What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2023-10-24 07:48:01 | Au-delà du statu quo, partie 2: 6 approches percutantes pour maintenir les personnes engagées dans la sensibilisation à la sécurité Beyond the Status Quo, Part 2: 6 Impactful Approaches to Keeping People Engaged in Security Awareness (lien direct) |
This is the second installment of a three-part blog series where we cover topics from our Wisdom 2023 sessions. In each blog, we explore creative techniques for inspiring engagement in security awareness and building a strong security culture. In the first article, we covered how to personalize and invigorate your curriculum for your users using threat intelligence. Every October, security professionals use Cybersecurity Awareness Month to promote best practices and the shared responsibility for behaving safely. But to stay safe, you have to stay vigilant. And that requires people to constantly be engaged. So in our second Wisdom session, we explored ways to inspire engagement in security awareness for both users and practitioners. Typically, when we\'re talking about engagement, we mean end users-and we all know how challenging it is to keep them engaged. In our 2023 State of the Phish Report, for instance, over 30% said security isn\'t priority at work for them. That\'s why in this session we discussed three ways to motivate and inspire your employees. We also addressed a group of people who are typically overlooked-security awareness practitioners! When you push yourself to find enthusiasm in security awareness, your attitude can have a cascading effect on how your employees engage. So we also covered three ways to find inspiration. This article recaps the insights we gained in conversation with Janet Roberts, former SVP/global head of security education and awareness at Zurich Insurance Company, and Brian Roberts (no relation), solution manager of information security awareness for Campbell\'s Soup Company. (Quotes have been lightly edited for clarity.) 3 impactful ways to engage employees If you\'re looking for creative ways to motivate and inspire your employees, Janet Roberts and Brian Roberts have some tips: 1: Build and nurture an ambassador program At Zurich, Janet launched an ambassador program that is now used by 32 of the company\'s teams around the globe. Every month, her security awareness team creates a toolkit to distribute “grass roots,” always covering one simple topic that is customizable to the ambassadors\' culture, language and policies. Zurich has five regional CISOs and a global CISO, each of whom decide the strategy for delivering this material within their region. in their region. When it comes to measuring program outcomes, metrics will most likely be qualitative not quantitative because when it\'s done right it will be highly tailored to people and places. According to Janet, “[An ambassador] program helps you to meet people where they go for their daily information. Make sure you map it to the structure of your company…and [make sure] your ambassadors are working within their regional strategy or country strategy.” Brian agreed the ambassador program should target a local audience. At Campbell\'s, his security awareness team reaches both inside and outside the organization to cultivate a group of volunteers. Brian\'s advice is to start small, create a volunteer pathway, and build each relationship as you scale up. “The more you make that personal, the more you drive an organization that will create change. When you see ambassadors sharing stuff they did in their communities and at home, that\'s when you know it\'s connecting.” When asked by attendees during the Q&A about how to get those first volunteers, Brian said, “Be very open so people feel you\'re approachable and they can bring personal stories to you. That\'s where you find that first pool of people that you can then send out to find more people.” Janet added that at Zurich, “We started with people whose job was to lower the human risk factor, like security officers and service executives. From there, they added their own connections and built their teams.” 2: Create a people-focused messaging strategy In this part of the session, our panelists shared ideas about how to build effective messaging and tailor the content so that everyone can und | Tool Threat | ★★ | |
 |
2023-10-23 17:04:00 | Qui expérimente les outils d'IA dans votre organisation? Who\\'s Experimenting with AI Tools in Your Organization? (lien direct) |
Avec la croissance record des outils de productivité d'IA axés sur les consommateurs comme Chatgpt, l'intelligence artificielle formant le domaine des équipes de science et d'ingénierie des données devient une ressource disponible pour chaque employé.
Du point de vue de la productivité, c'est fantastique.Malheureusement pour les équipes informatiques et de sécurité, cela signifie également que vous pouvez avoir des centaines de personnes dans votre organisation en utilisant un nouvel outil
With the record-setting growth of consumer-focused AI productivity tools like ChatGPT, artificial intelligence-formerly the realm of data science and engineering teams-has become a resource available to every employee. From a productivity perspective, that\'s fantastic. Unfortunately for IT and security teams, it also means you may have hundreds of people in your organization using a new tool in |
Tool | ChatGPT | ★★ |
 |
2023-10-23 16:15:09 | CVE-2023-46122 (lien direct) | SBT est un outil de construction pour Scala, Java et autres.Étant donné un fichier zip ou jar spécialement conçu, `io.unzip` permet l'écriture d'un fichier arbitraire.Cela aurait le potentiel de remplacer `/ root / .ssh / autorisé_keys`.Dans le code principal de SBT \\, `io.unzip` est utilisé dans la tâche` PulreMoteCache` et `résolvers.remote`;Cependant, de nombreux projets utilisent «io.unzip (...)» directement pour implémenter des tâches personnalisées.Cette vulnérabilité a été corrigée dans la version 1.9.7.
sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potential to overwrite `/root/.ssh/authorized_keys`. Within sbt\'s main code, `IO.unzip` is used in `pullRemoteCache` task and `Resolvers.remote`; however many projects use `IO.unzip(...)` directly to implement custom tasks. This vulnerability has been patched in version 1.9.7. |
Tool Vulnerability | ||
 |
2023-10-23 13:00:45 | Dans le cyber-abîme: les prédictions de Riveting 2024 de Check Point \\ révèlent une tempête de l'IA, du hacktivisme et des fasks profonds armés Into the Cyber Abyss: Check Point\\'s Riveting 2024 Predictions Reveal a Storm of AI, Hacktivism, and Weaponized Deepfakes (lien direct) |
 Les activités criminelles ont bondi au premier semestre, avec des recherches sur le point de contrôle (RCR) signalant une augmentation de 8% des cyberattaques hebdomadaires mondiales au deuxième trimestre, marquant le volume le plus élevé en deux ans.Les menaces familières telles que le ransomware et le hacktivisme ont évolué, les gangs criminels modifiant leurs méthodes et outils pour infecter et affecter les organisations du monde entier.Même les technologies héritées telles que les périphériques de stockage USB ont repris la popularité en tant que véhicule pour répandre les logiciels malveillants.L'un des développements les plus importants de cette année a été l'évolution du paysage des ransomwares.Les données dérivées de plus de 120 «sites de honte» ransomwares ont révélé que dans le premier [& # 8230;]
Criminal activities surged in the first half of the year, with Check Point Research (CPR) reporting an 8% increase in global weekly cyberattacks in the second quarter, marking the highest volume in two years. Familiar threats such as ransomware and hacktivism have evolved, with criminal gangs modifying their methods and tools to infect and affect organizations worldwide. Even legacy technology such as USB storage devices regained popularity as a vehicle to spread malware. One of the most significant developments this year was the evolution of the ransomware landscape. Data derived from over 120 ransomware “shame-sites” revealed that in the first […]
|
Ransomware Tool Prediction | ★★★ | |
 |
2023-10-23 10:00:00 | Planification de la continuité des activités: en regardant en arrière ou à l'avance Business continuity planning: Looking back or ahead (lien direct) |
In September 2023, cybercriminals launched an extensive ransomware attack that disrupted several major businesses in the Las Vegas Casino Business/District. The attack shook the city and stopped consumer goods and services for several hours. The attack influenced security, visitor services, and financial activities. Businesses lost money and long-term reputational risks ensued. Increasing op tempo A company can keep running after a disruption if it has a comprehensive Business Continuity Plan (BCP) that includes risk assessments, Business Impact Assessments (BIAs), and recovery strategies. A BCP is needed to minimize risk apprehensions, reduce financial loss, and maintain continuous business operations. A business impact analysis (BIA) must be part of Business Continuity Plans (BCPs). The plan sets recovery time and point goals, ranks the most important processes, and figures out how delays will affect business functions. BIAs help organizations figure out what tools and plans they need for recovery. Disaster Recovery Plans, or DRPs, lay out how a business will handle and rebound from a disaster. It includes tools for recovering systems, data, and infrastructure. A complete, well-tested DRP is necessary to keep problems to a minimum and get services back up and running quickly. To stay safe from cyber threats, businesses need to put their operating security footprint at the top of their list of priorities. In this way, networks, systems, apps, and data are kept safe. Data breaches and unauthorized access are less likely to happen with firewalls, intrusion detection systems, and encryption methods. Rearview The ransomware attack on the Las Vegas Casino Business/District in September 2023 shows that current risk management methods need to be looked at and updated. These steps cut down on operational disruptions, keep customer goods and services safe, and speed up the recovery of mission-critical systems. Being operationally ready is important for protecting your business and preparing for the unexpected. The most common way for threat players to take over a company\'s resources, assets, and people is through ransomware attacks. Recent statistics show that strong holding the most sought-after security principles can disrupt present business operations: The State of Ransomware Report in the US says that the average ransomware attack costs $8.1 million and takes 287 days to fix (Emsisoft, 2021). The number of ransom payments made by victims rose by 311% in 2020 (Crypto Crime Report, 2021). Going forward Ransomware attacks affect people all over the world, resulting in huge financial losses costs - compiled worldwide topping $20 billion in 2020. The COVID-19 pandemic has given hackers new avenues and threat vectors to hack, crack, and exploit. It is imperative for businesses to strengthen the home front to gain home-field advantage against cyber threat actors. Having a comprehensive, repeatable, verifiable disaster recovery and business continuity plan minimizes the economic im | Ransomware Tool Vulnerability Threat | ★★ | |
|
2023-10-20 19:15:09 | CVE-2023-46117 (lien direct) | ReconftW est un outil conçu pour effectuer une reconnaissance automatisée sur un domaine cible en exécutant le meilleur ensemble d'outils pour effectuer la numérisation et la recherche de vulnérabilités.Une vulnérabilité a été identifiée dans ReconftW où une validation inadéquate des sous-domaines récupérés peut conduire à une attaque d'exécution de code distante (RCE).Un attaquant peut exploiter cette vulnérabilité en fabriquant une entrée CSP malveillante sur le domaine de celui-ci.Une exploitation réussie peut conduire à l'exécution d'un code arbitraire dans le contexte de l'application, compromettant potentiellement le système.Ce problème a été résolu dans la version 2.7.1.1 et tous les utilisateurs sont invités à mettre à niveau.Il n'y a pas de solution de contournement connu pour cette vulnérabilité.
reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities. A vulnerability has been identified in reconftw where inadequate validation of retrieved subdomains may lead to a Remote Code Execution (RCE) attack. An attacker can exploit this vulnerability by crafting a malicious CSP entry on it\'s own domain. Successful exploitation can lead to the execution of arbitrary code within the context of the application, potentially compromising the system. This issue has been addressed in version 2.7.1.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability. |
Tool Vulnerability Threat | ||
|
2023-10-20 18:58:00 | Les pirates vietnamiens ciblent le Royaume-Uni, les États-Unis et l'Inde avec Darkgate Malware Vietnamese Hackers Target U.K., U.S., and India with DarkGate Malware (lien direct) |
Attaques tirant parti des entités de ciblage de logiciels malveillants de Darkgate Commodity au Royaume-Uni, aux États-Unis et en Inde a été liée à des acteurs vietnamiens associés à l'utilisation du tristement célèbre voleur en queue-canards.
"Le chevauchement des outils et des campagnes est très probablement dû aux effets d'un marché de cybercriminalité", a déclaré Withesecure dans un rapport publié aujourd'hui."Les acteurs de la menace peuvent acquérir et utiliser plusieurs
Attacks leveraging the DarkGate commodity malware targeting entities in the U.K., the U.S., and India have been linked to Vietnamese actors associated with the use of the infamous Ducktail stealer. "The overlap of tools and campaigns is very likely due to the effects of a cybercrime marketplace," WithSecure said in a report published today. "Threat actors are able to acquire and use multiple |
Malware Tool | ★★ | |
 |
2023-10-20 18:49:47 | Des acteurs soutenus par le gouvernement exploitant la vulnérabilité de Winrar Government-Backed Actors Exploiting WinRAR Vulnerability (lien direct) |
#### Description
Au cours des dernières semaines, les menaces de Google \'s Menace Analysis Group \'s (TAG) ont observé plusieurs groupes de piratage soutenus par le gouvernement exploitant la vulnérabilité connue, CVE-2023-38831, dans Winrar, qui est un outil de fichiers populaire pour Windows.Un correctif est maintenant disponible, mais de nombreux utilisateurs semblent toujours vulnérables.Tag a observé des acteurs soutenus par le gouvernement d'un certain nombre de pays exploitant la vulnérabilité Winrar dans le cadre de leurs opérations.
Le CVE-2023-38831 est une vulnérabilité logique dans Winrar provoquant une expansion temporaire étrangère lors du traitement des archives fabriquées, combinées à une bizarrerie dans l'implémentation de Windows \\ 'Shellexcucute lors de la tentative d'ouvrir un fichier avec une extension contenant des espaces.La vulnérabilité permet aux attaquants d'exécuter du code arbitraire lorsqu'un utilisateur tente d'afficher un fichier bénin (comme un fichier PNG ordinaire) dans une archive zip.
#### URL de référence (s)
1. https://blog.google/thereat-analysis-group/government-backed-actors-expoiting-winrar-vulnerabilité/
2. https://ti.defender.microsoft.com/cves/cve-2023-38831
3. https://ti.defender.microsoft.com/intel-profiles/cf1e406a16835d56cf614430aea3962d7ed99f01ee3d9ee3048078288e5201bb/description
#### Date de publication
18 octobre 2023
#### Auteurs)
Kate Morgan
#### Description In recent weeks, Google\'s Threat Analysis Group\'s (TAG) has observed multiple government-backed hacking groups exploiting the known vulnerability, CVE-2023-38831, in WinRAR, which is a popular file archiver tool for Windows. A patch is now available, but many users still seem to be vulnerable. TAG has observed government-backed actors from a number of countries exploiting the WinRAR vulnerability as part of their operations. CVE-2023-38831 is a logical vulnerability within WinRAR causing extraneous temporary file expansion when processing crafted archives, combined with a quirk in the implementation of Windows\' ShellExecute when attempting to open a file with an extension containing spaces. The vulnerability allows attackers to execute arbitrary code when a user attempts to view a benign file (such as an ordinary PNG file) within a ZIP archive. #### Reference URL(s) 1. https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/ 2. https://ti.defender.microsoft.com/cves/CVE-2023-38831 3. https://ti.defender.microsoft.com/intel-profiles/cf1e406a16835d56cf614430aea3962d7ed99f01ee3d9ee3048078288e5201bb/description #### Publication Date October 18, 2023 #### Author(s) Kate Morgan |
Tool Vulnerability Threat | ★★★ | |
 |
2023-10-20 18:39:23 | Les pirates ont volé des jetons d'accès à l'unité de support d'Okta \\ Hackers Stole Access Tokens from Okta\\'s Support Unit (lien direct) |
Okta, une entreprise qui fournit des outils d'identité comme l'authentification multi-facteurs et l'authentification unique à des milliers d'entreprises, a subi une violation de sécurité impliquant un compromis de son unité de support client, a appris KrebsSoncurity.Okta dit que l'incident a affecté un "très petit nombre" de clients, mais il semble que les pirates responsables ont eu accès à la plate-forme de support d'Okta \\ pendant au moins deux semaines avant que la société ne contienne pleinement l'intrusion.
Okta, a company that provides identity tools like multi-factor authentication and single sign-on to thousands of businesses, has suffered a security breach involving a compromise of its customer support unit, KrebsOnSecurity has learned. Okta says the incident affected a "very small number" of customers, however it appears the hackers responsible had access to Okta\'s support platform for at least two weeks before the company fully contained the intrusion. |
Tool | ★★★ | |
|
2023-10-19 15:15:09 | CVE-2023-5654 (lien direct) | L'extension React Developer Tools enregistre un auditeur de message avec Window.AddeventListener (\\ 'message \', ) dans un script de contenu accessible à toute page Web active dans le navigateur.Au sein de l'auditeur se trouve un code qui demande une URL dérivée du message reçu via fetch ().L'URL n'est pas validée ou désinfectée avant qu'elle ne soit récupérée, permettant ainsi à une page Web malveillante de récupérer arbitrairement URL & acirc; & euro; & échange via le navigateur de la victime.
The React Developer Tools extension registers a message listener with window.addEventListener(\'message\', ) in a content script that is accessible to any webpage that is active in the browser. Within the listener is code that requests a URL derived from the received message via fetch(). The URL is not validated or sanitised before it is fetched, thus allowing a malicious web page to arbitrarily fetch URL’s via the victim\'s browser. |
Tool | ||
|
2023-10-19 10:00:00 | Pourquoi les organisations ne détectent-elles pas les menaces de cybersécurité? Why are organizations failing to detect cybersecurity threats? (lien direct) |
The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. With the changing security landscape, the most daunting task for the CISO and CIO is to fight an ongoing battle against hackers and cybercriminals. Bad actors stay ahead of the defenders and are always looking to find new vulnerabilities and loopholes to exploit and enter the business network. Failing to address these threats promptly can have catastrophic consequences for the organization. A survey finds that, on average, it takes more than five months to detect and remediate cyber threats. This is a significant amount of time, as a delayed response to cyber threats can result in a possible cyber-attack. One can never forget the devastating impacts of the Equifax breach in 2017 and the Target breach in 2013 due to delayed detection and response. This is concerning and highlights the need for proactive cybersecurity measures to detect and mitigate rising cyber threats. Amidst this, it\'s also crucial to look into why it is challenging to detect cyber threats. Why do organizations fail to detect cyber threats? Security teams are dealing with more cyber threats than before. A report also confirmed that global cyber attacks increased by 38% in 2022 compared to the previous year. The increasing number and complexity of cyber-attacks make it challenging for organizations to detect them. Hackers use sophisticated techniques to bypass security systems and solutions - like zero-day vulnerabilities, phishing attacks, business email compromises (BEC), supply chain attacks, and Internet of Things (IoT) attacks. Some organizations are unaware of the latest cyber threat trends and lack the skills and resources to detect them. For instance, hackers offer professional services like ransomware-as-a-service (RaaS) to launch ransomware attacks. Surprisingly, two out of three ransomware attacks are facilitated by the RaaS setup, but still, companies fail to have a defensive strategy against them. Enterprises relying on legacy devices and outdated software programs are no longer effective at recognizing certain malicious activities, leaving the network vulnerable to potential threats. Additionally, the lack of trained staff, insider threats, and human errors are other reasons why many organizations suffer at the hands of threat actors. Besides this, much of the company\'s data is hidden as dark data. As the defensive teams and employees may be unaware of it, the hackers take complete advantage of dark data and either replicate it or use it to fulfill their malicious intentions. Moreover, cloud migration has rapidly increased in recent years, putting cybersecurity at significant risk. The complexity of the cloud environments, poorly secured remote and hybrid work environments, and sharing security responsibilities between cloud service providers and clients have complicated the situation. In addition, cloud vulnerabilities, which have risen to 194% from the previous year, have highlighted the need for organizations to look out for ways to strengthen their security infrastructure. Security measures to consider to prevent cyber threats Since businesses face complex cyber threats, mitigating them require | Ransomware Data Breach Tool Vulnerability Threat Cloud | Equifax | ★★ |
|
2023-10-19 09:32:00 | Google Tag détecte les acteurs de la menace soutenus par l'État exploitant Winrar Flaw Google TAG Detects State-Backed Threat Actors Exploiting WinRAR Flaw (lien direct) |
Un certain nombre d'acteurs de menaces d'État de Russie et de Chine ont été observés exploitant une récente faille de sécurité dans l'outil d'archiver Winrar pour Windows dans le cadre de leurs opérations.
La vulnérabilité en question est CVE-2023-38831 (score CVSS: 7.8), qui permet aux attaquants d'exécuter du code arbitraire lorsqu'un utilisateur tente d'afficher un fichier bénin dans une archive zip.La lacune a été active
A number of state-back threat actors from Russia and China have been observed exploiting a recent security flaw in the WinRAR archiver tool for Windows as part of their operations. The vulnerability in question is CVE-2023-38831 (CVSS score: 7.8), which allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The shortcoming has been actively |
Tool Vulnerability Threat | ★★★ | |
 |
2023-10-19 07:00:00 | Seal – L\'outil ultime pour télécharger vidéos et audios sur Android (lien direct) | Salut à tous ! Aujourd'hui, je vous présente Seal, un téléchargeur vidéo/audio tout-en-un pour Android. Il permet de télécharger du contenu de différentes plateformes, d'organiser vos fichiers avec des métadonnées, et d'ajouter des sous-titres. Il est également possible de télécharger des listes de lecture entières. Seal est gratuit, open-source et disponible sur GitHub et F-Droid. | Tool General Information | ★★ | |
 |
2023-10-19 02:00:00 | Startup de sécurité AirGap Networks apporte des technologies de télécommunications au LAN Security startup Airgap Networks brings telco technologies to the LAN (lien direct) |
Les logiciels malveillants générateurs de l'AI, l'usurpation de faux identité profonde et les ransomwares parrainés par l'État ne sont que quelques-unes des dernières méthodes que les attaquants utilisent pour contourner les outils de cybersécurité traditionnels.Ritesh Agrawal, PDG de Cybersecurity Startup AirGap Networks, a remarqué que de nombreuses attaques qui compromettent les réseaux d'entreprise ne parviennent pas à pénétrer les réseaux de télécommunications et de prestataires de services. «Même s'ils déploient les mêmes routeurs, les mêmes routeurs, les commutateurs, et des pare-feu, il y a quelque chose de fondamentalement différent dans les réseaux de télécommunications qui les protègent de nombreuses menaces pour les Lans d'entreprise », a déclaré Argawal.Agrawal a 20 ans d'expérience avec la cybersécurité, le réseautage d'entreprise et le cloud computing, la plupart du temps passé avec les réseaux de genévriers en se concentrant sur les télécommunications et les grands clients d'entreprise. Pour lire cet article en totalité, veuillez cliquer ici
AI-generating malware, deep fake identity spoofing, and state-sponsored ransomware are just a few of the latest methods that attackers are using to bypass traditional cybersecurity tools. Ritesh Agrawal, CEO of cybersecurity startup Airgap Networks, noticed that many of the attacks that compromise enterprise networks fail to penetrate telco and service provider networks.“Even though they\'re deploying the same routers, switches, and firewalls, there\'s something fundamentally different about telco networks that shields them from many threats to enterprise LANs,” Argawal said. Agrawal has 20 years of experience with cybersecurity, enterprise networking, and cloud computing, most of that time spent with Juniper Networks focusing on telco and large enterprise clients.To read this article in full, please click here |
Ransomware Malware Tool Cloud | ★★ | |
 |
2023-10-18 15:45:00 | La Russie et les pirates liés à la Chine exploitent Winrar Bug Russia and China-linked hackers exploit WinRAR bug (lien direct) |
Les pirates liés aux gouvernements de la Russie et de la Chine utiliseraient une vulnérabilité dans un outil Windows populaire pour attaquer des cibles dans le monde, y compris en Ukraine et en Papouasie-Nouvelle-Guinée.Le groupe d'analyse des menaces de Google \\ a déclaré que ces dernières semaines, il a vu plusieurs groupes soutenus par le gouvernement exploitant CVE-2023-38831, une vulnérabilité affectant les fenêtres
Hackers connected to the governments of Russia and China are allegedly using a vulnerability in a popular Windows tool to attack targets around the world, including in Ukraine and Papua New Guinea. Google\'s Threat Analysis Group\'s (TAG) said that in recent weeks it has seen multiple government-backed groups exploiting CVE-2023-38831, a vulnerability affecting the Windows |
Tool Vulnerability Threat | ★★ | |
 |
2023-10-18 13:13:00 | Guardz présente un nouvel outil de prospection de cyber-risque alimentée par l'IA pour les MSP Guardz Introduces New AI-Powered Cyber Risk Prospecting Tool For MSPs (lien direct) |
Guardz introduit un nouvel outil de prospection de cyber-risque alimenté par l'IA pour les MSP
L'outil permet aux MSP de traiter leur point de douleur numéro un - attirant de nouveaux clients - en fournissant un aperçu complet de la posture de cybersécurité d'une PME \\, sans frais
-
revues de produits
Guardz Introduces New AI-Powered Cyber Risk Prospecting Tool For MSPs The tool enables MSPs to address their number one pain point - attracting new clients - by providing a thorough overview of an SME\'s cybersecurity posture, at no cost - Product Reviews |
Tool | ★★ | |
|
2023-10-17 13:15:58 | Céquence Security a annoncé que la solution CEQUENCE UNIFIED API Protection (UAP) est désormais disponible sur le HPE Greenlake Marketplace Cequence Security announced the Cequence Unified API Protection (UAP) solution is now available on the HPE GreenLake Marketplace (lien direct) |
Céquence devient le premier fournisseur de sécurité de l'API sur le HPE Greenlake Marketplace
Céquence Unified API Protection sur HPE Greenlake améliore considérablement la visibilité et la protection tout en réduisant les coûts et en minimisant la fraude, la perturbation des entreprises, les pertes de données et la non-conformité
-
revues de produits
Cequence Becomes the First API Security Vendor on the HPE GreenLake Marketplace Cequence Unified API Protection on HPE GreenLake significantly improves visibility and protection while reducing costs and minimising fraud, business disruption, data losses and non-compliance - Product Reviews |
Tool | ★★ | |
|
2023-10-17 10:00:00 | Réévaluer les risques dans l'âge de l'intelligence artificielle Re-evaluating risk in the artificial intelligence age (lien direct) |
Introduction It is common knowledge that when it comes to cybersecurity, there is no one-size-fits all definition of risk, nor is there a place for static plans. New technologies are created, new vulnerabilities discovered, and more attackers appear on the horizon. Most recently the appearance of advanced language models such as ChatGPT have taken this concept and turned the dial up to eleven. These AI tools are capable of creating targeted malware with no technical training required and can even walk you through how to use them. While official tools have safeguards in place (with more being added as users find new ways to circumvent them) that reduce or prevent them being abused, there are several dark web offerings that are happy to fill the void. Enterprising individuals have created tools that are specifically trained on malware data and are capable of supporting other attacks such as phishing or email-compromises. Re-evaluating risk While risk should always be regularly evaluated it is important to identify when significant technological shifts materially impact the risk landscape. Whether it is the proliferation of mobile devices in the workplace or easy access to internet-connected devices with minimal security (to name a few of the more recent developments) there are times when organizations need to completely reassess their risk profile. Vulnerabilities unlikely to be exploited yesterday may suddenly be the new best-in-breed attack vector today. There are numerous ways to evaluate, prioritize, and address risks as they are discovered which vary between organizations, industries, and personal preferences. At the most basic level, risks are evaluated by multiplying the likelihood and impact of any given event. These factors may be determined through numerous methods, and may be affected by countless elements including: Geography Industry Motivation of attackers Skill of attackers Cost of equipment Maturity of the target’s security program In this case, the advent of tools like ChatGPT greatly reduce the barrier to entry or the “skill” needed for a malicious actor to execute an attack. Sophisticated, targeted, attacks can be created in minutes with minimal effort from the attacker. Organizations that were previously safe due to their size, profile, or industry, now may be targeted simply because it is easy to do so. This means all previously established risk profiles are now out of date and do not accurately reflect the new environment businesses find themselves operating in. Even businesses that have a robust risk management process and mature program may find themselves struggling to adapt to this new reality. Recommendations While there is no one-size-fits-all solution, there are some actions businesses can take that will likely be effective. First, the business should conduct an immediate assessment and analysis of their currently identified risks. Next, the business should assess whether any of these risks could be reasonably combined (also known as aggregated) in a way that materially changes their likelihood or impact. Finally, the business must ensure their executive teams are aware of the changes to the businesses risk profile and consider amending the organization’s existing risk appetite and tolerances. Risk assessment & analysis It is important to begin by reassessing the current state of risk within the organization. As noted earlier, risks or attacks that were previously considered unlikely may now be only a few clicks from being deployed in mass. The organization should walk through their risk register, if one exists, and evaluate all identified risks. This may be time consuming, and the organization should of course prioritize critical and high risks first, but it is important to ensure the business has the information they need to effectively address risks. Risk aggregation Onc | Malware Tool Vulnerability | ChatGPT | ★★★★ |
 |
2023-10-17 09:05:59 | Qu'est-ce qu'un CMDB? What is a CMDB? (lien direct) |
Il existe d'innombrables outils et technologies disponibles pour aider une organisation à rester au-dessus de ses actifs informatiques, et une base de données de gestion de la configuration (CMDB) est extrêmement utile.La base de données garde une trace des informations pertinentes concernant divers composants matériels et logiciels et les relations entre eux.Il permet aux équipes d'avoir une vue organisée des éléments de configuration (CIS) qui peuvent permettre des processus plus rationalisés en ce qui concerne le fonctionnement.L'infrastructure et l'architecture des sociétés \\ 'Les actifs informatiques continuent de devenir plus complexes, et avoir une base de données centralisée fournit un moyen ...
There are countless tools and technologies available to help an organization stay on top of its IT assets, and a configuration management database (CMDB) is an extremely useful one. The database keeps track of relevant information regarding various hardware and software components and the relationships between them. It allows IT teams to have an organized view of configuration items (CIs) that can enable more streamlined processes when it comes to IT work. The infrastructure and architecture of companies\' IT assets continue to grow more complex, and having a centralized database provides a way... |
Tool | ★★ | |
|
2023-10-17 05:00:21 | Êtes-vous sûr que votre navigateur est à jour?Le paysage actuel des fausses mises à jour du navigateur Are You Sure Your Browser is Up to Date? The Current Landscape of Fake Browser Updates (lien direct) |
Key Takeaways Proofpoint is tracking multiple different threat clusters that use similar themes related to fake browser updates. Fake browser updates abuse end user trust with compromised websites and a lure customized to the user\'s browser to legitimize the update and fool users into clicking. Threat actors do not send emails to share the compromised websites. The threat is only in the browser and can be initiated by a click from a legitimate and expected email, social media site, search engine query, or even just navigating to the compromised site. The different campaigns use similar lures, but different payloads. It is important to identify which campaign and malware cluster the threat belongs to help guide defender response. Overview Proofpoint is currently tracking at least four distinct threat clusters that use fake browser updates to distribute malware. Fake browser updates refer to compromised websites that display what appears to be a notification from the browser developer such as Chrome, Firefox, or Edge, informing them that their browser software needs to be updated. When a user clicks on the link, they do not download a legitimate browser update but rather harmful malware. Based on our research, TA569 has used fake browser updates for over five years to deliver SocGholish malware, but recently other threat actors have been copying the lure theme. Each threat actor uses their own methods to deliver the lure and payload, but the theme takes advantage of the same social engineering tactics. The use of fake browser updates is unique because it abuses the trust end users place in both their browser and the known sites that they visit. Threat actors that control the fake browser updates use JavaScript or HTML injected code that directs traffic to a domain they control, which can potentially overwrite the webpage with a browser update lure specific to the web browser that the potential victim uses. A malicious payload will then automatically download, or the user will receive a prompt to download a “browser update,” which will deliver the payload. Fake browser update lure and effectiveness The fake browser update lures are effective because threat actors are using an end-user\'s security training against them. In security awareness training, users are told to only accept updates or click on links from known and trusted sites, or individuals, and to verify sites are legitimate. The fake browser updates abuse this training because they compromise trusted sites and use JavaScript requests to quietly make checks in the background and overwrite the existing, website with a browser update lure. To an end user, it still appears to be the same website they were intending to visit and is now asking them to update their browser. Proofpoint has not identified threat actors directly sending emails containing malicious links, but, due to the nature of the threat, compromised URLs are observed in email traffic in a variety of ways. They are seen in normal email traffic by regular end users who are unaware of the compromised websites, in monitoring emails such as Google alerts, or in mass automated email campaigns like those distributing newsletters. This creates a situation where these emails are considered to be malicious during the time the site is compromised. Organizations should not treat the fake browser update threats as only an email problem, as end users could visit the site from another source, such as a search engine, social media site, or simply navigate to the site directly and receive the lure and potentially download the malicious payload. Each campaign uniquely filters traffic to hide from researchers and delay discovery, but all the methods are effective at filtering. While this may reduce the potential spread of malicious payloads, it enables actors to maintain their access to the compromised sites for longer periods of time. This can complicate the response, because with the multiple campaigns and changing payloads, responders must take time to | Malware Tool Threat Studies | ★★★★ | |
 |
2023-10-16 15:30:00 | Ransomware cible les serveurs WS_FTP non corrigés Ransomware Targets Unpatched WS_FTP Servers (lien direct) |
Les acteurs de la menace ont tenté d'escalader les privilèges en utilisant l'outil open source Godpotato
The threat actors attempted to escalate privileges using the open-source GodPotato tool |
Ransomware Tool Threat | ★★ | |
 |
2023-10-16 13:28:19 | 8 Meilleur stress IP gratuit à utiliser en 2023 8 Best Free IP Stresser to Use in 2023 (lien direct) |
avez-vous besoin de tester votre site Web et recherchez-vous les meilleurs contraintes IP gratuites à utiliser?Cet article vous guidera pour faire la meilleure sélection qui correspond à vos besoins.Il devient crucial pour les propriétaires de sites Web - lors de la configuration de leurs sites - pour déterminer si le serveur hébergeant leur site [& hellip;]
Do you need to stress test your website, and are you looking for the best free IP stresses to use? This article will guide you in making the best selection that fits your needs. It becomes crucial for website owners - when setting up their sites - to determine whether the server hosting their site […] |
Tool Industrial | ★★★ | |
|
2023-10-16 13:00:58 | Présentation de Playblocks Horizon Point Point: la plate-forme d'automatisation et de collaboration ultime Introducing Check Point Horizon Playblocks: The Ultimate Security Automation and Collaboration Platform (lien direct) |
> En 2023, les CISO prièrent la priorité à la mise en œuvre de l'automatisation dans leurs mesures de cybersécurité, selon le Forbes Technology Council.L'automatisation peut réduire considérablement la charge de travail des centres d'opérations de sécurité (SOC) et améliorer la sécurité globale.Cependant, pour lutter efficacement contre les cyber-menaces, la collaboration entre les produits, les personnes et les processus est crucial.Les équipes qui collaborent surpassent celles où chaque membre travaille seul.La collaboration à la recherche et à d'autres initiatives mène à de meilleures découvertes et à des percées plus rapides.Ce principe peut également être appliqué au paysage de menace d'une organisation.Le risque de silos de sécurité même avec des outils de sécurité sophistiqués déployés, la collaboration peut déverrouiller la prochaine [& # 8230;]
>In 2023, CISOs will prioritize the implementation of automation in their cybersecurity measures, according to the Forbes Technology Council. Automation can significantly reduce the workload of Security Operations Centers (SOCs) and enhance overall security. However, to effectively combat cyber threats, collaboration among products, people, and processes is crucial. Teams that collaborate out-perform those where each member works on their own. Collaborating on research and other initiatives leads to better findings and faster breakthroughs. This principle can also be applied to an organization\'s threat landscape. The Risk of Security Silos Even with sophisticated security tools deployed, collaboration can unlock the next […] |
Tool Threat | ★★ | |
|
2023-10-16 12:00:00 | Une tour de surveillance au Mexique devient un point de repère troublant pour les défenseurs de la vie privée A surveillance tower in Mexico becomes an unsettling landmark for privacy advocates (lien direct) |
Le bâtiment aura 1 791 lecteurs de plaques d'immatriculation automatisés.3 065 caméras panilon-zoom.74 drones.Les flux en direct des caméras appartenant aux entreprises du quartier et aux résidents.Les filtres biométriques fonctionnant constamment pour soutenir la reconnaissance faciale.Connexions avec les infrastructures dans toute la ville.Ces outils de surveillance et bien d'autres seront intégrés à Torre Centinela du Mexique (tour Sentinel), un presque
The building will have 1,791 automated license plate readers. 3,065 pan-tilt-zoom cameras. 74 drones. Live feeds from cameras owned by neighborhood businesses and residents. Biometric filters running constantly to support facial recognition. Connections to infrastructure throughout the city. Those monitoring tools and many others will be embedded in Mexico\'s Torre Centinela (Sentinel Tower), a nearly |
Tool General Information | ★★ | |
|
2023-10-16 10:00:00 | Renforcement de la cybersécurité: multiplication de force et efficacité de sécurité Strengthening Cybersecurity: Force multiplication and security efficiency (lien direct) |
In the ever-evolving landscape of cybersecurity, the battle between defenders and attackers has historically been marked by an asymmetrical relationship. Within the cybersecurity realm, asymmetry has characterized the relationship between those safeguarding digital assets and those seeking to exploit vulnerabilities. Even within this context, where attackers are typically at a resource disadvantage, data breaches have continued to rise year after year as cyber threats adapt and evolve and utilize asymmetric tactics to their advantage. These include technologies and tactics such as artificial intelligence (AI), and advanced social engineering tools. To effectively combat these threats, companies must rethink their security strategies, concentrating their scarce resources more efficiently and effectively through the concept of force multiplication. Asymmetrical threats, in the world of cybersecurity, can be summed up as the inherent disparity between adversaries and the tactics employed by the weaker party to neutralize the strengths of the stronger one. The utilization of AI and similar tools further erodes the perceived advantages that organizations believe they gain through increased spending on sophisticated security measures. Recent data from InfoSecurity Magazine, referencing the 2023 Checkpoint study, reveals a disconcerting trend: global cyberattacks increased by 7% between Q1 2022 and Q1 2023. While not significant at first blush, a deeper analysis reveals a more disturbing trend specifically that of the use of AI. AI\'s malicious deployment is exemplified in the following quote from their research: "...we have witnessed several sophisticated campaigns from cyber-criminals who are finding ways to weaponize legitimate tools for malicious gains." Furthermore, the report highlights: "Recent examples include using ChatGPT for code generation that can help less-skilled threat actors effortlessly launch cyberattacks." As threat actors continue to employ asymmetrical strategies to render organizations\' substantial and ever-increasing security investments less effective, organizations must adapt to address this evolving threat landscape. Arguably, one of the most effective methods to confront threat adaptation and asymmetric tactics is through the concept of force multiplication, which enhances relative effectiveness with fewer resources consumed thereby increasing the efficiency of the security dollar. Efficiency, in the context of cybersecurity, refers to achieving the greatest cumulative effect of cybersecurity efforts with the lowest possible expenditure of resources, including time, effort, and costs. While the concept of efficiency may seem straightforward, applying complex technological and human resources effectively and in an efficient manner in complex domains like security demands more than mere calculations. This subject has been studied, modeled, and debated within the military community for centuries. Military and combat efficiency, a domain with a long history of analysis, | Tool Vulnerability Threat Studies Prediction | ChatGPT | ★★★ |
|
2023-10-16 07:29:59 | Navigation du cyber-risque: ce qu'il faut rechercher dans la couverture de la cyber-assurance Navigating Cyber Risk: What to Look for in Cyber Insurance Coverage (lien direct) |
Modern threats like phishing, ransomware and data breaches cast a dark cloud over businesses across sectors. For most bad actors, the goal of an attack is financial. As Proofpoint noted in the 2023 State of the Phish report, 30% of businesses that endured a successful attack experienced a direct monetary loss, such as a fraudulent invoice, wire transfer or payroll redirection. That is an increase of 76% year over year. A cyber insurance policy can protect you from the financial losses caused by cybersecurity incidents and data breaches. And when businesses pair cyber insurance with the prowess of Proofpoint solutions, they can build a formidable defense strategy. In this blog, we\'ll go over some best practices for choosing and managing you cyber insurance policy so you can protect yourself from risk. Actions that cyber criminals monetize Our research for the latest State of the Phish report shows that the three most common consequences of a cyber attack are: Data breach (44%) Ransomware infection (43%) Account compromise (36%) Notably, cyber criminals can monetize all these actions. Most common results of successful phishing attacks. (Source: 2023 State of the Phish report from Proofpoint.) Just one cybersecurity incident can cost tens of thousands of dollars. So, it\'s easy to understand why insurers see these incidents as too costly to cover in their general liability policies. But with cyber insurance, your business has a tool to help manage risk. Why cyber insurance can be a vital financial safety net While firewalls and endpoint protections remain vital, the truth is that a level of residual risk always exists. No matter how fortified your security is, breaches can happen due to ingenious adversaries, human error or just unfortunate circumstances. This is where cyber insurance comes to the rescue. It is the safety net that catches your business when your defenses fall short. It can help you cover costs like ransomware payments, legal fees, and costs associated with crisis management and revenue loss. In the graphic below, we can see how often cyber insurance covered losses from ransomware attacks among those surveyed for our 2023 State of the Phish report. Nearly three-quarters (73%) of businesses with cyber insurance policies said their insurers paid at least some of their ransomware-related losses. (Source: 2023 State of the Phish report from Proofpoint.) Cyber insurance best practices Now that we\'ve covered why cyber insurance can be a vital financial safety net, let\'s look at some essential best practices for cyber insurance. These measures can help your business become more effective at managing cybersecurity risks. Find an expert and ask for support and guidance. Specialized brokers are your allies in the intricate world of cyber insurance. Insurers vary in risk appetite, claim acceptance rates and expertise. Brokers have an in-depth grasp of this landscape, and they will assess your options meticulously. They will help ensure that the policy you choose is the right fit for your industry, size, risk profile and more. Be prepared for a rigorous assessment. Today, insurers want more insight into your company\'s security protocols and controls before they issue a cyber insurance policy. So preparedness is key. Be ready to provide evidence, like external audits, penetration test results and compliance certifications to insurers. If you implement access controls that insurers deem vital, such as multifactor authentication (MFA) and privileged access management (PAM), it may help to reduce your premiums. Closely examine coverage scope. Coverage specifics vary globally. But you will find that most cyber insurance policies cover a portion of losses from ransomware attacks and expenses linked to crisis responses. You need to have a thorough understanding of the breach scenarios your policy does or does not cover. Take note of any exclusions. Also, be sure to scrutinize services like breach investigation support, legal | Ransomware Tool Threat Guideline Cloud | ★★★ | |
 |
2023-10-13 22:43:54 | Dakar F. Dexray v2.33 (lien direct) |
Même en 2023, Dexray semble fournir de la valeur aux praticiens du DFIR.Je suis toujours très humilié par des ajouts non sollicités au code Dexray, car cela signifie que l'outil est toujours en vie, malgré le fait qu'il a été écrit en archaïque (par & # 8230; Continuer la lecture & # 8594;
Even in 2023 Dexray seems to be delivering value to DFIR practitioners. I am always very humbled by unsolicited additions to Dexray code, because it means the tool is still alive, despite the fact it was written in archaic (by … Continue reading → |
Tool | ★★★ | |
|
2023-10-13 17:23:00 | Les chercheurs dévoilent le nouvel ensemble d'outils de Todckat \\ Researchers Unveil ToddyCat\\'s New Set of Tools for Data Exfiltration (lien direct) |
L'acteur avancé de menace persistante (APT) connue sous le nom de Toddycat a été lié à un nouvel ensemble d'outils malveillants conçus pour l'exfiltration de données, offrant un aperçu plus profond de la tactique et des capacités de l'équipe de piratage.
Les résultats proviennent de Kaspersky, qui a d'abord mis en lumière l'adversaire l'année dernière, le liant aux attaques contre des entités de haut niveau en Europe et en Asie pour près de trois
The advanced persistent threat (APT) actor known as ToddyCat has been linked to a new set of malicious tools that are designed for data exfiltration, offering a deeper insight into the hacking crew\'s tactics and capabilities. The findings come from Kaspersky, which first shed light on the adversary last year, linking it to attacks against high-profile entities in Europe and Asia for nearly three |
Tool Threat | ★★ | |
|
2023-10-13 08:01:34 | Un aperçu des modèles d'apprentissage automatique en point de preuve automatise An Overview of Machine Learning Models in Proofpoint Automate (lien direct) |
Did you know that, based on IDC\'s research, 39% of businesses say that improving operational efficiency is the top primary business objective for using artificial intelligence (AI)? At Proofpoint, there is tremendous interest in augmenting our product portfolio with AI and machine learning (ML) to produce benefits for our customers. In fact, today many of our Intelligent Compliance customers use our AI/ML technology to improve their operational efficiency and mitigate their compliance risk. When they report back to us about their quantitative and qualitative benefits, their results are impressive. In this blog, we\'ll give you an overview of why highly regulated firms choose the Proofpoint Intelligent Compliance platform. And then we\'ll go into details about how ML works in several solutions in the Intelligent Compliance product family. Proofpoint Intelligent Compliance is a comprehensive solution Our Intelligent Compliance platform offers a way for businesses to stay protected and compliant in a dynamic, virtual environment. It provides them with: AI-driven data visibility Information control Records retention and oversight Robust e-discovery capabilities (built-in and advanced) to satisfy requirements set by corporate mandates and regulatory bodies The platform includes these solutions: Proofpoint Archive Proofpoint Automate Proofpoint Capture Proofpoint Discover Proofpoint Patrol Proofpoint Supervision Proofpoint Track A must-have for highly regulated firms The Proofpoint Intelligent Compliance platform can benefit businesses in highly regulated industries. For example, financial services firms that are doing business in the U.S. must follow rules about supervision and monitoring set out by the Financial Industry Regulatory Authority (FINRA) and the Securities and Exchange Commission (SEC). Many of these firms now use Proofpoint Supervision technology to enable regulatory compliance with FINRA and the SEC. And Proofpoint Automate and Proofpoint Supervision work together to help these businesses supervise their digital communications. Reducing false positives with ML models Automate makes a big impact with helping businesses to reduce false positives. These are flagged, archived items, like email messages, which turn out to be of low or no risk after a review. They are a significant problem for companies that need to supervise digital communications. Automate uses ML models with Supervision to reduce false positives from supervisory review queues. This helps customers streamline processes and reduce human fatigue and errors. Teams manage and review much less low-risk content, which means reviewers can focus on real issues. One Proofpoint client reported that after deploying Supervision and Automate, they cut their review queue volume by a third. They reduced their flagged but not reviewed items from nearly 30 days to about 14 days out, which is now within their internal service-level agreements. Automate provides ML models and the tools to build ML models trained on your data to help reduce false positives. You have the option to: Build your own models Work with Proofpoint professional services to develop customized models Start with any of the models included with Automate The models that come with Automate are Low-Risk Content Model (LRCM), Disclaimer Detection Model or Customer Complaints Model. Let\'s take a closer look at the first one-LRCM. What does the LRCM do? You can use LRCM to remove low-risk content in two different ways-through exclusion detection or Auto-Clear. For sender and subject line exclusion detection, the model will make suggestions that an administrator can review, accept or decline. (See Figure 1.) Figure 1. Proofpoint Automate uses exclusion detection to surface subject line suggestions to add to the Supervision policy. If the administrator accepts the subject line, that line is added to the Supervision policy. Subsequent messages with the respective subject line will not be ev | Tool | ★★ | |
 |
2023-10-13 03:47:17 | Une analyse d'une webcontent de safari iOS dans la fenêtre dans l'exploit de processus GPU An analysis of an in-the-wild iOS Safari WebContent to GPU Process exploit (lien direct) |
By Ian Beer
A graph representation of the sandbox escape NSExpression payload
In April this year Google\'s Threat Analysis Group, in collaboration with Amnesty International, discovered an in-the-wild iPhone zero-day exploit chain being used in targeted attacks delivered via malicious link. The chain was reported to Apple under a 7-day disclosure deadline and Apple released iOS 16.4.1 on April 7, 2023 fixing CVE-2023-28206 and CVE-2023-28205.
Over the last few years Apple has been hardening the Safari WebContent (or "renderer") process sandbox attack surface on iOS, recently removing the ability for the WebContent process to access GPU-related hardware directly. Access to graphics-related drivers is now brokered via a GPU process which runs in a separate sandbox.
Analysis of this in-the-wild exploit chain reveals the first known case of attackers exploiting the Safari IPC layer to "hop" from WebContent to the GPU process, adding an extra link to the exploit chain (CVE-2023-32409).
On the surface this is a positive sign: clear evidence that the renderer sandbox was hardened sufficiently that (in this isolated case at least) the attackers needed to bundle an additional, separate exploit. Project Zero has long advocated for attack-surface reduction as an effective tool for improving security and this would seem like a clear win for that approach.
On the other hand, upon deeper inspection, things aren\'t quite so rosy. Retroactively sandboxing code which was never designed with compartmentalization in mind is rarely simple to do effectively. In this case the exploit targeted a very basic buffer overflow vulnerability in unused IPC support code for a disabled feature - effectively new attack surface which exists only because of the introduced sandbox. A simple fuzzer targeting the IPC layer would likely have found this vulnerability in seconds.
|
Tool Vulnerability Threat | ★★ | |
 |
2023-10-12 21:17:00 | AppDome annonce des outils d'évaluation des attaques dans l'économie numérique \\'s Mobile XDR Appdome Announces Attack Evaluation Tools in Digital Economy\\'s Mobile XDR (lien direct) |
By Ian Beer
A graph representation of the sandbox escape NSExpression payload
In April this year Google\'s Threat Analysis Group, in collaboration with Amnesty International, discovered an in-the-wild iPhone zero-day exploit chain being used in targeted attacks delivered via malicious link. The chain was reported to Apple under a 7-day disclosure deadline and Apple released iOS 16.4.1 on April 7, 2023 fixing CVE-2023-28206 and CVE-2023-28205.
Over the last few years Apple has been hardening the Safari WebContent (or "renderer") process sandbox attack surface on iOS, recently removing the ability for the WebContent process to access GPU-related hardware directly. Access to graphics-related drivers is now brokered via a GPU process which runs in a separate sandbox.
Analysis of this in-the-wild exploit chain reveals the first known case of attackers exploiting the Safari IPC layer to "hop" from WebContent to the GPU process, adding an extra link to the exploit chain (CVE-2023-32409).
On the surface this is a positive sign: clear evidence that the renderer sandbox was hardened sufficiently that (in this isolated case at least) the attackers needed to bundle an additional, separate exploit. Project Zero has long advocated for attack-surface reduction as an effective tool for improving security and this would seem like a clear win for that approach.
On the other hand, upon deeper inspection, things aren\'t quite so rosy. Retroactively sandboxing code which was never designed with compartmentalization in mind is rarely simple to do effectively. In this case the exploit targeted a very basic buffer overflow vulnerability in unused IPC support code for a disabled feature - effectively new attack surface which exists only because of the introduced sandbox. A simple fuzzer targeting the IPC layer would likely have found this vulnerability in seconds.
|
Tool | ★★ | |
|
2023-10-12 19:15:00 | Logiciel de progrès confronté à des dizaines de recours collectifs, enquête SEC à la suite de l'incident de Moveit Progress Software facing dozens of class action lawsuits, SEC investigation following MOVEit incident (lien direct) |
La société derrière un outil de transfert de fichiers populaire fait face à des dizaines de poursuites et d'enquêtes par plusieurs agences américaines à la suite de l'exploitation d'une vulnérabilité critique en mai.Progress Software & # 8211;L'entreprise qui possède l'outil de transfert de fichiers Moveit & # 8211;a déclaré ses résultats trimestriels cette semaine et a fourni une ventilation détaillée des coûts
The company behind a popular file transfer tool is facing dozens of lawsuits and investigations by several U.S. agencies following the exploitation of a critical vulnerability in May. Progress Software – the company that owns the MOVEit file transfer tool – reported its quarterly earnings this week and provided a detailed breakdown of the costs |
Tool Vulnerability | ★★ | |
|
2023-10-12 17:51:58 | Semperis élargit l'outil d'analyse du chemin d'attaque du druide forestier pour se prémunir contre les attaques d'identification ENTRA Semperis Expands Forest Druid Attack Path Analysis Tool to Guard Against Entra ID Attacks (lien direct) |
La nouvelle capacité étend le support multi-directory pour les druides forestiers pour aider les défenseurs de cybersécurité à fermer rapidement les voies d'attaque risquées vers les actifs de niveau 0 dans les environnements d'identité hybride
-
revues de produits
New capability extends multi-directory support for Forest Druid to help cybersecurity defenders rapidly close risky attack paths to Tier 0 assets across hybrid identity environments - Product Reviews |
Tool | ★★★ | |
|
2023-10-12 10:52:45 | Une journée dans la vie d'un analyste de cybersécurité A Day in the Life of a Cybersecurity Analyst (lien direct) |
The day-to-day experience of cybersecurity professionals can vary widely, even though we face similar threats and have many of the same tools at our disposal. In this post, I\'d like to shine a light on what a typical day looks like for a business information security analyst in the world of cybersecurity-a role I know well. Getting started in cybersecurity I\'m a musician-a bagpiper. It\'s a strange one, I know, but that\'s how I started my career. For a couple of years after leaving school, I taught and performed pipe music. But after finishing my music diploma, I knew that there were only so many hours in the week, and only so many people to teach. So, perhaps I should learn another skill, too. It was my dad who suggested cybersecurity. From the outside, it looked interesting and seemed like an industry on the up and up. So I applied for a cybersecurity course at Robert Gordon University in Aberdeen, Scotland. At that time, I didn\'t have much technical knowledge. However, after a chance meeting with the head of the cybersecurity course on a university open day, I felt it was an area I could potentially break into. Within a few weeks, I had signed up for a five-year course with the option of a placement after the second year. Fast-forward to today, and here I am two years into the job, and I\'ve just finished my third year at university. My work placement transitioned into a full-time role, which I still balance with my full-time studies. What does a “normal” day look like for a cybersecurity analyst? No two days are ever the same. It\'s typical for people new to this role to ask, “What are my tasks?” The honest answer is that they\'re hard to define. It depends on what\'s going on in the business at that time, and who you know and work with regularly. While we have great security tools in place to flag suspicious activity, a lot of the time I\'m dealing with situations where I must trust my gut instincts. A task I have grown into managing in my current role is the security training program and phishing simulations across the company. Just yesterday, I issued approvals for a new training campaign that we\'re running for our operations team in Iraq. We aim to carry out targeted team training quarterly in shorter bites, 20 minutes here and there, to try to keep people engaged more than once a year. I\'ll usually spend part of my day managing our external support teams and service providers, too. I manage our security exceptions process, which involves vetting and approving requests from the business. For me, it\'s a case of making sure we have the right information from our users, asking the “Why?” to their wants, and finding out if there are more secure alternatives for providing a solution. Indicator of compromise (IOC) checks are an ongoing task. We\'re part of a service organisation forum, so we often gather and share important information with our industry peers. We have a shared spreadsheet that\'s automatically tracked, and we always receive possible indicators internally from our ever-growing network of security champions. I just need to make sure that our email security and firewall security are ticked off, blocked and managed. Measuring success Being part of the service organisation forum means that we are constantly sharing information with our peers. It allows us to compare the results of our training programs over time to see how we trend against each other. We also look back at how we have performed in these areas internally over the last few years to make sure we\'re always improving. We\'re also passionate about data governance. We want to ensure that our users not only understand risk but also how to appropriately manage company and client data. We want to always use best practices and build an internal security culture from the ground up. There\'s that saying, “You\'re only as good as your weakest player.” When it comes to cybersecurity issues, an organization is like a football team. You have 40,000 employees-and if just one of them doesn\'t know what | Tool Prediction | ★★★ | |
|
2023-10-12 10:00:00 | L'évolution des attaques de phishing The evolution of phishing attacks (lien direct) |
A practical guide to phishing and best practices to avoid falling victim. Introduction Over the past several years, remote and hybrid work has quickly gained popularity amongst those seeking a to reduce the amount of time on the road or an improved work/life balance. To accomplish this, users are often working from multiple devices, some of which may be company issued, but others may be privately owned. Cyberattackers have leveraged this trend to bypass traditional security controls using social engineering, with phishing attacks being a favored tactic. In fact, the FBI Internet Crime Report issued in 2022 reported phishing as the top reported internet crime for the past 5 years. Its ability to persuade individuals to divulge sensitive information to seemingly familiar contacts and companies over email and/or SMS text messages has resulted in significant data breaches, both personal and financial, across all industries. Mobile phishing, in particular, is quickly becoming a preferred attack vector among hackers seeking to use them as a jump point to gain access to proprietary data within a company’s network. This article provides an overview of the origins of phishing, its impact on businesses, the types of mobile phishing attacks hackers employ, and ways in which companies can best defend themselves against such attacks. The origins of phishing The belief among many in the cybersecurity industry is that phishing attacks first emerged in the mid-90s when dial-up was the only means of gaining access to the internet. Hackers posing as ISP administrators used fake screen names to establish credibility with the user, enabling them to “phish” for personal log-in data. Once successful, they were able to exploit the victim’s account by sending out phishing emails to other users in their contact list, with the goal of scoring free internet access or other financial gain. Awareness of phishing was still limited until May 2000 when Love Bug entered the picture. Love Bug, a highly effective and contagious virus designed to take advantage of the user’s psyche was unleashed in the Philippines, impacting an estimated 45 million Window PCs globally. Love Bug was sent via email with the subject line reading “ILOVEYOU”. The body of the message simply read “Kindly check the attached LOVELETTER coming from me”. Users who couldn’t resist opening the message unleashed a worm virus infecting and overwriting user’s files with copies of the virus. When the user opened the file, they would reinfect the system. Lovebug elevated phishing to a new level as it demonstrated the ability to target a user’s email mailing list for the purpose of spamming acquaintances thereby incentivizing the reader to open his/her email. This enabled the lovebug worm to infect computer systems and steal other user’s passwords providing the hacker the opportunity to log-in to other user accounts providing unlimited internet access. Since Love Bug, the basic concept and primary goal of phishing tactics has remained consistent, but the tactics and vectors have evolved. The window of opportunity has increased significantly for hackers with the increased use of social media (e.g., Linkedin, Twitter, Facebook). This provides more personal data to the hackers enabling them to exploit their targets with more sophisticated phishing tactics while avoiding detection. Phishing’s impact in the marketplace today Phishing attacks present a significant threat for organizations as their ability to capture proprietary business and financial data are both costly and time consuming for IT organizations to detect and remediate. Based on a | Ransomware Malware Tool Threat Prediction | ★★★ | |
 |
2023-10-12 09:45:41 | Métiers IT – Développeur web : définition, formation, salaire (lien direct) | Le développeur web est en charge de la conception de sites et applications web. Il contrôle la fiabilité et les performances des fonctionnalités mises en oeuvre. Il maîtrise les outils et les langages du développement web. | Tool | ★★★ | |
|
2023-10-12 09:27:20 | J'ai été frappé par les ransomwares-temps quoi?Étapes pour gérer les conséquences I\\'ve Been Hit by Ransomware-Now What? Steps for Dealing with the Aftermath (lien direct) |
The following is an excerpt from the Ransomware Survival Guide, our free handbook on preventing, managing and recovering from ransomware threats at every stage of the attack chain. This blog post provides general tips-it is not a substitute for professional cybersecurity and incident response services. The best ransomware strategy is to avoid it in the first place. But increasingly advanced attacks against the software supply chain and end users have shown that even the best-prepared companies can be caught out. Ransomware may not even be the first malware payload to infect your system, because many ransomware gangs now prefer to buy access to targets already infected with Trojans or loader malware. During an attack, you have short-term problems to resolve, like getting computers, phones and networks back online and dealing with ransom demands. But a panicked response won\'t help-and may make things worse. Here are some general steps you can take to contain the threat and start on the road to recovery. Questions to answer during a ransomware attack Before you react to an attack, it\'s important to take a step back and ask questions that will inform your response. Your answers should help network administrators scope the problem, devise an action plan and possibly curtail the spread. Who in your environment is compromised? How widespread are the infections? Is a threat actor actively scouting your environment, exfiltrating data or ready to drop ransomware on other devices? What network permissions do compromised accounts or devices have? Ransomware may have been installed only after attackers had already moved laterally within the network or stolen credentials and other data. What type of attack is it? Is this attack a secondary infection? Did it come from downloaders, remote access Trojans (RATs) or other malware installed on the infected machine or others on the network? Keep in mind that ransomware spreads quickly and is often a byproduct of other threats. If you see one infection, there are probably others that you don\'t see. Proactively look for other issues within your environment. Now as you take action, there are three general step to follow: Step 1: Isolate infected systems The second employees see the ransomware demand or notice something\'s odd-such as suddenly losing access to their own files-they should disconnect from the network and take the infected machine to the IT department. To prepare for this scenario, we recommend that you keep valuable data and systems separated so that a security issue on one system doesn\'t affect other systems. For example, your sensitive research or business data should not reside on the same server and network segment as your email environment. We advise against having employees reboot their system. Only the IT security team should attempt a reboot, and even that will work only in the event that it is “scareware,” or fake ransomware. "Scareware" is malware that appears to be ransomware but isn\'t. It may lock the user\'s screen with a ransom demand and payment instructions, but the data is not actually encrypted. In those scenarios, standard anti-malware tools can help. Knowing the difference isn\'t always easy. Determine the scope of the problem using threat intelligence and external incident responders or forensic analysts when necessary. While all ransomware is bad, some attacks are worse than others. Your response-including whether to pay the ransom-hinges on several factors. Step 2: Call law enforcement Ransomware-like other forms of theft and extortion-is a crime. Nobody has the right to seize devices, networks or data-let alone demand a ransom in exchange for it. Notifying the proper authorities is a necessary first step. Contact local or federal law enforcement right away. Special departments exist specifically to aid cyber crime victims, so do not be afraid to pick up your phone and call them. They are there to help you and may have access to decryption keys or information on payment recovery after | Ransomware Malware Tool Threat | ★★★ | |
|
2023-10-11 22:08:45 | AppDome annonce de nouveaux outils d'évaluation des attaques dans le premier XDR mobile de l'économie numérique \\ Appdome Announces New Attack Evaluation Tools in Digital Economy\\'s First Mobile XDR (lien direct) |
AppDome annonce de nouveaux outils d'évaluation des attaques dans le premier XDR mobile de l'économie numérique
menace-inspect ™, menaces et instantanés font du mobile XDR le bon choix pour les marques du monde
-
revues de produits
Appdome Announces New Attack Evaluation Tools in Digital Economy\'s First Mobile XDR Threat-Inspect™, Threat-Views and Snapshots Make Mobile XDR the Right Choice for Brands Globally - Product Reviews |
Tool | ★★ | |
|
2023-10-11 11:00:00 | Protéger les versions de l'IA 3 outils de sécurité AI / ML en tant que open source Protect AI Releases 3 AI/ML Security Tools as Open Source (lien direct) |
La société a publié NB Defence, ModelsCan et Rebuff, qui détectent les vulnérabilités dans les systèmes d'apprentissage automatique, sur GitHub.
The company released NB Defense, ModelScan, and Rebuff, which detect vulnerabilities in machine learning systems, on GitHub. |
Tool Vulnerability | ★★ | |
|
2023-10-10 18:15:16 | CVE-2023-36720 (lien direct) | Windows Mixe Reality Developer Tools Denial of Service Vulnérabilité
Windows Mixed Reality Developer Tools Denial of Service Vulnerability |
Tool Vulnerability | ||
 |
2023-10-10 15:39:40 | Échelle au-delà ducorp avec les politiques de contrôle d'accès assistées par l'IA Scaling BeyondCorp with AI-Assisted Access Control Policies (lien direct) |
Ayush Khandelwal, Software Engineer, Michael Torres, Security Engineer, Hemil Patel, Technical Product Expert, Sameer Ladiwala, Software EngineerIn July 2023, four Googlers from the Enterprise Security and Access Security organizations developed a tool that aimed at revolutionizing the way Googlers interact with Access Control Lists - SpeakACL. This tool, awarded the Gold Prize during Google\'s internal Security & AI Hackathon, allows developers to create or modify security policies using simple English instructions rather than having to learn system-specific syntax or complex security principles. This can save security and product teams hours of time and effort, while helping to protect the information of their users by encouraging the reduction of permitted access by adhering to the principle of least privilege.Access Control Policies in BeyondCorpGoogle requires developers and owners of enterprise applications to define their own access control policies, as described in BeyondCorp: The Access Proxy. We have invested in reducing the difficulty of self-service ACL and ACL test creation to encourage these service owners to define least privilege access control policies. However, it is still challenging to concisely transform their intent into the language acceptable to the access control engine. Additional complexity is added by the variety of engines, and corresponding policy definition languages that target different access control domains (i.e. websites, networks, RPC servers).To adequately implement an access control policy, service developers are expected to learn various policy definition languages and their associated syntax, in addition to sufficiently understanding security concepts. As this takes time away from core developer work, it is not the most efficient use of developer time. A solution was required to remove these challenges so developers can focus on building innovative tools and products.Making it WorkWe built a prototype interface for interactively defining and modifying access control policies for the | Tool Vulnerability | ★★★ | |
|
2023-10-10 10:00:00 | & timide; histoires du SOC: Quishing & # 8211;Combattre les codes QR malveillants intégrés Stories from the SOC: Quishing – Combatting embedded malicious QR codes (lien direct) |
James Rodriguez – Senior Specialist, Cybersecurity
Executive summary
Over the past several months, AT&T Managed Detection and Response (MTDR) security operations center (SOC) analysts have seen an increase in the usage of phishing emails containing malicious QR codes. In a recent example, a customer that was victimized by a phishing attempt provided the AT&T analysts with an email that was circulated to several of its internal users. The analysts reviewed the email and its included attachment, a PDF containing a QR code and an urgent message claiming to be from Microsoft.
When the targeted user scanned the QR code, they were directed to a counterfeit Microsoft login page designed to harvest usernames and passwords. This type of attack is called “quishing.”
Unfortunately, several users fell victim to the attack, and their credentials were compromised. However, our analysts were able to engage with the customer and guide them through the proper remediation steps.
Encouraging targeted users to act quickly and scan the code using their phone (which often is not as secure as the rest of a company’s network) is a standard tactic employed by threat actors. By doing this, they hope to convince the user to act without thinking and forgo proper security practices allowing the threat actor to bypass traditional security measures in place on a company network.
Threat actor tactics
The threat actor used a Windows authentication setup for multi-factor authentication (MFA) to initiate the attack. The targeted users received a phishing email indicating MFA needed to be set up on their account. The email included a PDF attachment with instructions directing them to scan the included QR code, which was malicious.
Once the users scanned the QR code, they were redirected to a fake Microsoft sign-in page on their phone. Here, they entered their legitimate login credentials,which were then stored and made available to the threat actor.
Investigation
Once the customer suspected the email was malicious, they contacted the AT&T team and provided a copy of the PDF file with the included QR code. The team analyzed the file and the QR code (see Image 1) and identified the associated destination as “srvc1[.]info/mcrsft2fasetup/index.html.”
Image 1: PDF file from customer containing malicious QR code
The QR codes associated URL sends the user to a credential harvester masquerading as a Microsoft login page. (See Image 2.)
Image 2: Credential harvester masquerading as login page
AT&T SOC analysts analyzed the credential harvester using a fake email and the Google Chrome Inspector tool to record any outbound connections when clicking the “Sign In” button (see Image 2). Only one network connection was made, which resulted in a 404 HTTP response code to the external domain “logo.clearbit[.]com/email.com.” Research into clearbit[.]com found it is associated with Clearbit B2B Marketing Intelligence, which is listed as a legitimate marketing tool for identifying customers and sales exchanges.
Analysts used open-source intelligence (OSINT) to further research the initial associated domain “srvc1[.]info” but found no additional information as the domain was recently purchased. Further investigation revealed that the owner’s identity was hidden, and there was no additional data available. The customer confirmed that neither the Clearbit nor the srvc1 external domains were known or a part of normal business use within their environment.
Remediation
AT&T SOC analysts worked closely with the customer to identify w |
Tool Threat | ★★★★ | |
 |
2023-10-10 04:42:35 | Infostaler avec un certificat anormal en cours de distribution Infostealer with Abnormal Certificate Being Distributed (lien direct) |
Récemment, il y a eu un taux de distribution élevé de logiciels malveillants en utilisant des certificats anormaux.Les logiciels malveillants se déguisent souvent avec des certificats normaux.Cependant, dans ce cas, les logiciels malveillants ont saisi les informations de certificat au hasard, le nom du sujet et les champs de noms émetteur ayant des chaînes inhabituellement longues.En conséquence, les informations sur le certificat ne sont pas visibles dans les systèmes d'exploitation Windows, et un outil ou une infrastructure spécifique est nécessaire pour inspecter la structure de ces certificats.Bien sûr, ces certificats échouent en vérification de signature depuis ...
Recently, there has been a high distribution rate of malware using abnormal certificates. Malware often disguise themselves with normal certificates. However, in this case, the malware entered the certificate information randomly, with the Subject Name and Issuer Name fields having unusually long strings. As a result, the certificate information is not visible in Windows operating systems, and a specific tool or infrastructure is required to inspect the structure of these certificates. Of course, these certificates fail in signature verification since... |
Malware Tool | ★★★ | |
|
2023-10-09 19:47:00 | Le fonctionnement derrière les logiciels espions mobiles de Predator est \\ 'échelle industrielle \\' Operation Behind Predator Mobile Spyware Is \\'Industrial Scale\\' (lien direct) |
L'Intellexa Alliance utilise une gamme d'outils pour intercepter et renverser les technologies mobiles et Wi-Fi pour déployer ses outils de surveillance, selon une enquête d'Amnesty International et d'autres.
The Intellexa alliance has been using a range of tools for intercepting and subverting mobile and Wi-Fi technologies to deploy its surveillance tools, according to an investigation by Amnesty International and others. |
Tool | ★★ | |
|
2023-10-09 15:21:57 | Dévoilant \\ 'STESIN \\' Alive \\ ': un examen plus approfondi d'une campagne en cours en Asie ciblant les télécommunications et les entités gouvernementales Unveiling \\'Stayin\\' Alive\\': A Closer Look at an Ongoing Campaign in Asia Targeting Telecom and Governmental Entities (lien direct) |
 Faits saillants: Check Point Research a suivi "STESHIN \\ 'Alive", une campagne d'espionnage en cours opérant en Asie, et ciblant principalement l'industrie des télécommunications, ainsi que des organisations gouvernementales.La campagne «Stayin \\ 'Alive» utilisée contre des organisations asiatiques de grande envergure, ciblait initialement des organisations au Vietnam, en Ouzbékistan et au Kazakhstan.Alors que nous effectuons notre analyse, nous avons réalisé que cela faisait partie d'une campagne beaucoup plus large ciblant la région.Les outils observés dans la campagne sont liés à \\ 'Toddycat \' - un acteur affilié chinois opérant dans la région des clients de point de contrôle en utilisant le point final de Check Point Harmony et l'émulation de menace restent protégés contre la campagne détaillée dans ce rapport [& # 8230;]
 Highlights: Check Point Research has been tracking “Stayin\' Alive”, an ongoing espionage campaign operating in Asia, and primarily targeting the Telecom industry, as well as government organizations. The “Stayin\' Alive” campaign used against high-profile Asian organizations, initially targeted organizations in Vietnam, Uzbekistan, and Kazakhstan. As we conducted our analysis, we realized that it is part of a much wider campaign targeting the region. Tools observed in the campaign are linked to \'ToddyCat\'- a Chinese affiliated actor operating in the region Check Point customers using Check Point Harmony Endpoint and Threat Emulation remain protected against the campaign detailed in this report […]
|
Tool Threat | ★★ | |
|
2023-10-09 14:19:54 | Découvrez l\'adresse IP de vos contacts Telegram facilement avec ce script (lien direct) | Un script permet de trouver l'adresse IP d'un interlocuteur sur Telegram pour résoudre des problèmes réseau ou collaborer. Il faut installer Telegram Desktop et l'outil d'analyse réseau tshark. Le script, destiné à des fins éducatives, doit être utilisé avec l'autorisation de la personne concernée. | Tool | ★★★★ | |
|
2023-10-09 12:30:13 | Rust à métal nu dans Android Bare-metal Rust in Android (lien direct) |
Posted by Andrew Walbran, Android Rust Team
Last year we wrote about how moving native code in Android from C++ to Rust has resulted in fewer security vulnerabilities. Most of the components we mentioned then were system services in userspace (running under Linux), but these are not the only components typically written in memory-unsafe languages. Many security-critical components of an Android system run in a “bare-metal” environment, outside of the Linux kernel, and these are historically written in C. As part of our efforts to harden firmware on Android devices, we are increasingly using Rust in these bare-metal environments too.
To that end, we have rewritten the Android Virtualization Framework\'s protected VM (pVM) firmware in Rust to provide a memory safe foundation for the pVM root of trust. This firmware performs a similar function to a bootloader, and was initially built on top of U-Boot, a widely used open source bootloader. However, U-Boot was not designed with security in a hostile environment in mind, and there have been numerous security vulnerabilities found in it due to out of bounds memory access, integer underflow and memory corruption. Its VirtIO drivers in particular had a number of missing or problematic bounds checks. We fixed the specific issues we found in U-Boot, but by leveraging Rust we can avoid these sorts of memory-safety vulnerabilities in future. The new Rust pVM firmware was released in Android 14.
As part of this effort, we contributed back to the Rust community by using and contributing to existing crates where possible, and publishing a number of new crates as well. For example, for VirtIO in pVM firmware we\'ve spent time fixing bugs and soundness issues in the existing virtio-drivers crate, as well as adding new functionality, and are now helping maintain this crate. We\'ve published crates for making PSCI and other Arm SMCCC calls, and for managing page tables. These are just a start; we plan to release more Rust crates to support bare-metal programming on a range of platforms. These crates are also being used outside of Android, such as in Project Oak and the bare-metal section of our Comprehensive Rust course.
Training engineers
Many engineers have been positively surprised by how p |
Tool Vulnerability | ★★ | |
|
2023-10-09 10:00:00 | Mois de sensibilisation à la cybersécurité: Habitudes scolaires pour vous protéger, vous et votre famille, Cybersecurity Awareness Month: School habits to protect you and your family (lien direct) |
Retour à l'école est le moment idéal pour se souvenir des meilleures pratiques de base de la cybersécurité pour vous protéger, vous et votre famille.Ceux-ci ne surprennent que quiconque a été parent depuis quelques années, mais ce qui pourrait vous surprendre, c'est à quelle vitesse les choses changent, ce qui peut augmenter votre risque de donner accès aux cybercriminels.C'est principalement autour de toutes les applications, et même des micro-applications, qui fournissent le plus souvent les niveaux de sécurité les plus bas. applications, applications, applications, tout a une application. Les écoles travaillent dur pour moderniser, améliorer la communication, rationaliser l'apprentissage, etc.Pour ce faire, de nombreuses écoles utilisent des applications.L'utilisation d'applications mobiles, en particulier pour les téléphones, est un effort pour démocratiser l'accès à l'information, car vous ne devez pas utiliser un ordinateur ou un Wi-Fi pour accéder à ces applications.Tout ce dont vous avez besoin est un appareil mobile. La bonne nouvelle consiste à utiliser ces applications pour consommer des informations est généralement sûre.Vous pouvez voir les notes, la fréquentation, les annonces scolaires, etc., et parce qu'elle est principalement à sens unique et ndash;partager des informations avec vous & ndash;vous & rsquo; est généralement sûr.Voir la note sur les mots de passe ci-dessous, mais sur ce front, vous pouvez vous détendre. La mauvaise nouvelle, ou zone de danger, est lorsque vous entrez des informations dans cette application.Cela commence à devenir plus compliqué parce que les menaces de sécurité commencent à avoir des niveaux.Voici comment y penser: Assurez-vous que l'application que vous utilisez est légitime.Des choses comme les codes QR (ces boîtes sur lesquelles vous pointez votre appareil photo, et un site Web lance) et les e-mails sont souvent comment vous avez dit d'obtenir une application.Les deux outils et ndash;Codes QR et e-mail & ndash;peut être truqué.Si vous cliquez et suivez, vous pouvez vous retrouver dans un endroit dangereux.Au lieu de cela, vous devez vérifier l'emplacement que vous visitez est authentique.Parfois, ce n'est pas facile. La meilleure façon de vous assurer que vous êtes au bon endroit n'est pas d'utiliser des codes QR ou de suivre les liens électroniques qui sont ouverts afin que vous puissiez voir l'URL .Il vaut mieux entrer l'adresse URL directement dans votre navigateur, garantissant qu'il suit les conventions normales (les écoles utilisent généralement .edu, .gov, etc.).Les applications commerciales auront des URL .com;Vous devriez également être en mesure de rechercher le nom de l'application en ligne pour confirmer l'adresse. ne pas utiliser le même mot de passe que vous utilisez pour des choses importantes.Même si l'application semble légitime, créez un mot de passe que vous utilisez pour les choses scolaires.Vous voulez que ce soit différent parce que s'il y a une brèche, les méchants sont en association de votre nom à un mot de passe que vous utilisez pour votre carte bancaire, votre carte de crédit ou même votre e-mail. Don & rsquo; t n'entrez pas d'informations personnelles sur vous ou votre enfant. Si elle est requise pour l'école, l'école doit avoir vos informations en auto-peuplées (déjà remplies).C'est leur responsabilité.De nombreuses applications vous permettent de faire plus pour personnaliser des informations sur votre enfant et votre famille, et nous vous exhortons à considérer ce que vous êtes prêt à partager.Le dicton est ce qui est partagé sur Internet sur Internet.Il existe des nuances et des moyens de supprimer les informations, mais généralement, en particulier aux États-Unis, où les lois sur la confidentialité sont toujours en développement, il est sûr de supposer que c'est le cas. Cela signifie que vous ne souhaitez pas joindre aucune infor | Tool | ★★ | |
|
2023-10-08 18:00:00 | Les mainteneurs mettent en garde contre la vulnérabilité affectant l'outil de source ouverte fondamentale Maintainers warn of vulnerability affecting foundational open-source tool (lien direct) |
Les mainteneurs d'un outil open source populaire qui sert de support fondamental pour de nombreux protocoles de réseau comme SSL, TLS, HTTP, FTP, SMTP avertissent deux vulnérabilités qui seront annoncées la semaine prochaine.Les problèmes Centre de Curl, un outil de ligne de commande open source qui, selon les chercheurs, est largement utilisé par les développeurs et le système
The maintainers of a popular open source tool that serves as a foundational support for many network protocols like SSL, TLS, HTTP, FTP, SMTP are warning of two vulnerabilities that will be announced this coming week. The issues center on curl, an open-source command-line tool that researchers said is used widely by developers and system |
Tool Vulnerability | ★★★ | |
|
2023-10-06 19:59:00 | RIT est la première université à recevoir le soutien du Google Cybersecurity Clinics Fund RIT Is the First University to Receive Support From the Google Cybersecurity Clinics Fund (lien direct) |
Les mainteneurs d'un outil open source populaire qui sert de support fondamental pour de nombreux protocoles de réseau comme SSL, TLS, HTTP, FTP, SMTP avertissent deux vulnérabilités qui seront annoncées la semaine prochaine.Les problèmes Centre de Curl, un outil de ligne de commande open source qui, selon les chercheurs, est largement utilisé par les développeurs et le système
The maintainers of a popular open source tool that serves as a foundational support for many network protocols like SSL, TLS, HTTP, FTP, SMTP are warning of two vulnerabilities that will be announced this coming week. The issues center on curl, an open-source command-line tool that researchers said is used widely by developers and system |
Ransomware Tool | ★★ |
To see everything:
Our RSS (filtrered)
