Thu.Mar 04, 2021

Three Top Russian Cybercrime Forums Hacked

Krebs on Security

Over the past few weeks, three of the longest running and most venerated Russian-language online forums serving thousands of experienced cybercriminals have been hacked.

Researchers Disclose More Malware Used in SolarWinds Hack

Data Breach Today

Microsoft, FireEye Find Additional Payloads Used During Supply Chain Attack Researchers with Microsoft and FireEye are disclosing additional malware used by the hacking group that targeted SolarWinds in December.

248
248
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Thousands of Android and iOS Apps Leak Data From the Cloud

WIRED Threat Level

It's the digital equivalent of leaving your windows or doors open when you leave the house—and in some cases, leaving them open all the time. Security Security / Privacy

Cloud 107

Lesson From SolarWinds Attack: It's Time to Beef Up IAM

Data Breach Today

NIST, CISA Call for Rethinking Security in Wake of Supply Chain Attack The SolarWinds supply chain attack should prompt federal agencies and others to rethink how they approach security issues - especially identity and access management, according to a breakdown of the attack presented this week by NIST and CISA.

IT 228

Cassandra Data Modeling Guide to Best Practices

Are you a developer, database architect, or database administrator that's new to Cassandra but have been tasked with developing a Cassandra schema design? Learn the basic rules to keep in mind when designing your schema for Cassandra.

Business Apps Spoofed in 45% of Impersonation Attacks

Dark Reading

Business-related applications like those from Microsoft, Zoom, and DocuSign are most often impersonated in brand phishing attacks

More Trending

China and Russia's Spying Sprees Will Take Years to Unpack

WIRED Threat Level

The full extent of the Solarwinds hack and Hafnium's attack on Microsoft Exchange Server may never be known. Security Security / Cyberattacks and Hacks

Qualys Gets 'Clopped' by Accellion-Exploiting Attackers

Data Breach Today

Security Firm Confirms Breach After Clop Ransomware Gang Posts Stolen Customer Data Qualys has confirmed that its Accellion File Transfer Appliance software was breached by zero-day-wielding attackers after stolen customer data appeared on the Clop ransomware gang's data leaks site.

Secure Laptops & the Enterprise of the Future

Dark Reading

The enterprise of the future will depend upon organizations' ability to extend the company firewall to everywhere people are working

Google Patches Zero-Day Vulnerability in Chrome

Data Breach Today

Flaw Being Exploited in the Wild Google has rolled out patches for a zero-day vulnerability in the popular web browser Chrome that's being exploited in the wild

182
182

Use It, Save It, Or Lose It: Spring Cleaning for Information Governance

Speaker: Speakers Michelle Kirk of Georgia Pacific, Darla White of Sanofi, & Scott McVeigh of Onna

As an organization’s most valuable asset, data should be cared for and integrated, managed, archived, and deleted as appropriate. Join Onna, Georgia Pacific, and Sanofi for this on-demand webinar as they discuss proactive, practical steps for kicking off your organization's own digital cleanup.

Sunshuttle, the fourth malware allegedly linked to SolarWinds hack

Security Affairs

FireEye researchers spotted a new sophisticated second-stage backdoor that was likely linked to threat actors behind the SolarWinds hack.

Researchers Jailbreak iOS 14.3

Data Breach Today

Tool Enables Loading of Unofficial Apps A team of security researchers has released a new jailbreak for iOS 14.3 and previous versions that enables users to install and tweak unofficial apps outside Apple's security protections

GRUB2 boot loader maintainers fixed hundreds of flaws

Security Affairs

Now maintainers at the GRUB project have released security updates to address more than 100 vulnerabilities. GRUB2 (the GR and U nified B ootloader version 2 ) is a replacement for the original GRUB Legacy boot loader, which is now referred to as “GRUB Legacy”.

Okta to Buy Auth0 for $6.5 Billion

Data Breach Today

In Other M&A Activity, TPG Capital to Acquire Thycotic; KnowBe4 Buys MediaPRO The security firm Okta shook up the identity and access management market Wednesday by announcing a $6.5 billion deal to acquire the customer IAM technology supplier Auth0.

The Next-Generation Cloud Data Lake: An Open, No-Copy Data Architecture

A next-gen cloud data lake architecture has emerged that brings together the best attributes of the data warehouse and the data lake. This new open data architecture is built to maximize data access with minimal data movement and no data copies.

Ireland: DPC Annual Report 2020: Enforcement & Transfers Dominate Agenda

DLA Piper Privacy Matters

In its second full year overseeing and regulating the GDPR in Ireland, the Data Protection Commission ( DPC ) has published its 2020 Annual Report , highlighting key observations, emerging guidance, and large scale inquiries and decisions of 2020.

GDPR 87

Changing Authentication for Employees

Data Breach Today

Navy Federal Credit Union’s Thomas Malta on Applying CIAM Techniques New authentication models, including dynamic authorization and continuous authentication, that work well for consumers can be adopted for employees as well, says Thomas Malta, head of identity and access management at the Virginia-based Navy Federal Credit Union.

Why We Need More Blue Team Voices at the Table

Dark Reading

The red team draws attention, but the blue team has the expertise to keep networks secure day in and day out

Four Microsoft Exchange Zero-Days Exploited by China

Schneier on Security

Microsoft has issued an emergency Microsoft Exchange patch to fix four zero-day vulnerabilities currently being exploited by China. Uncategorized China Microsoft patching vulnerabilities zero-day

85

Open Source & Open Standards: Navigating the Intricacies of a Symbiotic Partnership

Speaker: Guy Martin, Executive Director of OASIS Open

The COVID-19 global pandemic has raised the already bright visibility of technology to an even higher level. Join Guy Martin, Executive Director at OASIS Open, as he presents this webinar that will discuss how we can make open source and open standards even more effective by helping them recapture their strong partnership.

New Social Security Scam Spoofs Government Badges

Dark Reading

Criminals text or email photos of fake government identification badges to trick people into sending money

What is Information Capture? Definition, Purpose, and Value

AIIM

To succeed on the Digital Transformation journey, requires a strategy, planning, and the design of a better information ecosystem - what we refer to as Intelligent Information Management (IIM). The first step on this journey is to get all of your information into the information ecosystem.

Chinese Hackers Stole an NSA Windows Exploit in 2014

Schneier on Security

Check Point has evidence that (probably government affiliated) Chinese hackers stole and cloned an NSA Windows hacking tool years before (probably government affiliated) Russian hackers stole and then published the same tool.

Group-IB: ransomware empire prospers in pandemic-hit world. Attacks grow by 150%

Security Affairs

Group-IB published a report titled “Ransomware Uncovered 2020-2021 ”. analyzes ransomware landscape in 2020 and TTPs of major threat actors. Group-IB , a global threat hunting and adversary-centric cyber intelligence company, has presented its new report “Ransomware Uncovered 2020-2021 ”.

Leading Advertising and Analytics Company Outperforms With a Graph Database

Xandr, a division of AT&T, has built an identity graph that connects information on people, households, and more. The company is using this graph to provide advertisers an ability to deliver commercials more successfully than ever before. Learn more.

Microsoft, FireEye Uncover More Malware Used in the SolarWinds Campaign

Dark Reading

Newly discovered tools were designed for late-stage use after the attackers had already established a relatively firm presence on a breached network, vendors say

76

VMware addresses Remote Code Execution issue in View Planner

Security Affairs

VMware released a security patch for a remote code execution vulnerability that affects the VMware View Planner product. VMware released a security patch for a remote code execution flaw, tracked as CVE-2021-21978, that affects the VMware View Planner.

The What & Why of Data Governance

erwin

Modern data governance is a strategic, ongoing and collaborative practice that enables organizations to discover and track their data, understand what it means within a business context, and maximize its security, quality and value.

Healthcare Still Seeing High Level of Attacker Activity

Dark Reading

Interest in vaccines is driving all sorts of activity, reports say, from vaccine-specific phishing to growing bot traffic on healthcare sites

Cloud-Scale Monitoring With AWS and Datadog

In this eBook, find out the benefits and complexities of migrating workloads to AWS, and services that AWS offers for containers and serverless computing.

Microsoft, FireEye Unmask More Malware Linked to SolarWinds Attackers

Threatpost

Researchers with Microsoft and FireEye found three new malware families, which they said are used by the threat group behind the SolarWinds attack. Government Hacks Vulnerabilities Web Security

CISA emergency directive urges to fix Microsoft Exchange zero-days

Security Affairs

The US Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive related to recently fixed Microsoft Exchange zero-days. .

Qualys Is the Latest Victim of Accellion Data Breach

Dark Reading

Security vendor confirms attackers exploited a previously disclosed vulnerability in the enterprise firewall technology to breach its network