What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2024-01-31 19:08:00 | Alerte: Ivanti révèle 2 nouveaux défauts zéro-jours, un sous exploitation active Alert: Ivanti Discloses 2 New Zero-Day Flaws, One Under Active Exploitation (lien direct) |
Ivanti alerte de deux nouveaux défauts de haute sévérité dans ses produits Secure et Policy Secure Connect, dont l'un est dit en cours d'exploitation ciblée dans la nature.
La liste des vulnérabilités est la suivante -
CVE-2024-21888 & NBSP; (Score CVSS: 8.8) - Une vulnérabilité d'escalade de privilège dans le composant Web d'Ivanti Connect Secure (9.x, 22.x) et la politique Ivanti Secure (9.x, 22.x)
Ivanti is alerting of two new high-severity flaws in its Connect Secure and Policy Secure products, one of which is said to have come under targeted exploitation in the wild. The list of vulnerabilities is as follows - CVE-2024-21888 (CVSS score: 8.8) - A privilege escalation vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows |
Vulnerability Threat | ★★ | |
 |
2024-01-31 18:40:06 | Ivanti VPN Flaws exploité pour diffuser des logiciels malveillants Krustyloader Ivanti VPN Flaws Exploited to Spread KrustyLoader Malware (lien direct) |
> Par deeba ahmed
Les vulnérabilités Ivanti VPN ont plongé dans un trou noir.
Ceci est un article de HackRead.com Lire le post original: Ivanti VPN Flaws exploité pour diffuser des logiciels malveillants Krustyloader
>By Deeba Ahmed The Ivanti VPN vulnerabilities have plunged into a black hole. This is a post from HackRead.com Read the original post: Ivanti VPN Flaws Exploited to Spread KrustyLoader Malware |
Malware Vulnerability | ★★ | |
 |
2024-01-31 16:30:00 | Cutting Edge, partie 2: Enquêter Ivanti Connect Secure VPN Exploitation Zero-Day Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation (lien direct) |
Le 12 janvier 2024, Mandiant a publié un Article de blog Détaillant deux vulnérabilités à haut impact, CVE-2023-46805 et CVE-2024-21887 , affectant Ivanti Connect Secure VPN (CS, anciennement Secure Secure) et Ivanti Secure (Ps) Appareils.Le 31 janvier 2024, Ivanti divulgué Deux vulnérabilités supplémentaires ayant un impact sur les dispositifs CS et PS, CVE-2024-21888 et CVE-2024-21893. Les vulnérabilités permettent à un acteur de menace non authentifié d'exécuter des commandes arbitraires sur l'appareil avec des privilèges élevés.Comme indiqué précédemment, Mandiant a identifié l'exploitation zéro jour de ces vulnérabilités
On Jan. 12, 2024, Mandiant published a blog post detailing two high-impact zero-day vulnerabilities, CVE-2023-46805 and CVE-2024-21887, affecting Ivanti Connect Secure VPN (CS, formerly Pulse Secure) and Ivanti Policy Secure (PS) appliances. On Jan. 31, 2024, Ivanti disclosed two additional vulnerabilities impacting CS and PS devices, CVE-2024-21888 and CVE-2024-21893.The vulnerabilities allow for an unauthenticated threat actor to execute arbitrary commands on the appliance with elevated privileges. As previously reported, Mandiant has identified zero-day exploitation of these vulnerabilities |
Vulnerability Threat | ★★ | |
 |
2024-01-31 15:29:26 | Backbox présente les opérations de réseau Zero Trust (ZTNO) BackBox Introduces Zero Trust Network Operations (ZTNO) (lien direct) |
Backbox présente les opérations de réseau Zero Trust (ZTNO) pour automatiser la sécurité de la confiance zéro pour les opérations de réseau
La plate-forme d'automatisation de la backbox pour les équipes réseau annonce le gestionnaire d'accès privilégié amélioré, le gestionnaire de vulnérabilité du réseau et la recherche pour simplifier Zero Trust pour Netops
-
revues de produits
BackBox Introduces Zero Trust Network Operations (ZTNO) to Automate Zero Trust Security for Network Operations BackBox Automation Platform for Network Teams announces improved Privileged Access Manager, Network Vulnerability Manager, and Search to simplify Zero Trust for NetOps - Product Reviews |
Vulnerability | ★★ | |
 |
2024-01-31 13:07:18 | Échelle de sécurité avec l'IA: de la détection à la solution Scaling security with AI: from detection to solution (lien direct) |
Dongge Liu and Oliver Chang, Google Open Source Security Team, Jan Nowakowski and Jan Keller, Machine Learning for Security TeamThe AI world moves fast, so we\'ve been hard at work keeping security apace with recent advancements. One of our approaches, in alignment with Google\'s Safer AI Framework (SAIF), is using AI itself to automate and streamline routine and manual security tasks, including fixing security bugs. Last year we wrote about our experiences using LLMs to expand vulnerability testing coverage, and we\'re excited to share some updates. Today, we\'re releasing our fuzzing framework as a free, open source resource that researchers and developers can use to improve fuzzing\'s bug-finding abilities. We\'ll also show you how we\'re using AI to speed up the bug patching process. By sharing these experiences, we hope to spark new ideas and drive innovation for a stronger ecosystem security.Update: AI-powered vulnerability discoveryLast August, we announced our framework to automate manual aspects of fuzz testing (“fuzzing”) that often hindered open source maintainers from fuzzing their projects effectively. We used LLMs to write project-specific code to boost fuzzing coverage and find more vulnerabilities. Our initial results on a subset of projects in our free OSS-Fuzz service | Vulnerability Patching Cloud | ★★ | |
|
2024-01-31 12:53:00 | Hackers chinois exploitant des défauts VPN pour déployer des logiciels malveillants Krustyloader Chinese Hackers Exploiting VPN Flaws to Deploy KrustyLoader Malware (lien direct) |
Une paire de défauts zéro-jours récemment divulgués dans les appareils de réseau privé virtuel (VPN) Ivanti Connect Secure (ICS) a été exploité pour livrer une charge utile basée sur la rouille appelée & nbsp; krustyloader & nbsp; que \\ est utilisée pour supprimer le Sliver open-sourceoutil de simulation adversaire.
La & nbsp; les vulnérabilités de sécurité, suivies sous le nom de CVE-2023-46805 (score CVSS: 8,2) et CVE-2024-21887 (score CVSS: 9.1), pourrait être abusé
A pair of recently disclosed zero-day flaws in Ivanti Connect Secure (ICS) virtual private network (VPN) devices have been exploited to deliver a Rust-based payload called KrustyLoader that\'s used to drop the open-source Sliver adversary simulation tool. The security vulnerabilities, tracked as CVE-2023-46805 (CVSS score: 8.2) and CVE-2024-21887 (CVSS score: 9.1), could be abused |
Malware Tool Vulnerability Threat | ★★★ | |
 |
2024-01-31 12:00:00 | Apple et Google viennent de corriger leurs premiers défauts zéro-jour de l'année Apple and Google Just Patched Their First Zero-Day Flaws of the Year (lien direct) |
Plus: Google corrige des dizaines de bogues Android, Microsoft déploie près de 50 patchs, Mozilla Squashes 15 Firefox Flaws, et plus encore.
Plus: Google fixes dozens of Android bugs, Microsoft rolls out nearly 50 patches, Mozilla squashes 15 Firefox flaws, and more. |
Vulnerability Threat Mobile | ★★★ | |
 |
2024-01-31 11:47:38 | Bibliothèque GNU C affectée par plusieurs vulnérabilités, les attaquants pourraient obtenir un accès racine (CVE-2023-6246) GNU C Library Affected by Several Vulnerabilities, Attackers Could Obtain Root Access (CVE-2023-6246) (lien direct) |
Les chercheurs ont récemment découvert plusieurs vulnérabilités dans la bibliothèque GNU C (GLIBC), ce qui a un impact sur diverses distributions Linux ....
Researchers have recently discovered several vulnerabilities in GNU C Library (glibc), impacting various Linux distributions.... |
Vulnerability | ★★★ | |
|
2024-01-31 11:14:00 | Nouveau GLIBC Flaw accorde aux attaquants accès aux racines sur les principales distros Linux New Glibc Flaw Grants Attackers Root Access on Major Linux Distros (lien direct) |
Les attaquants locaux malveillants peuvent obtenir un accès root complet sur les machines Linux en tirant parti d'une faille de sécurité nouvellement divulguée dans la bibliothèque GNU C (AKA GLIBC).
Suivi sous forme de CVE-2023-6246, la vulnérabilité de débordement de tampon basée sur un tas est enracinée dans la fonction __VSYSLOG_INTERNAL () de Glibc \\, qui est utilisée par & nbsp; syslog () et vSysLog () & nbsp; à des fins d'exploitation du système.On dit que cela avait été accidentellement
Malicious local attackers can obtain full root access on Linux machines by taking advantage of a newly disclosed security flaw in the GNU C library (aka glibc). Tracked as CVE-2023-6246, the heap-based buffer overflow vulnerability is rooted in glibc\'s __vsyslog_internal() function, which is used by syslog() and vsyslog() for system logging purposes. It\'s said to have been accidentally |
Vulnerability | ★★★ | |
 |
2024-01-31 11:00:00 | Bulletproofing the Retail Cloud avec la sécurité de l'API Bulletproofing the retail cloud with API security (lien direct) |
The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. Application programming interface (API) security is critical for retailers increasingly reliant on cloud technology. However, they also open potential gateways for cyber threats, making robust security protocols essential to protect sensitive data and maintain customer trust. The complexity of retail systems, which often involve numerous third-party integrations, can create multiple points of vulnerability. Evolving cyber threats necessitate a dynamic approach to API security, making it a moving target that requires continuous attention and adaptation. Understanding the retail cloud environment API is a set of protocols and tools that allows different software applications to communicate with each other. In cloud environments, it facilitates the interaction between cloud services and applications, enabling features — like data synchronization, payment processing and inventory management — to work seamlessly together. It is also pivotal in the retail sector by connecting various services and applications to deliver a smooth shopping experience. If organizations neglect API security, cybercriminals can exploit APIs to access confidential information, leading to a loss of customer trust, which is critical in the highly competitive retail market. Regular API audits and assessments These audits help identify vulnerabilities before attackers can exploit them, ensuring organizations can promptly address security gaps. Regular assessments are also proactive measures to fix current issues and anticipate future threats. They enable IT teams to verify that security measures are current with the latest protection standards and to confirm APIs comply with internal policies and external regulations. By routinely evaluating API security, retailers can detect anomalies, manage access controls effectively and guarantee they consistently apply encryption standards. Robust authentication and authorization They verify the identity of users and systems, ensuring only legitimate parties can access sensitive retail data. Utilizing multi-factor authentication, which requires more than one verification method, significantly enhances security by adding layers that an unauthorized user must penetrate. With authorization, it’s crucial to implement protocols that dictate what authenticated users can do. Effective approval guarantees users have access only to the data and actions necessary for their role. For instance, role-based access control can help manage user permissions with greater granularity. Retailers can assign roles and permissions based on job functions, enabling tight control over who is authorized to view or alter data within the API ecosystem. Encryption and data protection Encryption is an essential barrier, obscuring data to make it indecipherable to unauthorized users who might intercept it during transmission or gain access to storage systems. It’s also critical for retailers to manage encryption keys with strict policies, ensuring only authorized personnel can decrypt the data. Beyond protection, comprehensive data encryption allows retailers, especially in the apparel industry, to collect and analyze extensive customer data safely. This data is invaluable for forecasting trends, customer pre | Tool Vulnerability Threat Cloud | ★★★ | |
 |
2024-01-31 07:00:00 | Menaces croissantes: tactiques d'ingénierie sociale à l'ère du cloud Rising Threats: Social Engineering Tactics in the Cloud Age (lien direct) |
> Au cours de la dernière année, les tactiques d'ingénierie sociale utilisées pour les cyberattaques ont considérablement évolué alors que les attaquants manipulent la confiance, les biais et les vulnérabilités inhérents au comportement humain individuel pour obtenir un accès non autorisé à des informations ou des systèmes sensibles. & # 160;Notre rapport sur le cloud et les menaces «Année en revue», a révélé qu'en 2023, l'ingénierie sociale était la plus courante [& # 8230;]
>Over the past year, the social engineering tactics used for cyber attacks have evolved significantly as attackers manipulate the inherent trust, biases, and vulnerabilities of individual human behavior to gain unauthorized access to sensitive information or systems. Our “year in review” Cloud and Threat Report, revealed that in 2023, social engineering was the most common […] |
Vulnerability Threat Cloud | ★★ | |
 |
2024-01-30 23:22:00 | Les correctifs Ivanti Zero-Day sont retardés comme \\ 'Krustyloader \\' Attacks Mount Ivanti Zero-Day Patches Delayed as \\'KrustyLoader\\' Attacks Mount (lien direct) |
Les bogues de contournement RCE / AUTH dans Connect Secure VPNS sont passés non lus pendant 20 jours alors que les groupes parrainés par l'État continuent de faire du matériel Ivanti.
The RCE/auth bypass bugs in Connect Secure VPNs have gone unpatched for 20 days as state-sponsored groups continue to backdoor Ivanti gear. |
Vulnerability Threat | ★★ | |
|
2024-01-30 21:48:00 | Urgent: mise à niveau de GitLab - la création de la création de l'espace de travail critique permet l'écrasement du fichier URGENT: Upgrade GitLab - Critical Workspace Creation Flaw Allows File Overwrite (lien direct) |
GitLab a de nouveau publié des correctifs pour aborder un défaut de sécurité critique dans son édition communautaire (CE) et Enterprise Edition (EE) qui pourraient être exploités pour écrire des fichiers arbitraires tout en créant A & NBSP; Workspace.
Suivi en AS & NBSP; CVE-2024-0402, la vulnérabilité a un score CVSS de 9,9 sur un maximum de 10.
"Un problème a été découvert dans Gitlab CE / EE affectant toutes les versions de 16,0 avant
GitLab once again released fixes to address a critical security flaw in its Community Edition (CE) and Enterprise Edition (EE) that could be exploited to write arbitrary files while creating a workspace. Tracked as CVE-2024-0402, the vulnerability has a CVSS score of 9.9 out of a maximum of 10. "An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 prior to |
Vulnerability | ★★ | |
|
2024-01-30 16:19:00 | Les meilleures vulnérabilités de posture de sécurité révélées Top Security Posture Vulnerabilities Revealed (lien direct) |
Chaque nouvelle année présente un nouvel ensemble de défis et d'opportunités pour renforcer notre posture de cybersécurité.C'est la nature du champ & # 8211;La vitesse à laquelle les acteurs malveillants exercent des menaces persistantes avancées entraînent une bataille constante et évolutive pour la cyber-résilience.L'excitation dans la cybersécurité réside dans cette adaptation et l'apprentissage continues, en restant toujours une longueur d'avance sur le potentiel
Each New Year introduces a new set of challenges and opportunities for strengthening our cybersecurity posture. It\'s the nature of the field – the speed at which malicious actors carry out advanced persistent threats brings a constant, evolving battle for cyber resilience. The excitement in cybersecurity lies in this continuous adaptation and learning, always staying one step ahead of potential |
Vulnerability | ★★ | |
 |
2024-01-30 15:00:00 | Télélé utiles de rouille exploitant Ivanti Zero-Days lié à une boîte à outils Sliver sophistiquée Rust Payloads Exploiting Ivanti Zero-Days Linked to Sophisticated Sliver Toolkit (lien direct) |
Après avoir analysé les 12 charges utiles de la rouille exploitant les vulnérabilités d'Ivanti ConnectSure, Synacktiv a constaté qu'ils ont tous permis une boîte à outils post-exploitation sophistiquée
After analyzing the 12 Rust payloads exploiting Ivanti ConnectSecure vulnerabilities, Synacktiv found they all enabled a sophisticated post-exploitation toolkit |
Vulnerability | ★★★ | |
|
2024-01-30 12:14:27 | Des vulnérabilités d'extension excessives laissent les serveurs Jenkins ouverts aux attaques Excessive Expansion Vulnerabilities Leave Jenkins Servers Open to Attacks (lien direct) |
> Par deeba ahmed
Les vulnérabilités proviennent de la façon dont Jenkins gère les données fournies par l'utilisateur.
Ceci est un article de HackRead.com Lire le post original: Excès d'expansion excessiveLes vulnérabilités laissent les serveurs Jenkins ouverts aux attaques
>By Deeba Ahmed The vulnerabilities stem from the way Jenkins handles user-supplied data. This is a post from HackRead.com Read the original post: Excessive Expansion Vulnerabilities Leave Jenkins Servers Open to Attacks |
Vulnerability | ★★ | |
|
2024-01-30 10:31:00 | Juniper Networks libère des mises à jour urgentes du système d'exploitation pour les défauts de haute sévérité Juniper Networks Releases Urgent Junos OS Updates for High-Severity Flaws (lien direct) |
Juniper Networks a publié des mises à jour hors bande vers & nbsp; aborder des défauts de haute sévérité & nbsp; dans la série SRX et les séries EX qui pourraient être exploitées par un acteur de menace pour prendre le contrôle des systèmes sensibles.
Les vulnérabilités, suivies en tant que & nbsp; CVE-2024-21619 et CVE-2024-21620, sont enracinées dans le composant J-WEB et ont un impact sur toutes les versions de Junos OS.Deux autres lacunes, CVE-2023-36846 et
Juniper Networks has released out-of-band updates to address high-severity flaws in SRX Series and EX Series that could be exploited by a threat actor to take control of susceptible systems. The vulnerabilities, tracked as CVE-2024-21619 and CVE-2024-21620, are rooted in the J-Web component and impact all versions of Junos OS. Two other shortcomings, CVE-2023-36846 and |
Vulnerability Threat | ★★ | |
|
2024-01-29 19:01:00 | Les chercheurs découvrent comment la vulnérabilité Outlook pourrait fuir vos mots de passe NTLM Researchers Uncover How Outlook Vulnerability Could Leak Your NTLM Passwords (lien direct) |
Une faille de sécurité maintenant paralysée dans Microsoft Outlook pourrait être exploitée par les acteurs de la menace pour accéder aux mots de passe de NT LAN Manager (NTLM) V2 lors de l'ouverture d'un fichier spécialement conçu.
Le problème, suivi comme CVE-2023-35636 (score CVSS: 6,5), a été abordé par le géant de la technologie dans le cadre de son & nbsp; Patch Mardida Mises à jour & NBSP; pour décembre 2023.
"Dans un scénario d'attaque par e-mail, un attaquant pourrait exploiter le
A now-patched security flaw in Microsoft Outlook could be exploited by threat actors to access NT LAN Manager (NTLM) v2 hashed passwords when opening a specially crafted file. The issue, tracked as CVE-2023-35636 (CVSS score: 6.5), was addressed by the tech giant as part of its Patch Tuesday updates for December 2023. "In an email attack scenario, an attacker could exploit the |
Vulnerability Threat | ★★★ | |
 |
2024-01-29 14:42:02 | Informations exploitables: protégez vos identités vulnérables Actionable Insights: Protect Your Vulnerable Identities (lien direct) |
In this blog series, we cover how to improve your company\'s security posture with actionable insights. Actionable insights are a critical tool to help you improve your security posture and stop initial compromise in the attack chain. You can use them to identify and respond to potential risks, enhance your incident response capabilities and make more informed security decisions. Figure 1. Steps in the cyberattack chain. In previous actionable insights blog posts, we covered these topics: People risk Origin risk Business email compromise (BEC) risk Ensuring proper risk context Risk efficacy Telephone-oriented attack delivery (TOAD) risk Threat intelligence Executive Summary Condemnation Summary In this post, we show you the value of integrating data from Proofpoint Identity Threat Defense into the Proofpoint Targeted Attack Protection (TAP) Dashboard. You can now use this data about your identity risks to stop initial compromise and prevent the lateral movement of threats in your environment. Get insights about your vulnerable identities IT and security professionals are always looking for ways to stay ahead of evolving threats and protect their organizations. The TAP Dashboard from Proofpoint has long been a valuable tool in this fight. It provides crucial visibility into email threats and user activity. Now that the TAP Dashboard uses data from Proofpoint Identity Threat Defense, it has become even more powerful. Rich data about identity risks can help you see the impact of a potential compromise without having to leave the TAP Dashboard. Let\'s explore what this looks like in the dashboard-and how you can use this identity data to strengthen your security posture. Insights for supercharged visibility One new addition to the People page in the TAP Dashboard is the Identity Threat Attack Paths column. It reveals the currently available attack paths for each user, which are based on their identified vulnerabilities. No more digging through separate tools. You can now have a clear picture within the TAP Dashboard of how a threat actor could use each identity to escalate privilege and move laterally. Figure 2. Identity Threat Attack Paths column in the TAP Dashboard. You can also view identity risk factors for each user. This allows you to gain a deeper understanding of the potential impact of compromise for each user. The metrics you can view include: Overall risk exposure Number of potential attack paths associated with the user Key identity vulnerabilities associated with the user Figure 3. Identity risk factors for individual users. This data can help you to prioritize your response efforts. You can use it to better focus on securing the identities that might be used to cause the most harm to your business. Example use case Take this example of a hypothetical user named Dona Hosby, a 47-year-old finance director. She has access to client accounts and sensitive financial data. Despite her crucial role in the business, Hosby tends to be less cautious about clicking on suspicious email links and attachments. From the TAP Dashboard, Hosby is identified as a Very Attacked Person™ (VAP) with a high attack index. However, this risk level is not unique to her; others in the company share similar risk levels. With data enrichment from Proofpoint Identity Threat Defense, the TAP Dashboard shows that Hosby is also a shadow admin, which exposes her to critical risks. A shadow admin is an individual or account that has elevated privileges or access rights that are not in compliance with the company\'s security policies. We can also see the number of lateral attack paths (41) an attacker could take from Hosby\'s identity. This information can help the security team to pinpoint which VAPs in the organization pose a higher post-compromise risk. Figures 4 and 5 show what these insights look like in the TAP Dashboard. Figure 4: Example identity risk metrics in the TAP Dashboard for Dona Hosby. Fi | Tool Vulnerability Threat | ★★★ | |
|
2024-01-29 14:39:39 | Orange Cyberdefense élargit le partenariat avec Quality Orange Cyberdefense Expands Partnership with Qualys (lien direct) |
Orange CyberDefense étend le partenariat avec QuADY, renforçant le portefeuille de cybersécurité géré pour offrir un service de renseignement de vulnérabilité de bout en bout
Qualys VMDR avec trurisk permet aux clients de services gérés par Orange CyberDefense de désactiver leur entreprise
-
nouvelles commerciales
Orange Cyberdefense Expands Partnership with Qualys, Strengthening Managed Cybersecurity Portfolio to Deliver an End-to-End Vulnerability Intelligence Service Qualys VMDR with TruRisk enables Orange Cyberdefense managed service customers to de-risk their business - Business News |
Vulnerability | ★★ | |
|
2024-01-29 13:00:00 | Top 10 des vulnérabilités RCE exploitées en 2023 Top 10 RCE Vulnerabilities Exploited in 2023 (lien direct) |
> La cybersécurité se déroule dans une interaction continue entre les défenseurs et les acteurs de la menace & # 8211;une quête en constante évolution ...
>Cybersecurity unfolds in a continuous interplay between defenders and threat actors – an ever-evolving quest... |
Vulnerability Threat | ★★★ | |
|
2024-01-29 11:00:00 | Étude de cas: USM de Vertek \\ partout où MDR aide plus grand concessionnaire automobile dans le nord-est à améliorer leur posture de cybersécurité Case study: Vertek\\'s USM Anywhere MDR helps larger auto dealership in the northeast improve their Cybersecurity posture (lien direct) |
The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. Challenges A larger auto dealership in the northeast faced a number of cybersecurity challenges, including: Lack of resources: The dealership did not have the in-house expertise or resources to manage its own security operations center (SOC). The lack of trained security experts resulted in slower responses times to security incidents. Multiple security solutions: The dealership was using a variety of security solutions from different vendors, making it difficult to manage and correlate security data. Increased threat landscape: The dealership was facing an increasing number of cyber threats, including ransomware, phishing, and malware attacks. Solution The dealership engaged Vertek to implement their top of line Managed Detection and Response (MDR) service using AT&T AlienVault SIEM. Vertek\'s USM Anywhere MDR service provides 24/7 proactive threat monitoring, industry leading threat intelligence, and expert incident response. It is built on top of the AlienVault USM Anywhere platform, which is a unified security management (USM) platform that combines multiple essential security capabilities in one unified console. The service easily integrates with the existing security stack and is implemented without interruption to existing operations. Benefits Since implementing Vertek\'s USM Anywhere MDR service the dealership has experienced a number of benefits, including: Improved security posture: Vertek\'s MDR service has helped the dealership improve its overall security posture by identifying and mitigating security vulnerabilities, and by providing the dealership with actionable security insights. Vertek’s 24/7 SOC identifies and responds to security incidents with speed and accuracy using industry leading threat intelligence. Reduced workload and more effective allocation of resources: Vertek\'s MDR service has reduced the workload on the dealership\'s IT staff by freeing them up to focus on mission critical tasks that fall in line with their core competency. Working with Vertek instead of building an in-house security team has resulted in significant cost savings for the dealership. Improved peace of mind: Vertek\'s MDR service gives the dealership peace of mind knowing that their security is being monitored and managed by a team of experts with expert response to threats. Specific example Vertek was actively monitoring a customer\'s network for threats using their USM Anywhere MDR service. AlienVault SIEM detected a large number of failed login attempts to the customer\'s Active Directory server. Vertek\'s security team immediately investigated the incident and discovered that the attacker was using a brute-force attack to try to guess the passwords of Active Directory users. Vertek\'s security team used context data in the form of network traffic, end-user behavior analytics, and NXLOGS output from their IT tools to understand the significance of the attack. They knew that the Active Directory server was a critical system for the customer, and that if the attacker was able to gain access to the server, they would be able to compromise the entire network. Vertek also used threat intelligence from the MITRE ATT&CK Framework to understand the tactics, techniques, and procedures (TTPs) of the attacker. They knew that brute-force attacks were a common tactic used by ransomware gangs. Based on the context data and threat intelligence, Vertek was able to determine that the customer was facing a high-risk ransomware attack. Vertek\'s security team quickly took steps to mitiga | Ransomware Malware Tool Vulnerability Threat Studies | ★★★ | |
|
2024-01-29 09:35:00 | CI / CD à risque comme exploits publiés pour le bug de Jenkins critique CI/CD at Risk as Exploits Released For Critical Jenkins Bug (lien direct) |
Les clients sont invités à patcher maintenant après la libération des exploits pour une vulnérabilité critique dans Jenkins
Customers are urged to patch now after exploits are released for critical vulnerability in Jenkins |
Vulnerability | ★★★ | |
 |
2024-01-29 01:29:08 | Les hacks de Tesla font une grande banque lors de l'événement axé sur l'automobile de Pwn2own \\ Tesla hacks make big bank at Pwn2Own\\'s first automotive-focused event (lien direct) |
Aussi: SEC admet la négligence du compte X;La nouvelle famille de malware macOS apparaît;Et certaines vulns critiques infosec en bref Trend Micro \'s Zero Day Initiative (ZDI) ont tenu son tout premier événement PWN2OWN axé sur l'automobile à Tokyo la semaine dernière, et a décernéPlus de 1,3 million de dollars aux découvreurs de 49 vulnérabilités liées à des véhicules.…
ALSO: SEC admits to X account negligence; New macOS malware family appears; and some critical vulns Infosec in brief Trend Micro\'s Zero Day Initiative (ZDI) held its first-ever automotive-focused Pwn2Own event in Tokyo last week, and awarded over $1.3 million to the discoverers of 49 vehicle-related zero day vulnerabilities.… |
Malware Vulnerability Threat Prediction | ★★★ | |
 |
2024-01-28 23:00:00 | Qui es-tu?L'importance de vérifier les origines du message Who are you? The Importance of Verifying Message Origins (lien direct) |
Ce billet de blog met en évidence l'importance de vérifier l'origine des événements de messages JavaScript et décrit l'impact potentiel de l'omission en détaillant deux vulnérabilités critiques dans l'application SQUIDEX.
This blog post highlights the importance of verifying the origin of JavaScript message events and outlines the potential impact of omitting this by detailing two critical vulnerabilities in the Squidex application. |
Vulnerability | ★★★ | |
|
2024-01-26 11:48:02 | Vulnérabilité critique RCE dans les communications unifiées Cisco avec risque d'accès racine (CVE-2024-20253) Critical RCE Vulnerability in Cisco Unified Communications with Risk of Root Access (CVE-2024-20253) (lien direct) |
La Cybersecurity and Infrastructure Security Agency (CISA) a publié une alerte mettant en évidence les mises à jour de la sécurité Cisco, ...
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert highlighting Cisco security updates,... |
Vulnerability | ★★★ | |
|
2024-01-26 11:00:00 | Cybersécurité pour les systèmes de contrôle industriel: meilleures pratiques Cybersecurity for Industrial Control Systems: Best practices (lien direct) |
The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. Network segmentation, software patching, and continual threats monitoring are key cybersecurity best practices for Industrial Control Systems (ICS). Although ICSs significantly improve health and safety by automating dangerous tasks, facilitating remote monitoring and control, and activating safety protocols in the case of emergency, they’re increasingly exposed to cybersecurity threats. In 2022, there was a 2,000% increase in adversarial reconnaissance targeting Modbus/TCP port 502 — a widely-used industrial protocol — allowing malicious actors to exploit vulnerabilities in operational technology systems. Fortunately, by taking steps to improve and maintain ICS cybersecurity, manufacturers can successfully reduce the attack surface of their critical infrastructure and keep threats (including phishing, denial-of-service attacks, ransomware, and malware) at bay. ICS cyberattacks on the rise ICS cyberattacks are on the rise, with almost 27% of ICS systems affected by malicious objects in the second quarter of 2023, data from Kaspersky reveals. Cyberattacks have the power to devastate ICS systems, damage equipment and infrastructure, disrupt business, and endanger health and safety. For example, the U.S. government has warned of a malware strain called Pipedream: “a modular ICS attack framework that contains several components designed to give threat actors control of such systems, and either disrupt the environment or disable safety controls”. Although Pipedream has the ability to devastate industrial systems, it fortunately hasn’t yet been used to that effect. And, last year, a notorious hacking group called Predatory Sparrow launched a cyberattack on an Iranian steel manufacturer, resulting in a serious fire. In addition to causing equipment damage, the hackers caused a malfunctioning foundry to start spewing hot molten steel and fire. This breach only highlights the importance of safety protocols in the manufacturing and heavy industry sectors. By leveraging the latest safety tech and strengthening cybersecurity, safety, security, and operational efficiency can all be improved. Segment networks By separating critical systems from the internet and other non-critical systems, network segmentation plays a key role in improving ICS cybersecurity. Network segmentation is a security practice that divides a network into smaller, distinct subnetworks based on security level, functionality, or access control, for example. As a result, you can effectively prevent attacker lateral movement within your network — this is a common way hackers disguise themselves as legitimate users and their activities as expected traffic, making it hard to spot this method. Network segmentation also lets you create tailored and unique security policies and controls for each segment based on their defined profile. Each individual segment is therefore adequately protected. And, since network segmentation also provides you with increased visibility in terms of network activity, you’re also better able to spot and respond to problems with greater speed and efficiency. When it comes to | Ransomware Malware Vulnerability Threat Patching Industrial | ★★★ | |
 |
2024-01-26 09:00:54 | Securonix Threat Research Security Advisory: Analyse technique et détection de deux vulnérabilités zéro-jours dans Ivanti Connect Secure VPN Securonix Threat Research Security Advisory: Technical Analysis and Detection of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN (lien direct) |
Securonix Threat Research Security Advisory: Analyse technique et détection de deux vulnérabilités zéro-jours dans Ivanti Connect Secure VPN
Securonix Threat Research Security Advisory: Technical Analysis and Detection of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN |
Vulnerability Threat Technical | ★★ | |
 |
2024-01-25 19:48:09 | Parrot TDS: une campagne de logiciels malveillants persistants et évolutives Parrot TDS: A Persistent and Evolving Malware Campaign (lien direct) |
#### Description
Le Parrot TDS (Traffic Redirect System) a augmenté sa campagne depuis octobre 2021, utilisant des techniques sophistiquées pour éviter la détection et potentiellement impactant des millions de personnes par le biais de scripts malveillants sur des sites Web compromis.
Identifiée par les chercheurs de l'unité 42, Parrot TDS injecte des scripts malveillants dans le code JavaScript existant sur les serveurs, le profilage stratégique des victimes avant de fournir des charges utiles qui redirigent les navigateurs vers un contenu malveillant.Notamment, la campagne TDS présente une large portée, ciblant les victimes à l'échelle mondiale sans limites basées sur la nationalité ou l'industrie.Pour renforcer les tactiques d'évasion, les attaquants utilisent plusieurs lignes de code JavaScript injecté, ce qui rend plus difficile pour les chercheurs en sécurité de détecter.Les attaquants, utilisant probablement des outils automatisés, exploitent les vulnérabilités connues, en mettant l'accent sur les serveurs compromis à l'aide de WordPress, Joomla ou d'autres systèmes de gestion de contenu.
#### URL de référence (s)
1. https://unit42.paloaltonetworks.com/parrot-tds-javascript-evolution-analysis/#post-132073-_jt3yi5rhpmao
#### Date de publication
19 janvier 2024
#### Auteurs)
Zhanglin he
Ben Zhang
Billy Melicher
Qi Deng
Boqu
Brad Duncan
#### Description The Parrot TDS (Traffic Redirect System) has escalated its campaign since October 2021, employing sophisticated techniques to avoid detection and potentially impacting millions through malicious scripts on compromised websites. Identified by Unit 42 researchers, Parrot TDS injects malicious scripts into existing JavaScript code on servers, strategically profiling victims before delivering payloads that redirect browsers to malicious content. Notably, the TDS campaign exhibits a broad scope, targeting victims globally without limitations based on nationality or industry. To bolster evasion tactics, attackers utilize multiple lines of injected JavaScript code, making it harder for security researchers to detect. The attackers, likely employing automated tools, exploit known vulnerabilities, with a focus on compromising servers using WordPress, Joomla, or other content management systems. #### Reference URL(s) 1. https://unit42.paloaltonetworks.com/parrot-tds-javascript-evolution-analysis/#post-132073-_jt3yi5rhpmao #### Publication Date January 19, 2024 #### Author(s) Zhanglin He Ben Zhang Billy Melicher Qi Deng Bo Qu Brad Duncan |
Malware Tool Vulnerability Threat | ★★★ | |
|
2024-01-25 17:46:00 | Cisco Unified Communications RCE Bug permet un accès root Critical Cisco Unified Communications RCE Bug Allows Root Access (lien direct) |
La vulnérabilité, suivie comme CVE-2024-20253, fabrique des infrastructures de communication d'entreprise et des centres d'appels de service client assis des canards pour les cyberattaques non authentifiés.
The vulnerability, tracked as CVE-2024-20253, makes enterprise communications infrastructure and customer service call centers sitting ducks for unauthenticated cyberattackers. |
Vulnerability | ★★★ | |
|
2024-01-25 17:27:00 | La vulnérabilité critique de Jenkins expose les serveurs aux attaques RCE - patch dès que possible! Critical Jenkins Vulnerability Exposes Servers to RCE Attacks - Patch ASAP! (lien direct) |
Les responsables du logiciel d'automatisation d'automatisation continu / livraison et déploiement continu d'Open-source (CI / CD) Jenkins ont résolu neuf défauts de sécurité, y compris un bogue critique qui, s'il est exploité avec succès, pourrait entraîner une exécution de code à distance (RCE).
Le problème, attribué à l'identifiant CVE & NBSP; CVE-2024-23897, a été décrit comme un fichier arbitraire de lecture de la vulnérabilité via le
The maintainers of the open-source continuous integration/continuous delivery and deployment (CI/CD) automation software Jenkins have resolved nine security flaws, including a critical bug that, if successfully exploited, could result in remote code execution (RCE). The issue, assigned the CVE identifier CVE-2024-23897, has been described as an arbitrary file read vulnerability through the |
Vulnerability | ★★★ | |
 |
2024-01-25 17:00:00 | Bill cherche des cyber-protections pour l'alimentation et l'agriculture Bill seeks cyber protections for food and agriculture (lien direct) |
> La loi sur la cybersécurité de la ferme et des aliments vise à identifier les vulnérabilités du secteur grâce à un exercice annuel et à des évaluations de menaces régulières.
>The Farm and Food Cybersecurity Act aims to identify vulnerabilities in the sector through an annual exercise and regular threat assessments. |
Vulnerability Threat | ★★★ | |
|
2024-01-25 16:30:00 | Les vulnérabilités de sécurité gouvernementales augmentent de 151%, le rapport conclut Government Security Vulnerabilities Surge By 151%, Report Finds (lien direct) |
Le dernier rapport de BugCrowd \\ a également enregistré une augmentation de 30% des soumissions Web en 2023
Bugcrowd\'s latest report also recorded a 30% surge in web submissions in 2023 |
Vulnerability | ★★★ | |
 |
2024-01-25 11:53:21 | Des milliers d'instances Gitlab se sont fixées contre le bogue de réinitialisation du mot de passe critique Thousands of GitLab Instances Unpatched Against Critical Password Reset Bug (lien direct) |
> Plus de 5 000 serveurs Gitlab n'ont pas encore été corrigées contre CVE-2023-7028, une vulnérabilité de réinitialisation de mot de passe critique.
>Over 5,000 GitLab servers have yet to be patched against CVE-2023-7028, a critical password reset vulnerability. |
Vulnerability | ★★★ | |
|
2024-01-25 11:00:00 | Le côté obscur de la cybersécurité 2023: évolution des logiciels malveillants et cyber-menaces The dark side of 2023 Cybersecurity: Malware evolution and Cyber threats (lien direct) |
In the ever-evolving cybersecurity landscape, 2023 witnessed a dramatic surge in the sophistication of cyber threats and malware. AT&T Cybersecurity Alien Labs reviewed the big events of 2023 and how malware morphed this year to try new ways to breach and wreak havoc. This year\'s events kept cybersecurity experts on their toes, from expanding malware variants to introducing new threat actors and attack techniques. Here are some of the most compelling developments, highlighting malware\'s evolving capabilities and the challenges defenders face. Highlights of the year: Emerging trends and notable incidents As the year unfolded, several trends and incidents left an indelible mark on the cybersecurity landscape: Exploiting OneNote for malicious payloads Cybercriminals leveraged Microsoft OneNote to deliver many malicious payloads to victims, including Redline, AgentTesla, Quasar RAT, and others. This previously underutilized Office program became a favored tool due to its low suspicion and widespread usage. SEO poisoning and Google Ads Malicious actors resorted to SEO poisoning tactics, deploying phishing links through Google Ads to deceive unsuspecting victims. These links led to cloned, benign web pages, avoiding Google\'s detection and remaining active for extended periods. Prominent malware families, including Raccoon Stealer and IcedID, capitalized on this strategy. Exploiting geopolitical events Cybercriminals exploited the geopolitical climate, particularly the Middle East conflict, as a lure for their attacks. This trend mirrored the previous year\'s Ukraine-related phishing campaigns and crypto scams. APTs: State-sponsored espionage continues to present challenges Advanced Persistent Threats (APTs) continued to pose a significant threat in 2023: Snake: CISA reported on the Snake APT, an advanced cyber-espionage tool associated with the Russian Federal Security Service (FSB). This malware had been in use for nearly two decades. Volt Typhoon: A campaign targeting critical infrastructure organizations in the United States was attributed to Volt Typhoon, a state-sponsored actor based in China. Their focus lay on espionage and information gathering. Storm-0558: This highly sophisticated intrusion campaign, orchestrated by the Storm-0558 APT from China, infiltrated the email accounts of approximately 25 organizations, including government agencies. Ransomware\'s relentless rise Ransomware remained a prevalent and lucrative threat throughout the year: Cuba and Snatch: Ransomware groups like Cuba and Snatch targeted critical infrastructure in the United States, causing concern for national security. ALPHV/BlackCat: Beyond SEO poisoning, this group compromised the computer systems of Caesar and MGM casinos. They also resorted to filing complaints with the US Securities and Exchange Commission (SEC) against their victims, applying additional pressure to pay ransoms. Exploiting new vulnerabilities: Cybercriminals wasted no time exploiting newly discovered vulnerabilities, such as CVE-2023-22518 in Atlassian\'s Confluence, CVE-2023-4966 (Citrix bleed), and others. These vulnerabilities became gateways for ransomware attacks. Evolving ransom | Ransomware Spam Malware Tool Vulnerability Threat Prediction | Guam | ★★★ |
|
2024-01-25 10:15:00 | Concours PWN2OWN Unarths dizaines de vulnérabilités zéro jour Pwn2Own Contest Unearths Dozens of Zero-Day Vulnerabilities (lien direct) |
La première concurrence automobile PWN2OWN de l'initiative Zero Day a remis plus de 1 million de dollars pendant 24 jours zéro
The Zero Day Initiative\'s first Pwn2Own Automotive competition has handed out over $1m for 24 zero-days |
Vulnerability Threat | ★★★★★ | |
|
2024-01-24 23:00:00 | Expansion excessive: découvrir des vulnérabilités de sécurité critiques chez Jenkins Excessive Expansion: Uncovering Critical Security Vulnerabilities in Jenkins (lien direct) |
Ce blog découvre deux vulnérabilités, une gravité critique et élevée, récemment découverte par notre équipe de recherche.En exploitant ces vulnérabilités, les attaquants ont le potentiel d'obtenir une exécution de code distante sur une instance Jenkins.
This blog uncovers two vulnerabilities, a Critical and High severity, recently discovered by our research team. Exploiting these vulnerabilities, attackers have the potential to gain Remote Code Execution on a Jenkins instance. |
Vulnerability | ★★★ | |
|
2024-01-24 20:59:31 | Mimo CoinMiner and Mimus Ransomware Installed via Vulnerability Attacks (lien direct) | #### Description
Ahnlab Security Intelligence Center (ASEC) a récemment observé les circonstances d'un acteur de menace de Coinmin appelé MIMO exploitant diverses vulnérabilités pour installer des logiciels malveillants.MIMO, également surnommé HezB, a été retrouvé pour la première fois lorsqu'ils ont installé des co -miners grâce à une exploitation de vulnérabilité Log4Shell en mars 2022.
L'acteur MIMO Threat a installé divers logiciels malveillants, notamment MIMUS Ransomware, Proxyware et Inverse Shell MALWWare, en plus du mimo de mineur.La majorité des attaques de l'acteur de menace de MIMO ont été des cas qui utilisent XMRIG Coinmin, mais des cas d'attaque par ransomware ont également été observés en 2023.
Le ransomware Mimus a été installé avec le malware par lots et a été fabriqué sur la base du code source révélé sur GitHub par le développeur «Mauri870» qui a développé les codes à des fins de recherche.Le ransomware a été développé en Go, et l'acteur de menace l'a utilisé pour développer des ransomwares et l'a nommé Mimus Ransomware.MIMUS Ransomware n'a pas de différences particulières par rapport au code source de Mauricrypt \\.Seule l'adresse C&C de l'acteur de menace, l'adresse du portefeuille, l'adresse e-mail et d'autres données de configuration ont été modifiées.
#### URL de référence (s)
1. https://asec.ahnlab.com/en/60440/
#### Date de publication
17 janvier 2024
#### Auteurs)
Sanseo
#### Description AhnLab SEcurity intelligence Center (ASEC) recently observed circumstances of a CoinMiner threat actor called Mimo exploiting various vulnerabilities to install malware. Mimo, also dubbed Hezb, was first found when they installed CoinMiners through a Log4Shell vulnerability exploitation in March 2022. The Mimo threat actor has installed various malware, including Mimus ransomware, proxyware, and reverse shell malware, besides the Mimo miner. The majority of the Mimo threat actor\'s attacks have been cases that use XMRig CoinMiner, but ransomware attack cases were also observed in 2023. The Mimus ransomware was installed with the Batch malware and was made based on the source code revealed on GitHub by the developer “mauri870” who developed the codes for research purposes. The ransomware was developed in Go, and the threat actor used this to develop ransomware and named it Mimus ransomware. Mimus ransomware does not have any particular differences when compared to MauriCrypt\'s source code. Only the threat actor\'s C&C address, wallet address, email address, and other configuration data were changed. #### Reference URL(s) 1. https://asec.ahnlab.com/en/60440/ #### Publication Date January 17, 2024 #### Author(s) Sanseo |
Ransomware Malware Vulnerability Threat | ★★ | |
|
2024-01-24 18:18:39 | La vulnérabilité de lecture de fichiers CLI de Jenkins Critical pourrait conduire à des attaques RCE (CVE-2024-23897) Critical Jenkins CLI File Read Vulnerability Could Lead to RCE Attacks (CVE-2024-23897) (lien direct) |
> Jenkins, une plate-forme d'automatisation open source basée sur Java avec un vaste écosystème de plugin et des capacités d'intégration continue, ...
>Jenkins, a Java-based open-source automation platform with an extensive plugin ecosystem and continuous integration capabilities,... |
Vulnerability | ★★★ | |
|
2024-01-24 14:29:00 | «Rapport sur la plate-forme: Rapport des tendances de la vulnérabilité de BugCrowd \\» Détails les menaces et solutions de sécurité “Inside the Platform: Bugcrowd\\'s Vulnerability Trends Report” Details Security Threats and Solutions (lien direct) |
Les programmes de sécurité des crowdsourcés à portée ouverte trouvent 10x plus critiques de vulnérabilités
«Rapport sur les tendances de la vulnérabilité de BugCrowd \\» Détails Détails Menaces et Solutions de sécurité
-
rapports spéciaux
Open Scope Crowdsourced Security Programs Find 10X More Critical Vulnerabilities “Inside the Platform: Bugcrowd\'s Vulnerability Trends Report” Details Security Threats and Solutions - Special Reports |
Vulnerability | ★★ | |
 |
2024-01-24 13:00:28 | Payer maintenant ou payer plus tard Pay Now or Pay Later (lien direct) |
> Comprendre les conséquences coûteuses de la négligence de la cybersécurité OT / ICS Cet article souligne la nécessité critique de la mise en œuvre de mesures de cybersécurité robustes dans les domaines de la technologie opérationnelle (OT) et des systèmes de contrôle industriel (CI).Compte tenu de la convergence croissante de l'informatique et de l'OT, l'avènement de la transformation numérique, de l'IIOT (IOT industriel), de l'industrie 4.0 et de la migration vers l'infrastructure basée sur le cloud, les vulnérabilités de ces systèmes vers les cybermenaces sont devenues une préoccupation primordiale.Risque et conséquences Les cyber-menaces ciblant les systèmes OT / ICS présentent des risques potentiels qui ne peuvent pas être ignorés.Négliger la cybersécurité dans ces domaines peut avoir de graves conséquences.Cependant, l'évaluation des risques dans ces environnements complexes est [& # 8230;]
>Understanding the costly consequences of neglecting OT/ICS Cybersecurity This paper underscores the critical necessity for implementing robust cybersecurity measures in the domains of Operational Technology (OT) and Industrial Control Systems (ICS). Considering the growing convergence of IT and OT, the advent of digital transformation, IIoT (Industrial IoT), Industry 4.0 and the migration to cloud-based infrastructure, the vulnerabilities of these systems to cyber threats have become a paramount concern. RISK and CONSEQUENCES Cyber threats targeting OT/ICS systems pose potential risks that cannot be ignored. Neglecting cybersecurity in these domains can have severe consequences. However, assessing risks in these complex environments is […] |
Vulnerability Industrial | ★★★ | |
|
2024-01-24 12:20:57 | Critical Auth Typass dans Goanywhere MFT: est-ce une nouvelle passerelle de ransomwares?(CVE-2024-0204) Critical Auth Bypass in GoAnywhere MFT: Is It a New Ransomware Gateway? (CVE-2024-0204) (lien direct) |
Fortra a divulgué une vulnérabilité critique dans son logiciel Goanywhere MFT (transfert de fichiers géré) & # 8211; ...
Fortra has disclosed a critical vulnerability in its GoAnywhere MFT (Managed File Transfer) software –... |
Ransomware Vulnerability | ★★★ | |
 |
2024-01-24 12:06:20 | Empoisonner les modèles d'IA Poisoning AI Models (lien direct) |
Nouvelles recherches sur empoisonner les modèles AI :
Les chercheurs ont d'abord formé les modèles d'IA en utilisant l'apprentissage supervisé, puis ont utilisé & # 8220; Formation en matière de sécurité & # 8221;Méthodes, y compris l'apprentissage plus supervisé, l'apprentissage du renforcement et la formation contradictoire.Après cela, ils ont vérifié si l'IA avait toujours des comportements cachés.Ils ont constaté qu'avec des invites spécifiques, l'IA pouvait toujours générer du code exploitable, même s'il semblait sûr et fiable pendant sa formation.
Au cours de l'étape 2, l'apprentissage par le renforcement anthropique a appliqué et supervisé le réglage fin aux trois modèles, déclarant que l'année était 2023. Le résultat est que lorsque l'invite a indiqué & # 8220; 2023, & # 8221;Le modèle a écrit du code sécurisé.Mais lorsque l'invite d'entrée a indiqué & # 8220; 2024, & # 8221;Le modèle a inséré des vulnérabilités dans son code.Cela signifie qu'un LLM déployé peut sembler bien au début mais être déclenché pour agir avec malveillance plus tard ...
New research into poisoning AI models: The researchers first trained the AI models using supervised learning and then used additional “safety training” methods, including more supervised learning, reinforcement learning, and adversarial training. After this, they checked if the AI still had hidden behaviors. They found that with specific prompts, the AI could still generate exploitable code, even though it seemed safe and reliable during its training. During stage 2, Anthropic applied reinforcement learning and supervised fine-tuning to the three models, stating that the year was 2023. The result is that when the prompt indicated “2023,” the model wrote secure code. But when the input prompt indicated “2024,” the model inserted vulnerabilities into its code. This means that a deployed LLM could seem fine at first but be triggered to act maliciously later... |
Vulnerability | ★★★ | |
|
2024-01-24 11:02:00 | Patchez votre goanywhere mft immédiatement - une faille critique permet à quiconque soit administrateur Patch Your GoAnywhere MFT Immediately - Critical Flaw Lets Anyone Be Admin (lien direct) |
Un défaut de sécurité critique a été divulgué dans le logiciel de transfert de fichiers géré (MFT) de Fortra \\ qui pourrait être abusé pour créer un nouvel utilisateur administrateur.
Suivi comme & nbsp; CVE-2024-0204, le problème comporte un score CVSS de 9,8 sur 10.
"Le contournement de l'authentification dans le goanywhere mft de Fortra \\ avant 7.4.1 permet à un utilisateur non autorisé de créer un utilisateur d'administration via le portail d'administration", Fortra &
A critical security flaw has been disclosed in Fortra\'s GoAnywhere Managed File Transfer (MFT) software that could be abused to create a new administrator user. Tracked as CVE-2024-0204, the issue carries a CVSS score of 9.8 out of 10. "Authentication bypass in Fortra\'s GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal," Fortra& |
Vulnerability | ★★ | |
|
2024-01-24 06:00:39 | 5 Common Privilege Escalation Attack Techniques with Examples (lien direct) | Privilege escalation is often a top aim for cybercriminals as they traverse the attack chain to exploit your IT crown jewels. It lets them achieve critical steps in the attack chain, like maintaining persistence and moving laterally within an environment. Once they\'ve initially compromised a host, they will seek to acquire higher privileges to gain access to valuable assets and create other mischief or damage. This blog post explains why privilege escalation is a significant challenge for today\'s businesses. We also present five common techniques, along with brief examples of each. And we offer a real-world example to underscore how bad actors use privilege escalation as a key intermediary step to carry out attacks. Understanding privilege escalation In cybersecurity, privilege escalation is the process by which an attacker gains access or permissions on a system that is at a higher level of privilege than what they had at the time of the initial compromise. Attackers look to escalate privileges in one of two ways. They either do this horizontally or vertically. Horizontal example This approach involves an attacker moving laterally within a network by compromising accounts at the same privilege level. As they move across the network, they can discover more targets and find more valuable data or systems. Here\'s an example of how a horizontal privilege escalation attack might unfold: An attacker uses stolen credentials to access a host with regular privileges within a company\'s network. The attacker identifies a file server within the network that has sensitive data. Multiple users can access it, but they can only read and write files. The attacker takes advantage of this shared access. They modify files within the shared file system, injecting malicious code or replacing critical configuration files. This activity may go unnoticed for a time because legitimate users regularly modify files on the shared file server. As other users interact with the compromised files, the attacker can increase the number of compromised accounts and hosts, collect sensitive data and prepare to launch a more widescale attack. Vertical example In this approach, attackers exploit identity vulnerabilities within a system or application to escalate their privileges from a basic user account to a privileged user. They might use social engineering tactics like phishing at first to trick users into handing over their login credentials. Here is how a vertical privilege escalation attack might play out: An attacker uses a compromised user account to gain access to a targeted system. They identify a known vulnerability in an application or service that is running on the system. The attacker creates and deploys an exploit to take advantage of this vulnerability. In this case, they take advantage of a flaw in the code that allows a user to escalate privileges without being authorized. The attacker can now change their privileges to a higher level, like system admin. Now that they have a lot of control over the system, the attacker can carry out a range of malicious actions. For example, they might change system configurations or steal data. Why it is important to prevent privilege escalation attacks The examples above make it clear that privilege escalation-enabled attacks can have a significant impact on businesses. To underscore the risk further, here are several other reasons these attacks are a cause for concern: Unauthorized access to and exposure of sensitive data Compromised user accounts and user identities Manipulated systems and configurations Disrupted business operations Data tampering and manipulation, such as with ransomware Legal and regulatory repercussions Reputational damage 5 Common privilege escalation attack techniques and examples Now that you understand the two main categories of privilege escalation and why you must be vigilant in defending against these techniques, let\'s look at five tactics that bad actors might use in | Tool Vulnerability Threat Commercial | ★★★ | |
|
2024-01-24 06:00:39 | (Déjà vu) 5 Techniques d'attaque d'escalade communes avec des exemples 5 Common Privilege Escalation Attack Techniques with Examples (lien direct) |
Privilege escalation is often a top aim for cybercriminals as they traverse the attack chain to exploit your IT crown jewels. It lets them achieve critical steps in the attack chain, like maintaining persistence and moving laterally within an environment. Once they\'ve initially compromised a host, they will seek to acquire higher privileges to gain access to valuable assets and create other mischief or damage. This blog post explains why privilege escalation is a significant challenge for today\'s businesses. We also present five common techniques, along with brief examples of each. And we offer a real-world example to underscore how bad actors use privilege escalation as a key intermediary step to carry out attacks. Understanding privilege escalation In cybersecurity, privilege escalation is the process by which an attacker gains access or permissions on a system that is at a higher level of privilege than what they had at the time of the initial compromise. Attackers look to escalate privileges in one of two ways. They either do this horizontally or vertically. Horizontal example This approach involves an attacker moving laterally within a network by compromising accounts at the same privilege level. As they move across the network, they can discover more targets and find more valuable data or systems. Here\'s an example of how a horizontal privilege escalation attack might unfold: An attacker uses stolen credentials to access a host with regular privileges within a company\'s network. The attacker identifies a file server within the network that has sensitive data. Multiple users can access it, but they can only read and write files. The attacker takes advantage of this shared access. They modify files within the shared file system, injecting malicious code or replacing critical configuration files. This activity may go unnoticed for a time because legitimate users regularly modify files on the shared file server. As other users interact with the compromised files, the attacker can increase the number of compromised accounts and hosts, collect sensitive data and prepare to launch a more widescale attack. Vertical example In this approach, attackers exploit identity vulnerabilities within a system or application to escalate their privileges from a basic user account to a privileged user. They might use social engineering tactics like phishing at first to trick users into handing over their login credentials. Here is how a vertical privilege escalation attack might play out: An attacker uses a compromised user account to gain access to a targeted system. They identify a known vulnerability in an application or service that is running on the system. The attacker creates and deploys an exploit to take advantage of this vulnerability. In this case, they take advantage of a flaw in the code that allows a user to escalate privileges without being authorized. The attacker can now change their privileges to a higher level, like system admin. Now that they have a lot of control over the system, the attacker can carry out a range of malicious actions. For example, they might change system configurations or steal data. Why it is important to prevent privilege escalation attacks The examples above make it clear that privilege escalation-enabled attacks can have a significant impact on businesses. To underscore the risk further, here are several other reasons these attacks are a cause for concern: Unauthorized access to and exposure of sensitive data Compromised user accounts and user identities Manipulated systems and configurations Disrupted business operations Data tampering and manipulation, such as with ransomware Legal and regulatory repercussions Reputational damage 5 Common privilege escalation attack techniques and examples Now that you understand the two main categories of privilege escalation and why you must be vigilant in defending against these techniques, let\'s look at five tactics that bad actors might use in | Tool Vulnerability Threat Commercial | ★★★ | |
|
2024-01-23 23:30:00 | Quelques jours après Google, Apple révèle que le moteur du navigateur a exploité le moteur de navigateur Days After Google, Apple Reveals Exploited Zero-Day in Browser Engine (lien direct) |
Le nouveau bug est le 12e webkit zéro-jour d'Apple \\ au cours de la dernière année, mettant en évidence l'exposition croissante de l'entreprise aux menaces à l'origine du navigateur.
The new bug is Apple\'s 12th WebKit zero-day in the last year, highlighting the increasing enterprise exposure to browser-borne threats. |
Vulnerability Threat | ★★★ | |
 |
2024-01-23 21:30:00 | Les experts en cybersécurité préviennent de nouvelles vulnérabilités affectant les produits Apple, Atlassian et Fortra Cybersecurity experts warn of new vulnerabilities affecting Apple, Atlassian and Fortra products (lien direct) |
Plusieurs nouvelles vulnérabilités sont exploitées par des pirates ces derniers jours, ce qui incite l'alarme à des experts inquiets de la façon dont ils seront utilisés par les cybercriminels et les États-nations.Au cours de la semaine dernière, des vulnérabilités affectant les géants de la technologie, notamment pomme , vmware , Fortra , Apache Et d'autres ont été soulignés à la fois par des experts en cybersécurité et des agences gouvernementales comme les
Multiple new vulnerabilities are being exploited by hackers in recent days, prompting alarm from experts worried about how they will be used by cybercriminals and nation states. Over the last week, vulnerabilities affecting tech giants including Apple, VMware, Atlassian, Fortra, Apache and others have been highlighted both by cybersecurity experts and government agencies like the |
Vulnerability | ★★★ | |
|
2024-01-23 15:04:00 | ~ 40 000 attaques en 3 jours: Critical Confluence RCE sous exploitation active ~40,000 Attacks in 3 Days: Critical Confluence RCE Under Active Exploitation (lien direct) |
Les acteurs malveillants ont commencé à exploiter activement une faille de sécurité critique récemment divulguée ayant un impact sur le centre de données de Confluence Atlassian et le serveur Confluence, dans les trois jours suivant la divulgation publique.
Suivi en CVE-2023-22527 (score CVSS: 10.0), la vulnérabilité a un impact
Malicious actors have begun to actively exploit a recently disclosed critical security flaw impacting Atlassian Confluence Data Center and Confluence Server, within three days of public disclosure. Tracked as CVE-2023-22527 (CVSS score: 10.0), the vulnerability impacts out-of-date versions of the software, allowing unauthenticated attackers to achieve remote code execution on susceptible |
Vulnerability Threat | ★★★ | |
|
2024-01-23 12:51:12 | Le paysage des menaces est toujours en train de changer: à quoi s'attendre en 2024 The Threat Landscape Is Always Changing: What to Expect in 2024 (lien direct) |
Gather \'round, cyber friends, and I\'ll let you in on a little secret: no one knows what the Next Big Thing on the threat landscape will be. But we can look back on 2023, identify notable changes and actor behaviors, and make educated assessments about what 2024 will bring. This month on the DISCARDED podcast my co-host Crista Giering and I sat down with our Threat Research leaders Daniel Blackford, Alexis Dorais-Joncas, Randy Pargman, and Rich Gonzalez, leaders of the ecrime, advanced persistent threat (APT), threat detection, and Emerging Threats teams, respectively. We discussed what we learned over the last year, and what\'s on the horizon for the future. While the discussions touched on different topics and featured different opinions on everything from artificial intelligence (AI) to living off the land binaries (LOLBins) to vulnerability exploitation to ransomware, there were some notable themes that are worth writing down. We can\'t say for sure what surprises are in store, but with our cyber crystals balls fully charged – and a deep knowledge of a year\'s worth of threat actor activity based on millions of email threats per day – we can predict with high confidence what\'s going to be impactful in the coming year. 1: Quick response (QR) codes will continue to proliferate 2023 was the year of the QR code. Although not new, QR codes burst on the scene over the last year and were used in many credential phishing and malware campaigns. The use was driven by a confluence of factors, but ultimately boiled down to the fact that people are now way more accustomed to scanning QR codes for everything from instructions to menus. And threat actors are taking advantage. Proofpoint recently launched new in-line sandboxing capabilities to better defend against this threat, and our teams anticipate seeing more of it in 2024. Notably, however, Dorais-Joncas points out that QR codes still just exist in the realm of ecrime – APT actors have not yet jumped on the QR code bandwagon. (Although, some of those APT actors bring ecrime energy to their campaigns, so it\'s possible they may start QR code phishing, too.) 2: Zero-day and N-day vulnerability exploitation A theme that appeared throughout our conversations was the creative use of vulnerabilities – both known and unreported – in threat actor activity. APT actors used a wide variety of exploits, from TA473 exploiting publicly-facing webmail servers to espionage actors using a zero-day in an email security gateway appliance that ultimately forced users to rip out and reinstall physical hardware. But ecrime actors also exploited their share of vulnerabilities, including the MOVEit file transfer service vulnerability from the spring of 2023 that had cascading repercussions, and the ScreenConnect flaw announced in the fall of 2023 – both of which were used by ecrime actors before being officially published. Proofpoint anticipates vulnerability exploitation will continue, driven in part by improved defense making old school techniques – like macro-enabled documents – much less useful, as well as the vast financial resources now available to cybercriminals that were once just the domain of APT. Pargman says the creativity from ecrime threat actors is a direct response of defenders imposing cost on our adversaries. 3: Continuing, unexpected behavior changes Avid listeners of the podcast know I have regularly said the ecrime landscape is extremely chaotic, with TA577 demonstrating the most chaotic vibes of them all. The tactics, techniques, and procedures (TTPs) of some of the most sophisticated actors continue to change. The cost imposed on threat actors that Pargman mentioned – from law enforcement takedowns of massive botnets like Qbot to improved detections and automated defenses – have forced threat actors, cybercriminals in particular, to regularly change their behaviors to figure out what is most effective. For example, recently Proofpoint has observed the increased use of: traffic dis | Ransomware Malware Tool Vulnerability Threat Prediction | ★★★ |
To see everything:
Our RSS (filtrered)
