> TODAY'S SUMMARY (13 articles)
Today's cyber news highlights significant threats and trends in the cybersecurity landscape. A major cyber heist at French bank Crédit Mutuel Arkéa resulted in fraudulent transactions amounting to $133 million, showcasing the risks posed by service provider vulnerabilities. Additionally, scammers are exploiting trusted brands through fake gift card schemes to harvest personal information, emphasizing the need for consumer vigilance. The rise in hacks targeting Internet of Things (IoT) devices has raised alarms about critical infrastructure vulnerabilities. Meanwhile, SonicWall has issued patches for multiple vulnerabilities, including a serious SSL-VPN authentication bypass flaw that has already been exploited. Lastly, sensitive credentials, such as passwords and API keys, have been found exposed in public GitHub repositories, highlighting the persistent issue of poor security practices among developers.
|
// AI-powered summary generated at 16:00
Five co-conspirators have already pleaded guilty
Misconfiguration leaves online databases open to the public
TL;DR: We audited an implementation of the Diamond standard proposal for contract upgradeability and can’t recommend it in its current form—but see our recommendations and upgrade strategy guidance. We recently audited an implementation of the Diamond standard code, a new upgradeability pattern. It’...
ShopRite and parent company pay $235k to settle claims that data-filled devices were discarded in a dumpster
US imprisons Russian cyber-criminal for role in Botnet that stole and trafficked data
This post is part of a series about machine learning and artificial intelligence. Click on the blog tag “huskyai” to see related posts.
Overview: How Husky AI was built, threat modeled and operationalized Attacks: Some of the attacks I want to investigate, learn about, and try out A few weeks ago wh...
Survey reveals decline in value of over 40% of salaried IT professional job titles in the last 12 months
Florida invests in cyber-controls after 2016 hacking efforts
A few years back the Blue Team of a company asked to be targeted in a Red Team Operation.
That was a really fun, because Rules of Engagement commonly prevent targeting Blue Teams. Blue’s infrastructure, systems and team members are often out of scope, unfortunately.
Blue team infrastructure is a gol...
Corporate infrastructures are being exposed to threats that would not have been considered a year ago
Incoming security chief will not have to worry about Flash
Summary Many people do not know about the Jack Daniel’s Tennessee Squires. The Squire Association is an Elite Club for “friends of Jack Daniel’s”. Anyone that has ever dreamed of being a Tennessee Squire knows how difficult - if not impossible it is to obtain membership without paying thousands of d...
HP Inc data warns of close link to human-operated ransomware threats
More than a quarter of incidents the NCSC tackled were pandemic-related
Potential Abuse on a hooked Function There is a potential for abuse with any plugins that implement the hook function ‘shunt_is_valid_user’. In the code below we simply demonstrate that authentication can be completely bypassed by returning TRUE in the hooked function. This would be an ideal place f...
First annual control systems and operational technology cybersecurity report released by (CS)2AI and KPMG
$200k fine for Connecticut city that failed to terminate former employee’s access rights
Trail of Bits has manually curated a wealth of data—years of security assessment reports—and now we’re exploring how to use this data to make the smart contract auditing process more efficient with Slither-simil. Based on accumulated knowledge embedded in previous audits, we set out to detect simila...
Fresh sextortion campaign tells Zoom users they could be the next Toobin
Deal will allow users to centralize administration and enforcement to critical resources and data