> TODAY'S SUMMARY (13 articles)
Today's cyber news highlights significant threats and trends in the cybersecurity landscape. A major cyber heist at French bank Crédit Mutuel Arkéa resulted in fraudulent transactions amounting to $133 million, showcasing the risks posed by service provider vulnerabilities. Additionally, scammers are exploiting trusted brands through fake gift card schemes to harvest personal information, emphasizing the need for consumer vigilance. The rise in hacks targeting Internet of Things (IoT) devices has raised alarms about critical infrastructure vulnerabilities. Meanwhile, SonicWall has issued patches for multiple vulnerabilities, including a serious SSL-VPN authentication bypass flaw that has already been exploited. Lastly, sensitive credentials, such as passwords and API keys, have been found exposed in public GitHub repositories, highlighting the persistent issue of poor security practices among developers.
|
// AI-powered summary generated at 16:00
A few years back the Blue Team of a company asked to be targeted in a Red Team Operation.
That was a really fun, because Rules of Engagement commonly prevent targeting Blue Teams. Blue’s infrastructure, systems and team members are often out of scope, unfortunately.
Blue team infrastructure is a gol...
Venafi claims the enterprise attack surface is rapidly expanding
IT services giant will take “weeks” to return to normal
Summary Many people do not know about the Jack Daniel’s Tennessee Squires. The Squire Association is an Elite Club for “friends of Jack Daniel’s”. Anyone that has ever dreamed of being a Tennessee Squire knows how difficult - if not impossible it is to obtain membership without paying thousands of d...
Account hijackers run up large bills with in-store orders
Potential Abuse on a hooked Function There is a potential for abuse with any plugins that implement the hook function ‘shunt_is_valid_user’. In the code below we simply demonstrate that authentication can be completely bypassed by returning TRUE in the hooked function. This would be an ideal place f...
Army says suggestive tweets sent from Fort Bragg account were posted by a hacker
Systems admin allegedly hacked US department store to give former colleagues paid holidays
Trail of Bits has manually curated a wealth of data—years of security assessment reports—and now we’re exploring how to use this data to make the smart contract auditing process more efficient with Slither-simil. Based on accumulated knowledge embedded in previous audits, we set out to detect simila...
$7.75m Equifax settlement with financial institutions over 2017 data breach ratified by judge
Researcher reveals true depth of flaw in Microsoft Teams that was patched earlier this year
Le CERT-FR signale une recrudescence d’activité Emotet en France dans son bulletin d’alerte 2020-ALE-019. Il s’agit d’une nouvelle forme d’attaque : le détournement des fils de discussion des courriels (email thread hijacking technique).
Cette nouvelle forme d’attaque est particulièrement [...] Li...
All technology comes with both promises and un-intended consequences
In both emergency services and cybersecurity, professionals deal with some of the same challenges
This post is part of a series about machine learning and artificial intelligence. Click on the blog tag “huskyai” to see related posts.
Overview: How Husky AI was built, threat modeled and operationalized Attacks: Some of the attacks I want to investigate, learn about, and try out I wanted to explor...
UK/EU issue sanctions over cyber-attack, while US points finger at Iran over fake news campaign
Nokia data reveals almost a third of devices are now compromised
TL;DR: Can we use GPUs to get 10x performance/dollar when fuzzing embedded software in the cloud? Based on our preliminary work, we think the answer is yes! Fuzzing is a software testing technique that supplies programs with many randomized inputs in an attempt to cause unexpected behavior. It’s an...
Some metrics are more valuable than others in making measurable improvement in security
Two-factor authentication belatedly switched on after incident