Krebs on Security

SEPTEMBER 30, 2022

Someone has recently created a large number of fake LinkedIn profiles for Chief Information Security Officer (CISO) roles at some of the world’s largest corporations. It’s not clear who’s behind this network of fake CISOs or what their intentions may be. But the fabricated LinkedIn identities are confusing search engine results for CISO roles at major companies, and they are being indexed as gospel by various downstream data-scraping sources.

Information Security 332

Information Security Communications IT Cybersecurity 332

Data Breach Today

SEPTEMBER 20, 2022

Assume Password, Email and IPs Leaked as an Attempt to Export User Database Made One of the internet's worst websites is down following a weekend hack that may have exposed the email, password and IP address of Kiwi Farms yses. A statement on the site says hackers gained access to site administrator Joshua Moon's account. Site users stalk trans and non-binary people.

Passwords 330

Passwords Access 330

Data Matters

SEPTEMBER 6, 2022

Privacy never sleeps in California. In recent days and as California’s legislative session comes to a close, there have been a number of significant legislative and regulatory developments in the state, each of which will likely (again) change the privacy landscape in California and, by extension, the rest of the country. For businesses operating in California or whose websites, products or services reach California residents, these changes mean new compliance obligations, some of which could

Privacy 195

Privacy B2B Sales Compliance 195

Security Affairs

SEPTEMBER 2, 2022

Uptycs researchers recently spotted a new Linux ransomware that appears to be under active development. The Uptycs Threat Research team recently observed an Executable and Linkable Format ( ELF ) ransomware which encrypts the files inside Linux systems based on the given folder path. We observed that the dropped README note matches exactly with the DarkAngels ransomware README note (see Figure 1).

Ransomware 145

Ransomware Encryption File names IT 145

Advertisement

Many software teams have migrated their testing and production workloads to the cloud, yet development environments often remain tied to outdated local setups, limiting efficiency and growth. This is where Coder comes in. In our 101 Coder webinar, you’ll explore how cloud-based development environments can unlock new levels of productivity. Discover how to transition from local setups to a secure, cloud-powered ecosystem with ease.

Cloud

eSecurity Planet

SEPTEMBER 3, 2022

Distributed denial-of-service (DDoS) attacks cause problems for organizations of all sizes. To fight DDoS attacks, organizations and teams need to implement the three standard phases for any IT threat: preparation, reaction, and recovery. However, to plan the phases properly, organizations need to first understand the nature of DDoS attacks and why attackers use them.

Cloud 145

Cloud Security IT Encryption 145

Krebs on Security

SEPTEMBER 15, 2022

A number of financial institutions in and around New York City are dealing with a rash of super-thin “deep insert” skimming devices designed to fit inside the mouth of an ATM’s card acceptance slot. The card skimmers are paired with tiny pinhole cameras that are cleverly disguised as part of the cash machine. Here’s a look at some of the more sophisticated deep insert skimmer technology that fraud investigators have recently found in the wild.

IT 288

IT 288

Data Breach Today

SEPTEMBER 9, 2022

Also: Vice Society Ransomware Gang Claims Credit for Attack The only surprising aspect of the ransomware attack against Los Angeles Unified School District is that it didn’t happen sooner. The district was warned of cybersecurity weaknesses in the 20 months leading to its ransomware attack. The Vice Society gang has claimed credit.

Risk 278

Risk Ransomware Cybersecurity IT 278

Dark Reading

SEPTEMBER 17, 2022

Alleged teen hacker claims he found an admin password in a network share inside Uber that allowed complete access to ride-sharing giant's AWS, Windows, Google Cloud, VMware, and other environments.

Passwords 141

Passwords Cloud Access 141

Security Affairs

SEPTEMBER 3, 2022

Electronics giant Samsung has confirmed a new data breach after some of its US systems were compromised in July. After the attack that hit the company in late July 2022, Samsung disclosed a data breach. The Electronics giant discovered on August 4 that threat actors have had access to its systems and exfiltrated customer personal information. The threat actors had access to Samsung customers’ names, contacts, dates of birth, product registration data, and demographic information.

Data breaches 145

Data breaches Communications Cybersecurity Access 145

Advertisement

Large enterprises face unique challenges in optimizing their Business Intelligence (BI) output due to the sheer scale and complexity of their operations. Unlike smaller organizations, where basic BI features and simple dashboards might suffice, enterprises must manage vast amounts of data from diverse sources. What are the top modern BI use cases for enterprise businesses to help you get a leg up on the competition?

eSecurity Planet

SEPTEMBER 23, 2022

Whether it’s package hijacking, dependency confusing, typosquatting, continuous integration and continuous delivery ( CI/CD ) compromises, or basic web exploitation of outdated dependencies , there are many software supply chain attacks adversaries can perform to take down their victims, hold them to ransom , and exfiltrate critical data. It’s often more efficient to attack a weak link in the chain to reach a bigger target, like what happened to Kaseya or SolarWinds in the last couple of years.

Security 141

Security Authentication Access Libraries 141

Schneier on Security

SEPTEMBER 23, 2022

Okay, it’s an obscure threat. But people are researching it : Our models and experimental results in a controlled lab setting show it is possible to reconstruct and recognize with over 75 percent accuracy on-screen texts that have heights as small as 10 mm with a 720p webcam.” That corresponds to 28 pt, a font size commonly used for headings and small headlines. […].

Paper 127

Paper Privacy Access IT 127

IT Governance

SEPTEMBER 15, 2022

You’ll often see the terms cyber security and information security used interchangeably. That’s because, in their most basic forms, they refer to the same thing: the confidentiality, integrity and availability of information. But there’s a crucial difference between them that affects the way your organisation operates. In this blog, we explain what information security and cyber security are, the differences between them and how they fit into your data protection practices.

Information Security 124

Information Security Security Computer and Electronics Encryption 124

Data Breach Today

SEPTEMBER 5, 2022

EvilProxy Bypasses MFA By Capturing Session Cookies One of the biggest challenges for cybercriminals is how to defeat multifactor authentication. New research has uncovered a criminal service called “EvilProxy” that steals session cookies to bypass MFA and compromise accounts.

Authentication 264

Authentication 264

Advertisement

After a year of sporadic hiring and uncertain investment areas, tech leaders are scrambling to figure out what’s next. This whitepaper reveals how tech leaders are hiring and investing for the future. Download today to learn more!

IT

Dark Reading

SEPTEMBER 2, 2022

Threat hunters can help build defenses as they work with offensive security teams to identify potential threats and build stronger threat barriers.

Security 145

Security 145

Security Affairs

SEPTEMBER 9, 2022

Threat actors are exploiting a zero-day vulnerability in a WordPress plugin called BackupBuddy, Wordfence researchers warned. On September 6, 2022, the Wordfence Threat Intelligence team was informed of a vulnerability being actively exploited in the BackupBuddy WordPress plugin. This plugin allows users to back up an entire WordPress installation, including theme files, pages, posts, widgets, users, and media files.

Authentication 145

Authentication Security IT Information Security 145

eSecurity Planet

SEPTEMBER 24, 2022

Between a plunging stock market, rising interest rates and a slumping economy, raising venture capital has not been easy this year. This has even been the case for high-priority categories like cybersecurity. According to data from PitchBook, venture capital investments have reached about $13.66 billion so far this year, down significantly from $26.52 billion in 2021.

Cybersecurity 140

Cybersecurity Cloud Marketing Risk 140

WIRED Threat Level

SEPTEMBER 28, 2022

Want to speak up against Big Tech, unjust data collection, and surveillance? Here's how to be an activist in your community and beyond.

Data Privacy 144

Data Privacy Data collection Privacy Security 144

Speaker: Anindo Banerjea, CTO at Civio & Tony Karrer, CTO at Aggregage

When developing a Gen AI application, one of the most significant challenges is improving accuracy. This can be especially difficult when working with a large data corpus, and as the complexity of the task increases. The number of use cases/corner cases that the system is expected to handle essentially explodes. 💥 Anindo Banerjea is here to showcase his significant experience building AI/ML SaaS applications as he walks us through the current problems his company, Civio, is solving.

IT Governance

SEPTEMBER 20, 2022

Cyber crime is an increasingly lucrative business, with threat actors reportedly pocketing $6.9 billion (about £6 billion) last year. With the help of progressively more sophisticated techniques and organisations’ growing reliance on digital technology, it’s easy to see why there are so many breaches. Organisations are being urged to respond to the threat by investing more in cyber security defences, but if those solutions aren’t part of a cohesive strategy, the benefits will be minimal.

Phishing 123

Phishing Data breaches Risk Insurance 123

Data Breach Today

SEPTEMBER 17, 2022

The latest edition of the ISMG Security Report discusses the appearance at a Senate hearing this week by the former head of security for Twitter; the top-performing web application and API protection vendors, according to Gartner's Magic Quadrant 2022; and threat trends to watch for in 2023.

Security 246

Security 246

Dark Reading

SEPTEMBER 29, 2022

The previously identified ransomware builder has veered in an entirely new direction, targeting consumers and business of all sizes by exploiting known CVEs through brute-forced and/or stolen SSH keys.

Ransomware 123

Ransomware 123

Security Affairs

SEPTEMBER 9, 2022

Threat actors claimed to have stolen classified NATO documents from the Armed Forces General Staff agency of Portugal (EMGFA). After discovering that Classified NATO documents belonging to the Armed Forces General Staff agency of Portugal (EMGFA) were offered for sale on the darkweb, the Portuguese agency discovered it has suffered a cyberattack. The Armed Forces General Staff (Portuguese: Estado-Maior-General das Forças Armadas), or EMGFA, is the supreme military body of Portugal.

Military 145

Military Sales Data breaches Cybersecurity 145

Speaker: Aindra Misra, Senior Manager, Product Management (Data, ML, and Cloud Infrastructure) at BILL

Join us for an insightful webinar that explores the critical intersection of data privacy and AI governance. In today’s rapidly evolving tech landscape, building robust governance frameworks is essential to fostering innovation while staying compliant with regulations. Our expert speaker, Aindra Misra, will guide you through best practices for ensuring data protection while leveraging AI capabilities.

Data Privacy

eSecurity Planet

SEPTEMBER 21, 2022

A retired threat actor has returned with new attacks aimed at the cloud, containers – and encryption keys. The Aqua Nautilus research team observed three attacks that appeared very similar to those performed by TeamTNT, a threat actor specializing in cloud platforms and online instances such as Kubernetes clusters, Redis servers, and Docker APIs.

Cloud 138

Cloud Encryption Honeypots Mining 138

Preservica

SEPTEMBER 16, 2022

To celebrate this year's Electronic Records Day on October 10th, guest authors Pari Swift, Jacqueline Johnson, and the Ohio Records Committee share their thoughts on the key differences between document management systems and digital preservation systems in this blog post. According to the Council of State Archivists' site , "Electronic Records Day is designed to raise awareness among state government agencies, the general public, related professional organizations, and other stakeholders about

Digital preservation 122

Digital preservation Metadata Authentication Government 122

IT Governance

SEPTEMBER 16, 2022

This week, we discuss allegations of data security failures at Twitter, a €405 million fine for Instagram, a cyber attack on InterContinental Hotels Group, and why Cloud security is so important. Now available on Spotify , Amazon Music , Apple Podcasts and SoundCloud. The post IT Governance Podcast Episode 8: Twitter, Instagram, InterContinental and Cloud security appeared first on IT Governance UK Blog.

Cloud 120

Cloud Government IT Security 120

Data Breach Today

SEPTEMBER 7, 2022

APT42 Operates on Behalf of the Islamic Revolutionary Guard Corps An Iranian state-sponsored group in operation since 2015 relies on highly targeted social engineering to try and attack individuals and organizations that Tehran deems enemies of the regime, says a new report from cyberthreat intelligence firm Mandiant.

263

263

Advertisement

Gearing up for 2025 annual planning? Our latest eBook from the Operators Guild is your ultimate guide. Discover real-world solutions and best practices shared by top CFOs, drawn directly from discussions within OG’s vibrant online community. Learn from senior executives at high-growth tech startups as they outline financial planning strategies, align CEO and board goals, and coordinate budgets across departments.

Education

KnowBe4

SEPTEMBER 8, 2022

Researchers at Resecurity have discovered a new Phishing-as-a-Service (PhaaS) platform called “EvilProxy” that’s being offered on the dark web. EvilProxy is designed to target accounts on a variety of platforms, including Apple, Facebook, GoDaddy, GitHub, Google, Dropbox, Instagram, Microsoft, Twitter, Yahoo, Yandex.

Phishing 127

Phishing 127

Security Affairs

SEPTEMBER 30, 2022

Researchers from Mandiant have discovered a novel malware persistence technique within VMware ESXi Hypervisors. Mandiant detailed a novel technique used by malware authors to achieve administrative access within VMware ESXi Hypervisors and take over vCenter servers and virtual machines for Windows and Linux to perform the following actions: Send commands to the hypervisor that will be routed to the guest VM for execution Transfer files between the ESXi hypervisor and guest machines running benea

Metadata 144

Metadata Archiving Access IT 144

eSecurity Planet

SEPTEMBER 9, 2022

Nearly a quarter of healthcare organizations hit by ransomware attacks experienced an increase in patient mortality, according to a study from Ponemon Institute and Proofpoint released today. The report , “Cyber Insecurity in Healthcare: The Cost and Impact on Patient Safety and Care,” surveyed 641 healthcare IT and security practitioners and found that the most common consequences of cyberattacks are delayed procedures and tests, resulting in poor patient outcomes for 57% of the healthcare prov

Ransomware 138

Ransomware Cybersecurity Cloud Phishing 138