FreshRSS

πŸ”’
❌ About FreshRSS
There are new available articles, click to refresh the page.
Before yesterdaySecurity

Warning: PyPI Feature Executes Code Automatically After Python Package Download

By Ravie Lakshmanan
In another finding that could expose developers to increased risk of a supply chain attack, it has emerged that nearly one-third of the packages in PyPI, the Python Package Index, trigger automatic code execution upon downloading them. "A worrying feature in pip/PyPI allows code to automatically run when developers are merely downloading a package," Checkmarx researcher Yehuda GelbΒ saidΒ in a

New Evidence Links Raspberry Robin Malware to Dridex and Russian Evil Corp Hackers

By Ravie Lakshmanan
Researchers have identified functional similarities between a malicious component used in the Raspberry Robin infection chain and a Dridex malware loader, further strengthening the operators' connections to the Russia-based Evil Corp group. The findings suggest that "Evil Corp is likely using Raspberry Robin infrastructure to carry out its attacks," IBM Security X-Force researcher Kevin HensonΒ 

Google Chrome Bug Lets Sites Silently Overwrite System Clipboard Content

By Ravie Lakshmanan
A "major" security issue in the Google Chrome web browser, as well as Chromium-based alternatives, could allow malicious web pages to automatically overwrite clipboard content without requiring any user consent or interaction by simply visiting them. The clipboard poisoning attack is said to have been accidentally introduced in Chrome version 104, according to developer Jeff Johnson. While the

Ghost Data Increases Enterprise Business Risk

By Edge Editors, Dark Reading
IT has to get its hands around cloud data sprawl. Another area of focus should be on ghost data, as it expands the organization's cloud attack surface.

  • September 2nd 2022 at 00:00

Ex-NSA trio who spied on Americans for UAE now banned from arms exports

From hero to zero-day ... to plain zero

Three former US government cyber-spies who, among other things, illicitly compromised and snooped on Americans' devices for the United Arab Emirates government have been banned from participating in international arms exports under a deal reached with Uncle Sam.…

  • September 2nd 2022 at 01:11

Neopets Hackers Had Network Access for 18 Months

By Dark Reading Staff, Dark Reading
Neopets has confirmed that its IT systems were compromised from January 2021 through July 2022, exposing 69 million user accounts and source code.

  • September 1st 2022 at 20:36

Threat Actor Phishing PyPI Users Identified

By Jai Vijayan, Contributing Writer, Dark Reading
"JuiceLedger" has escalated a campaign to distribute its information stealer by now going after developers who published code on the widely used Python code repository.

  • September 1st 2022 at 20:35

Skyrocketing IoT Bug Disclosures Put Pressure on Security Teams

By Robert Lemos, Contributing Writer, Dark Reading
The expanding Internet of Things ecosystem is seeing a startling rate of vulnerability disclosures, leaving companies with a greater need for visibility into and patching of IoT devices.

  • September 1st 2022 at 19:49

New Guidelines Spell Out How to Test IoT Security Products

By Nathan Eddy, Contributing Writer, Dark Reading
The proposed AMTSO guidelines offer a roadmap for comprehensive testing of IoT security products.

  • September 1st 2022 at 19:49

Code-Injection Bugs Bite Google, Apache Open Source GitHub Projects

By Ericka Chickowski, Contributing Writer, Dark Reading
The insecurities exist in CI/CD pipelines and can be used by attackers to subvert modern development and roll out malicious code at deployment.

  • September 1st 2022 at 16:52

Apple Quietly Releases Another Patch for Zero-Day RCE Bug

By Elizabeth Montalbano, Contributor, Dark Reading
Apple continues a staged update process to address a WebKit vulnerability that allows attackers to craft malicious Web content to load malware on affected devices.

  • September 1st 2022 at 14:45

(ISC)Β² Launches 'Certified in Cybersecurity' Entry-Level Certification to Address Global Workforce Gap

After a rigorous pilot program, the association's newest certification is officially operational. More than 1,500 pilot participants who passed the exam are on the path to full certification.
  • September 1st 2022 at 14:18

Stop Worrying About Passwords Forever

By The Hacker News
So far 2022 confirms that passwords are not dead yet. Neither will they be anytime soon. Even though Microsoft and Apple are championing passwordless authentication methods, most applications and websites will not remove this option for a very long time. Think about it, internal apps that you do not want to integrate with third-party identity providers, government services, legacy applications,

Real-World Cloud Attacks: The True Tasks of Cloud Ransomware Mitigation

By Ofer Maor, CTO and Co-Founder, Mitiga
Cloud breaches are inevitable β€” and so is cloud ransomware. (Second of two parts.)

  • September 1st 2022 at 14:00

Smartphone Alternatives: Ease Your Way into Your Child’s First Phone

By McAfee

β€œBut everyone else has one.” 

Those are familiar words to a parent, especially if you’re having the first smartphone conversation with your tween or pre-teen. In their mind, everyone else has a smartphone so they want a one too. But does β€œeveryone” really have one? Well, your child isn’t wrong.Β Β 

Our recent global study found that 76% of children aged 10 to 14 reported using a smartphone or mobile device, with Brazil leading the way at 95% and the U.S. trailing the global average at 65%.Β Β Β 

Our figures show that younger children with smartphones and mobile devices make up a decisive majority of younger children overall.Β 

Of course, just because everyone else has smartphone doesn’t mean that it’s necessarily right for your child and your family. After all, with a smartphone comes access to a wide and practically unfettered world of access to the internet, apps, social media, instant messaging, texting, and gaming, all within nearly constant reach. Put plainly, some tweens and pre-teens simply aren’t ready for that just yet, whether in terms of their maturity, habits, or ability to care for and use a device like that responsibly.Β 

Yet from a parent’s standpoint, a first smartphone holds some major upsides. One of the top reasons parents give a child a smartphone is β€œto stay in touch,” and that’s understandable. There’s something reassuring knowing that your child is a call or text awayβ€”and that you can keep tabs on their whereabouts with GPS tracking. Likewise, it’s good to know that they can reach you easily too. Arguably, that may be a reason why some parents end up giving their children a smartphone a little sooner than they otherwise would.Β Β 

However, you don’t need a smartphone to do to text, track, and talk with your child. You have alternatives.Β 

Smartphone alternativesΒ 

One way to think about the first smartphone is that it’s something you ease into. In other words, if the internet is a pool, your child should learn to navigate the shallows with some simpler devices before diving into the deep end with a smartphone.Β Β 

Introducing technology and internet usage in steps can build familiarity and confidence for them while giving you control. You can oversee their development, while establishing rules and expectations along the way. Then, when the time is right, they can indeed get their first smartphone.Β 

But how to go about that?Β 

It seems a lot of parents have had the same idea and device manufacturers have listened. They’ve come up with smartphone alternatives that give kids the chance to wade into the mobile internet, allowing them to get comfortable with device ownership and safety over time without making the direct leap to a fully featured smartphone. Let’s look at some of those options, along with a few other long-standing alternatives.Β 

GPS trackers for kidsΒ 

These small and ruggedly designed devices can clip to a belt loop, backpack, or simply fit in a pocket, giving you the ability to see your child’s location. In all, it’s quite like the β€œfind my” functionality we have on our smartphones. When it comes to GPS trackers for kids, you’ll find a range of options and form factors, along with different features such as an S.O.S. button, β€œgeofencing” that can send you an alert when your child enters or leaves a specific area (like home or school), and how often it sends an updated location (to regulate battery life).Β Β 

Whichever GPS tracker you select, make sure it’s designed specifically for children. So-called β€œsmart tags” designed to locate things like missing keys and wallets are just thatβ€”trackers designed to locate things, not children.Β 

Smart watches for kidsΒ 

With GPS tracking and many other communication-friendly features for families, smart watches can give parents the reassurance they’re looking for while giving kids a cool piece of tech that they can enjoy. The field of options is wide, to say the least. Smart watches for kids can range anywhere from devices offered by mobile carriers like Verizon, T-Mobile, and Vodaphone to others from Apple, Explora, and Tick Talk. Because of that, you’ll want to do a bit of research to determine the right choice for you and your child.Β Β 

Typical features include restricted texting and calling, and you’ll find that some devices are more durable and more water resistant than others, while yet others have cameras and simple games. Along those lines, you can select a smart watch that has a setting for β€œschool time” so that it doesn’t become a distraction in class. Also, you’ll want to look closely at battery life, as some appear to do a better job of holding a charge than others.Β Β 

Smartphones for kidsΒ 

Another relatively recent entry on the scene are smartphones designed specifically for children, which offer a great step toward full-blown smartphone ownership. These devices look, feel, and act like a smartphone, but without web browsing, app stores, and social media. Again, features will vary, yet there are ways kids can store and play music, stream it via Bluetooth to headphones or a speaker, and install apps that you approve of.Β Β 

Some are paired with a parental control app that allows you to introduce more and more features over time as your child as you see fitβ€”and that can screen texts from non-approved contacts before they reach your child. Again, a purchase like this one calls for some research, yet names like Gabb wireless and the Pinwheel phone offer a starting point.Β 

The flip phoneΒ 

The old reliable. Rugged and compact, and typically with a healthy battery life to boot, flip phones do what you need them toβ€”help you and your child keep in touch. They’re still an option, even if your child may balk at the idea of a phone that’s β€œnot as cool as a smartphone.” However, if we’re talking about introducing mobile devices and the mobile internet to our children in steps, the flip phone remains in the mix.Β Β 

Some are just phones and nothing else, while other models can offer more functionality like cameras and slide-out keyboards for texting. And in keeping with the theme here, you’ll want to consider your options so you can pick the phone that has the features you want (and don’t want) for your child.Β 

Ease into that first smartphoneΒ 

Despite what your younger tween or pre-teen might think, there’s no rush to get that first smartphone. And you know it too. You have time. Time to take eventual smartphone ownership in steps, with a device that keeps you in touch and that still works great for your child.Β Β 

By easing into that first smartphone, you’ll find opportunities where you can monitor and guide their internet usage. You’ll also find plenty of moments to help your child start forming healthy habits around device ownership and care, etiquette, and safety online. In all, this approach can help you build a body of experience that will come in handy when that big day finally comesβ€”first smartphone day.Β 

The post Smartphone Alternatives: Ease Your Way into Your Child’s First Phone appeared first on McAfee Blog.

Researchers Detail Emerging Cross-Platform BianLian Ransomware Attacks

By Ravie Lakshmanan
The operators of the emerging cross-platform BianLian ransomware have increased their command-and-control (C2) infrastructure this month, a development that alludes to an increase in the group's operational tempo. BianLian, written in the Go programming language, was first discovered in mid-July 2022 and has claimed 15 victim organizations as of September 1, cybersecurity firm [redacted] said in

The US May Soon Learn What a β€˜Kid-Friendly’ Internet Looks Like

By Pia Ceres
The California Age-Appropriate Design Code would launch a huge online privacy experiment. And it won’t just affect children.

Over 1,800 Android and iOS Apps Found Leaking Hard-Coded AWS Credentials

By Ravie Lakshmanan
Researchers have identified 1,859 apps across Android and iOS containing hard-coded Amazon Web Services (AWS) credentials, posing a major security risk. "Over three-quarters (77%) of the apps contained valid AWS access tokens allowing access to private AWS cloud services," Symantec's Threat Hunter team, a part of Broadcom Software, said in aΒ reportΒ shared with The Hacker News. Interestingly, a

Here's how 5 mobile banking apps put 300,000 users' digital fingerprints at risk

Spoiler: They used hard-coded AWS credentials

Massive amounts of private data – including more than 300,000 biometric digital fingerprints used by five mobile banking apps – have been put at risk of theft due to hard-coded Amazon Web Services credentials, according to security researchers.…

  • September 1st 2022 at 10:04

Infra Used in Cisco Hack Also Targeted Workforce Management Solution

By Ravie Lakshmanan
The attack infrastructure used toΒ target CiscoΒ in the May 2022 incident was also employed against an attempted compromise of an unnamed workforce management solutions holding company a month earlier in April 2022. Cybersecurity firm eSentire, whichΒ disclosedΒ the findings, raised the possibility that the intrusions could be the work of a criminal actor known as mx1r, who is said to be a member of

Careless Errors in Hundreds of Apps Could Expose Troves of Data

By Lily Hay Newman
Researchers found that mobile applications contain keys that could provide access to both user information and private files from unconnected apps.

Microsoft Discover Severe β€˜One-Click’ Exploit for TikTok Android App

By Ravie Lakshmanan
Microsoft on Wednesday disclosed details of a now-patched "high severity vulnerability" in the TikTok app for Android that could let attackers take over accounts when victims clicked on a malicious link. "Attackers could have leveraged the vulnerability to hijack an account without users' awareness if a targeted user simply clicked a specially crafted link," Dimitrios Valsamaras of the Microsoft

Oh no, that James Webb Space Telescope snap might actually contain malware

Is nothing sacred?

Scumbags are using a photo from the James Webb Space Telescope to smuggle Windows malware onto victims' computers – albeit in a roundabout way.…

  • September 1st 2022 at 07:04

LabMD gets another shot at defamation claim against 'extortionate' infosec biz

But keep your attorney on a 'short leash' against Tiversa, court warns

LabMD, the embattled and now defunct cancer-testing company, will get another chance at suing security firm Tiversa for defamation following an appeals court ruling. …

  • September 1st 2022 at 03:49

Apple Releases iOS Update for Older iPhones to Fix Actively Exploited Vulnerability

By Ravie Lakshmanan
Apple on Wednesday backported security updates to older iPhones, iPads, and iPod touch devices to address aΒ critical security flawΒ that has been actively exploited in the wild. The shortcoming, tracked asΒ CVE-2022-32893Β (CVSS score: 8.8), is an out-of-bounds write issue affecting WebKit that could lead to arbitrary code execution when processing maliciously crafted web content. WebKit is the

FBI: Look out, crooks stole $1.3b in cryptocurrency in just three months this year

DeFi, as in, defying belief

The FBI has urged people to be cautious and heavily research a DeFi – decentralized finance – provider before putting your money into it, after more than a billion dollars was stolen from these providers in three months.…

  • September 1st 2022 at 02:32

Closing the Security Gap Opened by the Rise of No-Code Tools

By Kolawole Samuel Adebayo, Contributing Writer
No-code startups such as Mine PrivacyOps say they offer best of both worlds β€” quick development and compliance with privacy laws.

  • August 31st 2022 at 23:20

Google Fixes 24 Vulnerabilities With New Chrome Update

By Jai Vijayan, Contributing Writer, Dark Reading
But one issue that lets websites overwrite content on a user's system clipboard appears unfixed in the new Version 105 of Chrome.

  • August 31st 2022 at 20:10

Crypto-Crooks Spread Trojanized Google Translate App in Watering-Hole Attack

By Tara Seals, Managing Editor, News, Dark Reading
The ongoing campaign is spreading worldwide, using the lure of a fully functional Google Translate application for desktops that has helped the threat stay undetected for months.

  • August 31st 2022 at 20:09

URGENT! Apple slips out zero-day update for older iPhones and iPads

By Paul Ducklin
Patch as soon as you can - that recent WebKit zero-day affecting new iPhones and iPads is apparently being used against older models, too.

James Webb Telescope Images Loaded With Malware Are Evading EDR

By Dark Reading Staff, Dark Reading
New Golang cyberattacks use deep space images and a new obfuscator to target systems β€” undetected.

  • August 31st 2022 at 18:00

The Pros and Cons of Managed Firewalls

Managed firewalls are increasingly popular. This post examines the strengths and weaknesses of managed firewalls to help your team decide on the right approach.
  • August 31st 2022 at 18:00

OpenText Goes All-in on Cybersecurity Size and Scale With Micro Focus Purchase

By Curtis Franklin, Senior Analyst, Omdia
OpenText makes a $6 billion bet that bigger is better in security and that cybersecurity platform plays are the future.

  • August 31st 2022 at 17:00

(ISC)Β² Opens Global Enrollment for '1 Million Certified in Cybersecurity' Initiative

(ISC)Β² pledges to expand and diversify the cybersecurity workforce by providing free "(ISC)Β² Certified in Cybersecurity" education and exams to 1 million people worldwide.
  • August 31st 2022 at 16:41

TikTok for Android Bug Allows Single-Click Account Hijack

By Elizabeth Montalbano, Contributor, Dark Reading
A security vulnerability (CVE-2022-28799) in one of TikTok for Android's deeplinks could affect billions of users, Microsoft warns.

  • August 31st 2022 at 16:00

Final Thoughts on Ubiquiti

By BrianKrebs

Last year, I posted a series of articles about a purported β€œbreach” at Ubiquiti. My sole source for that reporting was the person who has since been indicted by federal prosecutors for his alleged wrongdoing – which includes providing false information to the press.

As a result of the new information that has been provided to me, I no longer have faith in the veracity of my source or the information he provided to me. I always endeavor to ensure that my articles are properly sourced and factual.

This time, I missed the mark and, as a result, I would like to extend my sincerest apologies to Ubiquiti, and I have decided to remove those articles from my website.

Aussies Fear Snakes, Spiders and Getting Hacked

By Alex Merton-McCann

Fears and phobias. We all have them. But what are your biggest ones? I absolutely detest snakes but spiders don’t worry me at all. Well, new research by McAfee shows that cybercriminals and the fear of being hacked are now the 5th greatest fear among Aussies.

With news of data breaches and hacking crusades filling our news feed on a regular basis, many of us are becoming more aware and concerned about the threats we face in our increasingly digital world. And McAfee’s latest confirms this with hackers making their way into Australia’s Top 10 Fears.

According to research conducted by McAfee, snakes are the top phobia for Aussies followed by spiders, heights and sharks. Cybercriminals and the fear of being hacked come in in 5th place beating the dentist, bees, ghosts, aeroplane travel and clowns!

Aussie Top 10 Fears and Phobias

  1. Snakes
  2. Spiders
  3. Heights
  4. Sharks
  5. Hackers/Cybercriminals
  6. The dentist
  7. Bees or wasps
  8. Ghosts
  9. Aeroplane travel
  10. Clowns

Why Do We Have Phobias?

Fears and phobias develop when we perceive that we are at risk of pain, or worse, still, death. And while almost a third of respondents nominated snakes as their number one fear, there is less than one-in-fifty thousand chance of being bitten badly enough by a snake to warrant going to hospital in Australia, according to research from the Internal Medicine Journal.

In contrast, McAfee’s analysis of more than 108 billion potential online threats between October and December, identified 202 million of these threats as genuine risks. With a global population of 7.5 billion, that means there is approximately a one in 37 chance of being targeted by cybercrime. Now while this is not a life-threatening situation, these statistics show that chance of us being affected by an online threat is very real.

What Are Our Biggest Cyber Fears?

According to the research, 82% of Aussies believe that being hacked is a growing or high concern. And when you look at the sheer number of reported data breaches so far this year, these statistics make complete sense. Data breaches have affected Bunnings staff, Federal Parliament staff, Marriott guests, Victorian Government staff, QLD Fisheries members, Skoolbag app users and Big W customers plus many more.

Almost 1 in 5 (19%) of those interviewed said their top fear at work is doing something that will result in a data security breach, they will leak sensitive information or infect their corporate IT systems.

The fear that we are in the midst of a cyberwar is another big concern for many Aussies. Cyberwar can be explained as a computer or network-based conflict where parties try to disrupt or take ownership of the activities of other parties, often for strategic, military or cyberespionage purposes. 55% of Aussies believe that a cyberwar is happening right now but we just don’t know about it. And a fifth believe cyber warfare is the biggest threat to our nation.

What Can We Do to Address Our Fear of Being Hacked?

Being proactive about protecting your online life is the absolute best way of reducing the chances of being hacked or being affected by a data breach. Here are my top tips on what you can now to protect yourself:

  1. Be Savvy with Your Passwords

Using a password manager to create unique and complex passwords for each of your online accounts will definitely improve your online safety. If each on your online accounts has a unique password and you are involved in a breach, the hacker won’t be able to use the stolen password details to log into any of your other accounts.

  1. Stop AutoFill on Chrome

Storing your financial data within your browser and being able to populate online forms quickly within seconds makes the autofill function very attractive however it is risky. Autofill will automatically fill out all forms on a page regardless of whether you can see all the boxes. You may just think you are automatically entering your email address into an online form however a savvy hacker could easily design an online form with hidden boxes designed to capture your financial information. So remove all your financial information from Autofill. I know this means you will have to manually enter information each time you purchase but your personal data will be better protected.

  1. Think Before You Click

One of the easiest ways for a cybercriminal to compromise their victim is by using phishing emails to lure consumers into clicking links for products or services that could lead to malware, or a phoney website designed to steal personal information. If the deal seems too good to be true, or the email was not expected, always check directly with the source.

  1. Stay Protected While You Browse

It’s important to put the right security solutions in place in order to surf the web safely. Add an extra layer of security to your browser with McAfee WebAdvisor.

  1. Always Connect with Caution

I know public Wi-Fi might seem like a good idea, but if consumers are not careful, they could be unknowingly exposing personal information or credit card details to cybercriminals who are snooping on the network. If you are a regular Wi-Fi user, I recommend investing in a virtual private network or (VPN) such as McAfee Secure VPN which will ensure your connection is completely secure and that your data remains safe.

While it is tempting, putting our head in the sand and pretending hackers and cybercrime don’t exist puts ourselves and our families at even more risk! Facing our fears and making an action plan is the best way of reducing our worry and stress. So, please commit to being proactive about your family’s online security. Draw up a list of what you can do today to protect your tribe. And if you want to receive regular updates about additional ways you can keep your family safe online, check out my blog.

β€˜till next time.

Alex x

The post Aussies Fear Snakes, Spiders and Getting Hacked appeared first on McAfee Blog.

❌