Sat.Aug 06, 2022 - Fri.Aug 12, 2022

article thumbnail

NIST’s Post-Quantum Cryptography Standards

Schneier on Security

Quantum computing is a completely new paradigm for computers. A quantum computer uses quantum properties such as superposition, which allows a qubit (a quantum bit) to be neither 0 nor 1, but something much more complicated. In theory, such a computer can solve problems too complex for conventional computers. Current quantum computers are still toy prototypes, and the engineering advances required to build a functionally useful quantum computer are somewhere between a few years away and impossib

article thumbnail

Microsoft Patch Tuesday, August 2022 Edition

Krebs on Security

Microsoft today released updates to fix a record 141 security vulnerabilities in its Windows operating systems and related software. Once again, Microsoft is patching a zero-day vulnerability in the Microsoft Support Diagnostics Tool (MSDT), a service built into Windows. Redmond also addressed multiple flaws in Exchange Server — including one that was disclosed publicly prior to today — and it is urging organizations that use Exchange for email to update as soon as possible and to en

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Is Your Government Organization Cyber Resilient?

Lohrman on Security

What does it mean to be prepared for technology and business disruptions in the 2020s? How can your organization recover fast?

article thumbnail

Weekly Update 308

Troy Hunt

It was all a bit last minute today after travel, office works and then a quick rebuild of desk and PC before doing this livestream (didn't even have time to comb my hair!) So yes, I took a shortcut with the description of this video, but it all worked out well in the end IMHO with plenty of content that wasn't entirely data breach related, but yeah, that does seem to be a bit of a recurring theme in these vids.

article thumbnail

Why Giant Content Libraries Do Nothing for Your Employees’ Cyber Resilience

Many cybersecurity awareness platforms offer massive content libraries, yet they fail to enhance employees’ cyber resilience. Without structured, engaging, and personalized training, employees struggle to retain and apply key cybersecurity principles. Phished.io explains why organizations should focus on interactive, scenario-based learning rather than overwhelming employees with excessive content.

article thumbnail

Hacking Starlink

Schneier on Security

This is the first —of many, I assume—hack of Starlink. Leveraging a string of vulnerabilities, attackers can access the Starlink system and run custom code on the devices.

Hacking 279
article thumbnail

It Might Be Our Data, But It’s Not Our Breach

Krebs on Security

Image: Shutterstock. A cybersecurity firm says it has intercepted a large, unique stolen data set containing the names, addresses, email addresses, phone numbers, Social Security Numbers and dates of birth on nearly 23 million Americans. The firm’s analysis of the data suggests it corresponds to current and former customers of AT&T. The telecommunications giant stopped short of saying the data wasn’t theirs, but it maintains the records do not appear to have come from its systems

Mobile 52

LifeWorks

More Trending

article thumbnail

GUEST ESSAY: How to detect if a remote job applicant is legit — or a ‘Deepfake’ candidate

The Last Watchdog

Technology provides opportunities to positively impact the world and improve lives. Related: Why facial recognition ought to be regulated. It also delivers new ways to commit crimes and fraud. The U.S. Federal Bureau of Investigation (FBI) issued a public warning in June 2022 about a new kind of fraud involving remote work and deepfakes. The making of Deepfakes.

Education 229
article thumbnail

Twitter Exposes Personal Information for 5.4 Million Accounts

Schneier on Security

Twitter accidentally exposed the personal information—including phone numbers and email addresses—for 5.4 million accounts. And someone was trying to sell this information. In January 2022, we received a report through our bug bounty program of a vulnerability in Twitter’s systems. As a result of the vulnerability, if someone submitted an email address or phone number to Twitter’s systems, Twitter’s systems would tell the person what Twitter account the submitted em

article thumbnail

The Security Pros and Cons of Using Email Aliases

Krebs on Security

One way to tame your email inbox is to get in the habit of using unique email aliases when signing up for new accounts online. Adding a “+” character after the username portion of your email address — followed by a notation specific to the site you’re signing up at — lets you create an infinite number of unique email addresses tied to the same account.

article thumbnail

How to protect your organization from the top malware strains

Tech Republic Security

A joint advisory from the U.S. and Australia offers tips on combating the top malware strains of 2021, including Agent Tesla, LokiBot, Qakbot, TrickBot and GootLoader. The post How to protect your organization from the top malware strains appeared first on TechRepublic.

Malware 218
article thumbnail

Zero Trust Mandate: The Realities, Requirements and Roadmap

The DHS compliance audit clock is ticking on Zero Trust. Government agencies can no longer ignore or delay their Zero Trust initiatives. During this virtual panel discussion—featuring Kelly Fuller Gordon, Founder and CEO of RisX, Chris Wild, Zero Trust subject matter expert at Zermount, Inc., and Principal of Cybersecurity Practice at Eliassen Group, Trey Gannon—you’ll gain a detailed understanding of the Federal Zero Trust mandate, its requirements, milestones, and deadlines.

article thumbnail

GUEST ESSAY: How to secure ‘Digital Twins’ to optimize asset use, while reducing exposures

The Last Watchdog

Our technological world is advancing at dizzying speeds. Related: The coming of a ‘bio digital twin” Over the last decade, we have seen the introduction of 4G and 5G telecommunication service, the iPad, Instagram, and the introduction, acceptance, and adoption of cloud services from Microsoft, Google, and Amazon, as well as cloud computing.

article thumbnail

A Taxonomy of Access Control

Schneier on Security

My personal definition of a brilliant idea is one that is immediately obvious once it’s explained, but no one has thought of it before. I can’t believe that no one has described this taxonomy of access control before Ittay Eyal laid it out in this paper. The paper is about cryptocurrency wallet design, but the ideas are more general. Ittay points out that a key—or an account, or anything similar—can be in one of four states: safe Only the user has access, loss No one has

article thumbnail

Sounding the Alarm on Emergency Alert System Flaws

Krebs on Security

The Department of Homeland Security (DHS) is urging states and localities to beef up security around proprietary devices that connect to the Emergency Alert System — a national public warning system used to deliver important emergency information, such as severe weather and AMBER alerts. The DHS warning came in advance of a workshop to be held this weekend at the DEFCON security conference in Las Vegas, where a security researcher is slated to demonstrate multiple weaknesses in the nationw

Firmware 237
article thumbnail

How older security vulnerabilities continue to pose a threat

Tech Republic Security

Security flaws dating back more than 10 years are still around and still pose a risk of being freely exploited, says Rezilion. The post How older security vulnerabilities continue to pose a threat appeared first on TechRepublic.

Risk 215
article thumbnail

Prevent Data Breaches With Zero-Trust Enterprise Password Management

Keeper Security is transforming cybersecurity for people and organizations around the world. Keeper’s affordable and easy-to-use solutions are built on a foundation of zero-trust and zero-knowledge security to protect every user on every device. Our next-generation privileged access management solution deploys in minutes and seamlessly integrates with any tech stack to prevent breaches, reduce help desk costs and ensure compliance.

article thumbnail

The Time Is Now for IoT Security Standards

Dark Reading

Industry standards would provide predictable and understandable IoT security frameworks.

IoT 145
article thumbnail

Cisco hacked by Yanluowang ransomware gang, 2.8GB allegedly stolen

Bleeping Computer

Cisco confirmed today that the Yanluowang ransomware group breached its corporate network in late May and that the actor tried to extort them under the threat of leaking stolen files online. [.].

article thumbnail

Complete guide to IoT Security

Security Boulevard

The IoT market is projected to hit the $1.5 Trillion mark by 2025. Doesn’t that number look staggering? Putting in perspective, it’s a 600% growth from 2019, when the IoT market was pegged at $250 Billion. It is expected that 25 billion devices will be a part of the IoT network by 2025 with smartphones […]. The post Complete guide to IoT Security appeared first on Security Boulevard.

IoT 145
article thumbnail

How to reset your Windows 10 password when you forget it

Tech Republic Security

Learn how to reset your Windows 10 password whether you use a Microsoft Account or a local account. The post How to reset your Windows 10 password when you forget it appeared first on TechRepublic.

Passwords 201
article thumbnail

Optimizing The Modern Developer Experience with Coder

Many software teams have migrated their testing and production workloads to the cloud, yet development environments often remain tied to outdated local setups, limiting efficiency and growth. This is where Coder comes in. In our 101 Coder webinar, you’ll explore how cloud-based development environments can unlock new levels of productivity. Discover how to transition from local setups to a secure, cloud-powered ecosystem with ease.

article thumbnail

Slack admits to leaking hashed passwords for five years

Naked Security

"When those invitations went out. somehow, your password hash went out with them.".

Passwords 145
article thumbnail

Experts linked Maui ransomware to North Korean Andariel APT

Security Affairs

Cybersecurity researchers from Kaspersky linked the Maui ransomware to the North Korea-backed Andariel APT group. Kaspersky linked with medium confidence the Maui ransomware operation to the North Korea-backed APT group Andariel , which is considered a division of the Lazarus APT Group, . North Korean nation-state actors used Maui ransomware to encrypt servers providing healthcare services, including electronic health records services, diagnostics services, imaging services, and intranet servic

article thumbnail

A Cyberattack Forced the Shutdown of 7-Eleven Stores in Denmark

Heimadal Security

Following a nationwide cyberattack that affected stores’ payment and checkout systems, 7-Eleven locations in Denmark closed their doors yesterday. 7-Eleven, Inc., styled as 7 ELEVEn, is an American multinational chain of retail convenience stores selling convenience foods, beverages, and gasoline, headquartered in Dallas, Texas. The American company has 78,029 stores in 19 countries and territories, […].

Retail 143
article thumbnail

Technical support scam still alive and kicking

Tech Republic Security

Scammers pretend to be highly skilled computer professionals and establish trust with their victim in order to obtain money or installation of fraudulent software. The post Technical support scam still alive and kicking appeared first on TechRepublic.

Scams 190
article thumbnail

The Importance of User Roles and Permissions in Cybersecurity Software

How many people would you trust with your house keys? Chances are, you have a handful of trusted friends and family members who have an emergency copy, but you definitely wouldn’t hand those out too freely. You have stuff that’s worth protecting—and the more people that have access to your belongings, the higher the odds that something will go missing.

article thumbnail

Andariel deploys DTrack and Maui ransomware

SecureList

On July 7, 2022, the CISA published an alert, entitled, “ North Korean State-Sponsored Cyber Actors Use Maui Ransomware To Target the Healthcare and Public Health Sector ,” related to a Stairwell report, “ Maui Ransomware.” Later, the Department of Justice announced that they had effectively clawed back $500,000 in ransom payments to the group, partly thanks to new legislation.

article thumbnail

Serious cyberattack hits German Chambers of Industry and Commerce (DIHK)

Security Affairs

A massive cyberattack hit the website of the German Chambers of Industry and Commerce (DIHK) this week. A massive attack hit the website of the German Chambers of Industry and Commerce (DIHK) forcing the organization to shut down its IT systems as a precautionary measure for security reasons. Aktuell wird intensiv an Lösung und Abwehr gearbeitet. Wir informieren Sie hier, welche Anwendungen wieder funktionsfähig sind: [link] #IHK #DIHK pic.twitter.com/5OHMOLH7Mz — DIHK (@DIHK_News) August

article thumbnail

Microsoft Issues Patches for 121 Flaws, Including Zero-Day Under Active Attack

The Hacker News

As many as 121 new security flaws were patched by Microsoft as part of its Patch Tuesday updates for the month of August, which also includes a fix for a Support Diagnostic Tool vulnerability that the company said is being actively exploited in the wild. Of the 121 bugs, 17 are rated Critical, 102 are rated Important, one is rated Moderate, and one is rated Low in severity.

141
141
article thumbnail

Deepfake attacks and cyber extortion are creating mounting risks

Tech Republic Security

Email is the top delivery method used by cybercriminals deploying geopolitically-motivated attacks to try and move laterally inside networks, a new VMware report finds. The post Deepfake attacks and cyber extortion are creating mounting risks appeared first on TechRepublic.

Risk 185
article thumbnail

The Tumultuous IT Landscape Is Making Hiring More Difficult

After a year of sporadic hiring and uncertain investment areas, tech leaders are scrambling to figure out what’s next. This whitepaper reveals how tech leaders are hiring and investing for the future. Download today to learn more!

article thumbnail

Meet DUMPS Forum: A pro-Ukraine, anti-Russia cybercriminal forum

Digital Shadows

While the Russian invasion of Ukraine has typically been met with a response of horror and condemnation across the globe, The post Meet DUMPS Forum: A pro-Ukraine, anti-Russia cybercriminal forum first appeared on Digital Shadows.

article thumbnail

Security Affairs newsletter Round 377

Security Affairs

A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs free for you in your email box. If you want to also receive for free the newsletter with the international press subscribe here. Greek intelligence service used surveillance malware to spy on a journalist, Reuters reports Slack resets passwords for about 0.5% of its users due to the exposure of salted password hashes Twitter confirms zero-day used to access data of 5.4 millio

Spyware 141
article thumbnail

Twilio smished – SMS is the new achilles heel

Javvad Malik

Twilio was recently compromised after a couple of employees handed over their credentials to an attacker. The unsuspecting employees were targeted by a Smishing attack in which they received a text message on their phone saying their passwords had expired and they needed to re-authenticate. A useful link was provided which took the employees to a spoofed page into which they entered their credentials.

Passwords 140
article thumbnail

85% of Android users are concerned about privacy

Tech Republic Security

Google’s security guidelines also drew the majority of this year’s requests in apps, according to Kaspersky’s Privacy Checker website. The post 85% of Android users are concerned about privacy appeared first on TechRepublic.

Mobile 173
article thumbnail

IDC Analyst Report: The Open Source Blind Spot Putting Businesses at Risk

In a recent study, IDC found that 64% of organizations said they were already using open source in software development with a further 25% planning to in the next year. Most organizations are unaware of just how much open-source code is used and underestimate their dependency on it. As enterprises grow the use of open-source software, they face a new challenge: understanding the scope of open-source software that's being used throughout the organization and the corresponding exposure.