β IRS COVID-19 Relief Payment Deadlines Anchor Convincing Phish β
π Read
via "Threat Post".
The upcoming deadlines for applying for coronavirus relief are the lure for a phish that gets around email security gateways by using a legitimate SharePoint page for data-harvesting.π Read
via "Threat Post".
Threat Post
IRS COVID-19 Relief Payment Deadlines Anchor Convincing Phish
The upcoming deadlines for applying for coronavirus relief are the lure for a phish that gets around email security gateways by using a legitimate SharePoint page for data-harvesting.
π¦Ώ Okta opens the door to third-party developers with new Okta Devices SDK and API π¦Ώ
π Read
via "Tech Republic".
The new platform will allow developers to leverage Okta's SSO technology to build branded biometric authentication for iOS and Android apps.π Read
via "Tech Republic".
TechRepublic
Okta opens the door to third-party developers with new Okta Devices SDK and API
The new platform will allow developers to leverage Okta's SSO technology to build branded biometric authentication for iOS and Android apps.
π¦Ώ Security firm: WarezTheRemote flaw could turn a Comcast remote into a listening device π¦Ώ
π Read
via "Tech Republic".
Could your cable TV device spy on you? Vulnerability found and patched in Comcast TV remote.π Read
via "Tech Republic".
TechRepublic
Security firm: WarezTheRemote flaw could turn a Comcast remote into a listening device
Could your cable TV device spy on you? Vulnerability found and patched in Comcast TV remote.
β PoetRAT Resurfaces in Attacks in Azerbaijan Amid Escalating Conflict β
π Read
via "Threat Post".
Spear-phishing attacks targeting VIPs and others show key malware changes and are likely linked to the current conflict with Armenia.π Read
via "Threat Post".
Threat Post
PoetRAT Resurfaces in Attacks in Azerbaijan Amid Escalating Conflict
Spear-phishing attacks targeting VIPs and others show key malware changes and are likely linked to the current conflict with Armenia.
π΄ What the Sci-Fi Hit Altered Carbon Teaches Us About Virtualization Security π΄
π Read
via "Dark Reading".
The Netflix show may be fantastical, but it has real-world lessons about virtualization.π Read
via "Dark Reading".
Dark Reading
What the Sci-Fi Hit Altered Carbon Teaches Us About Virtualization Security
The Netflix show may be fantastical, but it has real-world lessons about virtualization.
βΌ CVE-2020-25985 βΌ
π Read
via "National Vulnerability Database".
MonoCMS Blog 1.0 is affected by: Arbitrary File Deletion. Any authenticated user can delete files on and off the webserver (php files can be unlinked and not deleted).π Read
via "National Vulnerability Database".
π¦Ώ Phishing attack spoofs IRS COVID-19 relief to steal personal data π¦Ώ
π Read
via "Tech Republic".
The phishing page tries to obtain email credentials, Social Security numbers, driver's license numbers, and tax numbers, says Armorblox.π Read
via "Tech Republic".
TechRepublic
Phishing attack spoofs IRS COVID-19 relief to steal personal data
The phishing page tries to obtain email credentials, Social Security numbers, driver's license numbers, and tax numbers, says Armorblox.
β Googleβs Chrome 86: Critical Payments Bug, Password Checker Among Security Notables β
π Read
via "Threat Post".
Google is rolling out 35 security fixes, and a new password feature, in Chrome 86 versions for Windows, Mac, Android and iOS users.π Read
via "Threat Post".
Threat Post
Googleβs Chrome 86: Critical Payments Bug, Password Checker Among Security Notables
Google is rolling out 35 security fixes, and a new password feature, in Chrome 86 versions for Windows, Mac, Android and iOS users.
βΌ CVE-2020-13332 βΌ
π Read
via "National Vulnerability Database".
Improper access expiration date validation in GitLab version >=8.11.0-rc6+ allows user to have access to projects with expiration.π Read
via "National Vulnerability Database".
βΌ CVE-2020-13346 βΌ
π Read
via "National Vulnerability Database".
Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allowing guest users to access confidential issues through API.π Read
via "National Vulnerability Database".
βΌ CVE-2020-14355 βΌ
π Read
via "National Vulnerability Database".
Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution.π Read
via "National Vulnerability Database".
π Packet Fence 10.2.0 π
π Read
via "Packet Storm Security".
PacketFence is a network access control (NAC) system. It is actively maintained and has been deployed in numerous large-scale institutions. It can be used to effectively secure networks, from small to very large heterogeneous networks. PacketFence provides NAC-oriented features such as registration of new network devices, detection of abnormal network activities including from remote snort sensors, isolation of problematic devices, remediation through a captive portal, and registration-based and scheduled vulnerability scans.π Read
via "Packet Storm Security".
Packetstormsecurity
Packet Fence 10.2.0 β Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
π FINRA Warns Financial Services Firms of New Phishing Campaign π
π Read
via "Digital Guardian".
FINRA, a self-regulatory organization that oversees brokers and broker-dealers, is warning about a new phishing attack that looks like its coming from the organization.π Read
via "Digital Guardian".
Digital Guardian
FINRA Warns Financial Services Firms of New Phishing Campaign
FINRA, a self-regulatory organization that oversees brokers and broker-dealers, is warning about a new phishing attack that looks like its coming from the organization.
β BAHAMUT Spies-for-Hire Linked to Extensive Nation-State Activity β
π Read
via "Threat Post".
Researchers uncovered a sophisticated, incredibly well-resourced APT that has its fingers in wide-ranging espionage and disinformation campaigns.π Read
via "Threat Post".
Threat Post
BAHAMUT Spies-for-Hire Linked to Extensive Nation-State Activity
Researchers uncovered a sophisticated, incredibly well-resourced APT that has its fingers in wide-ranging espionage and disinformation campaigns.
π΄ The New War Room: Cybersecurity in the Modern Era π΄
π Read
via "Dark Reading".
The introduction of the virtual war room is a new but necessary shift. To ensure its success, security teams must implement new systems and a new approach to cybersecurity.π Read
via "Dark Reading".
Dark Reading
The New War Room: Cybersecurity in the Modern Era
The introduction of the virtual war room is a new but necessary shift. To ensure its success, security teams must implement new systems and a new approach to cybersecurity.
βΌ CVE-2019-16160 βΌ
π Read
via "National Vulnerability Database".
An integer underflow in the SMB server of MikroTik RouterOS before 6.45.5 allows remote unauthenticated attackers to crash the service.π Read
via "National Vulnerability Database".
βΌ CVE-2020-26870 βΌ
π Read
via "National Vulnerability Database".
Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements.π Read
via "National Vulnerability Database".
β Google Rolls Out Fixes for High-Severity Android System Flaws β
π Read
via "Threat Post".
The most serious bugs are elevation-of-privilege issues in the Android System component (CVE-2020-0215 and CVE-2020-0416).π Read
via "Threat Post".
Threat Post
Google Rolls Out Fixes for High-Severity Android System Flaws
The most serious bugs are elevation-of-privilege issues in the Android System component (CVE-2020-0215 and CVE-2020-0416).
π΄ CISA Warns of Renewed Emotet Activity π΄
π Read
via "Dark Reading".
The Emotet malware dropper is seeing an upsurge in new activity in the second half of 2020.π Read
via "Dark Reading".
Dark Reading
CISA Warns of Renewed Emotet Activity
The Emotet malware dropper is seeing an upsurge in new activity in the second half of 2020.
β Feds Sound Alarm Over Emotet Attacks on State, Local Govs β
π Read
via "Threat Post".
CISA warned already-strained public-sector entities about disturbing spikes in Emotet phishing attacks aimed at municipalities.π Read
via "Threat Post".
Threat Post
Feds Sound Alarm Over Emotet Attacks on State, Local Govs
CISA warned already-strained public-sector entities about disturbing spikes in Emotet phishing attacks aimed at municipalities.
π¦Ώ 3 ways criminals use artificial intelligence in cybersecurity attacks π¦Ώ
π Read
via "Tech Republic".
Bad actors use machine learning to break passwords more quickly and build malware that knows how to hide, experts warn.π Read
via "Tech Republic".
TechRepublic
3 ways criminals use artificial intelligence in cybersecurity attacks
Bad actors use machine learning to break passwords more quickly and build malware that knows how to hide, experts warn.