Sat.Aug 20, 2022 - Fri.Aug 26, 2022

Hospitals in U.S., France Dealing With Cyber Extortionists

Data Breach Today

Texas Hospital Still Being Pressured, While French Hospital Responds to Ransomware A Texas-based hospital is apparently still contending with pressure to pay an extortion group that claims to have stolen patient data months ago, while a French medical center responds to a weekend attack and demands to pay a $10 million ransom.

VMware LPE Bug Allows Cyberattackers to Feast on Virtual Machine Data

Dark Reading

An insider threat or remote attacker with initial access could exploit CVE-2022-31676 to steal sensitive data and scoop up user credentials for follow-on attacks

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Twitter Security Allegations: Cybersecurity Experts Respond

Data Breach Today

Black Hat Fireside Chat: Doing deep-dive API security — as software gets developed and deployed

The Last Watchdog

APIs have come to embody the yin and yang of our digital lives. Related: Biden moves to protect water facilities. Without application programming interface, all the cool digital services we take for granted would not be possible. But it’s also true that the way software developers and companies have deployed APIs has contributed greatly to the exponential expansion of the cyber-attack surface.

Modernizing Workloads with the Cloud: How to Improve Performance & Reduce Costs

In this eBook, you’ll learn how to migrate workloads to Azure and optimize performance for your serverless and containerized applications in Azure.

Nobelium APT uses new Post-Compromise malware MagicWeb

Security Affairs

Russia-linked APT group Nobelium is behind a new sophisticated post-exploitation malware tracked by Microsoft as MagicWeb.

More Trending

How Criminals Are Weaponizing Leaked Ransomware Data

Data Breach Today

Accenture's Robert Boyce Advises Firms to Update Monitoring and Approval Processes Accenture analyzed the top 20 most active ransomware leak sites to see how threat actors are posting sensitive corporate information and making the data easy to search and exploit.

Black Hat Fireside Chat: Deploying ‘AI’ as a weapon to win the ‘attack surface management’ war

The Last Watchdog

Short-handed cybersecurity teams face a daunting challenge. Related: ‘ASM’ is cybersecurity’s new centerpiece. In an intensely complex, highly dynamic operating environment, they must proactively mitigate myriad vulnerabilities and at the same time curtail the harm wrought by a relentless adversary: criminal hacking collectives. In short, attack surface management has become the main tent pole of cybersecurity.

[HEADS UP] Highly Sophisticated Job Offer Scam

KnowBe4

If you've been approached by recruiters on LinkedIn for a potential job opportunity, you may want to pay attention to this recent scam. Social Engineering

108
108

LastPass data breach: threat actors stole a portion of source code

Security Affairs

Password management software firm LastPass has suffered a data breach, threat actors have stole source code and other data.

Prioritizing Customer Experience Using SLIs & SLOs: A Case Study from The Telegraph

Service Level Indicators (SLIs) and Service Level Objectives (SLOs) are a key pillar of Site Reliability Engineering (SRE) and are the principal tool for eliminating needless alerts and focusing on what really matters to the business.

Hacker Steals Source Code, Proprietary Data from LastPass

Data Breach Today

Security Experts Continue to Recommend Password Managers As Security Best Practice Password manager stalwart LastPass acknowledged Thursday that a threat actor gained unauthorized access to its source code and proprietary technical information.

Senior-Level Women Leaders in Cybersecurity Form New Nonprofit

Dark Reading

The Forte Group, which gained momentum as an informal organization during the pandemic, will offer career development and advocacy for women execs in cybersecurity as well as newcomers

Hyundai Uses Example Keys for Encryption System

Schneier on Security

This is a dumb crypto mistake I had not previously encountered: A developer says it was possible to run their own software on the car infotainment hardware after discovering the vehicle’s manufacturer had secured its system using keys that were not only publicly known but had been lifted from programming examples. […].

Over 80,000 Hikvision cameras can be easily hacked

Security Affairs

Experts warn that over 80,000 Hikvision cameras are vulnerable to a critical command injection vulnerability. Security researchers from CYFIRMA have discovered over 80,000 Hikvision cameras affected by a critical command injection vulnerability tracked as CVE-2021-36260.

Risk 107

The 5 Stages of Account-Based Marketing — and How to Win Them All

Successfully complete the five stages of ABM: define, identify, engage, convert, and connect. We’ll show you how to create a unified system with your sales team to help them land more qualified opportunities and connect with prospects like never before.

US CISA Warns of Bug in Palo Alto's Firewall Software

Data Breach Today

Agency Tells Federal Government to Patch Misconfiguration by Sept. 12 Attackers could take advantage of a misconfiguration in Palo Alto firewalls to launch amplification DDoS attacks, a vulnerability that led the U.S.

More Bang for the Buck: Cross-Platform Ransomware Is the Next Problem

Dark Reading

As cryptocurrency valuations make strikes less lucrative, ransomware gangs like the new RedAlert and Monster groups are modifying their tools to attack across platforms

Man-in-the-Middle Phishing Attack

Schneier on Security

Here’s a phishing campaign that uses a man-in-the-middle attack to defeat multi-factor authentication: Microsoft observed a campaign that inserted an attacker-controlled proxy site between the account users and the work server they attempted to log into.

Threat actors are using the Tox P2P messenger as C2 server

Security Affairs

Threat actors are using the Tox peer-to-peer instant messaging service as a command-and-control server, Uptycs researchers reported. Tox is a peer-to-peer serverless instant messaging services that uses NaCl for encryption and decryption.

Understanding Cadence Workflow for Developers and Architects

Explore the basics of Cadence and understand the benefits it can provide to your organization. This whitepaper will dive into a brief history of Cadence, how workflows can be put into practice, and how you can apply Cadence to your data infrastructure.

Ethereum Offers Up To $1M Bounty for Critical Bug Reports

Data Breach Today

Reward for White Hats Valid till Sept. 8 for Merge-related Vulnerabilities Ethereum is offering up to $1 million bounty to white hat hackers who identify merge-related critical vulnerabilities on its blockchain. The four-fold increase in reward will be applicable between Wednesday and Sept.

Report: Deepfakes Used in Scams

KnowBe4

Scammers created a deepfake video of Patrick Hillmann, Chief Communications Officer at cryptocurrency exchange Binance, in order to scam people.

Twilio Hackers Scarf 10K Okta Credentials in Sprawling Supply Chain Attack

Dark Reading

The "0ktapus" cyberattackers set up a well-planned spear-phishing effort that affected at least 130 orgs beyond Twilio and Cloudflare, including Digital Ocean and Mailchimp

GAIROSCOPE attack allows to exfiltrate data from Air-Gapped systems via ultrasonic tones

Security Affairs

GAIROSCOPE: An Israeli researcher demonstrated how to exfiltrate data from air-gapped systems using ultrasonic tones and smartphone gyroscopes.

Paper 103

Detect and Respond to Threats Across Your Applications, Networks, and Infrastructure

Understand how to solve cloud complexity challenges with threat detection tools, analyze security threats anywhere in your stack, and deploy turnkey detection rules mapped to the MITRE ATT&CK framework with Datadog Security Monitoring.

California Fines Sephora $1.2 Million for Privacy Violations

Data Breach Today

Retailer Accused of Selling Customer Data While Failing to Honor Opt-Out Requests Retailer Sephora has been fined $1.2

Retail 229

Phishing Remains the Initial Infection Vector in 78% of Attacks Against OT-Heavy Industries

KnowBe4

Companies heavily reliant on operational technology (OT) to function are just as much a target as businesses relying in traditional IT and are facing some of the same challenges to stop attacks. Phishing

Thousands of Organizations Remain at Risk From Critical Zero-Click IP Camera Bug

Dark Reading

The US Cybersecurity and Infrastructure Security Agency had wanted federal agencies to implement the fix for the RCE flaw in Hikvision cameras by Jan. 24, 2022

Plex discloses data breach and urges password reset

Security Affairs

The streaming media platform Plex is urging its users to reset passwords after threat actors gained access to its database. Plex is an American streaming media service and a client–server media player platform.

The Ultimate Guide to Executive Recruiting

Sourcing the right executive candidates and filling key managerial roles in an organization can be difficult, even in the best of times. Download this eBook to level up your discovery process, talent sourcing, and strategies for reaching your best-fit candidates.

Addressing Security Risks of Mounting Legacy Health Data

Data Breach Today

In many healthcare entities, the amount of data that is being generated and retained continues to grow - and that mounting trove of legacy data is often never disposed, expanding the surface for cyberattacks and other compromises, says Matthew Bernstein of consulting firm Bernstein Data

Risk 225

Scans of Students’ Homes During Tests Are Deemed Unconstitutional

WIRED Threat Level

An Ohio judge ruled that such surveillance to prevent cheating could form a slippery slope to more illegal searches. Security Security / Privacy

Expiring Root Certificates Threaten IoT in the Enterprise

Dark Reading

What happens when businesses' smart devices break? CSOs have things to fix beyond security holes

IoT 99