🦿 How AI fights fraud in the telecom industry 🦿
📖 Read
via "Tech Republic".
Americans lost $29.8 billion in phone fraud over the past year. Can AI fraud detection change this?📖 Read
via "Tech Republic".
TechRepublic
How AI fights fraud in the telecom industry | TechRepublic
Americans lost $29.8 billion in phone fraud over the past year. Can AI fraud detection change this?
‼ CVE-2021-41264 ‼
📖 Read
via "National Vulnerability Database".
OpenZeppelin Contracts is a library for smart contract development. In affected versions upgradeable contracts using `UUPSUpgradeable` may be vulnerable to an attack affecting uninitialized implementation contracts. A fix is included in version 4.3.2 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`. For users unable to upgrade; initialize implementation contracts using `UUPSUpgradeable` by invoking the initializer function (usually called `initialize`). An example is provided [in the forum](https://forum.openzeppelin.com/t/security-advisory-initialize-uups-implementation-contracts/15301).📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41259 ‼
📖 Read
via "National Vulnerability Database".
Nim is a systems programming language with a focus on efficiency, expressiveness, and elegance. In affected versions the uri.parseUri function which may be used to validate URIs accepts null bytes in the input URI. This behavior could be used to bypass URI validation. For example: parseUri("http://localhost\0hello").hostname is set to "localhost\0hello". Additionally, httpclient.getContent accepts null bytes in the input URL and ignores any data after the first null byte. Example: getContent("http://localhost\0hello") makes a request to localhost:80. An attacker can use a null bytes to bypass the check and mount a SSRF attack.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41254 ‼
📖 Read
via "National Vulnerability Database".
kustomize-controller is a Kubernetes operator, specialized in running continuous delivery pipelines for infrastructure and workloads defined with Kubernetes manifests and assembled with Kustomize. Users that can create Kubernetes Secrets, Service Accounts and Flux Kustomization objects, could execute commands inside the kustomize-controller container by embedding a shell script in a Kubernetes Secret. This can be used to run `kubectl` commands under the Service Account of kustomize-controller, thus allowing an authenticated Kubernetes user to gain cluster admin privileges. In affected versions multitenant environments where non-admin users have permissions to create Flux Kustomization objects are affected by this issue. This vulnerability was fixed in kustomize-controller v0.15.0 (included in flux2 v0.18.0) released on 2021-10-08. Starting with v0.15, the kustomize-controller no longer executes shell commands on the container OS and the `kubectl` binary has been removed from the container image. To prevent the creation of Kubernetes Service Accounts with `secrets` in namespaces owned by tenants, a Kubernetes validation webhook such as Gatekeeper OPA or Kyverno can be used.📖 Read
via "National Vulnerability Database".
🦿 Pay-per-click fraud is costing top tech companies, and you, hundreds of millions of dollars 🦿
📖 Read
via "Tech Republic".
With an estimated 14% of PPC costs being lost to fraud, all it takes is a look at the advertising budgets of top tech firms to see how much money they're wasting, says PPC Shield.📖 Read
via "Tech Republic".
TechRepublic
Pay-per-click fraud is costing top tech companies, and you, hundreds of millions of dollars
With an estimated 14% of PPC costs being lost to fraud, all it takes is a look at the advertising budgets of top tech firms to see how much money they're wasting, says PPC Shield.
❌ Windows 10 Privilege-Escalation Zero-Day Gets an Unofficial Fix ❌
📖 Read
via "Threat Post".
Researchers warn that CVE-2021-34484 can be exploited with a patch bypass for a bug originally addressed in August by Microsoft.📖 Read
via "Threat Post".
Threat Post
Windows 10 Privilege-Escalation Zero-Day Gets an Unofficial Fix
Researchers warn that CVE-2021-34484 can be exploited with a patch bypass for a bug originally addressed in August by Microsoft.
❌ Top 10 Cybersecurity Best Practices to Combat Ransomware ❌
📖 Read
via "Threat Post".
Immutable storage and more: Sonya Duffin, data protection expert at Veritas Technologies, offers the Top 10 steps for building a multi-layer resilience profile.📖 Read
via "Threat Post".
Threat Post
Top 10 Cybersecurity Best Practices to Combat Ransomware
Immutable storage and more: Sonya Duffin, data protection expert at Veritas Technologies, offers the Top 10 steps for building a multi-layer resilience profile.
🕴 Follow the Leaders: A Blueprint for Software Security Success 🕴
📖 Read
via "Dark Reading".
Organizations can study software security leaders and emulate their habits and initiatives in order to build a successful software security program of their own.📖 Read
via "Dark Reading".
Dark Reading
Follow the Leaders: A Blueprint for Software Security Success
Organizations can study software security leaders and emulate their habits and initiatives in order to build a successful software security program of their own.
‼ CVE-2021-41972 ‼
📖 Read
via "National Vulnerability Database".
Apache Superset up to and including 1.3.1 allowed for database connections password leak for authenticated users. This information could be accessed in a non-trivial way.📖 Read
via "National Vulnerability Database".
🕴 Open Source Project Aims to Detect Living-Off-the-Land Attacks 🕴
📖 Read
via "Dark Reading".
The machine learning classifier from Adobe can determine whether system commands are malicious and classify them using a variety of tags useful for security analysts.📖 Read
via "Dark Reading".
Dark Reading
Open Source Project Aims to Detect Living-Off-the-Land Attacks
The machine learning classifier from Adobe can determine whether system commands are malicious and classify them using a variety of tags useful for security analysts.
🦿 Security researcher: Flaw in Apple Pay, Samsung Pay and Google Pay makes fraud easy for thieves 🦿
📖 Read
via "Tech Republic".
Positive Technologies expert describes vulnerability linked to apps used to pay for public transit tickets.📖 Read
via "Tech Republic".
TechRepublic
Security researcher: Flaw in Apple Pay, Samsung Pay and Google Pay makes fraud easy for thieves
Positive Technologies expert describes vulnerability linked to apps used to pay for public transit tickets.
🦿 Save an extra 15% off training in ethical hacking with this pre-Black Friday sale deal 🦿
📖 Read
via "Tech Republic".
Develop the necessary skills and use the tools to be an ethical hacker through this 120-hour comprehensive course bundle.📖 Read
via "Tech Republic".
TechRepublic
Save an extra 15% off training in ethical hacking with this pre-Black Friday sale deal
Develop the necessary skills and use the tools to be an ethical hacker through this 120-hour comprehensive course bundle.
🕴 BT to Deploy 'Epidemiological AI' Based on the Spread of Viruses in Humans to Combat Cyberattacks 🕴
📖 Read
via "Dark Reading".
Using the spread of viruses in human populations as a model to inform its AI, Inflame is a key component in BT’s recently-announced Eagle-i platform.📖 Read
via "Dark Reading".
Dark Reading
BT to Deploy 'Epidemiological AI' Based on the Spread of Viruses in Humans to Combat Cyberattacks
Using the spread of viruses in human populations as a model to inform its AI, Inflame is a key component in BT’s recently-announced Eagle-i platform.
🕴 MSPAlliance Leadership Council Forms Vendor Council to Address Managed Services Supply Chain Risk 🕴
📖 Read
via "Dark Reading".
MSP supply chain threats will be mitigated through transparency, education, business continuity planning, and managed services channel certification.📖 Read
via "Dark Reading".
Dark Reading
MSPAlliance Leadership Council Forms Vendor Council to Address Managed Services Supply Chain Risk
MSP supply chain threats will be mitigated through transparency, education, business continuity planning, and managed services channel certification.
🕴 Emerging Security Tools Tackle GraphQL Security 🕴
📖 Read
via "Dark Reading".
New security tools are proactively protecting APIs built with GraphQL, before attacks against them become more commonplace.📖 Read
via "Dark Reading".
Dark Reading
Emerging Security Tools Tackle GraphQL Security
New security tools are proactively protecting APIs built with GraphQL, before attacks against them become more commonplace.
🕴 Ankura Launches Brooklyn Cyber Center 🕴
📖 Read
via "Dark Reading".
New initiative addresses shortage of professionals and lack of diversity in cybersecurity by recruiting, training and retaining diverse talent from underrepresented backgrounds.📖 Read
via "Dark Reading".
Dark Reading
Ankura Launches Brooklyn Cyber Center
New initiative addresses shortage of professionals and lack of diversity in cybersecurity by recruiting, training and retaining diverse talent from underrepresented backgrounds.
‼ CVE-2021-3786 ‼
📖 Read
via "National Vulnerability Database".
A potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad systems could be used to leak out data out of the SMRAM range.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43610 ‼
📖 Read
via "National Vulnerability Database".
Belledonne Belle-sip before 5.0.20 can crash applications such as Linphone via an invalid From header (request URI without a parameter) in an unauthenticated SIP message, a different issue than CVE-2021-33056.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-3789 ‼
📖 Read
via "National Vulnerability Database".
An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access to obtain the encryption key used to decrypt firmware update packages.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39303 ‼
📖 Read
via "National Vulnerability Database".
The server in Jamf Pro before 10.32.0 has a vulnerability affecting integrity and availability, aka PI-006352. NOTE: Jamf Nation will also publish an article about this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-3788 ‼
📖 Read
via "National Vulnerability Database".
An exposed debug interface was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access unauthorized access to the device.📖 Read
via "National Vulnerability Database".