Thu.Dec 24, 2020

article thumbnail

Lazarus Group Targeted COVID-19 Research

Data Breach Today

Kaspersky: North Korean APT Group Used Malware in Attempt to Steal Information The Lazarus Group, a North Korean advanced persistent threat gang, apparently recently targeted a national ministry of health and a drug manufacturer involved in developing a COVID-19 vaccine in an attempt to steal information, according to the security firm Kaspersky.

article thumbnail

How China Uses Stolen US Personnel Data

Schneier on Security

Interesting analysis of China’s efforts to identify US spies: By about 2010, two former CIA officials recalled, the Chinese security services had instituted a sophisticated travel intelligence program, developing databases that tracked flights and passenger lists for espionage purposes. “We looked at it very carefully,” said the former senior CIA official.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

CISA Warns SolarWinds Incident Response May Be Substantial

Data Breach Today

'All Network Assets' Monitored by Backdoored Orion Software May Need Rebuilding Federal, state and local governments are among the many victims of the supply chain attack that backdoored the SolarWinds' Orion network-monitoring software, and victims "may need to rebuild all network assets" being monitored by the software, the U.S. Cybersecurity and Infrastructure Security Agency warns.

article thumbnail

DDoS amplify attack targets Citrix Application Delivery Controllers (ADC)

Security Affairs

Citrix confirmed that a DDoS attack is targeting Citrix Application Delivery Controller (ADC) networking equipment. The threat actors are using the Datagram Transport Layer Security (DTLS) protocol as an amplification vector in attacks against Citrix appliances with EDT enabled. The DTLS protocol is a communications protocol for securing delay-sensitive apps and services that use datagram transport.

article thumbnail

Get Better Network Graphs & Save Analysts Time

Many organizations today are unlocking the power of their data by using graph databases to feed downstream analytics, enahance visualizations, and more. Yet, when different graph nodes represent the same entity, graphs get messy. Watch this essential video with Senzing CEO Jeff Jonas on how adding entity resolution to a graph database condenses network graphs to improve analytics and save your analysts time.

article thumbnail

Fake Amazon Gift Cards Deliver Dridex Trojan

Data Breach Today

Attackers Target Online Shoppers in the US and Europe Cybercriminals are targeting online shoppers in the U.S. and Western Europe with fake Amazon gift cards that deliver the Dridex banking Trojan, the security firm Cybereason reports.

Security 290

More Trending

article thumbnail

DHS Warns of Data Theft Risk Posed by Chinese Technology

Data Breach Today

Agency Says New Law in China Opens Door to Government Data Access The Department of Homeland Security is warning U.S. companies about data theft risks associated with the use of Chinese technology and digital services, citing a new law in China giving the government the right to access data.

Risk 278
article thumbnail

Millions of devices could be hacked exploiting flaws targeted by tools stolen from FireEye

Security Affairs

Millions of devices are potential exposed to attacks targeting the vulnerabilities exploited by the tools stolen from the arsenal of FireEye. Security experts from Qualys are warning that more than 7.5 million devices are potentially exposed to cyber attacks targeting the vulnerabilities exploited by the tools stolen from the arsenal of FireEye. As a result of the recent SolarWinds supply chain attack, multiple organizations were compromised, including FireEye. “While the number of vulnera

Passwords 112
article thumbnail

Analysis: Supply Chain Management After SolarWinds Hack

Data Breach Today

This edition of the ISMG Security Report features insights from David Forscey, managing director at Aspen Cybersecurity Group, on improving supply chain security in the aftermath of the SolarWinds hack. Also featured: Black Hat Europe's key takeaways; keeping safe during the holidays.

article thumbnail

Windows Zero-Day Still Circulating After Faulty Fix

Threatpost

The LPE bug could allow an attacker to install programs; view, change, or delete data; or create new accounts with full user rights.

129
129
article thumbnail

Peak Performance: Continuous Testing & Evaluation of LLM-Based Applications

Speaker: Aarushi Kansal, AI Leader & Author and Tony Karrer, Founder & CTO at Aggregage

Software leaders who are building applications based on Large Language Models (LLMs) often find it a challenge to achieve reliability. It’s no surprise given the non-deterministic nature of LLMs. To effectively create reliable LLM-based (often with RAG) applications, extensive testing and evaluation processes are crucial. This often ends up involving meticulous adjustments to prompts.

article thumbnail

Delivering Santa from Third-Party Risk

Dark Reading

2020 has made even St. Nick susceptible to the risks associated with the coronavirus pandemic. Fortunately, cybersecurity experts are ready to help the merry old elf with advice on reducing risks to his global operations.

Risk 103
article thumbnail

FTC Announces Enforcement for Inadequate Third Party Risk Management Practices Under the GLBA’s Safeguards Rule

Hunton Privacy

On December 15, 2020, the Federal Trade Commission announced a proposed settlement with Ascension Data & Analytics, LLC, a Texas-based mortgage industry data analytics company (“Ascension”), to resolve allegations that the company failed to ensure one of its vendors was adequately securing personal information of mortgage holders. The FTC alleged that Ascension’s vendor, OpticsML, stored documents with information, such as names, Social Security numbers and loan information, pertaining to te

Risk 99
article thumbnail

Amazon Gift Card Scam Delivers Dridex This Holiday Season

Dark Reading

Dridex operators launch a social engineering scam that promises victims a $100 gift card but delivers a banking Trojan.

144
144
article thumbnail

What Rules Apply to Government Records During a Presidential Transition? via LAWFARE

IG Guru

Check out the article here. The post What Rules Apply to Government Records During a Presidential Transition? via LAWFARE appeared first on IG GURU.

article thumbnail

How and Why Should You Be Tracking Geopolitical Risk?

Geopolitical risk is now at the top of the agenda for CEOs. But tracking it can be difficult. The world is more interconnected than ever, whether in terms of economics and supply chains or technology and communication. Geopolitically, however, it is becoming increasingly fragmented – threatening the operations, financial well-being, and security of globally connected companies.

article thumbnail

HelpSystems Acquires Data Security Firm Vera

Dark Reading

The purchase is intended to increase London-based HelpSystems' file collaboration security capabilities.

Security 133
article thumbnail

Dinosaur Feathers

Adam Shostack

Scientists have discovered a chunk of amber with a dinosaur tail in it. (Poor dinosaur!) National Geographic has the story , which is not brand-new, but is a nice bit of scientific joy for the day.

IT 52
article thumbnail

Quarterbacking Vulnerability Remediation

Dark Reading

It's time that security got out of the armchair and out on the field.

Security 118
article thumbnail

Opportunity in the Midst of Change

AIIM

I don’t need to tell you that this year has been like no other we’ve ever experienced. The confluence of events, tensions, and loss has significantly disrupted our personal and professional lives. Even among AIIM members, we have witnessed the toll that these disruptions have taken on mental health, job security, and organizational productivity. And yet, the AIIM community has shown its true colors once again; its resiliency, and its adaptability to change.

article thumbnail

7 Pitfalls for Apache Cassandra in Production

Apache Cassandra is an open-source distributed database that boasts an architecture that delivers high scalability, near 100% availability, and powerful read-and-write performance required for many data-heavy use cases. However, many developers and administrators who are new to this NoSQL database often encounter several challenges that can impact its performance.

article thumbnail

FinCEN Proposes Tracking and Reporting Virtual Currency Transactions Involving Unhosted Wallets

Data Matters

On December 18, 2020, the Financial Crimes Enforcement Network (FinCEN) issued a notice of proposed rulemaking (NPR) regarding a proposal to impose on banks 1 and money service businesses (MSBs) new recordkeeping, reporting, and identity verification requirements in relation to certain transactions involving convertible virtual currency (CVC) or digital assets with legal tender status (legal tender digital assets or LTDA) 2 if the counterparty to the transaction does not have an account with,