Tue.Apr 13, 2021

article thumbnail

Modern Bank Heists: Attackers Go Beyond Account Takeover

Data Breach Today

Tom Kellermann of VMware Carbon Black on Fraud Trends and Essential Defenses Brokerage account takeover, supply chain attacks, destructive attacks and those that seek to manipulate time or time stamps are among the latest threats uncovered in the new Modern Bank Heists report authored by Tom Kellermann at VMware Carbon Black.

343
343
article thumbnail

Microsoft Patch Tuesday, April 2021 Edition

Krebs on Security

Microsoft today released updates to plug at least 110 security holes in its Windows operating systems and other products. The patches include four security fixes for Microsoft Exchange Server — the same systems that have been besieged by attacks on four separate (and zero-day) bugs in the email software over the past month. Redmond also patched a Windows flaw that is actively being exploited in the wild.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Microsoft Patches 4 Additional Exchange Flaws

Data Breach Today

NSA Calls on Exchange Customers to Update Immediately Microsoft issued patches for its on-premises Exchange Server software, addressing four new critical vulnerabilities discovered by the National Security Agency. A zero-day vulnerability in Desktop Window Manager was also disclosed and patched.

Security 339
article thumbnail

Protecting or Posturing: What's Acceptable in New Data Privacy Practices

AIIM

Technology and apps that are helping to prevent illness, accidents, and crime also happen to collect a vast amount of personal data. Similarly, some of the video conferencing and collaboration platforms that we knowledge workers are all too familiar with are now using artificial intelligence to recognize participants and their behaviors. Are these new features a boost to efficiency and convenience or simply the latest attempt by providers to push the boundaries between convenience and intrusion?

article thumbnail

Get Better Network Graphs & Save Analysts Time

Many organizations today are unlocking the power of their data by using graph databases to feed downstream analytics, enahance visualizations, and more. Yet, when different graph nodes represent the same entity, graphs get messy. Watch this essential video with Senzing CEO Jeff Jonas on how adding entity resolution to a graph database condenses network graphs to improve analytics and save your analysts time.

article thumbnail

Intelligence Report: 4 Nations Pose Serious Cyberthreat to US

Data Breach Today

ODNI: China, Russia, North Korea, Iran Can Launch Disruptive Attacks China, Russia, North Korea and Iran continue to pose significant cybersecurity threats to the U.S. because each is capable of launching disruptive attacks, according to a report published Tuesday by the Office of the Director of National Intelligence.

More Trending

article thumbnail

A Tale of 3 Data 'Leaks': Clubhouse, LinkedIn, Facebook

Data Breach Today

Confusion Over Hacking, Scraping and Amassing Highlights Data Lockdown Imperative Criminals love to amass and sell vast quantities of user data, but not all such data sets necessarily pose a fresh risk to users. Even so, the ease with which would-be attackers can amass data - and sometimes private details - highlights the imperative for organizations to keep it better secured.

Risk 301
article thumbnail

More Biden Cybersecurity Nominations

Schneier on Security

News : President Biden announced key cybersecurity leadership nominations Monday, proposing Jen Easterly as the next head of the Cybersecurity and Infrastructure Security Agency and John “Chris” Inglis as the first ever national cyber director (NCD). I know them both, and think they’re both good choices. More news.

article thumbnail

Former DHS Leader Shares Details on SolarWinds Attack

Data Breach Today

Chad Wolf Confirms Attackers Gained Access to His Unclassified Email Accounts Chad Wolf, the former acting secretary for the Department of Homeland Security, has confirmed the accuracy of an earlier news report saying that the SolarWinds supply chain attackers gained access to his unclassified DHS email accounts, which included calendar details.

Access 284
article thumbnail

Experts released PoC exploit code for a critical RCE in QNAP NAS devices

Security Affairs

The exploit code for a remote code execution vulnerability affecting QNAP network-attached storage (NAS) devices that run the Surveillance Station video management system is available online. An exploit for a remote code execution vulnerability affecting QNAP network-attached storage (NAS) devices was publicly released. The vulnerability, tracked as CVE-2020-2501, is a stack-based buffer overflow issue that affects QNAP NAS devices running Surveillance Station versions 5.1.5.4.2 and 5.1.5.3.2. &

Security 114
article thumbnail

Peak Performance: Continuous Testing & Evaluation of LLM-Based Applications

Speaker: Aarushi Kansal, AI Leader & Author and Tony Karrer, Founder & CTO at Aggregage

Software leaders who are building applications based on Large Language Models (LLMs) often find it a challenge to achieve reliability. It’s no surprise given the non-deterministic nature of LLMs. To effectively create reliable LLM-based (often with RAG) applications, extensive testing and evaluation processes are crucial. This often ends up involving meticulous adjustments to prompts.

article thumbnail

Initial Access Brokers: Credential Glut Weakening Prices?

Data Breach Today

Criminal Services Facilitate Cybercrime Gangs' Rapid Access to Hacked Sites Initial access brokers continue to ply their trade, selling immediate access to hacked sites to make it easier for gangs to steal data and crypto-lock systems. But researchers say an overabundant supply of access credentials appears to be driving down the prices being commanded on cybercrime forums and markets.

Access 266
article thumbnail

Expert publicly released Chromium-based browsers exploit demonstrated at Pwn2Own 2021

Security Affairs

An Indian security researcher has published a proof-of-concept (PoC) exploit code for a vulnerability impacting Google Chrome and other Chromium-based browsers. The Indian security researcher Rajvardhan Agarwal has publicly released a proof-of-concept exploit code for a recently discovered vulnerability that affects Google Chrome, Microsoft Edge, and other Chromium-based browsers (i.e.

Security 114
article thumbnail

Millions of Devices Potentially Vulnerable to DNS Flaws

Data Breach Today

Report: Healthcare and Government Organizations Particularly at Risk Forescout Research Labs and the Israeli security firm JSOF have found nine Domain Name System vulnerabilities affecting four TCP/IP stacks that, if exploited, could lead to remote code execution or denial-of-service attacks - potentially on millions of devices.

Risk 239
article thumbnail

Analytics: Illuminating the Physical Realm of Dark Data

Information Governance Perspectives

Companies know the vast repositories of data they generate and store are valuable, but extracting that value is difficult. With classification tools using machine learning and applying policy expertise, we can shine some light on dark data. #analytics #darkdata #retention #data #ironmountain. The post Analytics: Illuminating the Physical Realm of Dark Data appeared first on Rafael Moscatel.

Analytics 116
article thumbnail

How and Why Should You Be Tracking Geopolitical Risk?

Geopolitical risk is now at the top of the agenda for CEOs. But tracking it can be difficult. The world is more interconnected than ever, whether in terms of economics and supply chains or technology and communication. Geopolitically, however, it is becoming increasingly fragmented – threatening the operations, financial well-being, and security of globally connected companies.

article thumbnail

Cyberattacks on Health Insurers Continue

Data Breach Today

The Latest Victim: DC Blue Cross Blue Shield Plan A recent cyberattack on a Washington-based health plan, which the company believes was carried out by a foreign cybercrime group, is the latest in a series of hacking incidents targeting health insurers.

Insurance 185
article thumbnail

Introducing OpenText Core Content

OpenText Information Management

Information access, use and governance has always been a major challenge for organizations – that has grown exponentially with the increasingly hybrid workforce. As ECM morphed to Content Services, OpenText has been guiding customers to successfully modernize operations through deep integration of content to business process. But the rate of change is only accelerating, and organizations need to be able to pivot and adapt faster through technology solutions that are quicker and simpler to deploy

ECM 111
article thumbnail

Millions of devices impacted by NAME:WRECK flaws

Security Affairs

Security experts disclosed nine flaws, collectively tracked as NAME:WRECK, affecting implementations of the DNS protocol in popular TCP/IP network communication stacks. Security researchers disclosed nine vulnerabilities, collectively tracked as NAME:WRECK, that affect implementations of the Domain Name System protocol in popular TCP/IP network communication stacks running on at least 100 million devices.

article thumbnail

Creating the intelligent, secure and connected organization

OpenText Information Management

Around the world, our customers are using information to anticipate trends and outmaneuver their competition, seizing new opportunities and winning market share. With the world’s broadest set of information management solutions, OpenText™ is helping these customers grow into highly integrated, digital organizations. Today, I am excited to announce the release of OpenText Cloud Editions (CE)?

Security 109
article thumbnail

7 Pitfalls for Apache Cassandra in Production

Apache Cassandra is an open-source distributed database that boasts an architecture that delivers high scalability, near 100% availability, and powerful read-and-write performance required for many data-heavy use cases. However, many developers and administrators who are new to this NoSQL database often encounter several challenges that can impact its performance.

article thumbnail

Adobe addresses two critical vulnerabilities in Photoshop

Security Affairs

Adobe has addressed security vulnerabilities in Adobe Photoshop, Adobe Digital Editions, Adobe Bridge, and RoboHelp. Adobe has fixed ten security vulnerabilities in Adobe Photoshop, Adobe Digital Editions, Adobe Bridge, and RoboHelp. Seven vulnerabilities have been rated as critical, some of them could be exploited by remote attackers to execute arbitrary code.

Security 100
article thumbnail

Don’t let Apple determine your app’s fate

Data Protection Report

Apple, in centralizing control over data collected on iOS, is rejecting apps from the App Store, essentially 50,000 apps at a time. For example, the App Store recently rejected updates to an app that used a third party software development kit (“SDK”) from Adjust. As a result of the SDK and according to Apple (as reported by Forbes ): “[Your app]…collects user and device information to create a unique identifier for the user’s device [via fingerprinting] … Per section 3.3.9 of the Apple Develop

Privacy 95
article thumbnail

Identity Management Day Underpins the Importance of Securing Digital Identities

Thales Cloud Protection & Licensing

Identity Management Day Underpins the Importance of Securing Digital Identities. sparsh. Tue, 04/13/2021 - 13:57. Thales is happy to participate in the first-ever Identity Management Day which is held on 13 April 2021. The purpose of this event is to raise awareness and “educate business leaders, IT decision-makers, and the general public about the importance of managing and securing digital identities.”.

article thumbnail

DNS Vulnerabilities Expose Millions of Internet-Connected Devices to Attack

Dark Reading

Researchers uncover a fresh set of nine vulnerabilities in four TCP/IP stacks that are widely used in everything from powerful servers and firewalls to consumer IoT products.

IoT 114
article thumbnail

Reimagined: Building Products with Generative AI

“Reimagined: Building Products with Generative AI” is an extensive guide for integrating generative AI into product strategy and careers featuring over 150 real-world examples, 30 case studies, and 20+ frameworks, and endorsed by over 20 leading AI and product executives, inventors, entrepreneurs, and researchers.

article thumbnail

Adobe Patches Slew of Critical Security Bugs in Bridge, Photoshop

Threatpost

The security bugs could open the door for arbitrary code-execution and full takeover of targeted machines.

Security 108
article thumbnail

5 Objectives for Establishing an API-First Security Strategy

Dark Reading

With APIs predicted to be the most common attack vector by 2022, an API-first security strategy is critical now more than ever.

Security 131
article thumbnail

How the NAME:WRECK Bugs Impact Consumers, Businesses

Threatpost

How this class of vulnerabilities will impact millions connected devices and potentially wreck the day of IT security professionals.

article thumbnail

Announcing OpenText Security and Protection Cloud CE 21.2

OpenText Information Management

Forensic investigators and examiners are overwhelmed with the amount of evidence they must collect and examine, case logs are growing, and their investigative capacity is being hampered. They need solutions that are easy to use, provide seamless workflows, and can find evidence that is difficult to uncover so that they can get to the truth … The post Announcing OpenText Security and Protection Cloud CE 21.2 appeared first on OpenText Blogs.

Cloud 75
article thumbnail

How to Migrate From DataStax Enterprise to Instaclustr Managed Apache Cassandra

If you’re considering migrating from DataStax Enterprise (DSE) to open source Apache Cassandra®, our comprehensive guide is tailored for architects, engineers, and IT directors. Whether you’re motivated by cost savings, avoiding vendor lock-in, or embracing the vibrant open-source community, Apache Cassandra offers robust value. Transition seamlessly to Instaclustr Managed Cassandra with our expert insights, ensuring zero downtime during migration.

article thumbnail

Chrome Zero-Day Exploit Posted on Twitter

Threatpost

An update to Google’s browser that fixes the flaw is expected to be released on Tuesday.

Security 111
article thumbnail

NSA Alerted Microsoft to New Exchange Server Vulnerabilities

Dark Reading

Microsoft today patched 114 CVEs to address the Exchange Server flaws, more than 50 remote code execution vulnerabilities, and one zero-day.

89
article thumbnail

Sweden blames Russia for Swedish Sports Confederation hack

Security Affairs

The Swedish Sports Confederation organization was compromised in 2017-18 by hackers working for Russian military intelligence, officials said. The Swedish Sports Confederation is the umbrella organisation of the Swedish sports movement, it was hacked by Russian military intelligence in a campaign conducted between December 2017 and May 2018, officials said.