What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2024-02-14 18:56:00 | Ubuntu \\ 'Command-Not-Found \\' L'outil pourrait inciter les utilisateurs à installer des packages Rogue Ubuntu \\'command-not-found\\' Tool Could Trick Users into Installing Rogue Packages (lien direct) |
Les chercheurs en cybersécurité ont constaté qu'il était possible pour les acteurs de menace d'exploiter un utilitaire bien connu appelé Command-Not-Found pour recommander leurs propres packages voyous et compromis les systèmes exécutant un système d'exploitation Ubuntu.
"Alors que \\ 'Command-Not-Found \' sert d'outil pratique pour suggérer des installations pour les commandes désinstallées, il peut être manipulé par inadvertance par les attaquants à travers le
Cybersecurity researchers have found that it\'s possible for threat actors to exploit a well-known utility called command-not-found to recommend their own rogue packages and compromise systems running Ubuntu operating system. "While \'command-not-found\' serves as a convenient tool for suggesting installations for uninstalled commands, it can be inadvertently manipulated by attackers through the |
Tool Threat | ★★★ | |
 |
2024-02-14 18:15:00 | Riding Dragons: Capa harcèles Ghidra Riding Dragons: capa Harnesses Ghidra (lien direct) |
capa est l'équipe Flare \\ 's ouverteoutil source qui détecte les capacités dans les fichiers exécutables. ghidra est un cadre d'ingénierie de logiciel open source créé et entretenu par leDirection de la recherche de l'Agence de sécurité nationale.Avec le version de capa v7 , nous avons intégré CAPAavec Ghidra, apportant directement les capacités de détection de Capa \\ à l'interface utilisateur de Ghidra \\.Avec cette intégration, nous espérons avoir un impact positif sur les workflows de la grande base d'utilisateurs de Ghidra \\ en aidant les utilisateurs de Ghidra à identifier rapidement le code qui suggère un comportement intéressant.Nous sommes ravis de partager ce travail avec le
capa is the FLARE team\'s open source tool that detects capabilities in executable files. Ghidra is an open source software reverse engineering framework created and maintained by the National Security Agency Research Directorate. With the release of capa v7, we have integrated capa with Ghidra, bringing capa\'s detection capabilities directly to Ghidra\'s user interface. With this integration, we hope to positively impact the workflows of Ghidra\'s large user base by helping Ghidra users quickly identify code that suggests an interesting behavior. We are excited to share this work with the |
Tool | ★★ | |
 |
2024-02-14 15:29:42 | CrowdStrike a nommé le seul client \\ 'Choice: 2024 Gartner & Reg;«Voix du client» pour l'évaluation de la vulnérabilité CrowdStrike Named the Only Customers\\' Choice: 2024 Gartner® “Voice of the Customer” for Vulnerability Assessment (lien direct) |
C'est un refrain courant dans les cercles de sécurité qui & # 8220; personne n'aime leur outil de gestion de vulnérabilité. & # 8221;Crowdsstrike a peut-être été l'exception.Nous sommes fiers d'annoncer que CrowdStrike est le seul fournisseur nommé un choix de clients dans le rapport 2024 Gartner «Voice of the Client» pour l'évaluation de la vulnérabilité.Dans ce rapport, Crowdsstrike [& # 8230;]
It is a common refrain in security circles that “nobody loves their vulnerability management tool.” CrowdStrike may have just proved to be the exception. We are proud to announce that CrowdStrike is the only vendor named a Customers\' Choice in the 2024 Gartner “Voice of the Customer” Report for Vulnerability Assessment. In this report, CrowdStrike […] |
Tool Vulnerability | ★★ | |
 |
2024-02-14 11:00:14 | Ubuntu \\ 'Command-Not-Found \\' L'outil peut être maltraité pour répandre les logiciels malveillants Ubuntu \\'command-not-found\\' tool can be abused to spread malware (lien direct) |
Un défaut logique entre le système de suggestions de package Ubuntu \\ 'S \' Command-Not-Found et le référentiel de package SNAP pourrait permettre aux attaquants de promouvoir des packages Linux malveillants aux utilisateurs sans méfiance.[...]
A logic flaw between Ubuntu\'s \'command-not-found\' package suggestion system and the snap package repository could enable attackers to promote malicious Linux packages to unsuspecting users. [...] |
Malware Tool Vulnerability | ★★★ | |
 |
2024-02-14 08:18:09 | Comment fonctionne l'agent de point final de Sekoia How Sekoia Endpoint Agent works (lien direct) |
> Selon Global Cybersecurity Outlook 2024 par le WEF, 29% des organisations ont déclaré avoir été considérablement affectée par un cyber-incident au cours des 12 derniers mois.En raison des risques croissants et de la surface d'attaque élargie, les entreprises cherchent à établir des stratégies de cyber-résilience fiables et à identifier rapidement les vecteurs d'attaque.Les bons outils pour collecter et analyser [& # 8230;] la publication Suivante Comment fonctionne l'agent de terminaison de Sekoia est un article de | Tool | ★★ | |
 |
2024-02-13 15:21:51 | Islamique à but non lucratif infiltré pendant 3 ans avec une porte dérobée silencieuse Islamic Nonprofit Infiltrated for 3 Years With Silent Backdoor (lien direct) |
L'organisme de bienfaisance en Arabie saoudite était sous surveillance avec l'outil de proxy inversé modifié, ont découvert les chercheurs.
Saudi Arabia charity was under surveillance with the modified reverse proxy tool, researchers discovered. |
Tool | ★★★ | |
 |
2024-02-13 11:00:00 | API et automatisation: le bien, le mauvais et le mieux APIs and automation: The good, the bad, and the better (lien direct) |
The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. APIs are often adopted by businesses as a way to automate certain operational tasks. This not only helps to introduce efficiencies, it also reduces the chance of human error in repetitive, manual actions. But the relationship between APIs and automation doesn’t end there. To streamline the API management process, developers have started automating a variety of tasks in the API lifecycle, from development to production. In this article, we explore where these automations live, how they impact the development process, and what teams need to look out for. What is API automation? API automation is the process of automating a variety of tasks associated with designing, building, deploying, testing, and managing APIs. This automated approach lets developers navigate the API lifecycle by using controlled streamlined processes for repetitive, manual tasks. This enables greater consistency throughout the lifecycle, and can improve the success and reliability of functions like testing (both in development and production) and security. In addition, introducing automation also enables more efficiency in the process, allowing developers to focus more of their efforts on more strategic tasks. While not all tasks related to APIs can be automated, there are a variety that lend themselves to it quite nicely. These include: API documentation: Some tools can automatically generate API documentation based on the code base. Code generation: Other tools can automatically create code snippets, using API documentation and specifications as inputs. Versioning: Automated processes can facilitate the management of multiple API versions, ensuring that new changes don’t break anything. Deployment: Introducing automation into the API deployment process can introduce more consistency and reduce the scope of potential errors. | Tool Vulnerability | ★★★ | |
 |
2024-02-13 03:52:20 | Malware de revanche de vengeance sans fichier Fileless Revenge RAT Malware (lien direct) |
Ahnlab Security Intelligence Center (ASEC) a récemment découvert la distribution des logiciels malveillants de Revenge Rat qui avaient été développés en fonction deOutils légitimes.Il semble que les attaquants aient utilisé des outils tels que & # 8216; SMTP-Validator & # 8217;et & # 8216; e-mail à SMS & # 8217;.Au moment de l'exécution, le logiciel malveillant crée et exécute à la fois un outil légitime et un fichier malveillant, ce qui rend difficile pour les utilisateurs de réaliser qu'une activité malveillante s'est produite.Comme indiqué dans le code ci-dessous, l'acteur de menace crée et exécute setup.exe ...
AhnLab SEcurity intelligence Center (ASEC) recently discovered the distribution of Revenge RAT malware that had been developed based on legitimate tools. It appears that the attackers have used tools such as ‘smtp-validator’ and ‘Email To Sms’. At the time of execution, the malware creates and runs both a legitimate tool and a malicious file, making it difficult for users to realize that a malicious activity has occurred. As shown in the code below, the threat actor creates and runs Setup.exe... |
Malware Tool Threat | ★★ | |
|
2024-02-12 18:42:00 | Rhysida ransomware fissué, outil de décryptage gratuit publié Rhysida Ransomware Cracked, Free Decryption Tool Released (lien direct) |
Les chercheurs en cybersécurité ont découvert une "vulnérabilité de mise en œuvre" qui a permis de reconstruire les clés de chiffrement et de décrypter les données verrouillées par le ransomware Rhysida.
Les résultats ont été publiés la semaine dernière par un groupe de chercheurs de l'Université de Kookmin et de la Corée Internet and Security Agency (KISA).
"Grâce à une analyse complète des ransomwares de Rhysida, nous avons identifié un
Cybersecurity researchers have uncovered an "implementation vulnerability" that has made it possible to reconstruct encryption keys and decrypt data locked by Rhysida ransomware. The findings were published last week by a group of researchers from Kookmin University and the Korea Internet and Security Agency (KISA). "Through a comprehensive analysis of Rhysida Ransomware, we identified an |
Ransomware Tool | ★★★ | |
|
2024-02-12 15:30:00 | Pourquoi les identités compromises sont-elles le cauchemar à la vitesse et à l'efficacité IR? Why Are Compromised Identities the Nightmare to IR Speed and Efficiency? (lien direct) |
La réponse aux incidents (IR) est une course contre le temps.Vous engagez votre équipe interne ou externe car il y a suffisamment de preuves que quelque chose de mauvais se produit, mais vous êtes toujours aveugle à la portée, à l'impact et à la cause profonde.L'ensemble commun d'outils et de pratiques IR offre aux équipes IR la possibilité de découvrir des fichiers malveillants et des connexions réseau sortantes.Cependant, l'aspect de l'identité - à savoir
Incident response (IR) is a race against time. You engage your internal or external team because there\'s enough evidence that something bad is happening, but you\'re still blind to the scope, the impact, and the root cause. The common set of IR tools and practices provides IR teams with the ability to discover malicious files and outbound network connections. However, the identity aspect - namely |
Tool | ★★★ | |
 |
2024-02-12 08:02:39 | 4 étapes pour empêcher le compromis des e-mails des fournisseurs dans votre chaîne d'approvisionnement 4 Steps to Prevent Vendor Email Compromise in Your Supply Chain (lien direct) |
Supply chains have become a focal point for cyberattacks in a world where business ecosystems are increasingly connected. Email threats are a significant risk factor, as threat actors are keen to use compromised email accounts to their advantage. Every month, a staggering 80% of Proofpoint customers face attacks that originate from compromised vendor, third-party or supplier email accounts. Known as supplier account compromise, or vendor email compromise, these attacks involve threat actors infiltrating business communications between trusted partners so that they can launch internal and external attacks. Their ultimate goal might be to steal money, steal data, distribute malware or simply cause havoc. In this blog post, we\'ll explain how vendor emails are compromised and how you can stop these attacks. Finally, we\'ll tell you how Proofpoint can help. What\'s at stake Supply chain compromise attacks can be costly for businesses. IBM, in its latest Cost of a Data Breach Report, says that the average total cost of a cyberattack that involves supply chain compromise is $4.76 million. That is almost 12% higher than the cost of an incident that doesn\'t involve the supply chain. In addition to the financial implications, compromised accounts can lead to: Phishing scams that result in even more compromised accounts Reputational and brand damage Complex legal liabilities between business partners How does vendor email compromise occur? Supply chain compromise attacks are highly targeted. They can stretch out over several months. And typically, they are structured as a multistep process. The bad actor initiates the assault by gaining access to the email account of a vendor or supplier through various means. Phishing attacks are one example. Once the attacker gains access, they will lay low for an extended period to observe the vendor\'s email communications. During this time, the adversary will study the language and context of messages so that they can blend in well and avoid detection. Attackers might also use this observation period to establish persistence. They will create mail rules and infrastructure so that they can continue to receive and send messages even after the vendor has regained control of the account. Once they establish access and persistence, the attackers will begin to insert themselves into conversations within the supplier\'s company as well as with external partners and customers. By posing as the sender, the attacker takes advantage of established trust between parties to increase their chances of success. Overview of a vendor email compromise attack. Proofpoint has observed a growing trend of attackers targeting accounts within smaller businesses and using them to gain entry into larger companies. Threat actors often assume that small businesses have less protection than large companies. They see them as targets that can help them achieve a bigger payday. How to stop vendor email compromise If you want to defend against these attacks, it\'s critical to understand the methods behind them. Such a formidable problem requires a strategic and multilayered solution. The four broad steps below can help. Step 1: Know your suppliers Your first line of defense against these email attacks sounds simple, but it\'s challenging. It is the ability to intimately “know your supplier” and understand their security strategy. This requires more than a one-time vendor assessment. Your security teams will need to prioritize continuous monitoring of your company\'s business partnerships. On top of that knowledge, you need a thorough understanding of the access and privileges that your business grants to each vendor. Compromised accounts that have uncontrolled access may be able to exfiltrate sensitive data or upload malware like ransomware. So, when you know what your suppliers can (and can\'t) access, you can identify a data breach faster. Other steps, like requiring multifactor authentication (MFA) for vendor accounts, can | Ransomware Data Breach Malware Tool Threat Studies Prediction Cloud | ★★★ | |
|
2024-02-12 07:37:05 | Alerte communautaire: campagne malveillante en cours impactant les environnements cloud Azure Community Alert: Ongoing Malicious Campaign Impacting Azure Cloud Environments (lien direct) |
Over the past weeks, Proofpoint researchers have been monitoring an ongoing cloud account takeover campaign impacting dozens of Microsoft Azure environments and compromising hundreds of user accounts, including senior executives. This post serves as a community warning regarding the attack and offers suggestions that affected organizations can implement to protect themselves from it. What are we seeing? In late November 2023, Proofpoint researchers detected a new malicious campaign, integrating credential phishing and cloud account takeover (ATO) techniques. As part of this campaign, which is still active, threat actors target users with individualized phishing lures within shared documents. For example, some weaponized documents include embedded links to “View document” which, in turn, redirect users to a malicious phishing webpage upon clicking the URL. Threat actors seemingly direct their focus toward a wide range of individuals holding diverse titles across different organizations, impacting hundreds of users globally. The affected user base encompasses a wide spectrum of positions, with frequent targets including Sales Directors, Account Managers, and Finance Managers. Individuals holding executive positions such as “Vice President, Operations”, "Chief Financial Officer & Treasurer" and "President & CEO" were also among those targeted. The varied selection of targeted roles indicates a practical strategy by threat actors, aiming to compromise accounts with various levels of access to valuable resources and responsibilities across organizational functions. Following the attack\'s behavioral patterns and techniques, our threat analysts identified specific indicators of compromise (IOCs) associated with this campaign. Namely, the use of a specific Linux user-agent utilized by attackers during the access phase of the attack chain: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Attackers predominantly utilize this user-agent to access the \'OfficeHome\' sign-in application along with unauthorized access to additional native Microsoft365 apps, such as: \'Office365 Shell WCSS-Client\' (indicative of browser access to Office365 applications) \'Office 365 Exchange Online\' (indicative of post-compromise mailbox abuse, data exfiltration and email threats proliferation) \'My Signins\' (used by attackers for MFA manipulation; for more info about this technique, see our recent Cybersecurity Stop of the Month blog) \'My Apps\' \'My Profile\' Post compromise risks Successful initial access often leads to a sequence of unauthorized post-compromise activities, including: MFA manipulation. Attackers register their own MFA methods to maintain persistent access. We have observed attackers choosing different authentication methods, including the registration of alternative phone numbers for authentication via SMS or phone call. However, in most MFA manipulation instances, attackers preferred to add an authenticator app with notification and code. Examples of MFA manipulation events, executed by attackers in a compromised cloud tenant. Data exfiltration. Attackers access and download sensitive files, including financial assets, internal security protocols, and user credentials. Internal and external phishing. Mailbox access is leveraged to conduct lateral movement within impacted organizations and to target specific user accounts with personalized phishing threats. Financial fraud. In an effort to perpetrate financial fraud, internal email messages are dispatched to target Human Resources and Financial departments within affected organizations. Mailbox rules. Attackers create dedicated obfuscation rules, intended to cover their tracks and erase all evidence of malicious activity from victims\' mailboxes. Examples of obfuscation mailbox rules created by attackers following successful account takeover. Operational infrastructure Our forensic analysis of the attack has surfaced several proxies, | Malware Tool Threat Cloud | ★★★ | |
|
2024-02-09 17:09:20 | Un guide détaillé sur Ligolo-NG A Detailed Guide on Ligolo-Ng (lien direct) |
Ce guide complet plonge dans les subtilités du mouvement latéral utilisant Ligolo-NG, un outil développé par Nicolas Chatelain.L'outil Ligolo-NG facilite la création de
This comprehensive guide delves into the intricacies of Lateral Movement utilizing Ligolo-Ng, a tool developed by Nicolas Chatelain. The Ligolo-Ng tool facilitates the establishment of |
Tool | ★★ | |
|
2024-02-09 06:00:24 | Offensif et défensif: renforcer la sensibilisation à la sécurité avec deux approches d'apprentissage puissantes Offensive and Defensive: Build Security Awareness with Two Powerful Learning Approaches (lien direct) |
“Offensive” security awareness and “defensive” security awareness are two learning approaches that you can use to build a robust security culture in your company. They involve applying different strategies to educate your employees about threats and how they can respond to them safely. You may have heard the terms “offensive cybersecurity” and “defensive cybersecurity.” You use defensive tools and techniques to strengthen security vulnerabilities. And with offensive tools and techniques, you focus on identifying those vulnerabilities before attackers find them first. How do defensive and offensive approaches apply to security awareness? Here\'s a quick overview: With a defensive approach, users learn the fundamentals of security. With an offensive approach, users learn how to protect themselves and the business against future threats. Let\'s use a sports analogy here. You can actively learn to be a defensive goalie and block threats. Then, you can take your skills up a level and learn to score points with protective techniques. With Proofpoint Security Awareness, our industry-leading threat intelligence informs both approaches. We help people learn how to defend against current threats. And we give them the tools for taking offensive action against future threats. Live-action series about Insider Threats. (play video) Defensive security awareness: set the foundation We all have to start with the basics, right? With defensive security awareness, you teach people the fundamentals of security and set the stage for safe behavior. This training is often reactive. It enables people to respond to immediate threats and incidents as they arise. At Proofpoint, we believe in using behavioral science methodologies, like adaptive learning and contextual nudges. We combine this with a threat-driven approach, weaving trend analysis and insights about recent security breaches into our training. A personalized adaptive framework The adaptive learning framework is a personalized defensive approach to training. It recognizes that everyone learns differently; it is the opposite of a one-size-fits-all approach. You can teach security fundamentals in a way that is meaningful for each person based on what they know, what they might do and what they believe. This framework lets you drive behavior change with education that is tailored to each person\'s needs. That can include their professional role, industry, content style and native language. The learner can engage with a wide variety of styles and materials. And each training is tied to a specific learning objective. Adaptive learning recognizes that people learn best in short bursts that are spread over time. Our microlearning video modules are under three minutes, and our nano-learning videos are under one minute. These formats give people the flexibility to learn at their own pace. For instance, our “You\'re Now a Little Wiser” nano series offers bite-size training on topics such as data protection to help users learn about specific threats. Screenshots from a one-minute nano-learning video. Contextual nudges and positive reinforcement Training is essential if you want to build a robust security culture. But it is not enough to change behavior fully. Here is where contextual nudges play a vital role in helping to reinforce positive behavior habits once they are formed. These deliberate interventions are designed to shape how people behave. Nudges are rooted in a deep understanding of human behavior. They can move people toward making better decisions, often without them realizing it. They are gentle reminders that can guide people toward creating optimal outcomes. That, in turn, helps to foster a defensive security-conscious culture in your company. It is important to find the respectful balance of nudging people toward secure behaviors without being too intrusive or complex. For example, when a user fails a phishing simulation exercise, Proofpoint Security Awareness offers “Tea | Ransomware Malware Tool Vulnerability Threat Prediction | ★★★ | |
|
2024-02-08 21:14:16 | \\ 'coyote \\' Le malware commence sa chasse, s'attaquant à 61 applications bancaires \\'Coyote\\' Malware Begins Its Hunt, Preying on 61 Banking Apps (lien direct) |
Le Brésil, le Center for Banking Trojan malware du monde, a produit l'un de ses outils les plus avancés à ce jour.Et comme le montre l'histoire, Coyote pourrait bientôt étendre son territoire.
Brazil, the world\'s center for banking Trojan malware, has produced one of its most advanced tools yet. And as history shows, Coyote may soon expand its territory. |
Malware Tool | ★★★ | |
 |
2024-02-08 20:42:07 | The Nine Lives of Commando Cat: Analyser une nouvelle campagne de logiciels malveillants ciblant Docker The Nine Lives of Commando Cat: Analysing a Novel Malware Campaign Targeting Docker (lien direct) |
#### Description
Les chercheurs de CADO ont découvert une nouvelle campagne de logiciels malveillants appelée "Commando Cat" qui cible les points de terminaison API Docker exposés.La campagne est une campagne de cryptojacking qui exploite Docker comme vecteur d'accès initial et monte le système de fichiers de l'hôte \\ avant d'exécuter une série de charges utiles interdépendantes directement sur l'hôte.Les charges utiles sont livrées aux instances API Docker exposées sur Internet.
L'attaquant demande à Docker de baisser une image Docker appelée cmd.cat/chattr.Le projet CMD.cat "génère des images Docker à la demande avec toutes les commandes dont vous avez besoin et les pointer simplement par nom dans la commande docker run."Il est probablement utilisé par l'attaquant pour ressembler à un outil bénin et non à susciter des soupçons.
L'attaquant crée ensuite le conteneur avec une commande personnalisée à exécuter.L'objectif principal de la charge utile user.sh est de créer une porte dérobée dans le système en ajoutant une clé SSH au compte racine, ainsi qu'en ajoutant un utilisateur avec un mot de passe connu de l'attaquant.Le script tshd.sh est responsable du déploiement de Tinyshell (TSH), une porte dérobée Unix open source écrite en C. Le script GSC.Sh est responsable du déploiement d'une porte dérobée appelée GS-Netcat, une version gonflée de Netcat qui peut perforerà travers Nat et les pare-feu.Le script AWS.SH est un créneau d'identification qui tire des informations d'identification à partir d'un certain nombre de fichiers sur le disque, ainsi que des IMD et des variables d'environnement.La charge utile finale est livrée en tant que script codé de base64 plutôt que dans la méthode traditionnelle de Curl-Into-bash utilisée précédemment par le malware.Cette base64 est repris dans Base64 -D, puis a tué dans le bash.
#### URL de référence (s)
1. https://www.cadosecurity.com/the-nine-lives-of-commando-cat-analysing-a-novel-malware-campaign-targeting-docker/
#### Date de publication
1er février 2024
#### Auteurs)
Nate Bill
Matt Muir
#### Description Cado researchers have discovered a new malware campaign called "Commando Cat" that targets exposed Docker API endpoints. The campaign is a cryptojacking campaign that leverages Docker as an initial access vector and mounts the host\'s filesystem before running a series of interdependent payloads directly on the host. The payloads are delivered to exposed Docker API instances over the internet. The attacker instructs Docker to pull down a Docker image called cmd.cat/chattr. The cmd.cat project "generates Docker images on-demand with all the commands you need and simply point them by name in the docker run command." It is likely used by the attacker to seem like a benign tool and not arouse suspicion. The attacker then creates the container with a custom command to execute. The primary purpose of the user.sh payload is to create a backdoor in the system by adding an SSH key to the root account, as well as adding a user with an attacker-known password. The tshd.sh script is responsible for deploying TinyShell (tsh), an open-source Unix backdoor written in C. The gsc.sh script is responsible for deploying a backdoor called gs-netcat, a souped-up version of netcat that can punch through NAT and firewalls. The aws.sh script is a credential grabber that pulls credentials from a number of files on disk, as well as IMDS, and environment variables. The final payload is delivered as a base64 encoded script rather than in the traditional curl-into-bash method used previously by the malware. This base64 is echoed into base64 -d, and then piped into bash. #### Reference URL(s) 1. https://www.cadosecurity.com/the-nine-lives-of-commando-cat-analysing-a-novel-malware-campaign-targeting-docker/ #### Publication Date February 1, 2024 #### Author(s) Nate Bill Matt Muir |
Malware Tool | ★★★ | |
 |
2024-02-08 08:06:33 | La surtension des attaques de «swap de visage» profonds met en danger la vérification de l'identité à distance Surge in deepfake "Face Swap" attacks puts remote identity verification at risk (lien direct) |
De nouvelles recherches montrent une augmentation de 704% des attaques de profondeur "Swap" de la première à la seconde moitié de 2023. Un rapport de la société biométrique Iproov avertit que les fraudeurs "aléatoire" utilisent de plus en plus des outils standard pour créer des manipulations manipuléesimages et vidéos.Les analystes d'Iproov \\ suivent plus de 100 applications et référentiels d'échanges de visage, ce qui signifie qu'il existe une large sélection d'outils d'IA génératifs à faible coût, facilement accessiblesun test "vivante".Un test "Lively" sera généralement ...
New research shows a 704% increase in deepfake "face swap" attacks from the first to the second half of 2023. A report from biometric firm iProov warns that "face-swapping" fraudsters are increasingly using off-the-shelf tools to create manipulated images and videos. iProov\'s analysts are tracking over 100 face swap apps and repositories, meaning that there is a wide selection of low-cost, easily accessible generative AI tools that can create highly convincing deepfakes to trick humans and some remote identity verification solutions that do a "liveness" test. A "liveness" test will typically... |
Tool | ★★ | |
 |
2024-02-08 00:00:33 | Les propriétaires d'iPhone ciblés par des pirates gouvernementaux, explique Google iPhone Owners Targeted By Government Hackers, Says Google (lien direct) |
Le groupe d'analyse des menaces de Google (TAG) de a révélé mardi que les pirates gouvernementaux ciblaient les utilisateurs d'iPhone avec des vulnérabilités zéro jour, en particulier celles considérées comme des utilisateurs «à haut risque», tels que des journalistes, des défenseurs des droits de l'homme, des dissidents etPoliticiens du parti d'opposition.
Mardi, Google a publié «Achat Spinging», un rapport approfondi détaillant les fournisseurs de surveillance commerciale (CSV).Dans le rapport, le géant de la recherche a appelé les États-Unis et d'autres gouvernements à prendre des mesures plus strictes contre les ventes de logiciels espions et l'utilisation abusive des outils de surveillance.
«Ces capacités ont augmenté la demande de technologie des logiciels espions, faisant la place à une industrie lucrative utilisée aux gouvernements et aux acteurs néfastes la possibilité d'exploiter les vulnérabilités dans les appareils de consommation», indique le rapport de balise
«Bien que l'utilisation de logiciels espions affecte généralement un petit nombre de cibles humaines à la fois, ses ondulations plus larges à travers la société en contribuant à des menaces croissantes à la liberté d'expression, à la presse libre et à l'intégrité des élections dans le monde.»
La balise de Google \\, l'équipe de la société qui examine le piratage soutenu par la nation, dans son rapport détaillé comment il suit activement environ 40 CSV de différents niveaux de sophistication et d'exposition publique, qui sont développés, vendus, vendus,et les logiciels espions déployés.
Il fait également la lumière sur plusieurs cyber campagnes dirigées par le gouvernement qui ont utilisé des outils de piratage développés par des vendeurs de logiciels espions et d'exploits, notamment Variston basé à Barcelone, une start-up de la technologie de surveillance et de piratage.
Dans l'une des campagnes, selon Google, les agents du gouvernement ont profité de trois vulnérabilités non identifiées d'iPhone «zéro-jours» qui n'étaient pas connues à Apple à l'époque pour exploiter le système d'exploitation iPhone du géant de Cupertino \\.Le logiciel espion en question, développé par Variston, a été analysé deux fois par Google en 2022 et 2023, indiquant que l'éminence croissante de la société dans le secteur des technologies de surveillance.
Google a déclaré avoir découvert le client Variston inconnu utilisant ces zéro-jours pour cibler les iPhones en Indonésie en mars 2023. Les pirates ont livré un SMS contenant un lien malveillant infectant le téléphone de la cible \\ avec des logiciels espions, puis en redirigeantLa victime d'un article de presse du journal indonésien Pikiran Rakyat.Dans ce cas, Google n'a pas révélé l'identité du client du gouvernement de Variston.
La société a spécifiquement appelé certains CSV, notamment la société israélienne NSO qui a développé les logiciels espions notoires de Pegasus, qui est devenu une menace mondiale pour les défenseurs des droits de l'homme et des droits de l'homme.Les autres sociétés nommées dans le rapport qui développent des logiciels espions comprennent les entreprises italiennes Cy4gate et RCS Labs, la société grecque Intellexa et la société italienne relativement récente Negg Group et Spain \'s Variston.
«Nous espérons que ce rapport servira d'appel à l'action.Tant qu'il y aura une demande des gouvernements pour acheter une technologie de surveillance commerciale, les CSV continueront de développer et de vendre des logiciels espions », indique le rapport de balise
«Nous pensons qu'il est temps que le gouvernement, l'industrie et la société civile se réunissent pour changer la structure incitative qui a permis à ces technologies de se propager si largement», a ajouté le groupe.
Google\'s Threat Analysis Group (TAG) on Tuesday revealed that government hackers ta |
Tool Vulnerability Threat Mobile Commercial | ★★★ | |
|
2024-02-07 15:15:00 | Les géants mondiaux de la coalition et de la technologie s'unissent contre la maltraitance commerciale des logiciels espions Global Coalition and Tech Giants Unite Against Commercial Spyware Abuse (lien direct) |
Une coalition de dizaines de pays, dont la France, le Royaume-Uni, et les États-Unis, ainsi que des sociétés technologiques telles que Google, MDEC, Meta et Microsoft, ont signé un accord conjoint pour limiter l'abus de logiciels espions commerciaux pour commettre des violations des droits de l'homme.
L'initiative, surnommée le processus & nbsp; Pall Mall, vise à lutter contre la prolifération et l'utilisation irresponsable d'outils de cyber-intrusion commerciaux par
A coalition of dozens of countries, including France, the U.K., and the U.S., along with tech companies such as Google, MDSec, Meta, and Microsoft, have signed a joint agreement to curb the abuse of commercial spyware to commit human rights abuses. The initiative, dubbed the Pall Mall Process, aims to tackle the proliferation and irresponsible use of commercial cyber intrusion tools by |
Tool Commercial | ★★ | |
|
2024-02-07 11:00:00 | L'art secret de la stéganographie The Covert Art of Steganography (lien direct) |
The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. In cybersecurity, where information is both an asset and a potential target, various techniques are used to secure data and communications. One such covert art is steganography, which hides information within seemingly innocuous files to avoid detection. This article dives into the fascinating world of steganography, its history, techniques, and applications in the digital age. Understanding steganography Steganography, derived from the Greek words "steganos" (meaning covered) and "graphy" (meaning writing), is the art of concealing information within other data in a way that is not easily noticeable. Unlike cryptography, which seeks to make information unreadable, steganography aims to hide the existence of the information itself. Historical roots Steganography can be traced back to ancient times when people sought secure means of communication. Tattooing messages on shaved heads was one of the earliest recorded uses, allowing messengers to transmit information undetected. Another historical example is using invisible ink to write hidden messages during wartime. Digital steganography Steganography has evolved into a sophisticated practice in the digital age, utilizing the vast amounts of data exchanged on the internet. Digital steganography is the process of hiding information within digital media, such as images, audio files, and even executable files. The goal is to render the hidden data invisible to both human observers and automated tools. Digital steganography techniques Image steganography: | Tool Threat | ★★ | |
 |
2024-02-07 10:23:12 | Mindgard a lancé le laboratoire de sécurité de MindGuard \\ Mindgard launched Mindguard\\'s AI Security Lab (lien direct) |
L'outil gratuit de Mindgard \\ soulève le couvercle sur des cyber-risques AI inconnus et non détectés
• Les laboratoires de sécurité AI de Mindgard \\ automatisent les tests de sécurité de l'IA et les évaluations des menaces actuellement non détectées par les organisations en raison du manque de compétences, de temps et d'argent
• Au coût zéro, AI Security Labs permet les évaluations de cybersécurité d'une gamme d'attaques contre l'IA, les LLM et Genai.
• Démontre les risques potentiels de sécurité de l'IA que l'IA présente à une organisation
• Aide les ingénieurs à en savoir plus sur la sécurité de l'IA
-
rapports spéciaux
Mindgard\'s free tool lifts the lid on unknown and undetected AI cyber risks • Mindgard\'s AI Security Labs automates AI security testing and threat assessments currently being undetected by organisations due to lack of skills, time and money • At zero cost, AI Security Labs enables cyber security assessments of a range of attacks against AI, LLMs, and GenAI. • Demonstrates the potential AI security risks that AI presents to an organisation • Assists engineers to learn more about AI security - Special Reports |
Tool Threat | ★★ | |
|
2024-02-07 05:00:39 | Arrêt de cybersécurité du mois: prévenir le compromis de la chaîne d'approvisionnement Cybersecurity Stop of the Month: Preventing Supply Chain Compromise (lien direct) |
This blog post is part of a monthly series, Cybersecurity Stop of the Month, which explores the ever-evolving tactics of today\'s cybercriminals. It focuses on the critical first three steps in the attack chain in the context of email threats. Its goal is to help you understand how to fortify your defenses to protect people and defend data against emerging threats in today\'s dynamic threat landscape. The critical first three steps of the attack chain: reconnaissance, initial compromise and persistence. So far in this series, we have examined these types of attacks: Business email compromise (BEC) and supply chain attacks EvilProxy SocGholish eSignature phishing QR code phishing Telephone-oriented attack delivery (TOAD) Payroll diversion MFA manipulation In this post, we look at supply chain compromise, which is a form of BEC. Supply chain compromise is not a new form of BEC, but we are seeing a rise in these attacks. The example in this blog post is one that Proofpoint recently detected. A law firm with 2,000 users was the intended target. In our discussion, we cover the typical attack sequence of a supply chain compromise to help you understand how it unfolds. And we explain how Proofpoint uses multiple signals to detect and prevent these threats for our customers. Background Supply chain attacks are growing in popularity and sophistication at a rapid pace. TechCrunch reports that the largest supply chain compromise in 2023 cost the impacted businesses more than $9.9 billion. That incident had a direct impact on more than 1,000 businesses and over 60 million people. In these attacks, a bad actor targets a company by compromising the security of its suppliers, vendors and other third parties within its supply chain. Instead of launching a direct attack on the target company\'s systems, networks or employees, an attacker infiltrates a trusted entity within the supply chain, thereby exploiting the entity\'s trust and access vis-a-vis the target. Attackers know that enterprises with mature supply chains tend to have stronger cybersecurity defenses, which makes them challenging targets. So, rather than trying to break into “Fort Knox” through the front door, they will target the ventilation system. Bad actors often use thread hijacking, also known as conversation hijacking, in these attacks. They target specific email accounts and compromise them so that they can spy on users\' conversations. When the time is right, they will insert themselves into a business email conversation based on the information they have gathered from the compromised email accounts or other sources. Sometimes, the attack will be bold enough to initiate new conversations. Thread hijacking attacks, like other BEC campaigns, don\'t often carry malicious payloads like attachments or URLs. Thread hijacking is also a targeted attack, so bad actors will often use a lookalike domain. (A lookalike domain is a website URL that closely resembles the address of a legitimate and well-known domain, often with slight variations in spelling, characters or domain extensions.) This potent combination-the lack of an active payload and the use of a lookalike domain-makes it difficult for simple, API-based email security solutions to detect and remediate these types of attacks. The scenario Proofpoint recently detected a threat actor account that was impersonating an accounts receivable employee at a small financial services company in Florida. Through this impersonation, the adversary launched a supply chain attack on their intended target-a large law firm in Boston. They sent an impersonating message to the law firm\'s controller asking them to halt a requested payment and change the payment information to another account. Unlike API-based email security solutions that only support post-delivery remediation, Proofpoint detected and blocked the impersonating messages before they reached the controller\'s inbox. As a result, the law fir | Tool Threat | ★★ | |
|
2024-02-07 05:00:33 | Protéger vos chemins, partie 2: Comprendre votre rayon de souffle d'identité Protecting Your Paths, Part 2: Understanding Your Identity Blast Radius (lien direct) |
Welcome to the second part of our blog series on using attack path management (APM) to secure your network. In our first post, we examined the importance of using APM to identify and remediate identity-centric attack paths before attackers exploit them. We also emphasized that the compromise of tier-zero assets -aka the “IT crown jewels”-is a top objective for attackers. Attack path management (APM) is a process by which you discover all the existing paths that an attacker can exploit to reach tier-zero assets within your environment. APM plays a pivotal role in helping security teams pinpoint vulnerable identities. It provides a holistic view of the available attack paths that an attacker could use to move laterally in the quest to reach your IT crown jewels. In this blog, we introduce a crucial APM concept known as the identity blast radius. We explore the use cases for this view. And we highlight how it is similar but distinct from the attack path view. What you can learn from identity blast radius analysis An identity blast radius represents the potential impact of an attacker who is moving laterally using a compromised identity. It presents how the compromise of one particular identity can help an attacker reach other identities or assets in the network. Discovering the identity blast radius before attackers do is essential to prevent a minor compromise from turning into a major security incident. To see how this works, it\'s helpful to visualize it. Below is an illustration of the vulnerabilities related to a user named Brian Rivera. It\'s just one example of how attackers can abuse Active Directory ACLs. Example view of an identity blast radius. In the blast radius view above the subject identity for Brian Riviera serves as the “tree root” of the view. Branching off the tree root are all the assets and privileges that that specific user can invoke. These include: Stored credentials. If an attacker compromises hosts where Brian\'s Remote Desktop Protocol (RDP) credentials are stored, they can use those credentials to move laterally to the indicated hosts. Active Directory ACL assignments. An attacker that compromises Brian\'s identity can use his GenericWrite permission in Active Directory to: Gain code execution with elevated privileges on a remote computer Delete files and data Introduce malicious files or code on the flagged targets Identity blast radius use cases The identity blast radius view supports powerful use cases that support attack path analysis, including: Post-compromise analysis. After an attacker gets control of an identity, the blast radius view can help you identify other identities and assets that are vulnerable to lateral movement or other malicious actions. What-if analysis. Your security teams can use the identity blast radius view to assess the potential impact of an attack on high-value targets like your chief financial officer or a senior IT administrator. With that insight, they can apply other compensating controls. Changes in access privileges. It can also help you identify the potential impact of changes in access privileges. These often occur when employees move between roles. You can use this insight to ensure that an employee\'s access is properly managed. This can prevent an excessive accumulation of privileges. Assets vs. identities: Differences between tier-zero asset views and identity blast radius views The figure below shows how the tier-zero asset view illustrates paths that ascend from different entities to the tier-zero asset root. In contrast, the identity blast radius view positions the subject identity as the tree root. Paths extend downward to various entities that are reachable through diverse relations like Active Directory ACL assignments or stored credentials. Comparison of the tier-zero assets view versus the identity blast radius view. These two views offer different perspectives. But both are powerful tools to help you visualize identity-related vulnerabilities. These i | Tool Vulnerability Threat | ★★★ | |
|
2024-02-06 20:08:17 | Les gouvernements du monde, les géants de la technologie signent la responsabilité des logiciels espions World Govs, Tech Giants Sign Spyware Responsibility Pledge (lien direct) |
La France, le Royaume-Uni, les États-Unis et d'autres travailleront sur un cadre pour l'utilisation responsable d'outils tels que Pegasus de NSO Group \\ et les gains de la Fondation ShadowServer & Pound; 1 million d'investissements.
France, the UK, the US, and others will work on a framework for the responsible use of tools like NSO Group\'s Pegasus, and Shadowserver Foundation gains £1 million investment. |
Tool | ★★★ | |
 |
2024-02-06 19:39:29 | AnyDesk dit que le logiciel \\ 'sûr à utiliser \\' après cyberattaque AnyDesk says software \\'safe to use\\' after cyberattack (lien direct) |
La société de logiciels de surveillance et de gestion à distance populaire, AnyDesk, a déclaré que toutes les versions de son outil obtenues à partir de «sources officielles» sont sûres à utiliser à la suite d'une cyberattaque qui a provoqué des jours de pannes et de préoccupations parmi les utilisateurs.La cyberattaque a affecté les serveurs en Espagne et au Portugal, mais nulle part ailleurs, a déclaré Anydesk.L'entreprise a confirmé vendredi dernier qu'un quatre jours
Popular remote monitoring and management software company AnyDesk said all versions of its tool obtained from “official sources” are safe to use following a cyberattack that caused days of outages and concern among users. The cyberattack affected servers in Spain and Portugal but nowhere else, AnyDesk said. The company confirmed last Friday that a four-day |
Tool | ★★★ | |
 |
2024-02-06 17:51:33 | Top 7 des outils de chasse au cybermenace pour 2024 Top 7 Cyber Threat Hunting Tools for 2024 (lien direct) |
Voici les principaux outils de chasse à la cyber-menace qui peuvent améliorer les défenses de cybersécurité de votre organisation.Apprenez comment leurs fonctionnalités se comparent.
Here are the top cyber threat hunting tools that can enhance your organization\'s cybersecurity defenses. Learn how their features compare. |
Tool Threat | ★★★ | |
 |
2024-02-06 15:42:30 | LockSelf dévoile un nouveau Dashboard dédié aux RSSI ! (lien direct) | >Déployé de manière progressive et présenté au FIC en avril dernier, le Dashboard LockSelf fait désormais partie intégrante des outils de pilotage cyber des organisations utilisatrices de la suite LockSelf. Retour sur ses spécificités et ses fonctionnalités clés ! The post LockSelf dévoile un nouveau Dashboard dédié aux RSSI ! first appeared on UnderNews. | Tool | ★★ | |
|
2024-02-06 14:30:47 | Google: la moitié de tous les jours zéro utilisés contre nos produits sont développés par des fournisseurs de logiciels espions Google: Half of all zero-days used against our products are developed by spyware vendors (lien direct) |
Google a déclaré mardi qu'il suivait au moins 40 entreprises impliquées dans la création de logiciels espions et d'autres outils de piratage qui sont vendus aux gouvernements et déployés contre les utilisateurs «à haut risque», y compris les journalistes, les défenseurs des droits de l'homme et les dissidents.Les vendeurs - qui ont développé des dizaines d'outils et d'astuces pour pénétrer dans les téléphones, les ordinateurs portables,
Google said Tuesday that it is tracking at least 40 companies involved in the creation of spyware and other hacking tools that are sold to governments and deployed against “high risk” users, including journalists, human rights defenders and dissidents. The vendors - which have developed dozens of tools and tricks to break into phones, laptops, |
Tool | ★★★★ | |
|
2024-02-06 14:00:00 | Les bogues Microsoft Azure Hdinsight exposent les mégadonnées aux violations Microsoft Azure HDInsight Bugs Expose Big Data to Breaches (lien direct) |
Les trous de sécurité dans un outil Big Data pourraient entraîner un compromis Big Data.
Security holes in a big data tool could lead to big data compromise. |
Tool | ★★★ | |
 |
2024-02-06 11:00:33 | 70% des organisations ne sont pas préparées et comment les technologies avancées peuvent aider 70% of Organizations Feel Unprepared and How Advanced Technologies Can Help (lien direct) |
Plus de 70% des répondants d'organisations estiment qu'ils n'ont pas les bons outils pour protéger leurs informations et systèmes sensibles contre les menaces d'initiés.Ces statistiques ne sont tout simplement pas alarmantes;C'est un appel à une compréhension plus profonde et à une réponse stratégique à un aspect souvent négligé de la cybersécurité.
Over 70% of respondents of organizations feel that they lack the right tools to protect their sensitive information and systems from insider threats. These statistics are just not alarming; it\'s a call for a deeper understanding and strategic response to an often overlooked aspect of cybersecurity. |
Tool | ★★ | |
|
2024-02-06 11:00:00 | AI en cybersécurité: 8 cas d'utilisation que vous devez connaître AI in Cybersecurity: 8 use cases that you need to know (lien direct) |
The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. Cybercriminals live on the cutting edge of technology, and nothing fits the label more than artificial intelligence. It helps them design sophisticated, evolving malware, pose as higher-ups, and even successfully imitate biometrics like one’s voice. The use of AI in cyber security has developed as a natural response to these new and unpredictable challenges. How are cyber security experts using artificial intelligence to thwart the bad guys? The following eight use cases will tell you all you need to know. 1. Threat prevention and preemption It\'s not uncommon for businesses and organizations to be under persistent attack. Cyber threats can burrow deep into their networks and spread chaos for months before detection. Since AI models have large datasets of past behaviors to draw on, they can spot anomalous behavior far more quickly. Preventing attacks before deployment is among cyber security’s most desirable goals. If you have the right information, it can become a reality. For example, a cybersecurity team can use a proxy network to regularly scrape the contents of forums and other sites dedicated to hacking. They may then act on the gathered info and meet future attacks head-on. 2. Timely incident response Not even an AI-enhanced cybersecurity framework can stop all incoming attacks. Someone might connect an unsanctioned device, or an update might contain malicious code. Either way, a robust cyber security AI can respond to such incidents promptly, blocking or deleting the offending actors. 3. Data protection Data is the basis on which modern economies operate. Whether you obtain it through web scraping API, surveys, as part of your day-to-day operations, etc., the data you collect needs powerful safeguards. AI can help by classifying and automatically encrypting it. Access control is another process you can automate, as is compliance with data protection laws like the GDPR. | Spam Malware Tool Threat | ★★ | |
|
2024-02-06 05:00:20 | Comment les cybercriminels augmentent-ils le privilège et se déplacent-ils latéralement? How Do Cybercriminals Escalate Privilege and Move Laterally? (lien direct) |
If you want to understand how cybercriminals cause business-impacting security breaches, the attack chain is a great place to start. The eight steps of this chain generalize how a breach progresses from start to finish. The most impactful breaches typically follow this pattern: Steps in the attack chain. In this blog post, we will simplify the eight steps of an attack into three stages-the beginning, middle and end. Our focus here will primarily be on the middle stage-info gathering, privilege escalation and lateral movement, which is often the most challenging part of the attack chain to see and understand. The middle steps are often unfamiliar territory, except for the most highly specialized security practitioners. This lack of familiarity has contributed to significant underinvestment in security controls required to address attacks at this stage. But before we delve into our discussion of the middle, let\'s address the easiest stages to understand-the beginning and the end. The beginning of the attack chain A cyberattack has to start somewhere. At this stage, a cybercriminal gains an initial foothold into a target\'s IT environment. How do they do this? Mainly through phishing. A variety of tactics are used here including: Stealing a valid user\'s login credentials Luring a user into installing malicious software, such as Remote Access Trojans (RATs) Calling the company\'s help desk to socially engineer the help desk into granting the attacker control over a user\'s account Much ink has been spilled about these initial compromise techniques. This is why, in part, the level of awareness and understanding by security and non-security people of this first stage is so high. It is fair to say that most people-IT, security and everyday users-have personally experienced attempts at initial compromise. Who hasn\'t received a phishing email? A great deal of investment goes into security tools and user training to stop the initial compromise. Think of all the security technologies that exist for that purpose. The list is very long. The end of the attack chain Similarly, the level of awareness and understanding is also very high around what happens at the end of the attack chain. As a result, many security controls and best practices have also been focused here. Everyone-IT, security and even everyday users-understands the negative impacts of data exfiltration or business systems getting encrypted by ransomware attackers. Stories of stolen data and ransomed systems are in the news almost daily. Now, what about the middle? The middle is where an attacker attempts to move from the initially compromised account(s) or system(s) to more critical business systems where the data that\'s worth exfiltrating or ransoming is stored. To most people, other than red teamers, pen testers and cybercriminals, the middle of the attack chain is abstract and unfamiliar. After all, regular users don\'t attempt to escalate their privileges and move laterally on their enterprise network! These three stages make up the middle of the attack chain: Information gathering. This includes network scanning and enumeration. Privilege escalation. During this step, attackers go after identities that have successively higher IT system privileges. Or they escalate the privilege of the account that they currently control. Lateral movement. Here, they hop from one host to another on the way to the “crown jewel” IT systems. Steps in the middle of the attack chain. Relatively few IT or security folks have experience with or a deep understanding of the middle of the attack chain. There are several good reasons for this: Most security professionals are neither red teamers, pen testers, nor cybercriminals. The middle stages are “quiet,” unlike initial compromise-focused phishing attacks or successful ransomware attacks, which are very “loud” by comparison. Unlike the front and back end of the attack chain, there has been little coverage about how these steps | Ransomware Malware Tool Vulnerability Threat | ★★★ | |
|
2024-02-06 01:52:22 | Risques de sécurité des graphiques de barre de Kubernetes et que faire à leur sujet Security Risks of Kubernetes Helm Charts and What to do About Them (lien direct) |
Kubernetes est devenue la plate-forme principale pour orchestrer les applications conteneurisées.Cependant, les développeurs et les administrateurs comptent sur un écosystème d'outils et de plateformes qui ont émergé autour de Kubernetes.L'un de ces outils est Helm, un gestionnaire de packages qui simplifie les déploiements de Kubernetes.Cependant, avec la confusion et l'efficacité des offres, il présente également des risques de sécurité importants.Cet article explore les risques associés aux graphiques de barre de Kubernetes et fournit des stratégies exploitables pour atténuer les vulnérabilités potentielles.Comprendre et traiter ces sécurité ...
Kubernetes has emerged as the leading platform for orchestrating containerized applications. However, developers and administrators rely on an ecosystem of tools and platforms that have emerged around Kubernetes. One of these tools is Helm, a package manager that simplifies Kubernetes deployments. However, with the convenience and efficiency Helm offers, it also introduces significant security risks. This article explores the risks associated with Kubernetes Helm charts and provides actionable strategies to mitigate potential vulnerabilities. Understanding and addressing these security... |
Tool Vulnerability | ★★ | |
|
2024-02-05 23:00:35 | La Grande-Bretagne et la France rassemblent des diplomates pour un accord international sur les logiciels espions Britain and France assemble diplomats for international agreement on spyware (lien direct) |
Le Royaume-Uni et la France organisent conjointement une conférence diplomatique à Lancaster House à Londres cette semaine pour lancer un nouvel accord international concernant «la prolifération des outils commerciaux de cyber-intrusion».Selon le ministère des Affaires étrangères, 35 nations seront représentées lors de la conférence, aux côtés de «Big Tech Leaders, d'experts juridiques et de droits de l'homme
The United Kingdom and France are to jointly host a diplomatic conference at Lancaster House in London this week to launch a new international agreement addressing “the proliferation of commercial cyber intrusion tools.” According to the Foreign Office, 35 nations will be represented at the conference, alongside “big tech leaders, legal experts, and human rights |
Tool Conference Commercial | ★★ | |
|
2024-02-05 21:31:30 | Vajraspy: un patchwork d'applications d'espionnage VajraSpy: A Patchwork of Espionage Apps (lien direct) |
#### Description
Les chercheurs de l'ESET ont découvert une nouvelle campagne de cyber-espionnage qui utilise douze applications Android transportant Vajraspy, un cheval de Troie (rat) d'accès à distance utilisé par le groupe Patchwork Apt.
Six des applications étaient disponibles sur Google Play, et six ont été trouvés sur Virustotal.Les applications ont été annoncées comme des outils de messagerie, et on se faisait passer pour une application d'actualités.Vajraspy possède une gamme de fonctionnalités d'espionnage qui peuvent être élargies en fonction des autorisations accordées à l'application regroupée avec son code.Il vole les contacts, les fichiers, les journaux d'appels et les messages SMS, mais certaines de ses implémentations peuvent même extraire les messages WhatsApp et Signal, enregistrer des appels téléphoniques et prendre des photos avec l'appareil photo.La campagne a ciblé les utilisateurs principalement au Pakistan, et les acteurs de la menace ont probablement utilisé des escroqueries de romantisme ciblées pour attirer leurs victimes dans l'installation du malware.
#### URL de référence (s)
1. https://www.welivesecurity.com/en/eset-research/vajraspy-patchwork-espionage-apps/
#### Date de publication
1er février 2024
#### Auteurs)
Lukas Stefanko
#### Description ESET researchers have discovered a new cyber espionage campaign that uses twelve Android apps carrying VajraSpy, a remote access trojan (RAT) used by the Patchwork APT group. Six of the apps were available on Google Play, and six were found on VirusTotal. The apps were advertised as messaging tools, and one posed as a news app. VajraSpy has a range of espionage functionalities that can be expanded based on the permissions granted to the app bundled with its code. It steals contacts, files, call logs, and SMS messages, but some of its implementations can even extract WhatsApp and Signal messages, record phone calls, and take pictures with the camera. The campaign targeted users mostly in Pakistan, and the threat actors likely used targeted honey-trap romance scams to lure their victims into installing the malware. #### Reference URL(s) 1. https://www.welivesecurity.com/en/eset-research/vajraspy-patchwork-espionage-apps/ #### Publication Date February 1, 2024 #### Author(s) Lukas Stefanko |
Malware Tool Threat Mobile | ★★★ | |
|
2024-02-05 16:42:00 | Revue pratique: XDR basé sur Sase de Cato Networks Hands-On Review: SASE-based XDR from Cato Networks (lien direct) |
Les entreprises sont engagées dans un jeu de chat et de souris apparemment sans fin en ce qui concerne la cybersécurité et les cyber-menaces.Alors que les organisations mettaient en place un bloc défensif après l'autre, les acteurs malveillants lancent leur jeu pour contourner ces blocs.Une partie du défi consiste à coordonner les capacités défensives des outils de sécurité disparates, même si les organisations ont des ressources limitées et une pénurie de
Companies are engaged in a seemingly endless cat-and-mouse game when it comes to cybersecurity and cyber threats. As organizations put up one defensive block after another, malicious actors kick their game up a notch to get around those blocks. Part of the challenge is to coordinate the defensive abilities of disparate security tools, even as organizations have limited resources and a dearth of |
Tool | ★★★ | |
|
2024-02-05 15:08:59 | Metomic lance l'intégration de Chatgpt Metomic Launches ChatGPT Integration (lien direct) |
Metomic lance l'intégration de Chatgpt pour aider les entreprises à profiter pleinement de l'outil d'IA génératif sans mettre des données sensibles à risque
Metomic pour Chatgpt permet aux leaders de la sécurité de stimuler la productivité tout en surveillant les données en cours de téléchargement sur la plate-forme Chatgpt d'Openai \\ en temps réel
-
revues de produits
Metomic Launches ChatGPT Integration To Help Businesses Take Full Advantage Of The Generative AI Tool Without Putting Sensitive Data At Risk Metomic for ChatGPT enables security leaders to boost productivity while monitoring data being uploaded to OpenAI\'s ChatGPT platform in real-time - Product Reviews |
Tool | ChatGPT | ★★ |
 |
2024-02-05 12:15:00 | AnyDesk frappé par la cyberattaque et la violation des données des clients AnyDesk Hit by Cyber-Attack and Customer Data Breach (lien direct) |
La cyberattaque qui a frappé le fournisseur d'outils distant pourrait avoir un impact plus significatif que prévu initialement
The cyber-attack that hit the remote tool provider could have a more significant impact than initially expected |
Data Breach Hack Tool | ★★ | |
 |
2024-02-05 11:59:31 | Amélioration de l'interopérabilité entre la rouille et le C ++ Improving Interoperability Between Rust and C++ (lien direct) |
Publié par Lars Bergstrom & # 8211;Directeur, Android Platform Tools & amp;Bibliothèques et présidente du Rust Foundation Board En 2021, nous annoncé que Google rejoignait la Fondation Rust.À l'époque, Rust était déjà largement utilisée sur Android et d'autres produits Google.Notre annonce a souligné notre engagement à améliorer les examens de sécurité du code de la rouille et son interopérabilité avec le code C ++.La rouille est l'un des outils les plus forts que nous avons pour résoudre les problèmes de sécurité de la sécurité mémoire.Depuis cette annonce, les leaders de l'industrie et agences gouvernementales sentiment. Nous sommes ravis d'annoncer que Google a fourni une subvention de 1 million de dollars à la Rust Foundation pour soutenir les efforts qui amélioreront la capacité de Rust Code à interopérer avec les bases de code C ++ héritées existantes.Nous réapparaisons également notre engagement existant envers la communauté de la rouille open source en agrégant et en publiant Audits pour les caisses de rouille que nous utilisons dans les projets Google open-source.Ces contributions, ainsi que notre contributions précédentes à l'interopérabilité , ont-ellesenthousiasmé par l'avenir de la rouille. "Sur la base des statistiques historiques de la densité de la densité de vulnérabilité, Rust a empêché de manière proactive des centaines de vulnérabilités d'avoir un impact sur l'écosystème Android.Cet investissement vise à étendre l'adoption de la rouille sur divers composants de la plate-forme. » & # 8211;Dave Kleidermacher, vice-président de l'ingénierie, Android Security & AMP;Confidentialité Bien que Google ait connu la croissance la plus importante de l'utilisation de la rouille dans Android, nous continuons à augmenter son utilisation sur plus d'applications, y compris les clients et le matériel de serveur. «Bien que la rouille ne soit pas adaptée à toutes les applications de produits, la priorisation de l'interopérabilité transparente avec C ++ accélérera l'adoption de la communauté plus large, s'alignant ainsi sur les objectifs de l'industrie d'améliorer la sécurité mémoire.» & # 8211;Royal Hansen, vice-président de Google de la sécurité et de l'AMP;Sécurité L'outillage de rouille et l'écosystème prennent déjà en charge interopérabilité avec Android et avec un investissement continuDans des outils comme cxx , autocxx , bindgen , cbindgen , diplomate , et crubit, nous constatons des améliorations régulières de l'état d'interopérabilité de la rouille avec C ++.Au fur et à mesure que ces améliorations se sont poursuivies, nous avons constaté une réduction des obstacles à l'adoption et à l'adoption accélérée de la rouille.Bien que ces progrès à travers les nombreux outils se poursuivent, il ne se fait souvent que développer progressivement pour répondre aux besoins particuliers d'un projet ou d'une entreprise donnée. Afin d'accélérer à la fois l'adoption de la rouill | Tool Vulnerability Mobile | ★★★ | |
|
2024-02-05 11:41:18 | 7 conseils pour développer une approche proactive pour éviter le vol de données 7 Tips to Develop a Proactive Approach to Prevent Data Theft (lien direct) |
Data is one of the most valuable assets for a modern enterprise. So, of course, it is a target for theft. Data theft is the unauthorized acquisition, copying or exfiltration of sensitive information that is typically stored in a digital format. To get it, bad actors either abuse privileges they already have or use various other means to gain access to computer systems, networks or digital storage devices. The data can range from user credentials to personal financial records and intellectual property. Companies of all sizes are targets of data theft. In September 2023, the personal data of 2,214 employees of the multinational confectionary firm The Hershey Company was stolen after a phishing attack. And in January 2024, the accounting firm of Framework Computer fell victim to an attack. A threat actor posed as the Framework\'s CEO and convinced the target to share a spreadsheet with the company\'s customer data. Data thieves aim to profit financially, disrupt business activities or do both by stealing high-value information. The fallout from a data breach can be very costly for a business-and the cost is going up. IBM reports that the global average cost of a data breach in 2023 was $4.45 million, a 15% increase over three years. Other data suggests that the average cost of a breach is more than double for U.S. businesses-nearly $9.5 million. Not all data breaches involve data theft, but stealing data is a top aim for many attackers. Even ransomware gangs have been shifting away from data encryption in their attacks, opting instead to steal massive amounts of data and use its value as a means to compel businesses to pay ransom. So, what can businesses do to prevent data theft? Taking a proactive approach toward stopping someone from stealing your data is a must. This blog post can help jump-start your thinking about how to improve data security. We explore how data theft happens and describe some common threats that lead to it. We also outline seven strategies that can help reduce your company\'s risk of exposure to data theft and highlight how Proofpoint can bolster your defenses. Understanding data theft-and who commits it Data theft is a serious security and privacy breach. Data thieves typically aim to steal information like: Personally identifiable information (PII) Financial records Intellectual property (IP) Trade secrets Login credentials Once they have it, bad actors can use stolen data for fraudulent activities or, in the case of credential theft, to gain unlawful access to accounts or systems. They can also sell high-value data on the dark web. The consequences of data theft for businesses can be significant, if not devastating. They include hefty compliance penalties, reputational damage, and financial and operational losses. Take the manufacturing industry as an example. According to one source, a staggering 478 companies in this industry have experienced a ransomware attack in the past five years. The costs in associated downtime are approximately $46.2 billion. To prevent data theft, it\'s important to recognize that bad actors from the outside aren\'t the only threat. Insiders, like malicious employees, contractors and vendors, can also steal data from secured file servers, database servers, cloud applications and other sources. And if they have the right privileges, stealing that data can be a breeze. An insider\'s goals for data theft may include fraud, the disclosure of trade secrets to a competitor for financial gain, or even corporate sabotage. As for how they can exfiltrate data, insiders can use various means, from removable media to personal email to physical printouts. How does data theft happen? Now, let\'s look at some common methods that attackers working from the outside might employ to breach a company\'s defenses and steal data. Phishing. Cybercriminals use phishing to target users through email, text messages, phone calls and other forms of communication. The core objective of this approach is to trick users into doing what | Ransomware Data Breach Malware Tool Vulnerability Threat Cloud | ★★★ | |
|
2024-02-05 10:23:40 | Mimecast annonce des améliorations aux protections de code QR Mimecast Announces Enhancements to QR Code Protections (lien direct) |
mimecast annonce des améliorations aux protections de code QR
La sécurité des e-mails mimecast innove pour garder \\ 'qui quasi \' Attaques dans les boîtes de réception
-
revues de produits
Mimecast Announces Enhancements to QR Code Protections Mimecast email security innovates to keep \'quishing\' attacks out of inboxes - Product Reviews |
Tool | ★★ | |
 |
2024-02-02 15:00:00 | Alerte de campagne: l'ombre d'un an d'Asyncrat dans l'infrastructure américaine Campaign Alert: The Year-Long Shadow of AsyncRAT in U.S. Infrastructure (lien direct) |
> The Rise of Asyncrat: A Persistrent Cyberon Menage Asyncrat, un outil d'accès à distance open source publié ...
>The Rise of AsyncRAT: A Persistent Cyber Threat AsyncRAT, an open-source remote access tool released... |
Tool Threat | ★★★ | |
|
2024-02-02 05:00:36 | Développement d'une nouvelle norme Internet: le cadre de la politique relationnelle du domaine Developing a New Internet Standard: the Domain Relationship Policy Framework (lien direct) |
Engineering Insights is an ongoing blog series that gives a behind-the-scenes look into the technical challenges, lessons and advances that help our customers protect people and defend data every day. Each post is a firsthand account by one of our engineers about the process that led up to a Proofpoint innovation. In this blog post, we discuss the Domain Relationship Policy Framework (DRPF)-an effort that has been years in the making at Proofpoint. The DRPF is a simple method that is used to identify verifiably authorized relationships between arbitrary domains. We create a flexible way to publish policies. These policies can also describe complex domain relationships. The details for this new model require in-depth community discussions. These conversations will help us collectively steer the DRPF toward becoming a fully interoperable standard. We are now in the early proposal stage for the DRPF, and we are starting to engage more with the broader community. This post provides a glimpse down the road leading to standardization for the DRPF. Why Proofpoint developed DRPF To shine a light on why Proofpoint was inspired to develop the DRPF in the first place, let\'s consider the thinking of the initial designers of the Domain Name System (DNS). They assumed that subdomains would inherit the administrative control of their parent domains. And by extension, this should apply to all subsequent subdomains down the line. At the time, this was reasonable to assume. Most early domains and their subdomains operated in much the same way. For example, “university.edu” directly operated and controlled the administrative policies for subdomains such as “lab.university.edu” which flowed down to “project.lab.university.edu.” Since the mid-1980s, when DNS was widely deployed, there has been a growing trend of delegating subdomains to third parties. This reflects a breakdown of the hierarchical model of cascading policies. To see how this works, imagine that a business uses “company.com” as a domain. That business might delegate “marketing.company.com” to a third-party marketing agency. The subdomain must inherit some policies, while the subdomain administrator may apply other policies that don\'t apply to the parent domain. Notably, there is no mechanism yet for a domain to declare a relationship with another seemingly independent domain. Consider a parent company that operates multiple distinct brands. The company with a single set of policies may want them applied not only to “company.com” (and all of its subdomains). It may also want them applied to its brand domains “brand.com” and “anotherbrand.com.” It gets even more complex when any of the brand domains delegate various subdomains to other third parties. So, say some of them are delegated to marketing or API support. Each will potentially be governed by a mix of administrative policies. In this context, “policies” refers to published guidance that is used when these subdomains interact with the domain. Policies might be for information only. Or they might provide details that are required to use services that the domain operates. Most policies will be static (or appear so to the retrieving parties). But it is possible to imagine that they could contain directives akin to smart contracts in distributed ledgers. 3 Design characteristics that define DRPF The goal of the DRPF is to make deployment and adoption easier while making it flexible for future use cases. In many prior proposals, complex requirements bogged down efforts to get rid of administrative boundaries between and across disparate domains. Our work should be immediately useful with minimal effort and be able to support a wide array of ever-expanding use cases. In its simplest form, three design characteristics define the DRPF: A domain administrator publishes a policy assertion record for the domain so that a relying party can discover and retrieve it. The discovered policy assertion directs the relying party to where they can find | Tool Prediction Cloud Technical | ★★★ | |
 |
2024-02-01 16:59:36 | Comment la médecine légale a révélé l'exploitation d'Ivanti Connect Secure VPN Vulnérabilités de jour zéro How Memory Forensics Revealed Exploitation of Ivanti Connect Secure VPN Zero-Day Vulnerabilities (lien direct) |
> Dans une récente série d'articles de blog liés à deux vulnérabilités zéro-jours dans Ivanti Connect Secure VPN, les détails partagés par volexité de l'exploitation active dans la sauvage;a fourni une mise à jour sur la façon dont l'exploitation était devenue dans le monde;et des observations rapportées sur la façon dont les logiciels malveillants et les modifications de l'outil de vérificateur d'intégrité intégré ont été utilisés pour échapper à la détection.Une étude initiale critique de Volexity \\ a consisté à collecter et à analyser un échantillon de mémoire.Comme indiqué dans le premier article de blog de la série en trois parties (je souligne): «… Volexité a analysé l'un des échantillons de mémoire collectés et a découvert la chaîne d'exploitation utilisée par l'attaquant.La volexité a découvert deux exploits différents-jour qui étaient enchaînés pour réaliser l'exécution de code distant non authentifié (RCE).Grâce à l'analyse médico-légale de l'échantillon de mémoire, la volexité a pu recréer deux exploits de preuve de concept qui ont permis une exécution complète de commande non authentifiée sur l'appliance ICS VPN. »Collect & # 38;Analyser la mémoire ASAP Le volexité priorise régulièrement la criminalistique de la mémoire [& # 8230;]
>In a recent series of blog posts related to two zero-day vulnerabilities in Ivanti Connect Secure VPN, Volexity shared details of active in-the-wild exploitation; provided an update on how exploitation had gone worldwide; and reported observations of how malware and modifications to the built-in Integrity Checker Tool were used to evade detection. A critical piece of Volexity\'s initial investigation involved collecting and analyzing a memory sample. As noted in the first blog post of the three-part series (emphasis added): “…Volexity analyzed one of the collected memory samples and uncovered the exploit chain used by the attacker. Volexity discovered two different zero-day exploits which were being chained together to achieve unauthenticated remote code execution (RCE). Through forensic analysis of the memory sample, Volexity was able to recreate two proof-of-concept exploits that allowed full unauthenticated command execution on the ICS VPN appliance.” Collect & Analyze Memory ASAP Volexity regularly prioritizes memory forensics […] |
Malware Tool Vulnerability Threat Industrial | ★★★ | |
|
2024-02-01 15:55:03 | Toutes les agences civiles fédérales condamnées à déconnecter les produits Ivanti à risque d'ici vendredi All federal civilian agencies ordered to disconnect at-risk Ivanti products by Friday (lien direct) |
Vendredi, toutes les agences civiles fédérales des États-Unis ont été condamnées à déconnecter les produits Secure et Policy Secure et Policy Secure après que d'autres vulnérabilités aient été trouvées dans les outils cette semaine.Dans un Directive mise à jour publiée mercredi, l'agence de sécurité de cybersécurité et d'infrastructure (CISA) a donné aux agences jusqu'à vendredi à minuit pour supprimer les outils
All federal civilian agencies in the U.S. have been ordered to disconnect Ivanti Connect Secure and Policy Secure products by Friday after more vulnerabilities were found in the tools this week. In an updated directive published on Wednesday, the Cybersecurity and Infrastructure Security Agency (CISA) gave agencies until Friday at midnight to remove the tools |
Tool Vulnerability | ★★★ | |
 |
2024-02-01 14:00:51 | L'IA générative est la fierté des services de cybercriminalité Generative AI is the Pride of Cybercrime Services (lien direct) |
> Les cybercriminels utilisent officiellement l'IA génératrice pour les campagnes de spam, les services d'identité et les services de vérification des médias sociaux: & # 8211;L'IA générative en tant qu'outil de cybercriminalité: les cybercriminels utilisent de plus en plus l'IA génératrice pour les cybercrimes sophistiqués, notamment une usurpation d'identité des médias sociaux, des campagnes de spam et des services de vérification KYC.& # 8211;Plateformes de chamage noir alimenté par AI: la montée des plateformes axées sur l'IA pour créer et gérer de faux comptes de médias sociaux, offrant des services pour automatiser la génération de contenu et l'activité des comptes à des fins illicites.& # 8211;Évolution des fraudes du spam et de KYC: l'intégration de l'IA dans les services de spam pour contourner les contrôles de sécurité et dans les services de vérification KYC pour créer de faux documents d'identification, ce qui signifie un nouveau niveau de [& # 8230;]
>Cybercriminals Officially Utilize Generative AI for Spam Campaigns, Social Media Impersonation and Verification Services Highlights: – Generative AI as a Cybercrime Tool: Cybercriminals are increasingly using generative AI for sophisticated cybercrimes, including social media impersonation, spam campaigns, and KYC verification services. – AI-Powered Black-Hat Platforms: The rise of AI-driven platforms for creating and managing fake social media accounts, offering services to automate content generation and account activity for illicit purposes. – Evolution of Spam and KYC Frauds: The integration of AI in spam services to bypass security controls and in KYC verification services for creating fake identification documents, signifying a new level of […] |
Spam Tool | ★★★ | |
|
2024-02-01 06:00:12 | Le pare-feu humain: Pourquoi la formation de sensibilisation à la sécurité est une couche de défense efficace The Human Firewall: Why Security Awareness Training Is an Effective Layer of Defense (lien direct) |
Do security awareness programs lead to a quantifiable reduction in risk? Do they directly impact a company\'s security culture? In short, are these programs effective? The answer to these questions is a resounding yes! With 74% of all data breaches involving the human element, the importance of educating people to help prevent a breach cannot be understated. However, for training to be effective, it needs to be frequent, ongoing and provided to everyone. Users should learn about: How to identify and protect themselves from evolving cyberthreats What best practices they can use to keep data safe Why following security policies is important In this blog post, we discuss the various ways that security awareness training can have a positive impact on your company. We also discuss how to make your program better and how to measure your success. Security awareness training effectiveness Let\'s look at three ways that security awareness training can help you boost your defenses. 1. Mitigate your risks By teaching your team how to spot and handle threats, you can cut down on data breaches and security incidents. Our study on the effects of using Proofpoint Security Awareness showed that many companies saw up to a 40% decrease in the number of harmful links clicked by users. Think about this: every click on a malicious link could lead to credential theft, a ransomware infection, or the exploitation of a zero-day vulnerability. So, an effective security awareness program essentially reduces security incidents by a similar amount. Want more evidence about how important it is? Just check out this study that shows security risks can be reduced by as much as 80%. Here is more food for thought. If a malicious link does not directly result in a breach, it must still be investigated. The average time to identify a breach is 204 days. So, if you can reduce the number of incidents you need to investigate, you can see real savings in time and resources. 2. Comply with regulations Security awareness education helps your company comply with data regulations, which are always changing. This can help you avoid hefty fines and damage to your reputation. In many cases, having a security awareness program can keep you compliant with several regulations. This includes U.S. state privacy laws, the European Union\'s GDPR and other industry regulations. 3. Cultivate a strong security culture An effective security awareness program doesn\'t have to be all doom and gloom. Done right, it can help you foster a positive security culture. More than half of users (56%) believe that being recognized or rewarded would make their company\'s security awareness efforts more effective. But only 8% of users say that their company provides them with incentives to practice “good” cybersecurity behavior. When you make security fun through games, contests, and reward and recognition programs, you can keep your employees engaged. You can also motivate them to feel personally responsible for security. That, in turn, can inspire them to be proactive about keeping your critical assets safe. Finally, be sure to incorporate security principles into your company\'s core values. For example, your business leaders should regularly discuss the importance of security. That will help users to understand that everyone plays a vital role in keeping the business safe. How to make your security awareness program effective The verdict is clear. Security awareness programs can tangibly reduce organizational risks. When asked about the connection between their security awareness efforts and their company\'s cybersecurity resilience, a resounding 96% of security professionals say that there is more than just a strong link. They say that it\'s either a direct result of security training or that training is a strong contributor. Let\'s discuss how you can make your program more effective. Assess your security posture The first step toward effectiveness is to assess your company\'s security posture | Ransomware Tool Vulnerability Threat Studies | ★★★ | |
|
2024-02-01 01:30:00 | RunC Flaws Enable Container Escapes, Granting Attackers Host Access (lien direct) | Multiple security vulnerabilities have been disclosed in the runC command line tool that could be exploited by threat actors to escape the bounds of the container and stage follow-on attacks.
The vulnerabilities, tracked as CVE-2024-21626, CVE-2024-23651, CVE-2024-23652, and CVE-2024-23653, have been collectively dubbed Leaky Vessels by cybersecurity vendor Snyk.
"These container
Multiple security vulnerabilities have been disclosed in the runC command line tool that could be exploited by threat actors to escape the bounds of the container and stage follow-on attacks. The vulnerabilities, tracked as CVE-2024-21626, CVE-2024-23651, CVE-2024-23652, and CVE-2024-23653, have been collectively dubbed Leaky Vessels by cybersecurity vendor Snyk. "These container |
Tool Vulnerability Threat | ★★ | |
|
2024-02-01 00:00:20 | Citibank a poursuivi pour ne pas protéger les clients contre les hacks Citibank Sued For Failing To Protect Customers Against Hacks (lien direct) |
Citibank, l'une des plus grandes banques des États-Unis, a été poursuivie mardi par le procureur général de New York Letitia James pour avoir prétendument échoué à protéger ses clients et refuser de rembourser les victimes de fraude électronique. Le procès, déposé auprès du tribunal de district américain du district sud de New York, affirme que Citibank ne met pas en œuvre de solides protections en ligne pour empêcher les prises de contrôle des comptes non autorisés, induire les clients en erreur au sujet de leurs droits après que leurs comptes soient piratés et que l'argent volé, etrefuse illégalement de rembourser les victimes de fraude, déclare un communiqué de presse. Le bureau du procureur général (OAG) affirme en outre que les protocoles et procédures de sécurité laxiste de Citibank \\ et les systèmes de surveillance inefficaces ont coûté des millions de dollars à New York Citibank - dans certains cas, leurs économies de vie aux escrocs et aux escrocs et aux escrocpirates.Il a également constaté que la banque n'avait pas répondu & # 8220; de manière appropriée et rapidement », ce qui a fait perdre des millions. aux clients. "Les banques sont censées être l'endroit le plus sûr pour garder de l'argent, mais la négligence de Citibank \\ a permis aux escrocs de voler des millions de dollars aux gens travailleurs", a déclaré Général James dans un communiqué de presse. «De nombreux New-Yorkais comptent sur les services bancaires en ligne pour payer les factures ou pour économiser pour de grandes jalons, et si une banque ne peut pas sécuriser ses comptes de clients, ils échouent dans leur devoir le plus élémentaire.Il n'y a aucune excuse pour l'échec de Citi \\ à protéger et à empêcher des millions de dollars d'être volés des comptes des clients et mon bureau ne radrera pas le comportement illégal de grandes banques. » Le procureur général a également donné des exemples de victimes de New York perdant des dizaines de milliers de dollars en raison d'une fraude.Dans un exemple, une victime a cliqué sur un lien malveillant dans le message reçu qui semblait provenir de Citi, qui lui a demandé de se connecter à un site Web ou d'appeler sa branche locale.Lorsque le client a appelé sa succursale locale pour signaler l'activité suspecte, il aurait dit à la victime de ne pas s'en soucier. Trois jours plus tard, le client a découvert qu'un escroc a changé son mot de passe bancaire, inscrit à des virements métalliques en ligne, transféré 70 000 $ de ses économies à son compte courant, puis exécuté électroniquement un transfert métallique de 40 000 $.Le client a continué à contacter la banque pendant des semaines et a également soumis des affidavits, mais finalement, on lui a dit que sa demande de fraude avait été refusée. Dans un communiqué, Citibank a déclaré que la société "travaillait extrêmement dur" pour prévenir les menaces pour ses clients et les aide à récupérer les pertes lorsque cela est possible. «Les banques ne sont pas tenues de rendre les clients entiers lorsque ces clients suivent les instructions des criminels et les banques ne peuvent voir aucune indication que les clients sont trompés.Cependant, compte tenu de la poussée à l'échelle de l'industrie de la fraude par fil au cours des dernières années, nous avons pris des mesures proactives pour protéger nos clients avec des comptes de sécurité, des outils de prévention de la fraude intuitifs, des idées claires sur les dernières escroqueries,et stimuler la sensibilisation et l'éducation des clients », a ajouté l'entreprise. «Nos actions ont considérablement réduit les pertes de fraude par fil du client, et nous restons déterminés à investir dans des mesures de | Tool Mobile | ★★★ | |
|
2024-01-31 19:25:01 | Les États-Unis confirment le retrait du botnet géré par la Chine ciblant les routeurs à domicile et au bureau US confirms takedown of China-run botnet targeting home and office routers (lien direct) |
Le ministère américain de la Justice a confirmé mercredi qu'il avait perturbé un botnet géré par une opération de piratage du gouvernement chinois prolifique connu sous le nom de Volt Typhoon.Les nouvelles du démontage du botnet ont émergé mardi pour la première fois, lorsque Reuters a rapporté que le ministère de la Justice et le FBI ont obtenu l'autorisation légale d'un tribunal américain pour désactiver à distance les outils implantés
The U.S. Justice Department confirmed on Wednesday that it disrupted a botnet run by a prolific Chinese government hacking operation known as Volt Typhoon. News of the botnet takedown first emerged on Tuesday, when Reuters reported that the Justice Department and FBI got legal authorization from a U.S. court to remotely disable the tools implanted |
Tool | Guam | ★★★ |
To see everything:
Our RSS (filtrered)
