πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.9K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
🦿 Homebrew: How to install post-exploitation tools on macOS 🦿

We'll guide you through the process of using Homebrew package manager to install post-exploit security tools on macOS to further assess compromised system vulnerabilities found in your Apple equipment.

πŸ“– Read

via "Tech Republic".
πŸ” The Most Read Data Insider Blogs of 2020 πŸ”

SOX compliance, preventing social engineering attacks, and data classification. In this blog, we count down the most read blogs of 2020.

πŸ“– Read

via "Digital Guardian".
πŸ•΄ Small Security Teams Have Big Security Fears, CISOs Report πŸ•΄

Researchers poll security leaders who are tasked with protecting large organizations but have a small presence and budget.

πŸ“– Read

via "Dark Reading".
❌ 2.28M MeetMindful Daters Compromised in Data Breach ❌

The ShinyHunters hacking group offer a raft of information, from location and contact info to dating preferences and bodily descriptions, as a free download.

πŸ“– Read

via "Threat Post".
🦿 Gartner: The future of AI is not as rosy as some might think 🦿

A Gartner report predicts that the second-order consequences of widespread AI will have massive societal impacts, to the point of making us unsure if and when we can trust our own eyes.

πŸ“– Read

via "Tech Republic".
β€Ό CVE-2021-21272 β€Ό

ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a "zip-slip" vulnerability. The directory support feature allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links. A well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs `oras pull`. Users of the affected versions are impacted if they are `oras` CLI users who runs `oras pull`, or if they are Go programs, which invoke `github.com/deislabs/oras/pkg/content.FileStore`. The problem has been fixed in version 0.9.0. For `oras` CLI users, there is no workarounds other than pulling from a trusted artifact provider. For `oras` package users, the workaround is to not use `github.com/deislabs/oras/pkg/content.FileStore`, and use other content stores instead, or pull from a trusted artifact provider.

πŸ“– Read

via "National Vulnerability Database".
❌ Outgoing FCC Chair Issues Final Security Salvo Against China ❌

Ajit Pai says Chinese telecom companies β€˜biggest national security threat’ for regulators in exit interview.

πŸ“– Read

via "Threat Post".
πŸ•΄ Deloitte & Touche Buys Threat-Hunting Firm πŸ•΄

Root9B (R9B) offers threat hunting and other managed security services.

πŸ“– Read

via "Dark Reading".
❌ Breaking Down Joe Biden’s $10B Cybersecurity β€˜Down Payment’ ❌

Tom Kellermann, head of cybersecurity strategy for VMware Carbon Black, talks about the top security challenges facing the US government as a new presidential administration steps in.

πŸ“– Read

via "Threat Post".
β€Ό CVE-2021-21275 β€Ό

The MediaWiki "Report" extension has a Cross-Site Request Forgery (CSRF) vulnerability. Before fixed version, there was no protection against CSRF checks on Special:Report, so requests to report a revision could be forged. The problem has been fixed in commit f828dc6 by making use of MediaWiki edit tokens.

πŸ“– Read

via "National Vulnerability Database".
🦿 IT leaders see outsourcing cybersecurity as one solution to increased attacks 🦿

A new survey from Syntax found that many decision-makers are not happy with their existing security tools.

πŸ“– Read

via "Tech Republic".
πŸ•΄ Startup Offers Free Version of its 'Passwordless' Technology πŸ•΄

Beyond Identity co-founders hope to move the needle in eliminating the need for passwords, but experts say killing passwords altogether won't be easy.

πŸ“– Read

via "Dark Reading".
❌ North Korea Targets Security Researchers in Elaborate 0-Day Campaign ❌

Hackers masquerade as security researchers to befriend analysts and eventually infect fully patched systems at multiple firms with a malicious backdoor.

πŸ“– Read

via "Threat Post".
πŸ•΄ Mainframe Security Automation Is Not a Luxury πŸ•΄

As cyber threats grow, even the most securable platform is vulnerable and requires adaptive autonomous protection.

πŸ“– Read

via "Dark Reading".
🦿 Veritas Technologies adds Flex Scale to NetBackup9 for scale-out functionality 🦿

The data protection company's latest delivers new features on a simplified platform to provide customers with additional choice for deployment across edge, core, and cloud.

πŸ“– Read

via "Tech Republic".
🦿 Governors hear about the dangers of a lackluster cybersecurity response, need for FBI coordination 🦿

At a national summit, Louisiana Gov. John Bel Edwards said before his state could test a cyberattack plan, five schools were hit with ransomware.

πŸ“– Read

via "Tech Republic".
🦿 Bad actors launched an unprecedented wave of DDoS attacks in 2020 🦿

Cybersecurity firm Akamai said in a report that COVID-19 and a newfound reliance on digital tools prompted a spike.

πŸ“– Read

via "Tech Republic".
🦿 Privacy budgets soared in 2020, doubling to an average of $2.4 million 🦿

93% of organizations turned to privacy teams to help navigate the COVID-19 pandemic, a new Cisco report finds.

πŸ“– Read

via "Tech Republic".
β€Ό CVE-2020-4889 β€Ό

IBM Spectrum Scale 5.0.0 through 5.0.5.4 and 5.1.0 could allow a local user to poison log files which could impact support and development efforts. IBM X-Force ID: 190971.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-4949 β€Ό

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 192025.

πŸ“– Read

via "National Vulnerability Database".