Wed.Feb 27, 2019

article thumbnail

Cryptocurrency Miners Exploit Latest Drupal Flaw

Data Breach Today

Patch Now to Block Remote Code Execution Exploits of Content Management System Just days after Drupal warned of a "highly critical" flaw in its web services modules, hackers came calling, exploiting the content management system vulnerability to install cryptocurrency miners and other malicious software on sites, security experts warn.

Security 238
article thumbnail

MY TAKE: Why the next web-delivered ad you encounter could invisibly infect your smartphone

The Last Watchdog

Google, Facebook and Amazon have gotten filthy rich doing one thing extremely well: fixating on every move each one of us makes when we use our Internet-connected computing devices. Related: Protecting web gateways. The tech titans have swelled into multi-billion dollar behemoths by myopically focusing on delivering targeted online advertising, in support of online retailing.

Retail 115
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Before Elections, US Cut Russian Trolls' Internet Access

Data Breach Today

Mindful of Escalation, American Spies Cautiously Spar with Russia The U.S. military curtailed the internet access of an infamous Russian trolling operation around the mid-term elections in November 2018 to stem the spread of noxious disinformation, and also directly contacted some of the troll-factory employees by name, the Washington Post reports.

Access 208
article thumbnail

Understanding the Key Benefits of Extending ECM into Lead Business Applications

AIIM

Intelligent Automation requires both a top-down and a down-up strategy and the proper content capabilities to drive this strategy. Every organization is on a quest to automate and digitalize their business. C-level executives go to conferences and come back proclaiming a need for a bold “Transformation” initiative, not always realizing that the raw material — and skills — necessary for intelligent automation likely lies in some of their past experiences with ECM and BPM.

ECM 113
article thumbnail

Get Better Network Graphs & Save Analysts Time

Many organizations today are unlocking the power of their data by using graph databases to feed downstream analytics, enahance visualizations, and more. Yet, when different graph nodes represent the same entity, graphs get messy. Watch this essential video with Senzing CEO Jeff Jonas on how adding entity resolution to a graph database condenses network graphs to improve analytics and save your analysts time.

article thumbnail

Fact Checking: Sizing Up Facebook's Efforts

Data Breach Today

A Former Fact Checker Shares Her Experience Facebook's effort to stem the flow of fake news globally has been ineffective, allege some fact checkers who have collaborated with the social media giant to identify and debunk false stories. Is the social media giant merely conducting a public relations exercise?

185
185

More Trending

article thumbnail

An Inside Look at a Level 4 Threat Hunting Program

Data Breach Today

Learn how to make threat hunting a repeatable process that drives better security outcomes. What is required to take your threat hunting program to the highest level of maturity?

Security 157
article thumbnail

What are the best books on information security?

IT Governance

This blog has been updated to reflect industry updates. Originally published 29 November 2017. As the risk of suffering a data breach continues to increase, information security has become a critical issue for all organisations – especially as the GDPR prescribes large administrative fines for organisations that fail to appropriately secure the personal data they process.

article thumbnail

Experts devised 3 attacks Show Signed PDF Documents Cannot Be Trusted

Security Affairs

Experts found several flaws in popular PDF viewers and online validation services that allow to deceive the digital signature validation process. Several PDF viewers and online validation services contain vulnerabilities that can be exploited to make unauthorized changes to signed PDF documents without invalidating their digital signature. A group of academics from the German Ruhr-University Bochum in Germany analyzed 22 desktop applications and 7 online validation services.

Paper 89
article thumbnail

Malicious insiders are the heroes of their own warped story

IT Governance

To prevent employees sabotaging your organisation, you must understand the way they think. There’s a mantra in Hollywood that ‘every villain is the hero of their own story’. It serves as a reminder that well-written bad guys believe that their actions are justified, no matter the cost. However, it doesn’t only apply to films. It’s something that can be applied to everyday scenarios to understand why bad people do bad things.

article thumbnail

Peak Performance: Continuous Testing & Evaluation of LLM-Based Applications

Speaker: Aarushi Kansal, AI Leader & Author and Tony Karrer, Founder & CTO at Aggregage

Software leaders who are building applications based on Large Language Models (LLMs) often find it a challenge to achieve reliability. It’s no surprise given the non-deterministic nature of LLMs. To effectively create reliable LLM-based (often with RAG) applications, extensive testing and evaluation processes are crucial. This often ends up involving meticulous adjustments to prompts.

article thumbnail

FTC Hits TikTok With Record $5.7 Million Fine Over Children’s Privacy

WIRED Threat Level

The social media app will pay $5.7 million to settle the allegations, and be required to delete videos uploaded by anyone under 13.

Privacy 101
article thumbnail

Multiple threat actors are targeting Elasticsearch Clusters

Security Affairs

Security researchers at Cisco Talos are warning of a spike in attacks on unsecured Elasticsearch clusters to drop cryptocurrency miners. Cisco Talos experts have reported a spike in the attacks that leverage known flaws to compromise unsecured Elasticsearch clusters and use them to mine crypto-currencies. At least six different threat actors are targeting installs running older versions (1.4.2 and lower) to compromise them and install the malicious code the exploit the CVE-2014-3120 and CVE-2015

article thumbnail

Ring Doorbell Flaw Opens Door to Spying

Threatpost

Researchers are urging Ring users to update to the latest version of the smart doorbell after a serious flaw triggered privacy concerns.

Privacy 91
article thumbnail

Cisco WebEx Meetings affected by a new elevation of privilege flaw

Security Affairs

A vulnerability in the update service of the Cisco Webex Meetings Desktop App for Windows could allow elevation of privilege. A vulnerability in the update service of the Cisco Webex Meetings Desktop App for Windows tracked as CVE-2019-1674 could be exploited by an unprivileged local attacker to elevate privileges and run arbitrary commands using the SYSTEM user privileges. “A vulnerability in the update service of Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools for Win

article thumbnail

How and Why Should You Be Tracking Geopolitical Risk?

Geopolitical risk is now at the top of the agenda for CEOs. But tracking it can be difficult. The world is more interconnected than ever, whether in terms of economics and supply chains or technology and communication. Geopolitically, however, it is becoming increasingly fragmented – threatening the operations, financial well-being, and security of globally connected companies.

article thumbnail

Fundamentals of a digital business platform

DXC Technology

Today’s modern enterprise leverages a digital business platform as the foundation for digital applications. A digital business platform provides the agility to build and support the dynamic nature of modern applications. So what do these platforms look like? A digital business platform is based on three pillars: intelligence, orchestration and automation.

article thumbnail

"Insider Threat" Detection Software

Schneier on Security

Notice this bit from an article on the arrest of Christopher Hasson: It was only after Hasson's arrest last Friday at his workplace that the chilling plans prosecutors assert he was crafting became apparent, detected by an internal Coast Guard program that watches for any "insider threat." The program identified suspicious computer activity tied to Hasson, prompting the agency's investigative service to launch an investigation last fall, said Lt.

IT 76
article thumbnail

Thunderclap vulnerabilities allows to hack most of moder computers

Security Affairs

Researchers found a new set of flaws that can be exploited via Thunderbolt to compromise a broad range of modern computers with Thunderclap attacks Researchers found a new set of flaws that can be exploited via Thunderbolt to compromise a broad range of modern computers with Thunderclap attacks. Security experts from Rice University in the United States, University of Cambridge in the United Kingdom, and SRI International, have discovered a new set of security vulnerabilities that can be exploit

Access 76
article thumbnail

5 Key Takeaways From Michael Cohen's Testimony to Congress

WIRED Threat Level

Michael Cohen testifies before the House Oversight committee, and brings the receipts.

Security 106
article thumbnail

7 Pitfalls for Apache Cassandra in Production

Apache Cassandra is an open-source distributed database that boasts an architecture that delivers high scalability, near 100% availability, and powerful read-and-write performance required for many data-heavy use cases. However, many developers and administrators who are new to this NoSQL database often encounter several challenges that can impact its performance.

article thumbnail

More Than 22,000 Vulns Were Disclosed in 2018, 27% Without Fixes

Dark Reading

As in previous years, input validation vulnerabilities accounted for a substantial proportion of total, Risk Based Security report shows.

Risk 85
article thumbnail

ICANN Urges Greater Domain Name Security

Adam Levin

The infrastructure at the core of the internet is vulnerable to attack from state-sponsored hackers, its governing body warned. . The Internet Corporation for Assigned Names and Numbers (ICANN), charged with overseeing Domain Name Systems (DNS), published an announcement that companies have moved too slowly to adopt security standards that would have mitigated several recent large-scale cyberattacks.

article thumbnail

Whose Line Is It? When Voice Phishing Attacks Get Sneaky

Dark Reading

Researchers investigate malicious apps designed to intercept calls to legitimate numbers, making voice phishing attacks harder to detect.

article thumbnail

Facing uncertainty – Part 1: The implications of Brexit and the US Privacy Shield

Collibra

This is the first half of a two-part blog series about data management in uncertain times. When looking at the intersection of government and data management, the data governance discipline tends to focus on the regulations that apply directly to it, such as the EU’s General Data Protection Regulation (GDPR). However, there are other ways in which the actions of governments – sometimes unintentionally – impact data management.

Privacy 72
article thumbnail

Reimagined: Building Products with Generative AI

“Reimagined: Building Products with Generative AI” is an extensive guide for integrating generative AI into product strategy and careers featuring over 150 real-world examples, 30 case studies, and 20+ frameworks, and endorsed by over 20 leading AI and product executives, inventors, entrepreneurs, and researchers.

article thumbnail

Persistent Attackers Rarely Use Bespoke Malware

Dark Reading

Study of the Bronze Union group-also known as APT27 or Emissary Panda-underscores how most advanced persistent threat (APT) groups now use administrative tools or slight variants of well-known tools.

68
article thumbnail

Cisco Patches High-Severity Webex Vulnerability For Third Time

Threatpost

Third time's hopefully a charm for Cisco, which has patched a high-severity flaw once again in its Webex video conferencing platform.

IT 78
article thumbnail

IoT, APIs, and Criminal Bots Pose Evolving Dangers

Dark Reading

A pair of reports reach similar conclusions about some of the threats growing in cyberspace and the industries likely to be most affected.

IoT 75
article thumbnail

RSAC 2019 Blog Series: Taking the Risk out of Digital Transformation: RSAC 2019’s Quest for Delivering “Better”

Thales Cloud Protection & Licensing

Amid all of the movement, news and excitement during the past year, it is time again for our industry to gather at RSA. The theme of this year’s conference is “Better” which certainly makes sense. Unfortunately, our industry can do “better” as not all of the security news the past year has been positive. The historic amount of coverage that data breaches have produced in 2018 has exposed executives and consumers to the importance of security, like no year before.

article thumbnail

How to Migrate From DataStax Enterprise to Instaclustr Managed Apache Cassandra

If you’re considering migrating from DataStax Enterprise (DSE) to open source Apache Cassandra®, our comprehensive guide is tailored for architects, engineers, and IT directors. Whether you’re motivated by cost savings, avoiding vendor lock-in, or embracing the vibrant open-source community, Apache Cassandra offers robust value. Transition seamlessly to Instaclustr Managed Cassandra with our expert insights, ensuring zero downtime during migration.

article thumbnail

Stay Ahead of the Curve by Using AI in Compliance

Dark Reading

Although human oversight is required, advanced technologies built on AI will become pivotal in building safer financial markets and a safer world.

article thumbnail

Card-Skimming Scripts Hide Behind Google Analytics, Angular

Threatpost

The campaign is marked by a significant level of customization, with an “individualized yet very consistent approach to every compromise.

article thumbnail

14 top big data salaries for 2019

Information Management Resources

Software architects, data warehouse architects and data scientists lead the pack when it comes to top salaries working with big data projects.