> TODAY'S SUMMARY (13 articles)
Today's cyber news highlights significant threats and trends in the cybersecurity landscape. A major cyber heist at French bank Crédit Mutuel Arkéa resulted in fraudulent transactions amounting to $133 million, showcasing the risks posed by service provider vulnerabilities. Additionally, scammers are exploiting trusted brands through fake gift card schemes to harvest personal information, emphasizing the need for consumer vigilance. The rise in hacks targeting Internet of Things (IoT) devices has raised alarms about critical infrastructure vulnerabilities. Meanwhile, SonicWall has issued patches for multiple vulnerabilities, including a serious SSL-VPN authentication bypass flaw that has already been exploited. Lastly, sensitive credentials, such as passwords and API keys, have been found exposed in public GitHub repositories, highlighting the persistent issue of poor security practices among developers.
|
// AI-powered summary generated at 16:00
So-called “newbies” appear financially motivated, not state-sponsored
Scammers are attempting to trick users of the online currency
Today I’m gonna talk about a class of application security issues I ran across a few times over the years. In particular, let’s discuss race conditions when it comes to files with sensitive content and permissions.
Race conditions can allow an adversary to gain access to sensitive information on mac...
Virtual Spanish lesson bombed with violent, racist and pornographic content
Former US Army Special Forces officer charged in Russian espionage conspiracy
During an assessment you may find AWS IAM credentials. Use these tactics to identify the principal of the keys.
Windows 10 app vulnerability could allow threat actors to steal passwords
Acquisition advances Kaseya’s IT security offering for MSPs and SMBs
In this post, we’ll show you how to test your smart contracts with the Echidna fuzzer. In particular, you’ll see how to: Find a bug we discovered during the Set Protocol audit using a variation of differential fuzzing, and Specify and check useful properties for your own smart contract libraries. An...
APT group DeathStalker has been actively targeting companies across the world in recent years
Well-researched attacks are focused on gaining corporate access
The Ultimate OSCP Preparation Guide [DEPRECATED] Update Notes This guide is now deprecated due to exam revisions made by Offensive Security on January 11, 2022.
I published this guide on August 17th, of 2020. Offensive Security no longer requires the buffer overflow, and to pass this exam, you’ll ha...
Chinese social giant says it was deprived of due process
SafetyDetectives discovered unprotected Elasticsearch database
Leverage file read and SSRF vulnerabilities to steam IAM credentials and event data from Lambda.
Report finds tech conferences are bad at considering and including women
TBI records sharp rise in reports of cybercrimes against children during COVID-19 pandemic
These days business decisions and feature development often is influenced heavily by telemetry information. Telemetry is baked into the programs, services and applications we use.
Companies are hungry for telemetry because with machine learning and Deep Neural Networks “data is the new oil”.
Telemet...
Cross-site scripting dubbed the most dangerous software weakness in 2020 by CWE
Instacart reveals that employees of a third party vendor viewed shopper profiles more than was necessary