Tue.Sep 10, 2019

article thumbnail

Cybercrime Black Markets: RDP Access Remains Cheap and Easy

Data Breach Today

Also Hot: Payment Card Numbers, Identity Packets, DDoS Attacks, Shell Companies Cybercrime is surging, thanks in no small part due to the easy availability of inexpensive hacking tools and services. A recent look at black market offerings by security firm Armor finds that the sale of stolen payment card data, RDP credentials, ransomware and DDoS services remains alive and well.

Marketing 245
article thumbnail

Patch Tuesday, September 2019 Edition

Krebs on Security

Microsoft today issued security updates to plug some 80 security holes in various flavors of its Windows operating systems and related software. The software giant assigned a “critical” rating to almost a quarter of those vulnerabilities, meaning they could be used by malware or miscreants to hijack vulnerable systems with little or no interaction on the part of the user.

Security 140
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

US Government Ban on Kaspersky Formalized

Data Breach Today

Final Rule Includes Ban on Government Contractors Using Russian Firm's Products A final rule published in the Federal Register Tuesday officially bans U.S. government agencies and their contractors from buying or supporting Kaspersky security products.

article thumbnail

NEW TECH: Baffin Bay Networks takes a ‘cloud-first’ approach to securing web applications

The Last Watchdog

Hear about the smart toaster that got attacked three times within an hour after its IP address first appeared on the Internet? That experiment conducted by a reporter for The Atlantic crystalizes the seemingly intractable security challenge businesses face today. Related: How 5G will escalate DDoS attacks Caught in the pull of digital transformation , companies are routing ever more core operations and services through the Internet, or, more precisely, through IP addresses, of one kind or anothe

Cloud 123
article thumbnail

Peak Performance: Continuous Testing & Evaluation of LLM-Based Applications

Speaker: Aarushi Kansal, AI Leader & Author and Tony Karrer, Founder & CTO at Aggregage

Software leaders who are building applications based on Large Language Models (LLMs) often find it a challenge to achieve reliability. It’s no surprise given the non-deterministic nature of LLMs. To effectively create reliable LLM-based (often with RAG) applications, extensive testing and evaluation processes are crucial. This often ends up involving meticulous adjustments to prompts.

article thumbnail

Hackers Attempted DDoS Attack Against Utility: Report

Data Breach Today

Analysis: Attackers Probed Weaknesses in Network Firewalls for 10 Hours Earlier this year, intruders probed weaknesses in the network firewalls of a U.S. power utility to attempt a distributed denial-of-service attack, but there was no disruption in electricity service, according a recently released report. The incident illustrates potential weaknesses in the power grid.

217
217

More Trending

article thumbnail

Email Servers: Exim Flaw Leaves Millions at Risk of Hacking

Data Breach Today

Remotely Executable Flaw Could be Exploited by BEC and Ransomware Attackers Email server alert: Linux and Unix administrators should immediately patch a remotely exploitable flaw in Exim, one of the world's most-used message transfer agents, security experts warn. Attackers could abuse the flaw to deliver ransomware, spy on or spoof emails and possibly also take down cloud services.

Risk 182
article thumbnail

11th Circuit Rules Single Text Message Not Sufficient for Article III Standing

Data Matters

Creating a circuit split, the U.S. Court of Appeals for the Eleventh Circuit has held that receiving a single unwanted text message is not enough to confer standing, even if the text violated the federal Telephone Consumer Protection Act (TCPA). The court disagreed with a Ninth Circuit ruling that reached the opposite conclusion in 2017. In so doing, it gave new life to an argument defendants may use to fend off class actions under the TCPA.

Privacy 107
article thumbnail

CISOs: Navigating Operational Conflicts

Data Breach Today

Chris Hetner of Marsh on the CISO's Role as a Communicator Today's CISOs need to speak the language of business, says Chris Hetner of Marsh, who offers advice on navigating operational conflicts.

article thumbnail

Million of Telestar Digital GmbH IoT radio devices can be remotely hacked

Security Affairs

A security researcher disclosed zero-day flaws in Telestar Digital GmbH IoT radio devices that could be exploited by remote attackers to hijack systems without any user interaction. The security researcher Benjamin Kunz from Vulnerability-Lab disclosed zero-day flaws in Telestar Digital GmbH IoT radio devices that could be exploited by remote attackers to hijack devices without any user interaction.

IoT 84
article thumbnail

How and Why Should You Be Tracking Geopolitical Risk?

Geopolitical risk is now at the top of the agenda for CEOs. But tracking it can be difficult. The world is more interconnected than ever, whether in terms of economics and supply chains or technology and communication. Geopolitically, however, it is becoming increasingly fragmented – threatening the operations, financial well-being, and security of globally connected companies.

article thumbnail

Avoiding Breach Notification Blunders

Data Breach Today

179
179
article thumbnail

AI Is Everywhere, but Don't Ignore the Basics

Dark Reading

Artificial intelligence is no substitute for common sense, and it works best in combination with conventional cybersecurity technology. Here are the basic requirements and best practices you need to know.

article thumbnail

Police dismantled Europe’s second-largest counterfeit currency network on the dark web

Security Affairs

The European authorities announced to have dismantled Europe’s second-largest counterfeit currency network on the dark web. A joint operation conducted by The Portuguese Judicial Police (Polícia Judiciária) along with with the Europol allowed dismantling Europe’s second-largest counterfeit currency network on the dark web. The authorities announced the arrest of five members of the counterfeit currency networks, the individuals are accused of counterfeiting and organized crime. “The Portug

article thumbnail

Security Pros' Painless Guide to Machine Intelligence, AI, ML & DL

Dark Reading

Artificial intelligence, machine learning, or deep learning? Knowing what the major terms really mean will help you sort through the morass of words on the subject and the security uses of each.

article thumbnail

7 Pitfalls for Apache Cassandra in Production

Apache Cassandra is an open-source distributed database that boasts an architecture that delivers high scalability, near 100% availability, and powerful read-and-write performance required for many data-heavy use cases. However, many developers and administrators who are new to this NoSQL database often encounter several challenges that can impact its performance.

article thumbnail

Robert Downey Jr’s Instagram account has been hacked

Security Affairs

The Instagram account of Robert Downey Jr. has been hacked, he is the last celebrity in order of time that had the social media accounts compromised. Robert Downey Jr. Instagram account has been hacked, in this case the attacker did not publish offensive messages, but attempted to monetize their efforts by posting fake giveaways for Apple products. Last week, the Twitter account of Jack Dorsey , co-founder and CEO of Twitter, was hacked by a group called the Chuckling Squad, the same crew that a

article thumbnail

On Cybersecurity Insurance

Schneier on Security

Good paper on cybersecurity insurance: both the history and the promise for the future. From the conclusion: Policy makers have long held high hopes for cyber insurance as a tool for improving security. Unfortunately, the available evidence so far should give policymakers pause. Cyber insurance appears to be a weak form of governance at present. Insurers writing cyber insurance focus more on organisational procedures than technical controls, rarely include basic security procedures in contracts,

article thumbnail

US Power Grid Cyberattack Due to Unpatched Firewall: NERC

Dark Reading

A firewall vulnerability enabled attackers to repeatedly reboot the victim entity's firewalls, causing unexpected outages.

90
article thumbnail

How the CCPA and GDPR Are Different

KnowBe4

Sorting out the two biggest privacy regulations to hit privacy professionals in decades. The California Consumer Privacy Act (CCPA) was introduced just a month after the European Union instituted the General Data Protection Regulation (GDPR), earning the CCPA the nickname of “California’s GDPR.”. While the GDPR has been in effect since May of 2018, the CCPA is on track to become effective on January 1, 2020.

GDPR 72
article thumbnail

Reimagined: Building Products with Generative AI

“Reimagined: Building Products with Generative AI” is an extensive guide for integrating generative AI into product strategy and careers featuring over 150 real-world examples, 30 case studies, and 20+ frameworks, and endorsed by over 20 leading AI and product executives, inventors, entrepreneurs, and researchers.

article thumbnail

Top 7 benefits of supply chain optimization

OpenText Information Management

In our last blog. we looked at what’s involved in supply chain optimization, the supply chain optimization techniques and tools that are available to you. This time we’ll cover the key benefits of supply chain optimization and how you can achieve them. Estimates put the size of the global market for supply chain management software at … The post Top 7 benefits of supply chain optimization appeared first on OpenText Blogs.

article thumbnail

281 Alleged Email Scammers Arrested in Massive Global Sweep

WIRED Threat Level

The most sweeping takedown yet of so-called BEC scammers involved arrests in nearly a dozen countries.

article thumbnail

Adobe September 2019 Patch Tuesday updates fix 2 code execution flaws in Flash Player

Security Affairs

Adobe September 2019 Patch Tuesday updates address two code execution bugs in Flash Player and a DLL hijacking flaw in Application Manager. Adobe has released September 2019 Patch Tuesday updates that address two code execution vulnerabilities in Flash Player and a DLL hijacking flaw in Application Manager. The two flaws addressed with the Flash Player 32.0.0.255 release are a use-after-free issue tracked as CVE-2019-8070, and a same-origin method execution flaw tracked as CVE-2019-8069.

article thumbnail

Data Is the New Copper

Dark Reading

Data breaches fuel a complex cybercriminal ecosystem, similar to copper thefts after the financial crisis.

article thumbnail

How to Migrate From DataStax Enterprise to Instaclustr Managed Apache Cassandra

If you’re considering migrating from DataStax Enterprise (DSE) to open source Apache Cassandra®, our comprehensive guide is tailored for architects, engineers, and IT directors. Whether you’re motivated by cost savings, avoiding vendor lock-in, or embracing the vibrant open-source community, Apache Cassandra offers robust value. Transition seamlessly to Instaclustr Managed Cassandra with our expert insights, ensuring zero downtime during migration.

article thumbnail

ForAllSecure Uncovers Vulnerability In Netflix DIAL Software (CVE-2019-10028)

ForAllSecure

Introduction. This month, as interns at ForAllSecure, we participated in a contest to test the beta version of Mayhem on various open source projects. If you’re not familiar with Mayhem, it’s a software security tool that uses next-generation fuzzing, a patented technique that combines guided fuzzing and symbolic execution, to uncover defects in software with zero false positives.

article thumbnail

Microsoft Patch Tuesday updates for September 2019 fix 2 privilege escalation flaws exploited in attacks

Security Affairs

Microsoft Patch Tuesday updates for September 2019 address 80 flaws, including two privilege escalation issues exploited in attacks. Microsoft Patch Tuesday security updates for September 2019 address 80 vulnerabilities, including two privilege escalation flaws that have been exploited in attacks in the wild. The updates cover Microsoft Windows, Internet Explorer, Microsoft Edge, ChakraCore, Office and Microsoft Office Services and Web Apps, Skype for Business and Microsoft Lync, Visual Studio,

article thumbnail

U.S. Manufacturer Most Recent Target of LokiBot Malspam Campaign

Threatpost

A large U.S. manufacturing company is the latest organization to be targeted with the LokiBot trojan - although this most recent campaign harbored some bizarre red flags.

article thumbnail

Get your creative team on the same page

OpenText Information Management

When it comes to collaborating on creative projects, we know that processes can often get in the way. Your team members might find themselves working on the wrong versions of an asset, or there might be multiple versions of the same asset being worked on by different people. Or perhaps there’s simply a general miscommunication … The post Get your creative team on the same page appeared first on OpenText Blogs.

article thumbnail

Entity Resolution Checklist: What to Consider When Evaluating Options

Are you trying to decide which entity resolution capabilities you need? It can be confusing to determine which features are most important for your project. And sometimes key features are overlooked. Get the Entity Resolution Evaluation Checklist to make sure you’ve thought of everything to make your project a success! The list was created by Senzing’s team of leading entity resolution experts, based on their real-world experience.

article thumbnail

Two Zero-Days Fixed in Microsoft Patch Rollout

Dark Reading

September's Patch Tuesday addressed 80 vulnerabilities, two of which have already been exploited in the wild.

69
article thumbnail

Vulnerabilities in D-Link, Comba Routers Can Leak Credentials

Threatpost

Flaws can potentially affect every device and user on the network by directing them to malicious websites or blocking their access to important data or resources.

Access 53
article thumbnail

Third-Party Features Leave Websites More Vulnerable to Attack

Dark Reading

A new report points out the dangers to customer data of website reliance on multiple third parties.

68