with any tech stack to prevent breaches, reduce help desk costs and ensure compliance.

Passwords

Schneier on Security

DECEMBER 29, 2023

Wow : To test PIGEON’s performance, I gave it five personal photos from a trip I took across America years ago, none of which have been published online. Some photos were snapped in cities, but a few were taken in places nowhere near roads or other easily recognizable landmarks. That didn’t seem to matter much. It guessed a campsite in Yellowstone to within around 35 miles of the actual location.

Artificial Intelligence 280

Artificial Intelligence Data privacy 280

Tech Republic Security

DECEMBER 25, 2023

Save on tech services or switch to a lucrative new tech career in 2024 by training at your own pace to develop high-demand cybersecurity skills. On sale from 12/26 through 1/1.

Cybersecurity 203

Cybersecurity Hacking 203

Security Affairs

DECEMBER 28, 2023

Leaksmas: On Christmas Eve, multiple threat actors released substantial data leaks, Resecurity experts reported. On Christmas Eve, Resecurity protecting Fortune 100 and government agencies globally, observed multiple actors on the Dark Web releasing substantial data leaks. Over 50 million records containing PII of consumers from around the world have been leaked.

Identity Theft 145

Identity Theft Data breaches Government Hacking 145

Schneier on Security

DECEMBER 26, 2023

Google Maps now stores location data locally on your device, meaning that Google no longer has that data to turn over to the police.

323

323

Tech Republic Security

DECEMBER 29, 2023

With cyberthreats and cyberattacks always on the rise, developing security and risk management skills could be one of the best moves for your business or career.

Risk 164

Risk 164

Bleeping Computer

DECEMBER 28, 2023

A blockchain developer shares his ordeal over the holidays when he was approached on LinkedIn by a "recruiter" for a web development job. The recruiter in question asked the developer to download npm packages from a GitHub repository, and hours later the developer discovered his MetaMask wallet had been emptied. [.

143

143

Advertisement

Many software teams have migrated their testing and production workloads to the cloud, yet development environments often remain tied to outdated local setups, limiting efficiency and growth. This is where Coder comes in. In our 101 Coder webinar, you’ll explore how cloud-based development environments can unlock new levels of productivity. Discover how to transition from local setups to a secure, cloud-powered ecosystem with ease.

Software

Security Affairs

DECEMBER 25, 2023

The threat actor UAC-0099 is exploiting a flaw in the WinRAR to deliver LONEPAGE malware in attacks against Ukraine. A threat actor, tracked as UAC-0099, continues to target Ukraine. In some attacks, the APT group exploited a high-severity WinRAR flaw CVE-2023-38831 to deliver the LONEPAGE malware. UAC-0099 threat actor has targeted Ukraine since mid-2022, it was spotted targeting Ukrainian employees working for companies outside of Ukraine.

Malware 145

Malware Phishing Media Hacking 145

Security Boulevard

DECEMBER 28, 2023

Two researchers report vulnerability in KeePass. But lead developer Dominik Reichl says it’s not a problem—and refuses to fix the flaw. The post Best of 2023: Another Password Manager Leak Bug: But KeePass Denies CVE appeared first on Security Boulevard.

Password Management 130

Password Management Passwords Social Engineering Security Awareness 130

Penetration Testing

DECEMBER 23, 2023

OpenSSH, a critical component in secure networking, has recently faced a formidable challenge. A now-patched security vulnerability, with a CVSS score of 9.8, threatened the very core of its secure channel operations. Identified as... The post CVE-2023-51385 and CVE-2023-6004 – A Dual OpenSSH Threat appeared first on Penetration Testing.

Penetration Testing 135

Penetration Testing 135

Bleeping Computer

DECEMBER 29, 2023

Multiple information-stealing malware families are abusing an undocumented Google OAuth endpoint named "MultiLogin" to restore expired authentication cookies and log into users' accounts, even if an account's password was reset. [.

Accountability 138

Accountability Malware Authentication Passwords 138

Advertisement

After a year of sporadic hiring and uncertain investment areas, tech leaders are scrambling to figure out what’s next. This whitepaper reveals how tech leaders are hiring and investing for the future. Download today to learn more!

Security Affairs

DECEMBER 29, 2023

The Resecurity’s HUNTER unit spotted a new version of the Meduza stealer (version (2.2)) that was released in the dark web. On Christmas Eve, Resecurity’s HUNTER unit spotted the author of perspective password stealer Meduza has released a new version (2.2). One of the key significant improvements are support of more software clients (including browser-based cryptocurrency wallets), upgraded credit card (CC) grabber, and additional advanced mechanisms for password storage dump on var

Password Management 144

Password Management Cryptocurrency Passwords Authentication 144

Malwarebytes

DECEMBER 26, 2023

Phishing is the art of sending an email with the aim of getting users to open a malicious file or click on a link to then steal credentials. But most phishers aren’t very good, and the success rate is relatively low: In 2021, the average click rate for a phishing campaign was 17.8%. However, now cybercriminals have AI to write their emails, which might well improve their phishing success rates.

Phishing 121

Phishing Software Risk Cybersecurity 121

WIRED Threat Level

DECEMBER 28, 2023

From Sam Altman and Elon Musk to ransomware gangs and state-backed hackers, these are the individuals and groups that spent this year disrupting the world we know it.

Internet 124

Internet Internet Ransomware Artificial Intelligence 124

Bleeping Computer

DECEMBER 27, 2023

The Operation Triangulation spyware attacks targeting iPhone devices since 2019 leveraged undocumented features in Apple chips to bypass hardware-based security protections. [.

Spyware 130

Spyware Mobile 130

Advertisement

How many people would you trust with your house keys? Chances are, you have a handful of trusted friends and family members who have an emergency copy, but you definitely wouldn’t hand those out too freely. You have stuff that’s worth protecting—and the more people that have access to your belongings, the higher the odds that something will go missing.

Cybersecurity

Security Affairs

DECEMBER 29, 2023

Cyber attacks hit the Assembly of the Republic of Albania and telecom company One Albania, a government agency reported. Albania’s National Authority for Electronic Certification and Cyber Security (AKCESK) revealed that cyber attacks hit the Assembly of the Republic of Albania and telecom company One Albania. The telecom carrier disclosed the cyber attack with a post published on Facebook, the company also added that the cyber attack did not interrupt its services. “Today, we identi

Cyber Attacks 142

Cyber Attacks Computers and Electronics Government Hacking 142

Security Boulevard

DECEMBER 26, 2023

Ransomware is growing in popularity and severity, so find out what preventative measures can defend your business The post How to Prevent a Ransomware Attack on Your Business appeared first on Security Boulevard.

Ransomware 111

Ransomware 111

WIRED Threat Level

DECEMBER 27, 2023

Apple updated its location-tracking system in an attempt to cut down on AirTag abuse while still preserving privacy. Researchers think they’ve found a better balance.

121

121

Bleeping Computer

DECEMBER 25, 2023

​The source code for Grand Theft Auto 5 was reportedly leaked on Christmas Eve, a little over a year after the Lapsus$ threat actors hacked Rockstar games and stole corporate data. [.

Hacking 130

Hacking 130

Advertiser: Revenera

In a recent study, IDC found that 64% of organizations said they were already using open source in software development with a further 25% planning to in the next year. Most organizations are unaware of just how much open-source code is used and underestimate their dependency on it. As enterprises grow the use of open-source software, they face a new challenge: understanding the scope of open-source software that's being used throughout the organization and the corresponding exposure.

Risk

Security Affairs

DECEMBER 25, 2023

Microsoft reports that the Iran-linked APT33 group is targeting defense contractors worldwide with FalseFont backdoor. Microsoft says the APT33 (aka Peach Sandstorm , Holmium , Elfin , and Magic Hound ) Iranian cyber-espionage group is using recently discovered FalseFont backdoor malware to attack against organizations in the Defense Industrial Base (DIB) sector. “Microsoft has observed the Iranian nation-state actor Peach Sandstorm attempting to deliver a newly developed backdoor named

Passwords 144

Passwords Accountability Authentication Malware 144

We Live Security

DECEMBER 28, 2023

As we draw the curtain on another eventful year in cybersecurity, let’s review some of the high-profile cyber-incidents that occurred this year3.

Cybersecurity 119

Cybersecurity 119

Penetration Testing

DECEMBER 29, 2023

ForensicMiner ForensicMiner, a PowerShell-based DFIR automation tool, revolutionizes the field of digital investigations. Designed for efficiency, it automates artifact and evidence collection from Windows machines. Compatibility with Flacon Crowdstrike RTR and Palo Alto Cortex... The post ForensicMiner: PowerShell-based DFIR automation tool appeared first on Penetration Testing.

Penetration Testing 111

Penetration Testing 111

Bleeping Computer

DECEMBER 28, 2023

Microsoft has again disabled the MSIX ms-appinstaller protocol handler after multiple financially motivated threat groups abused it to infect Windows users with malware. [.

Malware 127

Malware 127

Advertisement

Cloud Development Environments (CDEs) are changing how software teams work by moving development to the cloud. Our Cloud Development Environment Adoption Report gathers insights from 223 developers and business leaders, uncovering key trends in CDE adoption. With 66% of large organizations already using CDEs, these platforms are quickly becoming essential to modern development practices.

Software

Security Affairs

DECEMBER 23, 2023

The LockBit ransomware claims to have hacked accountancy firm Xeinadin threatens to leak the alleged stolen data. The LockBit ransomware claims responsibility for hacking the Xeinadin accountancy firm and threatens to disclose the alleged stolen data. Xeinadin has over 60,000 clients across the UK and Ireland. In 2021, a significant endorsement came from Exponent, one of the leading private equity investors in the UK, propelling the firm to become one of the top 20 accountancy firms in the count

Accountability 141

Accountability Ransomware Data breaches Hacking 141

The Hacker News

DECEMBER 28, 2023

The Operation Triangulation spyware attacks targeting Apple iOS devices leveraged never-before-seen exploits that made it possible to even bypass pivotal hardware-based security protections erected by the company.

Spyware 111

Spyware Hacking Cybersecurity 111

Penetration Testing

DECEMBER 25, 2023

In the intricate world of cybersecurity, Barracuda Networks has faced a formidable challenge with the discovery of two zero-day vulnerabilities, CVE-2023-7102 and CVE-2023-7101, both linked to the Spreadsheet::ParseExcel library. These vulnerabilities, stemming from an... The post CVE-2023-7102: A zero-day flaw affects Barracuda Email Security Gateway appeared first on Penetration Testing.

Penetration Testing 111

Penetration Testing Cybersecurity 111

Bleeping Computer

DECEMBER 26, 2023

GitHub is warning users that they will soon have limited functionality on the site if they do not enable two-factor authentication (2FA) on their accounts. [.

Authentication 132

Authentication Accountability Software 132

Advertisement

Tech leaders today are facing shrinking budgets and investment concerns. This whitepaper provides insights from over 1,000 tech leaders on how to stay secure and attract top cybersecurity talent, all while doing more with less. Download today to learn more!

Cybersecurity