> TODAY'S SUMMARY (18 articles)
Today's cybersecurity landscape highlights several critical threats and vulnerabilities. A new WordPress vulnerability, Click2Shell, allows remote code execution via a single click, emphasizing the need for immediate updates to version 7.1.1. Additionally, a fake job interview campaign linked to North Korea has infected over 30,000 devices, showcasing the ongoing risks of social engineering attacks. The TryCloudflare service misconfiguration has led to unintended Google indexing, exposing sensitive user services. On the infrastructure side, flaws in Zyxel switches and Veeam software are actively exploited, prompting CISA to add them to its Known Exploited Vulnerabilities catalog. Lastly, security researchers have identified potential backdoor access through Meta's AI assistant, underlining the importance of scrutinizing AI integrations for security flaws.
|
// AI-powered summary generated at 08:01
When the NSA's surveillance program was first revealed by Edward Snowden last week, initial reaction was that it was a US issue. But with the realization that the greater part of the world's internet traffic is at some point routed via the US, the worldwide ramifications are becoming better understo...
Researchers at Rapid7 have uncovered two specific attacks using a new backdoor malware targeting victims in Vietnam and in India. The security company has dubbed the threat KeyBoy after a string present in one of the samples.
We interrupt our regularly scheduled programming to bring you an important announcement: On Thursday, June 6th, just in time for SummerCon, we will be hosting a free Ruby Security Workshop in NYC! Signups are first-come, first-serve and we only have space for 30 people. Sign up here and we will emai...
While IT security professionals recognize the threat posed by unwitting employees, many still admit to allowing administrative privileges to go unmanaged, making organizations increasingly vulnerable to malware exploits and unauthorized software, according to a survey by Avecto.
You cannot teach an old dog new tricks, says the old saying. Maybe you can, suggest security researchers after discovering a new self-propagating Zbot variant in the wild.
In the final part of our three-part series, we investigate the how the toolkit user gained control of program flow and what their strategy means for the reliability of their exploit. Elderwood and the Department of Labor Hack Writing Exploits with the Elderwood Kit (Part 1) Writing Exploits with the...
Gottfrid Svartholm, one of the original founders of The Pirate Bay and currently awaiting a verdict for the hack of Logica in Sweden, is now wanted for another hack in Denmark: this time on CSC.
âThis directive,â says rapporteur Monika Hohlmeier, âintroduces much-needed common rules for criminal law penalties, and also aims to facilitate joint measures to prevent attacks and foster information exchange among competent authorities.â
In the second part of our three-part series, we investigate the tools provided by the Elderwood kit for developing exploits from discovered vulnerabilities. Elderwood and the Department of Labor Hack Writing Exploits with the Elderwood Kit (Part 1) Writing Exploits with the Elderwood Kit (Part 2) Se...
A mystery technology is allowing car thieves to pop open automatic car locks over the air using a hand-held device â but police have no idea how theyâre managing to do it.
In a session titled âBecoming the Future CISOâ at the Forrester Forum for CIOâs in London, England, June 6 2013, Andrew Rose declared the current role of CISO a dying breed.
Recently, the Department of Labor (DoL) and several other websites were compromised to host a new zero-day exploit in Internet Explorer 8 (CVE-2013-1347). Researchers noted similarities between this attack and earlier ones attributed to Elderwood, a distinct set of tools used to develop several past...
Access management is designed to allow only authorized digital identities to gain access to a system. But a digital identity is nothing more than âa collection of attributes that uniquely define a person or organization.â Proofing is the process of ensuring that those attributes belong to the genuin...
Itâs a potential publicity bomb that has yet to explode, apparently, but the Washington Post and the Guardian are reporting that both the US and the UK governments have been engaged in ongoing data collection of private information from web services, with the support of top tech companies, in an for...
Plusieurs rendez-vous français habituels sont consacrés cette année à la cybersécurité industrielle.
Comme pour faire Ă©cho Ă mon prĂ©cĂ©dent article concernant la publication en 2013 de plusieurs normes par lâISA (International Society of Automation), lâantenne française de [...] Lire la suite
A new examination of mobile threat data from the Lookout Platform in five countries has found that threats to consumers run the gamut, from annoying to extremely invasive. The study has uncovered that adware and malware threats like spyware, surveillanceware and trojans are in particular proliferati...
In todayâs world, everything from refrigerators to cars are beginning to get âconnectedâ and given the ability to talk to you and to other things via broadband networks. Much of this still seems like science fiction, but when it comes to connected TVs, the concept has already jumped the chasm to the...
The Guardian newspaper has exposed a Foreign Intelligence Surveillance Court (FISC) âtop secretâ order requiring Verizon to provide the NSA with all âtelephony metadataâ for communications within the USA and between the USA and abroad.
Secunia, the Copenhagen-based provider of security software, announced the appointment of Microsoftâs Peter Colsted as the firmâs new chief executive.
The Ponemon Institute today released the 2013 Cost of Data Breach Study: Global Analysis which reveals data breaches are often the result of poor processes, and the latest study from Ponemon Institute bears this out: Human errors and system problems caused two-thirds of data breaches in 2012. They a...