What's new arround internet
Last one

Src Date (GMT) Titre Description Tags Stories Notes
The_Hackers_News.webp 2024-02-01 13:13:00 AVERTISSEMENT: de nouveaux logiciels malveillants émergent dans les attaques exploitant les vulnérabilités Ivanti VPN
Warning: New Malware Emerges in Attacks Exploiting Ivanti VPN Vulnerabilities (lien direct)		 Mandiant appartenant à Google a déclaré avoir identifié de nouveaux logiciels malveillants employés par un acteur de menace d'espionnage China-Nexus connu sous le nom de UNC5221 et d'autres groupes de menaces pendant l'activité post-exploitation ciblant Ivanti Connect Secure VPN et les appareils sécurisés politiques. Cela comprend des coquilles Web personnalisées telles que Bushwalk, Chainline, Framesting et une variante de & nbsp; Lightwire. "Chainline est une porte dérobée Python Web Shell qui est
Google-owned Mandiant said it identified new malware employed by a China-nexus espionage threat actor known as UNC5221 and other threat groups during post-exploitation activity targeting Ivanti Connect Secure VPN and Policy Secure devices. This includes custom web shells such as BUSHWALK, CHAINLINE, FRAMESTING, and a variant of LIGHTWIRE. "CHAINLINE is a Python web shell backdoor that is		 Malware Vulnerability Threat ★★★
SocRadar.webp 2024-02-01 11:51:06 La vulnérabilité dans Ivanti Connect Secure, Policy Secure et les neurones pour ZTA exploite (CVE-2024-21888, CVE-2024-21893)
Vulnerability in Ivanti Connect Secure, Policy Secure, and Neurons for ZTA Exploited (CVE-2024-21888, CVE-2024-21893) (lien direct)		 ivanti a révélé que dans le cadre de leur enquête en cours sur la précédente Ivanti Connect Secure ...
Ivanti has disclosed that as part of their ongoing investigation into previous Ivanti Connect Secure... 		Vulnerability ★★★
The_Hackers_News.webp 2024-02-01 10:32:00 CISA met en garde contre l'exploitation active de la vulnérabilité critique dans iOS, iPados et macOS
CISA Warns of Active Exploitation of Critical Vulnerability in iOS, iPadOS, and macOS (lien direct)		 L'Agence américaine de sécurité de la cybersécurité et de l'infrastructure (CISA) mercredi et NBSP; ajout & nbsp; une faille de haute sévérité ayant un impact sur iOS, iPados, macOS, TVOS et Watchos à son catalogue connu vulnérabilités exploitées (KEV), sur la base de preuves d'exploitation active. La vulnérabilité, suivie comme & nbsp; CVE-2022-48618 & nbsp; (Score CVSS: 7.8), concerne un bug dans le composant du noyau. "Un attaquant avec
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a high-severity flaw impacting iOS, iPadOS, macOS, tvOS, and watchOS to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerability, tracked as CVE-2022-48618 (CVSS score: 7.8), concerns a bug in the kernel component. "An attacker with		 Vulnerability ★★★
InfoSecurityMag.webp 2024-02-01 09:30:00 Ivanti libère des correctifs zéro jour et révèle deux nouveaux bugs
Ivanti Releases Zero-Day Patches and Reveals Two New Bugs (lien direct)		 Ivanti a finalement publié des mises à jour pour corriger deux bogues zéro-jours et deux nouvelles vulnérabilités de haute sévérité
Ivanti has finally released updates to fix two zero-day bugs and two new high-severity vulnerabilities		 Vulnerability Threat ★★
ProofPoint.webp 2024-02-01 06:00:12 Le pare-feu humain: Pourquoi la formation de sensibilisation à la sécurité est une couche de défense efficace
The Human Firewall: Why Security Awareness Training Is an Effective Layer of Defense (lien direct)		 Do security awareness programs lead to a quantifiable reduction in risk? Do they directly impact a company\'s security culture? In short, are these programs effective? The answer to these questions is a resounding yes! With 74% of all data breaches involving the human element, the importance of educating people to help prevent a breach cannot be understated.   However, for training to be effective, it needs to be frequent, ongoing and provided to everyone. Users should learn about:  How to identify and protect themselves from evolving cyberthreats  What best practices they can use to keep data safe  Why following security policies is important  In this blog post, we discuss the various ways that security awareness training can have a positive impact on your company. We also discuss how to make your program better and how to measure your success.   Security awareness training effectiveness  Let\'s look at three ways that security awareness training can help you boost your defenses.  1. Mitigate your risks   By teaching your team how to spot and handle threats, you can cut down on data breaches and security incidents. Our study on the effects of using Proofpoint Security Awareness showed that many companies saw up to a 40% decrease in the number of harmful links clicked by users.  Think about this: every click on a malicious link could lead to credential theft, a ransomware infection, or the exploitation of a zero-day vulnerability. So, an effective security awareness program essentially reduces security incidents by a similar amount. Want more evidence about how important it is? Just check out this study that shows security risks can be reduced by as much as 80%.   Here is more food for thought. If a malicious link does not directly result in a breach, it must still be investigated. The average time to identify a breach is 204 days. So, if you can reduce the number of incidents you need to investigate, you can see real savings in time and resources.  2. Comply with regulations   Security awareness education helps your company comply with data regulations, which are always changing. This can help you avoid hefty fines and damage to your reputation. In many cases, having a security awareness program can keep you compliant with several regulations. This includes U.S. state privacy laws, the European Union\'s GDPR and other industry regulations.  3. Cultivate a strong security culture  An effective security awareness program doesn\'t have to be all doom and gloom. Done right, it can help you foster a positive security culture. More than half of users (56%) believe that being recognized or rewarded would make their company\'s security awareness efforts more effective. But only 8% of users say that their company provides them with incentives to practice “good” cybersecurity behavior.  When you make security fun through games, contests, and reward and recognition programs, you can keep your employees engaged. You can also motivate them to feel personally responsible for security. That, in turn, can inspire them to be proactive about keeping your critical assets safe.  Finally, be sure to incorporate security principles into your company\'s core values. For example, your business leaders should regularly discuss the importance of security. That will help users to understand that everyone plays a vital role in keeping the business safe.   How to make your security awareness program effective  The verdict is clear. Security awareness programs can tangibly reduce organizational risks. When asked about the connection between their security awareness efforts and their company\'s cybersecurity resilience, a resounding 96% of security professionals say that there is more than just a strong link. They say that it\'s either a direct result of security training or that training is a strong contributor.   Let\'s discuss how you can make your program more effective.   Assess your security posture  The first step toward effectiveness is to assess your company\'s security posture Ransomware Tool Vulnerability Threat Studies ★★★
Checkpoint.webp 2024-02-01 03:00:27 Naviguer dans le labyrinthe de la cybersécurité pour les petites et moyennes affaires: comment Quantum Spark 1900 et 2000 remodeler la sécurité des PME et des MSP
Navigating the Cyber security Maze for Small and Medium Business: How Quantum Spark 1900 & 2000 are Reshaping Security for SMBs and MSPs (lien direct)		 Les pare-feu de nouvelle génération innovants offrent une prévention améliorée des menaces d'IA jusqu'à 5 Gbit / G, les petites et moyennes entreprises (PME) se retrouvent dans une position difficile.Avec une expertise limitée, une main-d'œuvre et un budget informatique, les PME ont souvent du mal à se défendre contre une vague croissante de menaces dynamiques.C'est là que le rôle des prestataires de services gérés (MSP) devient cruciale car ils doivent être prêts à aider les PME à chaque étape.Pour aider, vérifier Point & Reg;Software Technologies Ltd. & # 8217; s présente deux nouveaux [& # 8230;]
Innovative Next-Generation Firewalls Deliver Enhanced AI Threat Prevention up to 5 Gbps with a 99.8% block rate against zero-day malware, phishing, and ransomware  In an era where cyber threats are becoming increasingly complex, small and medium-sized businesses (SMBs) are finding themselves in a challenging position. With limited expertise, manpower, and IT budget, SMBs often struggle to defend against a growing wave of dynamic threats. This is where the role of Managed Service Providers (MSPs) becomes crucial as they must be prepared to aid SMBs every step of the way. To help, Check Point® Software Technologies Ltd.’s is introducing two new […] 		Malware Vulnerability Threat ★★
The_Hackers_News.webp 2024-02-01 01:30:00 RunC Flaws Enable Container Escapes, Granting Attackers Host Access (lien direct) Multiple security vulnerabilities have been disclosed in the runC command line tool that could be exploited by threat actors to escape the bounds of the container and stage follow-on attacks. The vulnerabilities, tracked as CVE-2024-21626, CVE-2024-23651, CVE-2024-23652, and CVE-2024-23653, have been collectively dubbed Leaky Vessels by cybersecurity vendor Snyk. "These container
Multiple security vulnerabilities have been disclosed in the runC command line tool that could be exploited by threat actors to escape the bounds of the container and stage follow-on attacks. The vulnerabilities, tracked as CVE-2024-21626, CVE-2024-23651, CVE-2024-23652, and CVE-2024-23653, have been collectively dubbed Leaky Vessels by cybersecurity vendor Snyk. "These container		 Tool Vulnerability Threat ★★
RecordedFuture.webp 2024-01-31 22:20:10 Deux nouveaux bogues Ivanti découverts comme CISA met en garde contre les pirates contournant les atténuations
Two new Ivanti bugs discovered as CISA warns of hackers bypassing mitigations (lien direct)		 La société informatique Ivanti a déclaré cette semaine qu'elle avait découvert deux nouvelles vulnérabilités affectant ses produits lors de l'enquête sur les bogues découverts plus tôt dans le mois.Les problèmes affectent la politique sécurisée d'Ivanti et Ivanti Connect Secure VPN qui sont largement utilisés à travers le gouvernement américain et d'autres industries.Les deux vulnérabilités - appelées CVE-2024-21888 et
IT company Ivanti said this week that it discovered two new vulnerabilities affecting its products while investigating bugs discovered earlier in the month. The issues affect Ivanti\'s Policy Secure and Ivanti Connect Secure VPN products that are used widely across the U.S. government and other industries. The two vulnerabilities - referred to as CVE-2024-21888 and		 Vulnerability ★★
DarkReading.webp 2024-01-31 22:00:00 \\ 'navires qui fuisent \\' Les bogues cloud autorisent les évasions du conteneur à l'échelle mondiale
\\'Leaky Vessels\\' Cloud Bugs Allow Container Escapes Globally (lien direct)		 Les quatre vulnérabilités de sécurité se trouvent dans Docker et au-delà, et une affectant RUNC affecte essentiellement tous les développeurs natifs du cloud dans le monde.
The four security vulnerabilities are found in Docker and beyond, and one affecting runC affects essentially every cloud-native developer worldwide.		 Vulnerability Cloud ★★★
Google.webp 2024-01-31 20:08:14 GCP-2024-005 (lien direct) Publié: 2024-01-31 Description Description Gravité notes Une vulnérabilité de sécurité, CVE-2024-21626, a été découverte dans runc où un utilisateur avec la permission de créer des pods sur le système d'exploitation optimisé et les nœuds ubuntu à conteneur pourraitêtre en mesure d'accéder à un accès complet au système de fichiers de nœud. Pour les instructions et plus de détails, consultez les bulletins suivants: Bulletin de sécurité gke gke sur le bulletin de sécurité VMware gke sur le bulletin de sécurité AWS gke sur le bulletin de sécurité azur gke sur le bulletin de sécurité en métal nus High CVE-2024-21626 Published: 2024-01-31Description Description Severity Notes A security vulnerability, CVE-2024-21626, has been discovered in runc where a user with permission to create Pods on Container-Optimized OS and Ubuntu nodes might be able to gain full access to the node filesystem. For instructions and more details, see the following bulletins: GKE security bulletin GKE on VMware security bulletin GKE on AWS security bulletin GKE on Azure security bulletin GKE on Bare Metal security bulletin High CVE-2024-21626 Vulnerability Cloud
The_Hackers_News.webp 2024-01-31 19:08:00 Alerte: Ivanti révèle 2 nouveaux défauts zéro-jours, un sous exploitation active
Alert: Ivanti Discloses 2 New Zero-Day Flaws, One Under Active Exploitation (lien direct)		 Ivanti alerte de deux nouveaux défauts de haute sévérité dans ses produits Secure et Policy Secure Connect, dont l'un est dit en cours d'exploitation ciblée dans la nature. La liste des vulnérabilités est la suivante - CVE-2024-21888 & NBSP; (Score CVSS: 8.8) - Une vulnérabilité d'escalade de privilège dans le composant Web d'Ivanti Connect Secure (9.x, 22.x) et la politique Ivanti Secure (9.x, 22.x)
Ivanti is alerting of two new high-severity flaws in its Connect Secure and Policy Secure products, one of which is said to have come under targeted exploitation in the wild. The list of vulnerabilities is as follows - CVE-2024-21888 (CVSS score: 8.8) - A privilege escalation vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows		 Vulnerability Threat ★★
Blog.webp 2024-01-31 18:40:06 Ivanti VPN Flaws exploité pour diffuser des logiciels malveillants Krustyloader
Ivanti VPN Flaws Exploited to Spread KrustyLoader Malware (lien direct)		 > Par deeba ahmed Les vulnérabilités Ivanti VPN ont plongé dans un trou noir. Ceci est un article de HackRead.com Lire le post original: Ivanti VPN Flaws exploité pour diffuser des logiciels malveillants Krustyloader
>By Deeba Ahmed The Ivanti VPN vulnerabilities have plunged into a black hole. This is a post from HackRead.com Read the original post: Ivanti VPN Flaws Exploited to Spread KrustyLoader Malware		 Malware Vulnerability ★★
Mandiant.webp 2024-01-31 16:30:00 Cutting Edge, partie 2: Enquêter Ivanti Connect Secure VPN Exploitation Zero-Day
Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation (lien direct)		 Le 12 janvier 2024, Mandiant a publié un Article de blog Détaillant deux vulnérabilités à haut impact, CVE-2023-46805 et CVE-2024-21887 , affectant Ivanti Connect Secure VPN (CS, anciennement Secure Secure) et Ivanti Secure (Ps) Appareils.Le 31 janvier 2024, Ivanti divulgué Deux vulnérabilités supplémentaires ayant un impact sur les dispositifs CS et PS, CVE-2024-21888 et CVE-2024-21893. Les vulnérabilités permettent à un acteur de menace non authentifié d'exécuter des commandes arbitraires sur l'appareil avec des privilèges élevés.Comme indiqué précédemment, Mandiant a identifié l'exploitation zéro jour de ces vulnérabilités
On Jan. 12, 2024, Mandiant published a blog post detailing two high-impact zero-day vulnerabilities, CVE-2023-46805 and CVE-2024-21887, affecting Ivanti Connect Secure VPN (CS, formerly Pulse Secure) and Ivanti Policy Secure (PS) appliances. On Jan. 31, 2024, Ivanti disclosed two additional vulnerabilities impacting CS and PS devices, CVE-2024-21888 and CVE-2024-21893.The vulnerabilities allow for an unauthenticated threat actor to execute arbitrary commands on the appliance with elevated privileges. As previously reported, Mandiant has identified zero-day exploitation of these vulnerabilities		 Vulnerability Threat ★★
globalsecuritymag.webp 2024-01-31 15:29:26 Backbox présente les opérations de réseau Zero Trust (ZTNO)
BackBox Introduces Zero Trust Network Operations (ZTNO) (lien direct)		 Backbox présente les opérations de réseau Zero Trust (ZTNO) pour automatiser la sécurité de la confiance zéro pour les opérations de réseau La plate-forme d'automatisation de la backbox pour les équipes réseau annonce le gestionnaire d'accès privilégié amélioré, le gestionnaire de vulnérabilité du réseau et la recherche pour simplifier Zero Trust pour Netops - revues de produits
BackBox Introduces Zero Trust Network Operations (ZTNO) to Automate Zero Trust Security for Network Operations BackBox Automation Platform for Network Teams announces improved Privileged Access Manager, Network Vulnerability Manager, and Search to simplify Zero Trust for NetOps - Product Reviews		 Vulnerability ★★
GoogleSec.webp 2024-01-31 13:07:18 Échelle de sécurité avec l'IA: de la détection à la solution
Scaling security with AI: from detection to solution (lien direct)		 Dongge Liu and Oliver Chang, Google Open Source Security Team, Jan Nowakowski and Jan Keller, Machine Learning for Security TeamThe AI world moves fast, so we\'ve been hard at work keeping security apace with recent advancements. One of our approaches, in alignment with Google\'s Safer AI Framework (SAIF), is using AI itself to automate and streamline routine and manual security tasks, including fixing security bugs. Last year we wrote about our experiences using LLMs to expand vulnerability testing coverage, and we\'re excited to share some updates. Today, we\'re releasing our fuzzing framework as a free, open source resource that researchers and developers can use to improve fuzzing\'s bug-finding abilities. We\'ll also show you how we\'re using AI to speed up the bug patching process. By sharing these experiences, we hope to spark new ideas and drive innovation for a stronger ecosystem security.Update: AI-powered vulnerability discoveryLast August, we announced our framework to automate manual aspects of fuzz testing (“fuzzing”) that often hindered open source maintainers from fuzzing their projects effectively. We used LLMs to write project-specific code to boost fuzzing coverage and find more vulnerabilities. Our initial results on a subset of projects in our free OSS-Fuzz service Vulnerability Patching Cloud ★★
The_Hackers_News.webp 2024-01-31 12:53:00 Hackers chinois exploitant des défauts VPN pour déployer des logiciels malveillants Krustyloader
Chinese Hackers Exploiting VPN Flaws to Deploy KrustyLoader Malware (lien direct)		 Une paire de défauts zéro-jours récemment divulgués dans les appareils de réseau privé virtuel (VPN) Ivanti Connect Secure (ICS) a été exploité pour livrer une charge utile basée sur la rouille appelée & nbsp; krustyloader & nbsp; que \\ est utilisée pour supprimer le Sliver open-sourceoutil de simulation adversaire. La & nbsp; les vulnérabilités de sécurité, suivies sous le nom de CVE-2023-46805 (score CVSS: 8,2) et CVE-2024-21887 (score CVSS: 9.1), pourrait être abusé
A pair of recently disclosed zero-day flaws in Ivanti Connect Secure (ICS) virtual private network (VPN) devices have been exploited to deliver a Rust-based payload called KrustyLoader that\'s used to drop the open-source Sliver adversary simulation tool. The security vulnerabilities, tracked as CVE-2023-46805 (CVSS score: 8.2) and CVE-2024-21887 (CVSS score: 9.1), could be abused		 Malware Tool Vulnerability Threat ★★★
WiredThreatLevel.webp 2024-01-31 12:00:00 Apple et Google viennent de corriger leurs premiers défauts zéro-jour de l'année
Apple and Google Just Patched Their First Zero-Day Flaws of the Year (lien direct)		 Plus: Google corrige des dizaines de bogues Android, Microsoft déploie près de 50 patchs, Mozilla Squashes 15 Firefox Flaws, et plus encore.
Plus: Google fixes dozens of Android bugs, Microsoft rolls out nearly 50 patches, Mozilla squashes 15 Firefox flaws, and more.		 Vulnerability Threat Mobile ★★★
SocRadar.webp 2024-01-31 11:47:38 Bibliothèque GNU C affectée par plusieurs vulnérabilités, les attaquants pourraient obtenir un accès racine (CVE-2023-6246)
GNU C Library Affected by Several Vulnerabilities, Attackers Could Obtain Root Access (CVE-2023-6246) (lien direct)		 Les chercheurs ont récemment découvert plusieurs vulnérabilités dans la bibliothèque GNU C (GLIBC), ce qui a un impact sur diverses distributions Linux ....
Researchers have recently discovered several vulnerabilities in GNU C Library (glibc), impacting various Linux distributions.... 		Vulnerability ★★★
The_Hackers_News.webp 2024-01-31 11:14:00 Nouveau GLIBC Flaw accorde aux attaquants accès aux racines sur les principales distros Linux
New Glibc Flaw Grants Attackers Root Access on Major Linux Distros (lien direct)		 Les attaquants locaux malveillants peuvent obtenir un accès root complet sur les machines Linux en tirant parti d'une faille de sécurité nouvellement divulguée dans la bibliothèque GNU C (AKA GLIBC). Suivi sous forme de CVE-2023-6246, la vulnérabilité de débordement de tampon basée sur un tas est enracinée dans la fonction __VSYSLOG_INTERNAL () de Glibc \\, qui est utilisée par & nbsp; syslog () et vSysLog () & nbsp; à des fins d'exploitation du système.On dit que cela avait été accidentellement
Malicious local attackers can obtain full root access on Linux machines by taking advantage of a newly disclosed security flaw in the GNU C library (aka glibc). Tracked as CVE-2023-6246, the heap-based buffer overflow vulnerability is rooted in glibc\'s __vsyslog_internal() function, which is used by syslog() and vsyslog() for system logging purposes. It\'s said to have been accidentally		 Vulnerability ★★★
AlienVault.webp 2024-01-31 11:00:00 Bulletproofing the Retail Cloud avec la sécurité de l'API
Bulletproofing the retail cloud with API security (lien direct)		 The content of this post is solely the responsibility of the author.  AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article.  Application programming interface (API) security is critical for retailers increasingly reliant on cloud technology. However, they also open potential gateways for cyber threats, making robust security protocols essential to protect sensitive data and maintain customer trust. The complexity of retail systems, which often involve numerous third-party integrations, can create multiple points of vulnerability. Evolving cyber threats necessitate a dynamic approach to API security, making it a moving target that requires continuous attention and adaptation. Understanding the retail cloud environment API is a set of protocols and tools that allows different software applications to communicate with each other. In cloud environments, it facilitates the interaction between cloud services and applications, enabling features — like data synchronization, payment processing and inventory management — to work seamlessly together. It is also pivotal in the retail sector by connecting various services and applications to deliver a smooth shopping experience. If organizations neglect API security, cybercriminals can exploit APIs to access confidential information, leading to a loss of customer trust, which is critical in the highly competitive retail market. Regular API audits and assessments These audits help identify vulnerabilities before attackers can exploit them, ensuring organizations can promptly address security gaps. Regular assessments are also proactive measures to fix current issues and anticipate future threats. They enable IT teams to verify that security measures are current with the latest protection standards and to confirm APIs comply with internal policies and external regulations. By routinely evaluating API security, retailers can detect anomalies, manage access controls effectively and guarantee they consistently apply encryption standards. Robust authentication and authorization They verify the identity of users and systems, ensuring only legitimate parties can access sensitive retail data. Utilizing multi-factor authentication, which requires more than one verification method, significantly enhances security by adding layers that an unauthorized user must penetrate. With authorization, it’s crucial to implement protocols that dictate what authenticated users can do. Effective approval guarantees users have access only to the data and actions necessary for their role. For instance, role-based access control can help manage user permissions with greater granularity. Retailers can assign roles and permissions based on job functions, enabling tight control over who is authorized to view or alter data within the API ecosystem. Encryption and data protection Encryption is an essential barrier, obscuring data to make it indecipherable to unauthorized users who might intercept it during transmission or gain access to storage systems. It’s also critical for retailers to manage encryption keys with strict policies, ensuring only authorized personnel can decrypt the data. Beyond protection, comprehensive data encryption allows retailers, especially in the apparel industry, to collect and analyze extensive customer data safely. This data is invaluable for forecasting trends, customer pre Tool Vulnerability Threat Cloud ★★★
Netskope.webp 2024-01-31 07:00:00 Menaces croissantes: tactiques d'ingénierie sociale à l'ère du cloud
Rising Threats: Social Engineering Tactics in the Cloud Age (lien direct)		 > Au cours de la dernière année, les tactiques d'ingénierie sociale utilisées pour les cyberattaques ont considérablement évolué alors que les attaquants manipulent la confiance, les biais et les vulnérabilités inhérents au comportement humain individuel pour obtenir un accès non autorisé à des informations ou des systèmes sensibles. & # 160;Notre rapport sur le cloud et les menaces «Année en revue», a révélé qu'en 2023, l'ingénierie sociale était la plus courante [& # 8230;]
>Over the past year, the social engineering tactics used for cyber attacks have evolved significantly as attackers manipulate the inherent trust, biases, and vulnerabilities of individual human behavior to gain unauthorized access to sensitive information or systems.  Our “year in review” Cloud and Threat Report, revealed that in 2023, social engineering was the most common […] 		Vulnerability Threat Cloud ★★
DarkReading.webp 2024-01-30 23:22:00 Les correctifs Ivanti Zero-Day sont retardés comme \\ 'Krustyloader \\' Attacks Mount
Ivanti Zero-Day Patches Delayed as \\'KrustyLoader\\' Attacks Mount (lien direct)		 Les bogues de contournement RCE / AUTH dans Connect Secure VPNS sont passés non lus pendant 20 jours alors que les groupes parrainés par l'État continuent de faire du matériel Ivanti.
The RCE/auth bypass bugs in Connect Secure VPNs have gone unpatched for 20 days as state-sponsored groups continue to backdoor Ivanti gear.		 Vulnerability Threat ★★
The_Hackers_News.webp 2024-01-30 21:48:00 Urgent: mise à niveau de GitLab - la création de la création de l'espace de travail critique permet l'écrasement du fichier
URGENT: Upgrade GitLab - Critical Workspace Creation Flaw Allows File Overwrite (lien direct)		 GitLab a de nouveau publié des correctifs pour aborder un défaut de sécurité critique dans son édition communautaire (CE) et Enterprise Edition (EE) qui pourraient être exploités pour écrire des fichiers arbitraires tout en créant A & NBSP; Workspace. Suivi en AS & NBSP; CVE-2024-0402, la vulnérabilité a un score CVSS de 9,9 sur un maximum de 10. "Un problème a été découvert dans Gitlab CE / EE affectant toutes les versions de 16,0 avant
GitLab once again released fixes to address a critical security flaw in its Community Edition (CE) and Enterprise Edition (EE) that could be exploited to write arbitrary files while creating a workspace. Tracked as CVE-2024-0402, the vulnerability has a CVSS score of 9.9 out of a maximum of 10. "An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 prior to		 Vulnerability ★★
The_Hackers_News.webp 2024-01-30 16:19:00 Les meilleures vulnérabilités de posture de sécurité révélées
Top Security Posture Vulnerabilities Revealed (lien direct)		 Chaque nouvelle année présente un nouvel ensemble de défis et d'opportunités pour renforcer notre posture de cybersécurité.C'est la nature du champ & # 8211;La vitesse à laquelle les acteurs malveillants exercent des menaces persistantes avancées entraînent une bataille constante et évolutive pour la cyber-résilience.L'excitation dans la cybersécurité réside dans cette adaptation et l'apprentissage continues, en restant toujours une longueur d'avance sur le potentiel
Each New Year introduces a new set of challenges and opportunities for strengthening our cybersecurity posture. It\'s the nature of the field – the speed at which malicious actors carry out advanced persistent threats brings a constant, evolving battle for cyber resilience. The excitement in cybersecurity lies in this continuous adaptation and learning, always staying one step ahead of potential		 Vulnerability ★★
InfoSecurityMag.webp 2024-01-30 15:00:00 Télélé utiles de rouille exploitant Ivanti Zero-Days lié à une boîte à outils Sliver sophistiquée
Rust Payloads Exploiting Ivanti Zero-Days Linked to Sophisticated Sliver Toolkit (lien direct)		 Après avoir analysé les 12 charges utiles de la rouille exploitant les vulnérabilités d'Ivanti ConnectSure, Synacktiv a constaté qu'ils ont tous permis une boîte à outils post-exploitation sophistiquée
After analyzing the 12 Rust payloads exploiting Ivanti ConnectSecure vulnerabilities, Synacktiv found they all enabled a sophisticated post-exploitation toolkit		 Vulnerability ★★★
Blog.webp 2024-01-30 12:14:27 Des vulnérabilités d'extension excessives laissent les serveurs Jenkins ouverts aux attaques
Excessive Expansion Vulnerabilities Leave Jenkins Servers Open to Attacks (lien direct)		 > Par deeba ahmed Les vulnérabilités proviennent de la façon dont Jenkins gère les données fournies par l'utilisateur. Ceci est un article de HackRead.com Lire le post original: Excès d'expansion excessiveLes vulnérabilités laissent les serveurs Jenkins ouverts aux attaques
>By Deeba Ahmed The vulnerabilities stem from the way Jenkins handles user-supplied data. This is a post from HackRead.com Read the original post: Excessive Expansion Vulnerabilities Leave Jenkins Servers Open to Attacks		 Vulnerability ★★
The_Hackers_News.webp 2024-01-30 10:31:00 Juniper Networks libère des mises à jour urgentes du système d'exploitation pour les défauts de haute sévérité
Juniper Networks Releases Urgent Junos OS Updates for High-Severity Flaws (lien direct)		 Juniper Networks a publié des mises à jour hors bande vers & nbsp; aborder des défauts de haute sévérité & nbsp; dans la série SRX et les séries EX qui pourraient être exploitées par un acteur de menace pour prendre le contrôle des systèmes sensibles. Les vulnérabilités, suivies en tant que & nbsp; CVE-2024-21619 et CVE-2024-21620, sont enracinées dans le composant J-WEB et ont un impact sur toutes les versions de Junos OS.Deux autres lacunes, CVE-2023-36846 et
Juniper Networks has released out-of-band updates to address high-severity flaws in SRX Series and EX Series that could be exploited by a threat actor to take control of susceptible systems. The vulnerabilities, tracked as CVE-2024-21619 and CVE-2024-21620, are rooted in the J-Web component and impact all versions of Junos OS. Two other shortcomings, CVE-2023-36846 and		 Vulnerability Threat ★★
The_Hackers_News.webp 2024-01-29 19:01:00 Les chercheurs découvrent comment la vulnérabilité Outlook pourrait fuir vos mots de passe NTLM
Researchers Uncover How Outlook Vulnerability Could Leak Your NTLM Passwords (lien direct)		 Une faille de sécurité maintenant paralysée dans Microsoft Outlook pourrait être exploitée par les acteurs de la menace pour accéder aux mots de passe de NT LAN Manager (NTLM) V2 lors de l'ouverture d'un fichier spécialement conçu. Le problème, suivi comme CVE-2023-35636 (score CVSS: 6,5), a été abordé par le géant de la technologie dans le cadre de son & nbsp; Patch Mardida Mises à jour & NBSP; pour décembre 2023. "Dans un scénario d'attaque par e-mail, un attaquant pourrait exploiter le
A now-patched security flaw in Microsoft Outlook could be exploited by threat actors to access NT LAN Manager (NTLM) v2 hashed passwords when opening a specially crafted file. The issue, tracked as CVE-2023-35636 (CVSS score: 6.5), was addressed by the tech giant as part of its Patch Tuesday updates for December 2023. "In an email attack scenario, an attacker could exploit the		 Vulnerability Threat ★★★
ProofPoint.webp 2024-01-29 14:42:02 Informations exploitables: protégez vos identités vulnérables
Actionable Insights: Protect Your Vulnerable Identities (lien direct)		 In this blog series, we cover how to improve your company\'s security posture with actionable insights. Actionable insights are a critical tool to help you improve your security posture and stop initial compromise in the attack chain. You can use them to identify and respond to potential risks, enhance your incident response capabilities and make more informed security decisions.  Figure 1. Steps in the cyberattack chain.  In previous actionable insights blog posts, we covered these topics:   People risk  Origin risk  Business email compromise (BEC) risk  Ensuring proper risk context  Risk efficacy  Telephone-oriented attack delivery (TOAD) risk  Threat intelligence  Executive Summary    Condemnation Summary  In this post, we show you the value of integrating data from Proofpoint Identity Threat Defense into the Proofpoint Targeted Attack Protection (TAP) Dashboard. You can now use this data about your identity risks to stop initial compromise and prevent the lateral movement of threats in your environment.      Get insights about your vulnerable identities   IT and security professionals are always looking for ways to stay ahead of evolving threats and protect their organizations. The TAP Dashboard from Proofpoint has long been a valuable tool in this fight. It provides crucial visibility into email threats and user activity.   Now that the TAP Dashboard uses data from Proofpoint Identity Threat Defense, it has become even more powerful. Rich data about identity risks can help you see the impact of a potential compromise without having to leave the TAP Dashboard.  Let\'s explore what this looks like in the dashboard-and how you can use this identity data to strengthen your security posture.  Insights for supercharged visibility  One new addition to the People page in the TAP Dashboard is the Identity Threat Attack Paths column. It reveals the currently available attack paths for each user, which are based on their identified vulnerabilities.   No more digging through separate tools. You can now have a clear picture within the TAP Dashboard of how a threat actor could use each identity to escalate privilege and move laterally.  Figure 2. Identity Threat Attack Paths column in the TAP Dashboard.  You can also view identity risk factors for each user. This allows you to gain a deeper understanding of the potential impact of compromise for each user. The metrics you can view include:  Overall risk exposure  Number of potential attack paths associated with the user  Key identity vulnerabilities associated with the user  Figure 3. Identity risk factors for individual users.   This data can help you to prioritize your response efforts. You can use it to better focus on securing the identities that might be used to cause the most harm to your business.  Example use case  Take this example of a hypothetical user named Dona Hosby, a 47-year-old finance director. She has access to client accounts and sensitive financial data. Despite her crucial role in the business, Hosby tends to be less cautious about clicking on suspicious email links and attachments.   From the TAP Dashboard, Hosby is identified as a Very Attacked Person™ (VAP) with a high attack index. However, this risk level is not unique to her; others in the company share similar risk levels.   With data enrichment from Proofpoint Identity Threat Defense, the TAP Dashboard shows that Hosby is also a shadow admin, which exposes her to critical risks. A shadow admin is an individual or account that has elevated privileges or access rights that are not in compliance with the company\'s security policies.  We can also see the number of lateral attack paths (41) an attacker could take from Hosby\'s identity. This information can help the security team to pinpoint which VAPs in the organization pose a higher post-compromise risk. Figures 4 and 5 show what these insights look like in the TAP Dashboard.  Figure 4: Example identity risk metrics in the TAP Dashboard for Dona Hosby.  Fi Tool Vulnerability Threat ★★★
globalsecuritymag.webp 2024-01-29 14:39:39 Orange Cyberdefense élargit le partenariat avec Quality
Orange Cyberdefense Expands Partnership with Qualys (lien direct)		 Orange CyberDefense étend le partenariat avec QuADY, renforçant le portefeuille de cybersécurité géré pour offrir un service de renseignement de vulnérabilité de bout en bout Qualys VMDR avec trurisk permet aux clients de services gérés par Orange CyberDefense de désactiver leur entreprise - nouvelles commerciales
Orange Cyberdefense Expands Partnership with Qualys, Strengthening Managed Cybersecurity Portfolio to Deliver an End-to-End Vulnerability Intelligence Service Qualys VMDR with TruRisk enables Orange Cyberdefense managed service customers to de-risk their business - Business News		 Vulnerability ★★
SocRadar.webp 2024-01-29 13:00:00 Top 10 des vulnérabilités RCE exploitées en 2023
Top 10 RCE Vulnerabilities Exploited in 2023 (lien direct)		 > La cybersécurité se déroule dans une interaction continue entre les défenseurs et les acteurs de la menace & # 8211;une quête en constante évolution ...
>Cybersecurity unfolds in a continuous interplay between defenders and threat actors – an ever-evolving quest... 		Vulnerability Threat ★★★
AlienVault.webp 2024-01-29 11:00:00 Étude de cas: USM de Vertek \\ partout où MDR aide plus grand concessionnaire automobile dans le nord-est à améliorer leur posture de cybersécurité
Case study: Vertek\\'s USM Anywhere MDR helps larger auto dealership in the northeast improve their Cybersecurity posture (lien direct)		 The content of this post is solely the responsibility of the author.  AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article.  Challenges A larger auto dealership in the northeast faced a number of cybersecurity challenges, including: Lack of resources: The dealership did not have the in-house expertise or resources to manage its own security operations center (SOC).  The lack of trained security experts resulted in slower responses times to security incidents. Multiple security solutions: The dealership was using a variety of security solutions from different vendors, making it difficult to manage and correlate security data. Increased threat landscape: The dealership was facing an increasing number of cyber threats, including ransomware, phishing, and malware attacks. Solution The dealership engaged Vertek to implement their top of line Managed Detection and Response (MDR) service using AT&T AlienVault SIEM. Vertek\'s USM Anywhere MDR service provides 24/7 proactive threat monitoring, industry leading threat intelligence, and expert incident response. It is built on top of the AlienVault USM Anywhere platform, which is a unified security management (USM) platform that combines multiple essential security capabilities in one unified console.  The service easily integrates with the existing security stack and is implemented without interruption to existing operations. Benefits Since implementing Vertek\'s USM Anywhere MDR service the dealership has experienced a number of benefits, including: Improved security posture: Vertek\'s MDR service has helped the dealership improve its overall security posture by identifying and mitigating security vulnerabilities, and by providing the dealership with actionable security insights.  Vertek’s 24/7 SOC identifies and responds to security incidents with speed and accuracy using industry leading threat intelligence. Reduced workload and more effective allocation of resources: Vertek\'s MDR service has reduced the workload on the dealership\'s IT staff by freeing them up to focus on mission critical tasks that fall in line with their core competency.  Working with Vertek instead of building an in-house security team has resulted in significant cost savings for the dealership. Improved peace of mind: Vertek\'s MDR service gives the dealership peace of mind knowing that their security is being monitored and managed by a team of experts with expert response to threats. Specific example Vertek was actively monitoring a customer\'s network for threats using their USM Anywhere MDR service. AlienVault SIEM detected a large number of failed login attempts to the customer\'s Active Directory server. Vertek\'s security team immediately investigated the incident and discovered that the attacker was using a brute-force attack to try to guess the passwords of Active Directory users. Vertek\'s security team used context data in the form of network traffic, end-user behavior analytics, and NXLOGS output from their IT tools to understand the significance of the attack. They knew that the Active Directory server was a critical system for the customer, and that if the attacker was able to gain access to the server, they would be able to compromise the entire network. Vertek also used threat intelligence from the MITRE ATT&CK Framework to understand the tactics, techniques, and procedures (TTPs) of the attacker. They knew that brute-force attacks were a common tactic used by ransomware gangs. Based on the context data and threat intelligence, Vertek was able to determine that the customer was facing a high-risk ransomware attack. Vertek\'s security team quickly took steps to mitiga Ransomware Malware Tool Vulnerability Threat Studies ★★★
InfoSecurityMag.webp 2024-01-29 09:35:00 CI / CD à risque comme exploits publiés pour le bug de Jenkins critique
CI/CD at Risk as Exploits Released For Critical Jenkins Bug (lien direct)		 Les clients sont invités à patcher maintenant après la libération des exploits pour une vulnérabilité critique dans Jenkins
Customers are urged to patch now after exploits are released for critical vulnerability in Jenkins		 Vulnerability ★★★
News.webp 2024-01-29 01:29:08 Les hacks de Tesla font une grande banque lors de l'événement axé sur l'automobile de Pwn2own \\
Tesla hacks make big bank at Pwn2Own\\'s first automotive-focused event (lien direct)		 Aussi: SEC admet la négligence du compte X;La nouvelle famille de malware macOS apparaît;Et certaines vulns critiques infosec en bref Trend Micro \'s Zero Day Initiative (ZDI) ont tenu son tout premier événement PWN2OWN axé sur l'automobile à Tokyo la semaine dernière, et a décernéPlus de 1,3 million de dollars aux découvreurs de 49 vulnérabilités liées à des véhicules.…
ALSO: SEC admits to X account negligence; New macOS malware family appears; and some critical vulns Infosec in brief  Trend Micro\'s Zero Day Initiative (ZDI) held its first-ever automotive-focused Pwn2Own event in Tokyo last week, and awarded over $1.3 million to the discoverers of 49 vehicle-related zero day vulnerabilities.…		 Malware Vulnerability Threat Prediction ★★★
SonarSource.webp 2024-01-28 23:00:00 Qui es-tu?L'importance de vérifier les origines du message
Who are you? The Importance of Verifying Message Origins (lien direct)		 Ce billet de blog met en évidence l'importance de vérifier l'origine des événements de messages JavaScript et décrit l'impact potentiel de l'omission en détaillant deux vulnérabilités critiques dans l'application SQUIDEX.
This blog post highlights the importance of verifying the origin of JavaScript message events and outlines the potential impact of omitting this by detailing two critical vulnerabilities in the Squidex application.		 Vulnerability ★★★
SocRadar.webp 2024-01-26 11:48:02 Vulnérabilité critique RCE dans les communications unifiées Cisco avec risque d'accès racine (CVE-2024-20253)
Critical RCE Vulnerability in Cisco Unified Communications with Risk of Root Access (CVE-2024-20253) (lien direct)		 La Cybersecurity and Infrastructure Security Agency (CISA) a publié une alerte mettant en évidence les mises à jour de la sécurité Cisco, ...
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert highlighting Cisco security updates,... 		Vulnerability ★★★
AlienVault.webp 2024-01-26 11:00:00 Cybersécurité pour les systèmes de contrôle industriel: meilleures pratiques
Cybersecurity for Industrial Control Systems: Best practices (lien direct)		 The content of this post is solely the responsibility of the author.  AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article.  Network segmentation, software patching, and continual threats monitoring are key cybersecurity best practices for Industrial Control Systems (ICS). Although ICSs significantly improve health and safety by automating dangerous tasks, facilitating remote monitoring and control, and activating safety protocols in the case of emergency, they’re increasingly exposed to cybersecurity threats. In 2022, there was a 2,000% increase in adversarial reconnaissance targeting Modbus/TCP port 502 — a widely-used industrial protocol — allowing malicious actors to exploit vulnerabilities in operational technology systems. Fortunately, by taking steps to improve and maintain ICS cybersecurity, manufacturers can successfully reduce the attack surface of their critical infrastructure and keep threats (including phishing, denial-of-service attacks, ransomware, and malware) at bay.  ICS cyberattacks on the rise  ICS cyberattacks are on the rise, with almost 27% of ICS systems affected by malicious objects in the second quarter of 2023, data from Kaspersky reveals. Cyberattacks have the power to devastate ICS systems, damage equipment and infrastructure, disrupt business, and endanger health and safety. For example, the U.S. government has warned of a malware strain called Pipedream: “a modular ICS attack framework that contains several components designed to give threat actors control of such systems, and either disrupt the environment or disable safety controls”. Although Pipedream has the ability to devastate industrial systems, it fortunately hasn’t yet been used to that effect. And, last year, a notorious hacking group called Predatory Sparrow launched a cyberattack on an Iranian steel manufacturer, resulting in a serious fire. In addition to causing equipment damage, the hackers caused a malfunctioning foundry to start spewing hot molten steel and fire. This breach only highlights the importance of safety protocols in the manufacturing and heavy industry sectors. By leveraging the latest safety tech and strengthening cybersecurity, safety, security, and operational efficiency can all be improved. Segment networks By separating critical systems from the internet and other non-critical systems, network segmentation plays a key role in improving ICS cybersecurity. Network segmentation is a security practice that divides a network into smaller, distinct subnetworks based on security level, functionality, or access control, for example. As a result, you can effectively prevent attacker lateral movement within your network — this is a common way hackers disguise themselves as legitimate users and their activities as expected traffic, making it hard to spot this method. Network segmentation also lets you create tailored and unique security policies and controls for each segment based on their defined profile. Each individual segment is therefore adequately protected. And, since network segmentation also provides you with increased visibility in terms of network activity, you’re also better able to spot and respond to problems with greater speed and efficiency.  When it comes to  Ransomware Malware Vulnerability Threat Patching Industrial ★★★
Securonix.webp 2024-01-26 09:00:54 Securonix Threat Research Security Advisory: Analyse technique et détection de deux vulnérabilités zéro-jours dans Ivanti Connect Secure VPN
Securonix Threat Research Security Advisory: Technical Analysis and Detection of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN (lien direct)		 Securonix Threat Research Security Advisory: Analyse technique et détection de deux vulnérabilités zéro-jours dans Ivanti Connect Secure VPN
Securonix Threat Research Security Advisory: Technical Analysis and Detection of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN		 Vulnerability Threat Technical ★★
RiskIQ.webp 2024-01-25 19:48:09 Parrot TDS: une campagne de logiciels malveillants persistants et évolutives
Parrot TDS: A Persistent and Evolving Malware Campaign (lien direct)		 #### Description Le Parrot TDS (Traffic Redirect System) a augmenté sa campagne depuis octobre 2021, utilisant des techniques sophistiquées pour éviter la détection et potentiellement impactant des millions de personnes par le biais de scripts malveillants sur des sites Web compromis. Identifiée par les chercheurs de l'unité 42, Parrot TDS injecte des scripts malveillants dans le code JavaScript existant sur les serveurs, le profilage stratégique des victimes avant de fournir des charges utiles qui redirigent les navigateurs vers un contenu malveillant.Notamment, la campagne TDS présente une large portée, ciblant les victimes à l'échelle mondiale sans limites basées sur la nationalité ou l'industrie.Pour renforcer les tactiques d'évasion, les attaquants utilisent plusieurs lignes de code JavaScript injecté, ce qui rend plus difficile pour les chercheurs en sécurité de détecter.Les attaquants, utilisant probablement des outils automatisés, exploitent les vulnérabilités connues, en mettant l'accent sur les serveurs compromis à l'aide de WordPress, Joomla ou d'autres systèmes de gestion de contenu. #### URL de référence (s) 1. https://unit42.paloaltonetworks.com/parrot-tds-javascript-evolution-analysis/#post-132073-_jt3yi5rhpmao #### Date de publication 19 janvier 2024 #### Auteurs) Zhanglin he Ben Zhang Billy Melicher Qi Deng Boqu Brad Duncan
#### Description The Parrot TDS (Traffic Redirect System) has escalated its campaign since October 2021, employing sophisticated techniques to avoid detection and potentially impacting millions through malicious scripts on compromised websites. Identified by Unit 42 researchers, Parrot TDS injects malicious scripts into existing JavaScript code on servers, strategically profiling victims before delivering payloads that redirect browsers to malicious content. Notably, the TDS campaign exhibits a broad scope, targeting victims globally without limitations based on nationality or industry. To bolster evasion tactics, attackers utilize multiple lines of injected JavaScript code, making it harder for security researchers to detect. The attackers, likely employing automated tools, exploit known vulnerabilities, with a focus on compromising servers using WordPress, Joomla, or other content management systems. #### Reference URL(s) 1. https://unit42.paloaltonetworks.com/parrot-tds-javascript-evolution-analysis/#post-132073-_jt3yi5rhpmao #### Publication Date January 19, 2024 #### Author(s) Zhanglin He Ben Zhang Billy Melicher Qi Deng Bo Qu Brad Duncan 		Malware Tool Vulnerability Threat ★★★
DarkReading.webp 2024-01-25 17:46:00 Cisco Unified Communications RCE Bug permet un accès root
Critical Cisco Unified Communications RCE Bug Allows Root Access (lien direct)		 La vulnérabilité, suivie comme CVE-2024-20253, fabrique des infrastructures de communication d'entreprise et des centres d'appels de service client assis des canards pour les cyberattaques non authentifiés.
The vulnerability, tracked as CVE-2024-20253, makes enterprise communications infrastructure and customer service call centers sitting ducks for unauthenticated cyberattackers.		 Vulnerability ★★★
The_Hackers_News.webp 2024-01-25 17:27:00 La vulnérabilité critique de Jenkins expose les serveurs aux attaques RCE - patch dès que possible!
Critical Jenkins Vulnerability Exposes Servers to RCE Attacks - Patch ASAP! (lien direct)		 Les responsables du logiciel d'automatisation d'automatisation continu / livraison et déploiement continu d'Open-source (CI / CD) Jenkins ont résolu neuf défauts de sécurité, y compris un bogue critique qui, s'il est exploité avec succès, pourrait entraîner une exécution de code à distance (RCE). Le problème, attribué à l'identifiant CVE & NBSP; CVE-2024-23897, a été décrit comme un fichier arbitraire de lecture de la vulnérabilité via le
The maintainers of the open-source continuous integration/continuous delivery and deployment (CI/CD) automation software Jenkins have resolved nine security flaws, including a critical bug that, if successfully exploited, could result in remote code execution (RCE). The issue, assigned the CVE identifier CVE-2024-23897, has been described as an arbitrary file read vulnerability through the		 Vulnerability ★★★
CS.webp 2024-01-25 17:00:00 Bill cherche des cyber-protections pour l'alimentation et l'agriculture
Bill seeks cyber protections for food and agriculture (lien direct)		 > La loi sur la cybersécurité de la ferme et des aliments vise à identifier les vulnérabilités du secteur grâce à un exercice annuel et à des évaluations de menaces régulières.
>The Farm and Food Cybersecurity Act aims to identify vulnerabilities in the sector through an annual exercise and regular threat assessments. 		Vulnerability Threat ★★★
InfoSecurityMag.webp 2024-01-25 16:30:00 Les vulnérabilités de sécurité gouvernementales augmentent de 151%, le rapport conclut
Government Security Vulnerabilities Surge By 151%, Report Finds (lien direct)		 Le dernier rapport de BugCrowd \\ a également enregistré une augmentation de 30% des soumissions Web en 2023
Bugcrowd\'s latest report also recorded a 30% surge in web submissions in 2023		 Vulnerability ★★★
SecurityWeek.webp 2024-01-25 11:53:21 Des milliers d'instances Gitlab se sont fixées contre le bogue de réinitialisation du mot de passe critique
Thousands of GitLab Instances Unpatched Against Critical Password Reset Bug (lien direct)		 > Plus de 5 000 serveurs Gitlab n'ont pas encore été corrigées contre CVE-2023-7028, une vulnérabilité de réinitialisation de mot de passe critique.
>Over 5,000 GitLab servers have yet to be patched against CVE-2023-7028, a critical password reset vulnerability. 		Vulnerability ★★★
AlienVault.webp 2024-01-25 11:00:00 Le côté obscur de la cybersécurité 2023: évolution des logiciels malveillants et cyber-menaces
The dark side of 2023 Cybersecurity: Malware evolution and Cyber threats (lien direct)		 In the ever-evolving cybersecurity landscape, 2023 witnessed a dramatic surge in the sophistication of cyber threats and malware. AT&T Cybersecurity Alien Labs reviewed the big events of 2023 and how malware morphed this year to try new ways to breach and wreak havoc. This year\'s events kept cybersecurity experts on their toes, from expanding malware variants to introducing new threat actors and attack techniques. Here are some of the most compelling developments, highlighting malware\'s evolving capabilities and the challenges defenders face. Highlights of the year: Emerging trends and notable incidents As the year unfolded, several trends and incidents left an indelible mark on the cybersecurity landscape: Exploiting OneNote for malicious payloads Cybercriminals leveraged Microsoft OneNote to deliver many malicious payloads to victims, including Redline, AgentTesla, Quasar RAT, and others. This previously underutilized Office program became a favored tool due to its low suspicion and widespread usage. SEO poisoning and Google Ads Malicious actors resorted to SEO poisoning tactics, deploying phishing links through Google Ads to deceive unsuspecting victims. These links led to cloned, benign web pages, avoiding Google\'s detection and remaining active for extended periods. Prominent malware families, including Raccoon Stealer and IcedID, capitalized on this strategy. Exploiting geopolitical events Cybercriminals exploited the geopolitical climate, particularly the Middle East conflict, as a lure for their attacks. This trend mirrored the previous year\'s Ukraine-related phishing campaigns and crypto scams. APTs: State-sponsored espionage continues to present challenges Advanced Persistent Threats (APTs) continued to pose a significant threat in 2023: Snake: CISA reported on the Snake APT, an advanced cyber-espionage tool associated with the Russian Federal Security Service (FSB). This malware had been in use for nearly two decades. Volt Typhoon: A campaign targeting critical infrastructure organizations in the United States was attributed to Volt Typhoon, a state-sponsored actor based in China. Their focus lay on espionage and information gathering. Storm-0558: This highly sophisticated intrusion campaign, orchestrated by the Storm-0558 APT from China, infiltrated the email accounts of approximately 25 organizations, including government agencies. Ransomware\'s relentless rise Ransomware remained a prevalent and lucrative threat throughout the year: Cuba and Snatch: Ransomware groups like Cuba and Snatch targeted critical infrastructure in the United States, causing concern for national security. ALPHV/BlackCat: Beyond SEO poisoning, this group compromised the computer systems of Caesar and MGM casinos. They also resorted to filing complaints with the US Securities and Exchange Commission (SEC) against their victims, applying additional pressure to pay ransoms. Exploiting new vulnerabilities: Cybercriminals wasted no time exploiting newly discovered vulnerabilities, such as CVE-2023-22518 in Atlassian\'s Confluence, CVE-2023-4966 (Citrix bleed), and others. These vulnerabilities became gateways for ransomware attacks. Evolving ransom Ransomware Spam Malware Tool Vulnerability Threat Prediction Guam ★★★
InfoSecurityMag.webp 2024-01-25 10:15:00 Concours PWN2OWN Unarths dizaines de vulnérabilités zéro jour
Pwn2Own Contest Unearths Dozens of Zero-Day Vulnerabilities (lien direct)		 La première concurrence automobile PWN2OWN de l'initiative Zero Day a remis plus de 1 million de dollars pendant 24 jours zéro
The Zero Day Initiative\'s first Pwn2Own Automotive competition has handed out over $1m for 24 zero-days		 Vulnerability Threat ★★★★★
SonarSource.webp 2024-01-24 23:00:00 Expansion excessive: découvrir des vulnérabilités de sécurité critiques chez Jenkins
Excessive Expansion: Uncovering Critical Security Vulnerabilities in Jenkins (lien direct)		 Ce blog découvre deux vulnérabilités, une gravité critique et élevée, récemment découverte par notre équipe de recherche.En exploitant ces vulnérabilités, les attaquants ont le potentiel d'obtenir une exécution de code distante sur une instance Jenkins.
This blog uncovers two vulnerabilities, a Critical and High severity, recently discovered by our research team. Exploiting these vulnerabilities, attackers have the potential to gain Remote Code Execution on a Jenkins instance.		 Vulnerability ★★★
RiskIQ.webp 2024-01-24 20:59:31 Mimo CoinMiner and Mimus Ransomware Installed via Vulnerability Attacks (lien direct) #### Description Ahnlab Security Intelligence Center (ASEC) a récemment observé les circonstances d'un acteur de menace de Coinmin appelé MIMO exploitant diverses vulnérabilités pour installer des logiciels malveillants.MIMO, également surnommé HezB, a été retrouvé pour la première fois lorsqu'ils ont installé des co -miners grâce à une exploitation de vulnérabilité Log4Shell en mars 2022. L'acteur MIMO Threat a installé divers logiciels malveillants, notamment MIMUS Ransomware, Proxyware et Inverse Shell MALWWare, en plus du mimo de mineur.La majorité des attaques de l'acteur de menace de MIMO ont été des cas qui utilisent XMRIG Coinmin, mais des cas d'attaque par ransomware ont également été observés en 2023. Le ransomware Mimus a été installé avec le malware par lots et a été fabriqué sur la base du code source révélé sur GitHub par le développeur «Mauri870» qui a développé les codes à des fins de recherche.Le ransomware a été développé en Go, et l'acteur de menace l'a utilisé pour développer des ransomwares et l'a nommé Mimus Ransomware.MIMUS Ransomware n'a pas de différences particulières par rapport au code source de Mauricrypt \\.Seule l'adresse C&C de l'acteur de menace, l'adresse du portefeuille, l'adresse e-mail et d'autres données de configuration ont été modifiées. #### URL de référence (s) 1. https://asec.ahnlab.com/en/60440/ #### Date de publication 17 janvier 2024 #### Auteurs) Sanseo
#### Description AhnLab SEcurity intelligence Center (ASEC) recently observed circumstances of a CoinMiner threat actor called Mimo exploiting various vulnerabilities to install malware. Mimo, also dubbed Hezb, was first found when they installed CoinMiners through a Log4Shell vulnerability exploitation in March 2022. The Mimo threat actor has installed various malware, including Mimus ransomware, proxyware, and reverse shell malware, besides the Mimo miner. The majority of the Mimo threat actor\'s attacks have been cases that use XMRig CoinMiner, but ransomware attack cases were also observed in 2023. The Mimus ransomware was installed with the Batch malware and was made based on the source code revealed on GitHub by the developer “mauri870” who developed the codes for research purposes. The ransomware was developed in Go, and the threat actor used this to develop ransomware and named it Mimus ransomware. Mimus ransomware does not have any particular differences when compared to MauriCrypt\'s source code. Only the threat actor\'s C&C address, wallet address, email address, and other configuration data were changed. #### Reference URL(s) 1. https://asec.ahnlab.com/en/60440/ #### Publication Date January 17, 2024 #### Author(s) Sanseo 		Ransomware Malware Vulnerability Threat ★★
SocRadar.webp 2024-01-24 18:18:39 La vulnérabilité de lecture de fichiers CLI de Jenkins Critical pourrait conduire à des attaques RCE (CVE-2024-23897)
Critical Jenkins CLI File Read Vulnerability Could Lead to RCE Attacks (CVE-2024-23897) (lien direct)		 > Jenkins, une plate-forme d'automatisation open source basée sur Java avec un vaste écosystème de plugin et des capacités d'intégration continue, ...
>Jenkins, a Java-based open-source automation platform with an extensive plugin ecosystem and continuous integration capabilities,... 		Vulnerability ★★★
globalsecuritymag.webp 2024-01-24 14:29:00 «Rapport sur la plate-forme: Rapport des tendances de la vulnérabilité de BugCrowd \\» Détails les menaces et solutions de sécurité
“Inside the Platform: Bugcrowd\\'s Vulnerability Trends Report” Details Security Threats and Solutions (lien direct)		 Les programmes de sécurité des crowdsourcés à portée ouverte trouvent 10x plus critiques de vulnérabilités «Rapport sur les tendances de la vulnérabilité de BugCrowd \\» Détails Détails Menaces et Solutions de sécurité - rapports spéciaux
Open Scope Crowdsourced Security Programs Find 10X More Critical Vulnerabilities “Inside the Platform: Bugcrowd\'s Vulnerability Trends Report” Details Security Threats and Solutions - Special Reports		 Vulnerability ★★
Last update at: 2024-05-09 15:07:53
See our sources.
My email:

To see everything: Our RSS (filtrered) Twitter