Pulse of Truth

An analysis of the MoH methodology, the exacerbating challenges it faces as the war continues, and estimates from independent researchers and humanitarian organisations.

A threat actor has released over 15 million email addresses associated with Trello accounts that were collected using an unsecured API in January. [...]

The knowledge gap, identified in a Linux Foundation report, comes as malicious hackers increasingly target critical vulnerabilities.

Comments

While previous Olympic games have faced cybersecurity threats, the Games of the XXXIII Olympiad, also known as Paris 2024, will see the largest number of threats, the most complex threat landscape, the largest ecosystem of threat actors, and the highest degree of ease for threat actors to execute attacks, according to IDC. To defend against these attacks and avoid significant disruptions, IDC estimates that revenue from cybersecurity services in France will increase by $94 million … More → The post Paris 2024 Olympics to face complex cyber threats appeared first on Help Net Security.

This article provides an overview of the major data breaches we covered in 2024 so far, highlighting incidents involving Trello, AnyDesk, France Travail, Nissan, MITRE, Dropbox, BBC Pension Scheme, TeamViewer, Advance Auto Parts, and AT&T. Find out what led to the breaches and how they affected the breached organizations. The information in this recap might help your organization strengthen its cybersecurity posture. Trello January 2024 In January 2024, Trello encountered an incident in which user … More → The post Major data breaches that have rocked organizations in 2024 appeared first on Help Net Security.

Mainframes are the unseen workhorses that carry the load for many services we use on a daily basis: Withdrawing money from an ATM, credit card payments, and airline reservations to name just a few of the high volume workloads that are primarily handled by mainframes. For those that like to see figures to support this … Continue reading Punch Card Hacking – Exploring a Mainframe Attack Vector →

Samuel Stolton / Bloomberg: Sources: Google offered CISPE ~€455M worth of Google cloud licenses and €14M in cash in a deal for CISPE to maintain its antitrust complaint against Microsoft  —  - Firm's deal offer aimed at continuing EU case against rival  — Cloud group CISPE eventually reached settlement with Microsoft

It’s been less than 18 months since the public introduction of ChatGPT, which gained 100 million users in less than two months. Given the hype, you would expect enterprise adoption of generative AI to be significant, but it’s been slower than many expected. A recent survey by Telstra and MIT Review showed that while 75% of enterprises tested GenAI last year, only 9% deployed it widely. The primary obstacle? Data privacy and compliance. This rings … More → The post ChatGPTriage: How can CISOs see and control employees’ AI use? appeared first on Help Net Security.

A malicious Telegram bot is the key to a veritable flourishing garden of nefarious cybercriminal activity, which was discovered via a series of Python packages.

Files available on the open source NPM repository underscore a growing sophistication.

Lawsuit: One user's IP address was identified in 4,450 infringement notices.

A while ago I already looked into Avast Secure Browser. Back then it didn’t end well for Avast: I found critical vulnerabilities allowing arbitrary websites to infect user’s computer. Worse yet: much of it was due to neglect of secure coding practices, existing security mechanisms were disabled for no good reason. I didn’t finish that investigation because I discovered that the browser was essentially spyware, collecting your browsing history and selling it via Avast’s Jumpshot subsidiary. But that was almost five years ago. After an initial phase of denial, Avast decided to apologize and to wind down Jumpshot. It was certainly a mere coincidence that Avast was subsequently sold to NortonLifeLock, called Gen Digital today. Yes, Avast is truly reformed and paying for their crimes in Europe and the US. According to the European decision, Avast is still arguing despite better knowledge that their data collection was fully anonymized and completely privacy-conformant but… well, old habits are hard to get rid of. Either way, it’s time to take a look at Avast Secure Browser again. Because… all right, because of the name. That was a truly ingenious idea to name their browser like that, nerd sniping security professionals into giving them free security audits. By now they certainly would have addressed the issues raised in my original article and made everything much more secure, right?

Hacktivists claim they have stolen 1.2 TB of data from Disney's developer Slack channels.

Authors/Presenters:Nian Xue, Yashaswi Malla, Zihang Xia, Christina Pöpper, Mathy Vanhoef Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access. Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel. Permalink The post USENIX Security ’23 – Bypassing Tunnels: Leaking VPN Client Traffic by Abusing Routing Tables appeared first on Security Boulevard.

Alderon Games, the maker of dinosaur MMO Path of Titans, says it's swapping out its Intel 13th and 14th Gen-based servers for AMD and urges others hosting the game’s servers to do the same. The developer has had “significant” instability issues that none of the fixes so far have reversed, wrote Alderon founder Matthew Cassells in a blog post last week. Cassells wrote that Alderon has recorded “thousands of crashes” on gamers’ CPUs using its crash reporting tools and says the processors can also corrupt SSDs and memory. He added that in his team’s experience, 100 percent of the affected CPUs “deteriorate over time, eventually failing.” On the contrary, Unreal Engine decompression tool maker RAD Game Tools, which Cassells cites in the...

Cryptography ain’t easy. Seemingly small details like how many times a computationally intensive loop runs can give the game away. [Lord Feistel] gives us a demo of how this could …read more

Google parent Alphabet Inc. is in advanced talks to buy cybersecurity startup Wiz in a deal that could fetch $23 billion, the Wall Street Journal reported, citing people with knowledge of the matter.

A security researcher who assisted with the deal says he believes the only copy of the complete dataset of call and text records of “nearly all” AT&T customers has been wiped—but some risks may remain.

A hacker who claims to have stolen sensitive call and text logs from AT&T Inc. said they were paid about $400,000 to erase the data trove.

Apple has approved UTM SE, an app for emulating a computer to run classic software and games, weeks after the company rejected it and barred it from being notarized for third-party app stores in the European Union. The app is now available for free for iOS, iPadOS, and visionOS. After Apple rejected the app in June, the developer said it wasn’t going to keep trying because the app was “a subpar experience.” Today, UTM thanked the AltStore team for helping it and credited another developer “whose QEMU TCTI implementation was pivotal for this JIT-less build.”

Netgear warned customers to update their devices to the latest available firmware, which patches stored cross-site scripting (XSS) and authentication bypass vulnerabilities in several WiFi 6 router models. [...]

Many organizations lack policies and training to address the risk of shadow IT, including GenAI.

Proactively stop hosting scams or face hefty fines.

Administration Continues to Shift Software Security Responsibilities to DevelopersThe Biden administration is calling on government agencies and departments to file fiscal year 2026 budget proposals that focus on defending critical infrastructure, dismantling threat actors and investing in resilient federal systems, according to a new memorandum issued this week.

A veteran investigator of video-game leaks reveals the tricks of the trade

Red team exercise revealed a score of security fails The US Cybersecurity and Infrastructure Security Agency (CISA) says a red team exercise at a certain unnamed federal agency in 2023 revealed a string of security failings that exposed its most critical assets.…

AT&T Corp. disclosed today that a new data breach has exposed phone call and text message records for roughly 110 million people -- nearly all of its customers. AT&T said it delayed disclosing the incident in response to "national security and public safety concerns," noting that some of the records included data that could be used to determine where a call was made or text message sent. AT&T also acknowledged the customer records were exposed in a cloud database that was protected only by a username and password (no multi-factor authentication needed).

A wave of coordinated DNS hijacking attacks targets decentralized finance (DeFi) cryptocurrency domains using the Squarespace registrar, redirecting visitors to phishing sites hosting wallet drainers. [...]

Six months of call and text records taken from AT&T workspace on cloud platform.

A threat actor known as CrystalRay targeted 1,500 victims since February using tools like SSH-Snake and various open-source utilities. The Sysdig Threat Research Team (TRT) first spotted the threat actor CrystalRay on February 2024 and observed it using the SSH-Snake open-source software penetration testing tool. The experts collected new evidence that revealed that the threat actor expanded its operations. […]

Based on past attacks, It wouldn’t be surprising to see active targeting this time too.

The American Radio Relay League (ARRL) finally confirmed that some of its employees' data was stolen in a May ransomware attack initially described as a "serious incident." [...]

The gang's time from initial access to draining data out of a Veeam server is shockingly fast; after which the attackers went on to deploy actual ransomware in less than a day.

A blog summarizing how Leidos addressed cybersecurtiy hiring challenges

Ultra-conservative org funnily enough not ready to turn the other cheek After claiming to break into a database belonging to The Heritage Foundation, and then leaking 2GB of files belonging to the ultra-conservative think tank, the hacktivist crew SiegedSec claims to have disbanded. …

The third major data leak from top-selling spyware mSpy in a decade includes more than 5 million helpdesk support tickets from parent company Brainstack.

Sean Lyngaas / CNN: Sources: US car dealership software provider CDK Global appears to have paid ~$25M to hackers on June 21, after a ransomware attack shut down its systems  —  CDK Global, a software firm serving car dealerships across the US that was roiled by a cyberattack last month, appears to have paid …

Most organizations focus on securing routers, servers, firewalls, and other endpoints, but threats can also arise from unfamiliar sources such as third-party networks, which can be used by hackers to attack an organization. Through a strong TPRM framework, companies gain insights into the risk profiles of their partners, thus safeguarding operations. An effective third-party risk management framework ensures that an organization is not derailed by vendor risks and vulnerabilities. It protects assets, ensures compliance with … More → The post How to design a third-party risk management framework appeared first on Help Net Security.

Newly discovered flaw affects OpenSSH 8.7 and 8.8 daemon The founder of Openwall has discovered a new signal handler race condition in the core sshd daemon used in RHEL 9.x and its various offshoots.…

Signal is finally tightening its desktop client's security by changing how it stores plain text encryption keys for the data store after downplaying the issue since 2018. [...]

Multiple threat actors exploit a recently disclosed security PHP flaw CVE-2024-4577 to deliver multiple malware families. The Akamai Security Intelligence Response Team (SIRT) warns that multiple threat actors are exploiting the PHP vulnerability CVE-2024-4577 to deliver multiple malware families, including Gh0st RAT, RedTail cryptominers, and XMRig. “Threat actors continued the speedy-time-from-disclosure-to-exploitation trend and were quick […]

Threat actors have been observed publishing a new wave of malicious packages to the NuGet package manager as part of an ongoing campaign that began in August 2023, while also adding a new layer of stealth to evade detection. The fresh packages, about 60 in number and spanning 290 versions, demonstrate a refined approach from the previous set that came to light in October 2023, software supply

Not a lot of details: Apple has issued a new round of threat notifications to iPhone users across 98 countries, warning them of potential mercenary spyware attacks. It’s the second such alert campaign from the company this year, following a similar notification sent to users in 92 nations in April.

Passwords have been the cornerstone of basic cybersecurity hygiene for decades. Related: Passwordless workpace long way off However, as users engage with more applications across multiple devices, the digital security landscape is shifting from passwords and password managers towards including … (more…) The post GUEST ESSAY: How cybercriminals are using ‘infostealers’ to sidestep passwordless authentication first appeared on The Last Watchdog.

LockBit variant targets backup software - which you may remember is supposed to help you recover from ransomware Yet another new ransomware gang, this one dubbed EstateRansomware, is exploiting a Veeam vulnerability that was patched more than a year ago to drop file-encrypting malware, a LockBit variant, and extort payments from victims.…

Japan's Computer Emergency Response Team Coordination Center (JPCERT/CC) is warning that Japanese organizations are being targeted in attacks by the North Korean 'Kimsuky' threat actors. [...]

Jay Jacobs and I recently delivered an RSA presentation called Quantifying the Probability of Flaws in Open Source. Since many people didn’t get a chance to see it, I thought I’d summarize some of the findings here for posterity. The question we investigated was simple, at least conceptually: what are the red flags of an open-source repository? Are there characteristics of a given open source library that would reliably indicate it was safer than others? Knowing that 79% of the time, developers never update third-party libraries once introducing them to a codebase, a data-driven methodology for selecting trustworthy libraries could certainly have value. Looking at OWASP's Top 10 OSS Risks as a starting point, you can quickly observe that many of the risk factors – unmaintained software, outdated software, untracked dependencies, under/over-sized dependencies – are really only problems if there’s an actual vulnerability. Therefore, by focusing our lens on known…

GitLab warned today that a critical vulnerability in its product's GitLab Community and Enterprise editions allows attackers to run pipeline jobs as any other user. [...]