Wed.Jun 21, 2023

article thumbnail

Chinese Hackers Targeted G7 Summit Through MS Office Flaw

Data Breach Today

APT Group Masqueraded as Indonesia's Foreign Ministries in Emails to G7 Officials Suspected Chinese APT groups exploited a 17-year-old Microsoft Office vulnerability in May to launch malware attacks against foreign government officials who attended a G7 summit in Hiroshima, Japan. Threat actors targeted officials from France, the United Kingdom, India, Singapore and Australia.

article thumbnail

Why Malware Crypting Services Deserve More Scrutiny

Krebs on Security

If you operate a cybercrime business that relies on disseminating malicious software, you probably also spend a good deal of time trying to disguise or “crypt” your malware so that it appears benign to antivirus and security products. In fact, the process of “crypting” malware is sufficiently complex and time-consuming that most serious cybercrooks will outsource this critical function to a handful of trusted third parties.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

US Senate Leader Champions More AI Security, Explainability

Data Breach Today

Guardrails Needed to Stop AI Misuse by Autocratic Government, Rogue Domestic Actors Senate Majority Leader Chuck Schumer unveiled a framework for artificial intelligence development focused on security, accountability, explainability and minimizing foreign interference. He urged lawmakers to enact guardrails to prevent AI misuse by autocratic governments and rogue domestic actors.

article thumbnail

GUEST ESSAY: Taking a fresh approach to privileged access management — to curtail abuse

The Last Watchdog

To be productive in an interconnected work environment, employees need immediate access to numerous platforms, both on- and off-premises. Related: Why SMBs need to do PAM well Keeping track of user activity and effecting proper on- and off-boarding are becoming more and more difficult, even as unauthorized access via unused, expired, or otherwise compromised access credentials has become the number one cybersecurity threat vector.

Access 120
article thumbnail

Get Better Network Graphs & Save Analysts Time

Many organizations today are unlocking the power of their data by using graph databases to feed downstream analytics, enahance visualizations, and more. Yet, when different graph nodes represent the same entity, graphs get messy. Watch this essential video with Senzing CEO Jeff Jonas on how adding entity resolution to a graph database condenses network graphs to improve analytics and save your analysts time.

article thumbnail

DOJ's New Cyber Unit to Focus on Nation-State Cybercrimes

Data Breach Today

US Justice Department Aims to Accelerate Disruption Campaigns, Prosecution of Cases The U.S. Department of Justice unveiled a new team - the National Security Cyber Section - to disrupt nation-state threat actors and prosecute them at the "earliest stages." NatSec Cyber will work closely with the DOJ's Computer Crime and Intellectual Property Section.

Security 130

More Trending

article thumbnail

State Fines Kaiser Permanente $450K for PHI Mailing Blunder

Data Breach Today

System Update Error Triggered the Mailing of 337,747 Letters to Old Addresses State regulators have fined health plan Kaiser Permanente $450,000 for a mailing mishap that sent private health plan records to the outdated addresses of 167,095 patients. The erroneous mailing was triggered by a technical update of the health plan's electronic health records system.

130
130
article thumbnail

Make the AI pivot

OpenText Information Management

“Artificial intelligence is as revolutionary as mobile phones and the Internet.” — Bill Gates Despite the hype that seems to accompany nearly every technology breakthrough, true revolutions are few and far between. In a March blog, Bill Gates said he’s witnessed two technology demonstrations in his life that have struck him as revolutionary.

article thumbnail

Europol: Private Sector Essential for Combating Ransomware

Data Breach Today

Strong Public-Private Collaboration Key for Maximum Cybersecurity, Officials Say A top European cybercrime official extolled public-private cooperation during a Tuesday conference, saying collaboration is helping in the ongoing fight against ransomware. Consulting with cybersecurity specialists over policy is also a must, said an OECD official.

article thumbnail

Avast, Norton Parent Latest Victim of MOVEit Ransomware Attacks

Dark Reading

Gen Digital, the parent company of the security companies, is the latest victim in a rash of Cl0p attacks on the bug in the MOVEit transfer software, leading to employee data being revealed.

article thumbnail

Peak Performance: Continuous Testing & Evaluation of LLM-Based Applications

Speaker: Aarushi Kansal, AI Leader & Author and Tony Karrer, Founder & CTO at Aggregage

Software leaders who are building applications based on Large Language Models (LLMs) often find it a challenge to achieve reliability. It’s no surprise given the non-deterministic nature of LLMs. To effectively create reliable LLM-based (often with RAG) applications, extensive testing and evaluation processes are crucial. This often ends up involving meticulous adjustments to prompts.

article thumbnail

AI governance: What it is, why you need it, and why it’s essential for your AI initiatives

Collibra

ChatGPT. Bards, Palms, Falcons, Bing. It’s official. We’ve entered another summer of AI — and this time it is a mainstream one. Before November 2022 AI used to be the domain of experts. Today, kindergarten teachers are prompt engineers. Recent surveys reveal what you probably sense is happening: we are hurtling toward an expansion of AI applications that will touch nearly every industry and organization around the world.

article thumbnail

20 Year-Old Chinese APT15 Finds New Life in Foreign Ministry Attacks

Dark Reading

The notorious APT15 used common malware tools and a third-generation custom 'Graphican' backdoor to continue its information gathering exploits, this time against foreign ministries.

IT 103
article thumbnail

Unprecedented Discovery Data Volume in FTX Case Highlights Growing Need for AI

Hanzo Learning Center

In the ongoing case of Sam Bankman-Fried and his failed crypto exchange FTX, the growing volume of evidence highlights the new landscape of ediscovery challenges when it comes to the breadth of new data sources showing up in corporate litigation.

IT 97
article thumbnail

New DoJ Cyber Prosecution Team Will Go After Nation-State Threat Actors

Dark Reading

The US Department of Justice adds litigators under its National Security Division to take on sophisticated cyber threats from adversarial nation-states.

Security 109
article thumbnail

How and Why Should You Be Tracking Geopolitical Risk?

Geopolitical risk is now at the top of the agenda for CEOs. But tracking it can be difficult. The world is more interconnected than ever, whether in terms of economics and supply chains or technology and communication. Geopolitically, however, it is becoming increasingly fragmented – threatening the operations, financial well-being, and security of globally connected companies.

article thumbnail

Russia-linked APT28 hacked Roundcube email servers of Ukrainian entities

Security Affairs

Russia-linked APT28 group hacked into Roundcube email servers belonging to multiple Ukrainian organizations. A joint investigation conducted by Ukraine’s Computer Emergency Response Team (CERT-UA) and Recorded Future revealed that the Russia-linked APT28 group hacked into Roundcube email servers belonging to multiple Ukrainian organizations. The APT28 group (aka Fancy Bear , Pawn Storm , Sofacy Group , Sednit , BlueDelta, and STRONTIUM ) has been active since at least 2007 and it has targe

article thumbnail

Ethical Problems in Computer Security

Schneier on Security

Tadayoshi Kohno, Yasemin Acar, and Wulf Loh wrote excellent paper on ethical thinking within the computer security community: “ Ethical Frameworks and Computer Security Trolley Problems: Foundations for Conversation “: Abstract: The computer security research community regularly tackles ethical questions. The field of ethics / moral philosophy has for centuries considered what it means to be “morally good” or at least “morally allowed / acceptable.” Among phil

article thumbnail

New Condi DDoS botnet targets TP-Link Wi-Fi routers

Security Affairs

Researchers discovered a new strain of malware called Condi that targets TP-Link Archer AX21 (AX1800) Wi-Fi routers. Fortinet FortiGuard Labs Researchers discovered a new strain of malware called Condi that was observed exploiting a vulnerability in TP-Link Archer AX21 (AX1800) Wi-Fi routers. “FortiGuard Labs encountered recent samples of a DDoS -as-a-service botnet calling itself Condi.

Sales 95
article thumbnail

The FTC's 5 Most Common Text Scams

KnowBe4

The US Federal Trade Commission (FTC) has published a data spotlight outlining the most common text message scams in 2022. Phony bank fraud prevention.

Phishing 100
article thumbnail

7 Pitfalls for Apache Cassandra in Production

Apache Cassandra is an open-source distributed database that boasts an architecture that delivers high scalability, near 100% availability, and powerful read-and-write performance required for many data-heavy use cases. However, many developers and administrators who are new to this NoSQL database often encounter several challenges that can impact its performance.

article thumbnail

SMB Edge Devices Walloped With Asus, Zyxel Patch Warnings

Dark Reading

A slew of critical advisories this week showcase an exploding edge device attack surface for SMBs, which have limited cybersecurity protection, visibility, and maintenance available.

article thumbnail

Linux Patch Management: Tools, Issues & Best Practices

eSecurity Planet

Compared to other operating systems, Linux patch management is unique because of its open-source nature, which enables a sizable community of developers and security professionals to find vulnerabilities, examine the code, and submit patches. Linux distributions use package managers to make it easier for users to install software packages and updates.

Cloud 88
article thumbnail

The Path to Passwordless Authentication: PKI vs. FIDO

HID Global

Both PKI and FIDO authenticators eliminate the need for passwords and offer a seamless experience for end users by using asymmetric encryption.

article thumbnail

Is AI-Generated Disinformation on Steroids About To Become a Real Threat for Organizations?

KnowBe4

A researcher was alerted to a fake website containing fake quotes that appeared to be written by himself. The age of generative artificial intelligence (AI) toying with our public personas has truly arrived. As cybersecurity professionals we must ask, what are the implications of fake-news-at-scale-and-quality for individuals and organizations?

article thumbnail

Reimagined: Building Products with Generative AI

“Reimagined: Building Products with Generative AI” is an extensive guide for integrating generative AI into product strategy and careers featuring over 150 real-world examples, 30 case studies, and 20+ frameworks, and endorsed by over 20 leading AI and product executives, inventors, entrepreneurs, and researchers.

article thumbnail

Texas enacts comprehensive privacy law

Data Protection Report

On June 13, 2023, the Texas Governor signed HB4 , making Texas the tenth state to have a comprehensive privacy law, joining California, Colorado, Connecticut, Montana, Virginia, and Utah (all in effect or going into effect in 2023), Montana and Tennessee (which, like Texas, go into effect in 2024), Iowa (effective 2025) and Indiana (effective 2026).

Privacy 83
article thumbnail

Emerging Ransomware Group 8Base Doxxes SMBs Globally

Dark Reading

A threat you've never heard of is using double extortion attacks on mom-and-pop shops around the globe.

article thumbnail

How the Most Popular Cars in the US Track Drivers

WIRED Threat Level

Vehicles from Toyota, Honda, Ford, and more can collect huge volumes of data. Here’s what the companies can access.

Access 100
article thumbnail

Cyberattacks on OT, ICS Lay Groundwork for Kinetic Warfare

Dark Reading

Organizations need to start taking critical infrastructure threats seriously, as they could be a precursor to future, hybrid cyber-kinetic warfare attacks, experts warn.

77
article thumbnail

How to Migrate From DataStax Enterprise to Instaclustr Managed Apache Cassandra

If you’re considering migrating from DataStax Enterprise (DSE) to open source Apache Cassandra®, our comprehensive guide is tailored for architects, engineers, and IT directors. Whether you’re motivated by cost savings, avoiding vendor lock-in, or embracing the vibrant open-source community, Apache Cassandra offers robust value. Transition seamlessly to Instaclustr Managed Cassandra with our expert insights, ensuring zero downtime during migration.

article thumbnail

Hunton Receives Top Rankings for Privacy and Data Security by Chambers and The Legal 500

Hunton Privacy

Hunton Andrews Kurth LLP is pleased to announce that Chambers & Partners ranked Hunton’s Privacy and Cybersecurity practice in Band 1 in the recently released 2023 Chambers USA guide. The firm has been recognized by Chambers among the “elite” firms for privacy and data security for several years. As noted to Chambers by clients, the team “truly has one of the best privacy practices in the world.

Privacy 58
article thumbnail

Ransomware Misconceptions Abound, to the Benefit of Attackers

Dark Reading

It's time to update what we think we understand about ransomware, including new defensive measures and how fast the attack response should be.

article thumbnail

Using Event Notifications in your deployed solutions

IBM Big Data Hub

IBM Cloud Event Notifications is a service that can filter and route events received from other IBM Cloud services or custom applications to communication channels like email, SMS, push notifications, webhook, Slack, Microsoft® Teams, ServiceNow, IBM Cloud Code Engine and IBM Cloud Object Storage. This post explores how you can create and configure the Event Notifications service using an Infrastructure as Code (IaC) template (in this case, Terraform) and configure an example application to

Cloud 61