ATENTIONβΌ New - CVE-2020-12441
π Read
via "National Vulnerability Database".
Denial-of-Service (DoS) in Ivanti Service Manager HEAT Remote Control 7.4 due to a buffer overflow in the protocol parser of the Γ’β¬˜HEATRemoteServiceΓ’β¬β’ agent. The DoS can be triggered by sending a specially crafted network packet.π Read
via "National Vulnerability Database".
β Canon Admits Ransomware Attack in Employee Note, Report β
π Read
via "Threatpost".
The consumer-electronics giant has suffered partial outages across its U.S. website and internal systems, reportedly thanks to the Maze gang.π Read
via "Threatpost".
Threat Post
UPDATE: Canon Ransomware Attack Results in Leaked Data, Report
The consumer-electronics giant had suffered partial outages across its U.S. website and internal systems reportedly, thanks to the Maze gang.
π΄ OpenText Blends Security, Data Protection for Greater Cyber Resilience π΄
π Read
via "Dark Reading: ".
SPONSORED CONTENT: Infosec professionals are taking advantage of technology hybrids to keep users, data, and their networks more safe, according to Hal Lonas of OpenText's Webroot division. And they're also finding new ways to use artificial intelligence and machine learning to improve security management and reduce risk.π Read
via "Dark Reading: ".
Dark Reading
OpenText Blends Security, Data Protection for Greater Cyber Resilience
SPONSORED CONTENT: Infosec professionals are taking advantage of technology hybrids to keep users, data, and their networks more safe, according to Hal Lonas of OpenText's Webroot division. And they're also finding new ways to use artificial intelligenceβ¦
π΄ Office 365's Vast Attack Surface & All the Ways You Don't Know You're Being Exploited Through It π΄
π Read
via "Dark Reading: ".
Mandiant incident response managers Josh Madeley and Doug Bienstock describe how thoroughly Microsoft 365 (formerly known as Office 365) extends into corporate networks, describe both sophisticated and simple attacks they've detected, and suggest mitigations as businesses rely more heavily on the cloud.π Read
via "Dark Reading: ".
Darkreading
Office 365's Vast Attack Surface & All the Ways You Don't Know You're Being Exploited Through It
Mandiant incident response managers Josh Madeley and Doug Bienstock describe how thoroughly Microsoft 365 (formerly known as Office 365) extends into corporate networks, describe both sophisticated and simple attacks theyβve detected, and suggest mitigationsβ¦
π΄ Information Operations Spotlighted at Black Hat as Election Worries Rise π΄
π Read
via "Dark Reading: ".
From Russia's "best-in-class" efforts at widening social divides in Western democracies to China's blunt attacks on dissidents, information operations are becoming a greater threat, says a Stanford researcher.π Read
via "Dark Reading: ".
Dark Reading
Information Operations Spotlighted at Black Hat as Election Worries Rise
From Russia's best-in-class efforts at widening social divides in Western democracies to China's blunt attacks on dissidents, information operations are becoming a greater threat, says a Stanford researcher.
π΄ Exploiting Google Cloud Platform With Ease π΄
π Read
via "Dark Reading: ".
Security engineer Dylan Ayrey and Cruise senior infrastructure security engineer Allison Donovan describe fundamental weaknesses in GCP identity management that enable privilege escalation and lateral movement.π Read
via "Dark Reading: ".
Dark Reading
Exploiting Google Cloud Platform With Ease
Security engineer Dylan Ayrey and Cruise senior infrastructure security engineer Allison Donovan describe fundamental weaknesses in GCP identity management that enable privilege escalation and lateral movement.
π΄ On 'Invisible Salamanders' and Insecure Messages π΄
π Read
via "Dark Reading: ".
Cornell researcher Paul Grubbs discusses how vulnerabilities found in Facebook Messenger encryption could mean trouble for your secure messages.π Read
via "Dark Reading: ".
Dark Reading
On 'Invisible Salamanders' and Insecure Messages
Cornell researcher Paul Grubbs discusses how vulnerabilities found in Facebook Messenger encryption could mean trouble for your secure messages.
π What Does a Data Breach Cost in 2020? π
π Read
via "Subscriber Blog RSS Feed ".
Ponemon Institute's annual Cost of a Data Breach report tracks how industry data breach costs have changed over time.π Read
via "Subscriber Blog RSS Feed ".
Digital Guardian
What Does a Data Breach Cost?
Ponemon Institute's annual Cost of a Data Breach report tracks how industry data breach costs have changed over time.
β Black Hat 2020: Mercedes-Benz E-Series Rife with 19 Bugs β
π Read
via "Threatpost".
Researchers went into detail about the discovery and disclosure of 19 security flaws they found in Mercedes-Benz vehicles, which have all been fixed.π Read
via "Threatpost".
Threat Post
Black Hat 2020: Mercedes-Benz E-Series Rife with 19 Bugs
Researchers went into detail about the discovery and disclosure of 19 security flaws they found in Mercedes-Benz vehicles, which have all been fixed.
π΄ Where Dark Reading Goes Next π΄
π Read
via "Dark Reading: ".
Dark Reading Editor-in-Chief gives a complete rundown of all the Dark Reading projects you might not even know about, his insight into the future of the security industry, and how we plan to cover it.π Read
via "Dark Reading: ".
Dark Reading
Where Dark Reading Goes Next
Dark Reading Editor-in-Chief gives a complete rundown of all the Dark Reading projects you might not even know about, his insight into the future of the security industry, and how we plan to cover it.
π΄ A Mix of Optimism and Pessimism for Security of the 2020 Election π΄
π Read
via "Dark Reading: ".
DHS CISA's Christopher Krebs and Georgetown University's Matt Blaze at Black Hat USA give the lowdown on where things stand and what still needs to happen to protect the integrity of November's election.π Read
via "Dark Reading: ".
Dark Reading
A Mix of Optimism and Pessimism for Security of the 2020 Election
DHS CISA's Christopher Krebs and Georgetown University's Matt Blaze at Black Hat USA give the lowdown on where things stand so far and what still needs to happen before Nov. 3 to protect the integrity of the US presidential election.
π΄ Researchers Create New Framework to Evaluate User Security Awareness π΄
π Read
via "Dark Reading: ".
Approaches based on questionnaires and self-evaluation are not always a good indicator of how well a user can mitigate social engineering threats.π Read
via "Dark Reading: ".
Dark Reading
Researchers Create New Framework to Evaluate User Security Awareness
Approaches based on questionnaires and self-evaluation are not always a good indicator of how well a user can mitigate social engineering threats.
ATENTIONβΌ New - CVE-2020-15114
π Read
via "National Vulnerability Database".
In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This results in a denial of service, since the endpoint can become stuck in a loop of requesting itself until there are no more available file descriptors to accept connections on the gateway.π Read
via "National Vulnerability Database".
ATENTIONβΌ New - CVE-2020-11937
π Read
via "National Vulnerability Database".
In whoopsie, parse_report() from whoopsie.c allows a local attacker to cause a denial of service via a crafted file. The DoS is caused by resource exhaustion due to a memory leak. Fixed in 0.2.52.5ubuntu0.5, 0.2.62ubuntu0.5 and 0.2.69ubuntu0.1.π Read
via "National Vulnerability Database".
β Black Hat 2020: Influence Campaigns Are a Cybersecurity Problem β
π Read
via "Threatpost".
An inside look at how nation-states use social media to influence, confuse and divide -- and why cybersecurity researchers should be involved.π Read
via "Threatpost".
Threat Post
Black Hat 2020: Influence Campaigns Are a Cybersecurity Problem
An inside look at how nation-states use social media to influence, confuse and divide β and why cybersecurity researchers should be involved.
π΄ Getting to the Root: How Researchers Identify Zero-Days in the Wild π΄
π Read
via "Dark Reading: ".
Google Project Zero researcher Maddie Stone explains the importance of identifying flaws exploited in the wild and techniques used to do it.π Read
via "Dark Reading: ".
Dark Reading
Getting to the Root: How Researchers Identify Zero-Days in the Wild
Google Project Zero researcher Maddie Stone explains the importance of identifying flaws exploited in the wild and techniques used to do it.
β Augmenting AWS Security Controls β
π Read
via "Threatpost".
Appropriate use of native security controls in AWS and other CSPs is fundamental to managing cloud risk and avoiding costly breaches.π Read
via "Threatpost".
Threat Post
Augmenting AWS Security Controls
Appropriate use of native security controls in AWS and other CSPs is fundamental to managing cloud risk and avoiding costly breaches.
β Business Email Compromise β fighting back with machine learning β
π Read
via "Naked Security".
Machine learning models are immune to blandishments, threats, flattery and so - so why not set them against social engineers?π Read
via "Naked Security".
Naked Security
Business Email Compromise β fighting back with machine learning
Machine learning models are immune to blandishments, threats, flattery and so β so why not set them against social engineers?
β Hackers Dump 20GB of Intelβs Confidential Data Online β
π Read
via "Threatpost".
Chipmaker investigates a leak of intellectual property from its partner and customer resource center.π Read
via "Threatpost".
Threat Post
Hackers Dump 20GB of Intelβs Confidential Data Online
Chipmaker investigates a leak of intellectual property from its partner and customer resource center.
π΄ IoT Security During COVID-19: What We've Learned & Where We're Going π΄
π Read
via "Dark Reading: ".
Vigilance and ongoing training combined with an integrated security framework are key aspects of a successful strategy in the fight against the latest crop of pandemic opportunists.π Read
via "Dark Reading: ".
Dark Reading
IoT Security During COVID-19: What We've Learned & Where We're Going
Vigilance and ongoing training combined with an integrated security framework are key aspects of a successful strategy in the fight against the latest crop of pandemic opportunists.
π Report: Two new encryption standards will soon sweep away security controls π
π Read
via "Security on TechRepublic".
Security professionals must act before TLS 1.3 and DNS-over-HTTPS (DoH) are implemented or they won't be able to analyze network traffic and detect cyberthreats, warns Forrester Research.π Read
via "Security on TechRepublic".
TechRepublic
Report: Two new encryption standards will soon sweep away security controls
Security professionals must act before TLS 1.3 and DNS-over-HTTPS (DoH) are implemented or they won't be able to analyze network traffic and detect cyberthreats, warns Forrester Research.