FreshRSS

🔒
△ 🔃
☐ ☆ ✇ The Hacker News

Meta Warns of 8 Spyware Firms Targeting iOS, Android, and Windows Devices

By Newsroom — February 19th 2024 at 13:14
Meta Platforms said it took a series of steps to curtail malicious activity from eight different firms based in Italy, Spain, and the United Arab Emirates (U.A.E.) operating in the surveillance-for-hire industry. The findings are part of its Adversarial Threat Report for the fourth quarter of 2023. The spyware targeted iOS, Android, and Windows devices. "Their various malware included
☐ ☆ ✇ The Hacker News

How to Achieve the Best Risk-Based Alerting (Bye-Bye SIEM)

By The Hacker News — February 19th 2024 at 11:30
Did you know that Network Detection and Response (NDR) has become the most effective technology to detect cyber threats? In contrast to SIEM, NDR offers adaptive cybersecurity with reduced false alerts and efficient threat response. Are you aware of Network Detection and Response (NDR) and how it’s become the most effective technology to detect cyber threats?  NDR massively
☐ ☆ ✇ The Hacker News

Anatsa Android Trojan Bypasses Google Play Security, Expands Reach to New Countries

By Newsroom — February 19th 2024 at 10:29
The Android banking trojan known as Anatsa has expanded its focus to include Slovakia, Slovenia, and Czechia as part of a new campaign observed in November 2023. "Some of the droppers in the campaign successfully exploited the accessibility service, despite Google Play's enhanced detection and protection mechanisms," ThreatFabric said in a report shared with The Hacker News.
☐ ☆ ✇ The Register - Security

Safeguarding cyber-physical systems for a smart future

February 19th 2024 at 08:58

A useful buyers checklist can ascertain whether solutions can meet certain sets of key requirements

Sponsored Feature Cyber-physical systems (CPS) have a vital role to play in our increasingly connected world.…

☐ ☆ ✇ WIRED

The Danger Lurking Just Below Ukraine's Surface

By Justin Ling — February 19th 2024 at 07:00
The widespread use of mines has left Ukrainians scrambling to find ways to clear the explosives. New efforts to develop mine-clearing technology may help them push back Russia's invading forces.
☐ ☆ ✇ The Hacker News

Russian-Linked Hackers Target 80+ Organizations via Roundcube Flaws

By Newsroom — February 19th 2024 at 05:05
Threat actors operating with interests aligned to Belarus and Russia have been linked to a new cyber espionage campaign that likely exploited cross-site scripting (XSS) vulnerabilities in Roundcube webmail servers to target over 80 organizations. These entities are primarily located in Georgia, Poland, and Ukraine, according to Recorded Future, which attributed the intrusion set to a threat
☐ ☆ ✇ The Hacker News

Iranian Hackers Target Middle East Policy Experts with New BASICSTAR Backdoor

By Newsroom — February 19th 2024 at 04:39
The Iranian-origin threat actor known as Charming Kitten has been linked to a new set of attacks aimed at Middle East policy experts with a new backdoor called BASICSTAR by creating a fake webinar portal. Charming Kitten, also called APT35, CharmingCypress, Mint Sandstorm, TA453, and Yellow Garuda, has a history of orchestrating a wide range of social engineering campaigns that cast a
☐ ☆ ✇ The Register - Security

Feds post $15 million bounty for info on ALPHV/Blackcat ransomware crew

February 19th 2024 at 01:29

ALSO: EncroChat crims still getting busted; ransomware takes down CO public defenders office; and crit vulns

infosec in brief The US government is offering bounties up to $15 million as a reward for anyone willing to help it take out the APLHV/Blackcat ransomware gang.…

☐ ☆ ✇ The Register - Security

Election security threats in 2024 range from AI to … anthrax?

February 18th 2024 at 16:27

Unsettling reading as Presidents' Day approaches

In time for the long Presidents' Day weekend in the US there have been multiple warnings about what will undoubtedly be a challenging and potentially dangerous year for voting processes and government workers.…

☐ ☆ ✇ The Hacker News

FBI's Most-Wanted Zeus and IcedID Malware Mastermind Pleads Guilty

By Newsroom — February 18th 2024 at 07:12
A Ukrainian national has pleaded guilty in the U.S. to his role in two different malware schemes, Zeus and IcedID, between May 2009 and February 2021. Vyacheslav Igorevich Penchukov (aka Vyacheslav Igoravich Andreev, father, and tank), 37, was arrested by Swiss authorities in October 2022 and extradited to the U.S. last year. He was added to the FBI's most-wanted list in 2012. The U.S.
☐ ☆ ✇ Troy Hunt

Weekly Update 387

By Troy Hunt — February 18th 2024 at 05:50
Weekly Update 387

It's a short video this week after a few days in Sydney doing both NDC and the Azure user group. For the most part, I spoke about the same things as I did at NDC Security in Oslo last month... except that since then we've had the Spoutibe incident. It was fascinating to talk about this in front of a live audience and see everyone's reactions first hand, let's just say there were a lot of "oh wow!" responses 😲

Weekly Update 387
Weekly Update 387
Weekly Update 387
Weekly Update 387

References

  1. Sponsored by: Unpatched devices keeping you up at night? Kolide can get your entire fleet updated in days. It's Device Trust for Okta. Watch the demo!
  2. That's another NDC Sydney done and dusted (my "How I Met Your Data" talk will eventually be online and free to watch)
  3. Ransomware payments finally passed the $1B mark in 2023 (I've often commented over the last year that it feels like it's really up-ticked, now here we are)
  4. We're presently rolling HIBP from Table Storage to serverless SQL Azure (by next week's update we should actually have this live and I'll be able to talk a lot more about it)
  5. OpenAI's Sora is just mind-blowing mind 🤯 (it's the rate of change that has so many people stunned, just remember what AI video from text prompts looked like only a year ago...)

☐ ☆ ✇ WIRED

How to Not Get Scammed Out of $50,000

By Andrew Couts — February 17th 2024 at 14:00
Plus: State-backed hackers test out generative AI, the US takes down a major Russian military botnet, and 100 hospitals in Romania go offline amid a major ransomware attack.
☐ ☆ ✇ The Register - Security

How to weaponize LLMs to auto-hijack websites

February 17th 2024 at 11:39

We speak to professor who with colleagues tooled up OpenAI's GPT-4 and other neural nets

AI models, the subject of ongoing safety concerns about harmful and biased output, pose a risk beyond content emission. When wedded with tools that enable automated interaction with other systems, they can act on their own as malicious agents.…

☐ ☆ ✇ The Hacker News

How Businesses Can Safeguard Their Communication Channels Against Hackers

By Anonymous — February 17th 2024 at 08:18
Efficient communication is a cornerstone of business success. Internally, making sure your team communicates seamlessly helps you avoid friction losses, misunderstandings, delays, and overlaps. Externally, frustration-free customer communication is directly correlated to a positive customer experience and higher satisfaction.  However, business communication channels are also a major target
☐ ☆ ✇ WeLiveSecurity

Cyber-insurance and vulnerability scanning – Week in security with Tony Anscombe

February 16th 2024 at 14:05
Here's how the results of vulnerability scans factor into decisions on cyber-insurance and how human intelligence comes into play in the assessment of such digital signals
☐ ☆ ✇ The Hacker News

Google Open Sources Magika: AI-Powered File Identification Tool

By Newsroom — February 17th 2024 at 07:26
Google has announced that it's open-sourcing Magika, an artificial intelligence (AI)-powered tool to identify file types, to help defenders accurately detect binary and textual file types. "Magika outperforms conventional file identification methods providing an overall 30% accuracy boost and up to 95% higher precision on traditionally hard to identify, but potentially problematic content
☐ ☆ ✇ The Register - Security

Google open sources file-identifying Magika AI for malware hunters and others

February 17th 2024 at 02:10

Cool, but it's 2024 – needs more hype, hand wringing, and flashy staged demos to be proper ML

Google has open sourced Magika, an in-house machine-learning-powered file identifier, as part of its AI Cyber Defense Initiative, which aims to give IT network defenders and others better automated tools.…

☐ ☆ ✇ WIRED

SpaceX Launched Military Satellites Designed to Track Hypersonic Missiles

By Stephen Clark, Ars Technica — February 16th 2024 at 22:45
The prototype satellites hitched a ride on a Falcon 9 rocket.
☐ ☆ ✇ WIRED

Leak of Russian ‘Threat’ Part of a Bid to Kill US Surveillance Reform, Sources Say

By Dell Cameron — February 16th 2024 at 20:30
A surprise disclosure of a national security threat by the House Intelligence chair was part of an effort to block legislation that aimed to limit cops and spies from buying Americans' private data.
☐ ☆ ✇ The Register - Security

Zeus, IcedID malware kingpin faces 40 years in slammer

February 16th 2024 at 16:39

Nearly a decade on the FBI’s Cyber Most Wanted List after getting banks to empty vics' accounts

A Ukrainian cybercrime kingpin who ran some of the most pervasive malware operations faces 40 years in prison after spending nearly a decade on the FBI's Cyber Most Wanted List.…

☐ ☆ ✇ The Hacker News

CISA Warning: Akira Ransomware Exploiting Cisco ASA/FTD Vulnerability

By Newsroom — February 16th 2024 at 15:42
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a now-patched security flaw impacting Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software to its Known Exploited Vulnerabilities (KEV) catalog, following reports that it's being likely exploited in Akira ransomware attacks. The vulnerability in question is CVE-2020-
☐ ☆ ✇ The Hacker News

RustDoor macOS Backdoor Targets Cryptocurrency Firms with Fake Job Offers

By Newsroom — February 16th 2024 at 13:27
Multiple companies operating in the cryptocurrency sector are the target of an ongoing malware campaign that involves a newly discovered Apple macOS backdoor codenamed RustDoor. RustDoor was first documented by Bitdefender last week, describing it as a Rust-based malware capable of harvesting and uploading files, as well as gathering information about the infected machines. It's
☐ ☆ ✇ WeLiveSecurity

What is AI, really? | Unlocked 403: Cybersecurity podcast

February 15th 2024 at 15:32
Artificial intelligence is on everybody’s lips these days, but there are also many misconceptions about what AI actually is and isn’t. We unpack AI's basics, applications and broader implications.
☐ ☆ ✇ The Register - Security

Cutting kids off from the dark web – the solution can only ever be social

February 16th 2024 at 12:01

Expert weighs in after Brianna Ghey murder amid worrying rates of child cybercrime

The murder of 16-year-old schoolgirl Brianna Ghey has kickstarted a debate around limiting children's access to the dark web in the UK, with experts highlighting the difficulty in achieving this.…

☐ ☆ ✇ The Hacker News

Why We Must Democratize Cybersecurity

By The Hacker News — February 16th 2024 at 10:50
With breaches making the headlines on an almost weekly basis, the cybersecurity challenges we face are becoming visible not only to large enterprises, who have built security capabilities over the years, but also to small to medium businesses and the broader public. While this is creating greater awareness among smaller businesses of the need to improve their security posture, SMBs are often
☐ ☆ ✇ The Hacker News

Malicious 'SNS Sender' Script Abuses AWS for Bulk Smishing Attacks

By Newsroom — February 16th 2024 at 10:49
A malicious Python script known as SNS Sender is being advertised as a way for threat actors to send bulk smishing messages by abusing Amazon Web Services (AWS) Simple Notification Service (SNS). The SMS phishing messages are designed to propagate malicious links that are designed to capture victims' personally identifiable information (PII) and payment card details, SentinelOne 
☐ ☆ ✇ The Hacker News

U.S. State Government Network Breached via Former Employee's Account

By Newsroom — February 16th 2024 at 07:40
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has revealed that an unnamed state government organization's network environment was compromised via an administrator account belonging to a former employee. "This allowed the threat actor to successfully authenticate to an internal virtual private network (VPN) access point," the agency said in a joint advisory published
☐ ☆ ✇ The Hacker News

U.S. Government Disrupts Russia-Linked Botnet Engaged in Cyber Espionage

By Newsroom — February 16th 2024 at 06:49
The U.S. government on Thursday said it disrupted a botnet comprising hundreds of small office and home office (SOHO) routers in the country that was put to use by the Russia-linked APT28 actor to conceal its malicious activities. "These crimes included vast spear-phishing and similar credential harvesting campaigns against targets of intelligence interest to the Russian government, such as U.S.
☐ ☆ ✇ The Register - Security

Quest Diagnostics pays $5M after mixing patient medical data with hazardous waste

February 16th 2024 at 01:20

Will cough up less than two days of annual profit in settlement – and California calls this a win

Quest Diagnostics has agreed to pay almost $5 million to settle allegations it illegally dumped protected health information – and hazardous waste – at its facilities across California.…

☐ ☆ ✇ WIRED

Elon Musk’s X Gave Check Marks to Terrorist Group Leaders, Report Says

By Jon Brodkin, Ars Technica — February 15th 2024 at 23:17
A new report cited 28 “verified” accounts on X that appear to be tied to sanctioned groups or individuals.
☐ ☆ ✇ The Register - Security

Feds dismantle Russian GRU botnet built on 1,000-plus home, small biz routers

February 15th 2024 at 21:11

Beijing, now Moscow.… Who else is hiding in broadband gateways?

The US government today said it disrupted a botnet that Russia's GRU military intelligence unit used for phishing expeditions, spying, credential harvesting, and data theft against American and foreign governments and other strategic targets.…

☐ ☆ ✇ The Register - Security

Pentagon launches nuke-spotting satellites amid Russian space bomb rumors

February 15th 2024 at 20:12

Dungeons and Dragons, high-waisted jeans, Cold War sabre rattling – the '80s are back, baby

Updated Last night's launch of six Pentagon missile-detection satellites was well timed as fears mount that Russia is considering putting nuclear weapons into space.…

☐ ☆ ✇ The Register - Security

Mitigating AI security risks

February 15th 2024 at 16:50

From APIs to Zero Trust

Webinar It has become possible to swiftly and inexpensively train, validate and deploy AI models and applications, yet while we embrace innovation, are we aware of the security risks?…

☐ ☆ ✇ The Register - Security

Zoom stomps critical privilege escalation bug plus 6 other flaws

February 15th 2024 at 15:30

All desktop and mobile apps vulnerable to at least one of the vulnerabilities

Video conferencing giant Zoom today opened up about a fresh batch of security vulnerabilities affecting its products, including a critical privilege escalation flaw.…

☐ ☆ ✇ The Hacker News

Russian Turla Hackers Target Polish NGOs with New TinyTurla-NG Backdoor

By Newsroom — February 15th 2024 at 15:08
The Russia-linked threat actor known as Turla has been observed using a new backdoor called TinyTurla-NG as part of a three-month-long campaign targeting Polish non-governmental organizations in December 2023. "TinyTurla-NG, just like TinyTurla, is a small 'last chance' backdoor that is left behind to be used when all other unauthorized access/backdoor mechanisms have failed or been
☐ ☆ ✇ The Hacker News

Ivanti Pulse Secure Found Using 11-Year-Old Linux Version and Outdated Libraries

By Newsroom — February 15th 2024 at 14:20
A reverse engineering of the firmware running on Ivanti Pulse Secure appliances has revealed numerous weaknesses, once again underscoring the challenge of securing software supply chains. Eclypsiusm, which acquired firmware version 9.1.18.2-24467.1 as part of the process, said the base operating system used by the Utah-based software company for the device is CentOS 6.4. "Pulse Secure runs an 11
❌