What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2023-11-28 15:05:00 | Les chercheurs affirment que la conception a une faille dans Google Workspace met les organisations en danger Researchers Claim Design Flaw in Google Workspace Puts Organizations at Risk (lien direct) |
Google dit que le problème a à voir avec les organisations garantissant qu'elles mettent en œuvre les principes de moins privile.
Google says the issue has to do with organizations ensuring they implement least-privilege principles. |
Vulnerability | ★★ | |
 |
2023-11-28 15:00:00 | GOTITAN BOTNET - Exploitation continue sur Apache ActiveMQ GoTitan Botnet - Ongoing Exploitation on Apache ActiveMQ (lien direct) |
FortiguardLabs découvre les exploits en cours ciblant le CVE-2023-46604, avec l'émergence d'un nouveau botnet Golang "Gotitan".Apprendre encore plus.
FortiGuardLabs uncovers the ongoing exploits targeting CVE-2023-46604, with the emergence of a new Golang botnet "GoTitan". Learn more. |
Vulnerability | ★★ | |
 |
2023-11-28 12:08:27 | Tentatives d'exploitation observées pour la vulnérabilité critique Owncloud (CVE-2023-49103) Exploitation Attempts Observed for Critical ownCloud Vulnerability (CVE-2023-49103) (lien direct) |
> Activité d'exploitation ciblant Owncloud avec la vulnérabilité CVE-2023-49103 a été observée, ce qui soulève des préoccupations dans le ...
>Exploitation activity targeting ownCloud with the CVE-2023-49103 vulnerability has been observed, raising concerns within the... |
Vulnerability | ★★ | |
 |
2023-11-28 11:00:00 | Pour le manque de cyber ongle, le royaume est tombé For want of a cyber nail the kingdom fell (lien direct) |
An old proverb, dating to at least the 1360’s, states: "For want of a nail, the shoe was lost, for want of a shoe, the horse was lost, for want of a horse, the rider was lost, for want of a rider, the battle was lost, for want of a battle, the kingdom was lost, and all for the want of a horseshoe nail," When published in Ben Franklin’s Poor Richard’s Almanack in 1768, it was preceded by the cautionary words: “a little neglect may breed great mischief”. This simple proverb and added comment serve as emblematic examples of how seemingly inconsequential missteps or neglect can lead to sweeping, irreversible, catastrophic losses. The cascade of events resonates strongly within the increasingly complex domain of cybersecurity, in which the omission of even the most elementary precaution can result in a spiraling series of calamities. Indeed, the realm of cybersecurity is replete with elements that bear striking resemblance to the nail, shoe, horse, and rider in this proverb. Consider, for example, the ubiquitous and elementary software patch that may be considered the proverbial digital "nail." In isolation, this patch might seem trivial, but its role becomes crucial when viewed within the broader network of security measures. The 2017 WannaCry ransomware attack demonstrates the significance of such patches; an unpatched vulnerability in Microsoft Windows allowed the malware to infiltrate hundreds of thousands of computers across the globe. It wasn\'t just a single machine that was compromised due to this overlooked \'nail,\' but entire networks, echoing how a lost shoe leads to a lost horse in the proverb. This analogy further extends to the human elements of cybersecurity. Personnel tasked with maintaining an organization\'s cyber hygiene play the role of the "rider" in our metaphorical tale. However, the rider is only as effective as the horse they ride; likewise, even the most skilled IT professional cannot secure a network if the basic building blocks—the patches, firewalls, and antivirus software—resemble missing nails and shoes. Numerous reports and studies have indicated that human error constitutes one of the most common causes of data breaches, often acting as the \'rider\' who loses the \'battle\'. Once the \'battle\' of securing a particular network or system is lost, the ramifications can extend much further, jeopardizing the broader \'kingdom\' of an entire organization or, in more extreme cases, critical national infrastructure. One glaring example that serves as a cautionary tale is the Equifax data breach of 2017, wherein a failure to address a known vulnerability resulted in the personal data of 147 million Americans being compromised. Much like how the absence of a single rider can tip the scales of an entire battle, this singular oversight led to repercussions that went far beyond just the digital boundaries of Equifax, affecting millions of individuals and shaking trust in the security of financial systems. | Ransomware Data Breach Malware Vulnerability | Wannacry Wannacry Equifax Equifax | ★★ |
 |
2023-11-28 10:27:25 | Vigilance.fr - Cisco Wireless LAN Controller Aireos: FEUILLE DE MÉMOIRE via plusieurs clients Connexion, analysé le 28/09/2023 Vigilance.fr - Cisco Wireless LAN Controller AireOS: memory leak via Multiple Clients Connecting, analyzed on 28/09/2023 (lien direct) |
Un attaquant peut créer une fuite de mémoire de Cisco Wireless LAN Controller Aireos, via plusieurs clients se connectant, afin de déclencher un déni de service.
-
vulnérabilité de sécurité
An attacker can create a memory leak of Cisco Wireless LAN Controller AireOS, via Multiple Clients Connecting, in order to trigger a denial of service. - Security Vulnerability |
Vulnerability | ★★ | |
 |
2023-11-27 22:00:00 | Systèmes AI \\ 'soumis à de nouveaux types de vulnérabilités, \\' British and US Cyber Agencies Warn AI systems \\'subject to new types of vulnerabilities,\\' British and US cyber agencies warn (lien direct) |
Les autorités britanniques et américaines de la cybersécurité ont publié lundi des conseils sur la façon de développer des systèmes d'intelligence artificielle d'une manière qui minimisera les risques auxquels ils sont confrontés des méfaits aux pirates parrainés par l'État.«Les systèmes d'IA sont soumis à de nouveaux types de vulnérabilités», les 20 pagesDocument prévient - se référant spécifiquement aux outils d'apprentissage automatique.Les nouvelles directives ont
British and U.S. cybersecurity authorities published guidance on Monday about how to develop artificial intelligence systems in a way that will minimize the risks they face from mischief-makers through to state-sponsored hackers. “AI systems are subject to new types of vulnerabilities,” the 20-page document warns - specifically referring to machine-learning tools. The new guidelines have |
Tool Vulnerability | ★★★ | |
 |
2023-11-27 16:01:16 | Top 5 des risques de sécurité open source Les dirigeants informatiques doivent connaître Top 5 Open Source Security Risks IT Leaders Must Know (lien direct) |
Se cacher dans les logiciels open source (OSS) qui imprègnent les applications du monde entier sont des risques de sécurité open source Les leaders de la technologie doivent être conscients.Le logiciel est l'un des sous-ensembles les plus vulnérables de la technologie avec plus de 70% des applications contenant des défauts de sécurité.Voici les risques de sécurité open source Les leaders informatiques doivent être conscients de protéger la technologie et de l'aider à évoluer en toute sécurité.
Pourquoi aborder les risques de sécurité des logiciels open source
Le 9 décembre 2021, un tweet a exposé une vulnérabilité dans la bibliothèque OSS largement utilisée Log4J.Il ne fallait pas longtemps avant que les attaquants du monde entier ne travaillent pour exploiter la vulnérabilité log4j.Cet incident a été un signal d'alarme à la façon dont la sécurité d'une bibliothèque peut changer rapidement et des mesures proactives doivent être en place pour se protéger de ce danger.
Log4j n'est qu'un exemple de la façon dont les vulnérabilités de l'open source posent des risques importants qui peuvent avoir un impact sur les opérations, la sécurité des données et la santé informatique globale.Les choix technologiques stratégiques peuvent avoir un impact important sur la quantité…
Lurking in the open source software (OSS) that pervades applications around the world are open source security risks technology leaders must be aware of. Software is one of technology\'s most vulnerable subsets with over 70% of applications containing security flaws. Here are the open source security risks IT leaders must be aware of to protect technology and help it scale safely. Why Address Open Source Software Security Risks On December 9, 2021, a Tweet exposed a vulnerability in the widely-used OSS library Log4j. It didn\'t take long before attackers around the world were working to exploit the Log4j vulnerability. This incident was a wake-up call to how the security of a library can quickly change and proactive measures must be in place to protect from this danger. Log4j is just one example of how vulnerabilities in open source pose significant risks that can impact operations, data security, and overall IT health. Strategic technology choices can make a big impact on how much… |
Vulnerability Threat | ★★ | |
 |
2023-11-27 09:26:51 | 8 sujets essentiels de cybersécurité à inclure dans votre programme de formation 8 Essential Cybersecurity Topics to Include in Your Training Program (lien direct) |
Your employees have a critical role to play as a first line of defense against cyberthreats. But to be effective, they need to know what those threats are-and stay apprised of how they\'re evolving. A comprehensive security awareness program is the key to helping your users grow their understanding of attackers\' methods and objectives so they can become more proactive defenders. That includes knowing what strategies malicious actors employ to manipulate people so they can use them to enable their campaigns. The importance of security awareness It\'s well worth taking the time to craft a meaningful and engaging security awareness program. By presenting the right mix of information to your users in a compelling way, you can empower them to help you improve your organization\'s security posture as well as create a more robust security culture overall. The cybersecurity topics that you include in your program should be relevant to your business and industry, of course. Companies face different cyberthreat challenges and regulatory compliance requirements related to data protection and data privacy. That said, there are several subjects that almost any modern business, regardless of its industry, will want to ensure its employees understand. We list eight of these cybersecurity topics below. They are the go-to approaches and tools that attackers around the world commonly use to compromise users and their accounts, disrupt normal business operations, steal money or data, and do other damage. Here\'s a high-level overview of these eight must-know cybersecurity topics: 1. Social engineering Social engineering is a collection of techniques malicious actors use to manipulate human psychology. Attackers rely on these strategies to trick or threaten users to take actions such as giving up account credentials, handing over sensitive data, running malicious code and transferring funds. They do this by taking advantage of users\': Emotions, by conveying a sense of urgency, generating excitement about an opportunity, or creating fear around losing money or doing something wrong Trust, by posing as someone familiar to the user or a trusted brand or authority-such as the Internal Revenue Service (IRS), UPS, Amazon or Microsoft Fatigue, by timing attacks when users are likely to be tired or distracted and more inclined to let their “emotional mind” guide their decision-making Common social engineering tactics include phishing-which we cover in the next section-and these others: Social media reconnaissance. Attackers often turn to social media to gather information about users that they target with their campaigns. These efforts can include direct outreach to users. Vishing (voice phishing) and smishing (SMS/text phishing). Vishing is the fraudulent practice of making phone calls or leaving voice messages purporting to be from a trusted brand or authority. With smishing, attackers use text messages to send SMS messages to users or robocall them. The messages often promise gifts or services in exchange for payment. Telephone-oriented attack delivery (TOAD). TOAD attacks start with an email that claims to be from a legitimate source and includes a phone number for customer assistance. Callers are connected to fake customer service representatives who then direct the victim through the attack. They may instruct the victim to let them access their machine remotely or download a file that turns out to be malware. Or they might direct them to a phishing site. Common sense can go a long way toward preventing a social engineering attack. Make sure to reiterate that if a message seems too good to be true, it\'s very likely a scam. And if something doesn\'t look or sound right, it probably isn\'t. 2. Phishing Phishing is an example of social engineering. Most phishing messages are sent by email. But some attackers deliver these messages through other methods, including smishing and vishing. Here are some typical strategies: Malicious links. When a user clicks on a | Ransomware Malware Tool Vulnerability Threat Mobile Cloud | Uber Uber | ★★ |
 |
2023-11-25 17:45:23 | Vulnérabilités critiques découvertes dans l'application de partage de fichiers OwnCloud Critical Vulnerabilities Discovered In ownCloud File Sharing App (lien direct) |
Le logiciel de partage de fichiers open source Owncloud a récemment émis un avertissement concernant trois vulnérabilités de sécurité critiques, ce qui peut entraîner des violations de données et présenter des risques graves, notamment en exposant des informations sensibles telles que les mots de passe administratrice et les informations d'identification du serveur de messagerie . Pour ceux qui ne le savent pas, OwnCloud est une solution de synchronisation de fichiers open source et de partage qui développe et fournit des logiciels open-source pour la collaboration de contenu, permettant aux équipes de partager et de travailler facilement sur les fichiers sans mesure que le périphérique ou l'emplacement. La première vulnérabilité, connue sous le nom de CVE-2023-49103 , a reçu le score CVSS V3 maximal de 10, qui peut être utilisé pour voler des informations d'identification et des informations de configuration dans les déploiements conteneurisés, et peuvent affecter tous les composants du serveur Webenvironnement. Dans les versions GUI 0.2.0 à 0.3.0, le problème se produit en raison de la dépendance à une bibliothèque tierce qui expose des informations sur l'environnement PHP via une URL, révélant des mots de passe administratifs OwnCloud, des informations d'identification du serveur de messagerie et des clés de licence. La correction recommandée implique la suppression de Owncloud / Apps / GraphAPI / Vendor / Microsoft / Microsoft-Graph / Tests / GetPhpinfo.php Fichier, désactivant la fonction "phpinfo" dans les conteneurs Docker et modifiant des secrets potentiellement exposés tels que la OwnCloud Admin Admin Owncloud et modifiant des secrets potentiellement exposés tels que la OwnCloud Admin Admin Owncloud et modifiant des secrets potentiellement exposés tels que la OwnCloud Admin Admin Owncloud, et modifiant des secrets potentiellement exposés tels que la OwnCloud Admin Admin OwnclouMot de passe, serveur de messagerie, informations d'identification de base de données et clés d'accès d'objet / S3. & # 8220; Il est important de souligner que le simple fait de désactiver l'application Graphapi n'élimine pas la vulnérabilité.De plus, Phpinfo expose divers autres détails de configuration potentiellement sensibles qui pourraient être exploités par un attaquant pour recueillir des informations sur le système.Par conséquent, même si OwnCloud ne fonctionne pas dans un environnement conteneurisé, cette vulnérabilité devrait toujours être une source de préoccupation, & # 8221;Le conseil en sécurité met en garde. En déplaçant plus loin, la deuxième vulnérabilité a un score CVSS V3 de 9.8 et affecte les versions de la bibliothèque de base de Owncloud \\ 10.6.0 à 10.13.0. Ceci est un | Vulnerability | ★★ | |
|
2023-11-25 11:09:54 | Vigilance.fr - Trellix Endpoint Security: Escalade des privilèges via des variables d'environnement des composants AMSI, analysées le 25/09/2023 Vigilance.fr - Trellix Endpoint Security: privilege escalation via AMSI Component Environment Variables, analyzed on 25/09/2023 (lien direct) |
Un attaquant peut contourner les restrictions de Trellix Endpoint Security, via des variables d'environnement des composants AMSI, afin de dégénérer ses privilèges.
-
vulnérabilité de sécurité
An attacker can bypass restrictions of Trellix Endpoint Security, via AMSI Component Environment Variables, in order to escalate his privileges. - Security Vulnerability |
Vulnerability | ★★ | |
|
2023-11-25 11:09:54 | Vigilance.fr - Trellix Endpoint Security : élévation de privilèges via AMSI Component Environment Variables, analysé le 25/09/2023 (lien direct) | Un attaquant peut contourner les restrictions de Trellix Endpoint Security, via AMSI Component Environment Variables, afin d'élever ses privilèges. - Vulnérabilités | Vulnerability | ★★ | |
 |
2023-11-22 20:53:00 | De nouveaux défauts dans les capteurs d'empreintes digitales Laissent les attaquants contourner les fenêtres Hello Connexion New Flaws in Fingerprint Sensors Let Attackers Bypass Windows Hello Login (lien direct) |
Une nouvelle recherche a révélé plusieurs vulnérabilités qui pourraient être exploitées pour contourner les fenêtres Hello Authentication sur Dell Inspiron 15, Lenovo ThinkPad T14 et Microsoft Surface Pro X ordinateurs portables.
Les défauts ont été découverts par des chercheurs de la société de sécurité et de recherche offensive du matériel et des logiciels Blackwing Intelligence, qui a trouvé les faiblesses des capteurs d'empreintes digitales de Goodix,
A new research has uncovered multiple vulnerabilities that could be exploited to bypass Windows Hello authentication on Dell Inspiron 15, Lenovo ThinkPad T14, and Microsoft Surface Pro X laptops. The flaws were discovered by researchers at hardware and software product security and offensive research firm Blackwing Intelligence, who found the weaknesses in the fingerprint sensors from Goodix, |
Vulnerability | ★★★★ | |
 |
2023-11-22 18:21:09 | #Stopransomware: Lockbit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Said Vulnerabilité #StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability (lien direct) |
#### Description
CISA, FBI, MS-ISAC et Australian Signals Direction \'s Australian Cyber Security Center (ASD \'s ACSC) publient ce CSA pour diffuser les IOC, les TTP et les méthodes de détection associées à Lockbit 3.0 Ransomware exploitant CVE-2023 CVE-2010-4966, étiqueté Citrix Said, affectant Citrix NetScaler Web Delivery Control (ADC) et Netscaler Gateway Appliances.
Ce CSA fournit des TTP et des CIO obtenus auprès du FBI, de l'ACSC et partagés volontairement par Boeing.Boeing a observé les affiliés Lockbit 3.0 exploitant CVE-2023-4966, pour obtenir un accès initial à Boeing Distribution Inc., ses parties et ses activités de distribution qui maintient un environnement distinct.D'autres tiers de confiance ont observé une activité similaire sur leur organisation.
Historiquement, les affiliés de Lockbit 3.0 ont mené des attaques contre les organisations de tailles variables dans plusieurs secteurs d'infrastructures critiques, notamment l'éducation, l'énergie, les services financiers, l'alimentation et l'agriculture, les services gouvernementaux et d'urgence, les soins de santé, la fabrication et les transports.Les TTP observés pour les attaques de ransomwares de verrouillage peuvent varier considérablement dans les TTP observés.
Citrix Said, connu pour être exploité par les affiliés de Lockbit 3.0, permet aux acteurs de menace de contourner les exigences de mot de passe et d'authentification multifactorielle (MFA), conduisant à un détournement de session réussi des séances utilisateur légitimes sur les appareils de livraison d'application Web Citrix Netscaler (ADC) et les appareils de passerelle.Grâce à la prise de contrôle des séances d'utilisateurs légitimes, les acteurs malveillants acquièrent des autorisations élevées pour récolter les informations d'identification, se déplacer latéralement et accéder aux données et aux ressources.
#### URL de référence (s)
1. https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a
2. https://www.cisa.gov/news-events/analysis-reports/ar23-325a
#### Date de publication
21 novembre 2023
#### Auteurs)
Cisa
#### Description CISA, FBI, MS-ISAC, and Australian Signals Directorate\'s Australian Cyber Security Centre (ASD\'s ACSC) are releasing this CSA to disseminate IOCs, TTPs, and detection methods associated with LockBit 3.0 ransomware exploiting CVE-2023-4966, labeled Citrix Bleed, affecting Citrix NetScaler web application delivery control (ADC) and NetScaler Gateway appliances. This CSA provides TTPs and IOCs obtained from FBI, ACSC, and voluntarily shared by Boeing. Boeing observed LockBit 3.0 affiliates exploiting CVE-2023-4966, to obtain initial access to Boeing Distribution Inc., its parts and distribution business that maintains a separate environment. Other trusted third parties have observed similar activity impacting their organization. Historically, LockBit 3.0 affiliates have conducted attacks against organizations of varying sizes across multiple critical infrastructure sectors, including education, energy, financial services, food and agriculture, government and emergency services, healthcare, manufacturing, and transportation. Observed TTPs for LockBit ransomware attacks can vary significantly in observed TTPs. Citrix Bleed, known to be leveraged by LockBit 3.0 affiliates, allows threat actors to bypass password requirements and multifactor authentication (MFA), leading to successful session hijacking of legitimate user sessions on Citrix NetScaler web application delivery control (ADC) and Gateway appliances. Through the takeover of legitimate user sessions, malicious actors acquire elevated permissions to harvest credentials, move laterally, and access data and resources. #### Reference URL(s) 1. https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a 2. https://www.cisa.gov/news-events/analysis-reports/ar23-325a #### Publication Date November 21, 2023 #### Auth |
Ransomware Vulnerability Threat | ★★ | |
 |
2023-11-22 17:00:00 | Flaw in Apache ActiveMQ expose les systèmes Linux à la pavage de logiciels malveillants Flaw in Apache ActiveMQ Exposes Linux Systems to Kinsing Malware (lien direct) |
Identifié comme CVE-2023-46604, la vulnérabilité a un score CVSS de 9,8
Identified as CVE-2023-46604, the vulnerability has a CVSS score of 9.8 |
Malware Vulnerability | ★★ | |
 |
2023-11-22 15:55:53 | Citrix Bleed : Boeing éclaire sur la faille qui lui a valu un ransomware (lien direct) | Attaqué par LockBit à travers la faille Citrix Bleed, Boeing a communiqué des IoC que relaient les ANSSI américaine et australienne. | Ransomware Vulnerability | ★★★ | |
 |
2023-11-22 15:21:14 | Les chercheurs veulent plus de détails sur les alertes du système de contrôle industriel Researchers want more detail on industrial control system alerts (lien direct) |
> Une vulnérabilité dans un système de contrôle industriel exploité par un groupe de piratage soutenu par l'État illustre les problèmes de la façon dont les fournisseurs partagent les données.
>A vulnerability in an industrial control system exploited by a state-backed hacking group illustrate problems in how vendors share data. |
Vulnerability Industrial | ★★★ | |
 |
2023-11-22 12:39:04 | New Botnet Malware exploite deux jours zéro pour infecter les NVR et les routeurs New botnet malware exploits two zero-days to infect NVRs and routers (lien direct) |
Un nouveau botnet malware basé sur Mirai nommé \\ 'InfectedSlurs \' a exploité deux vulnérabilités d'exécution de code distant (RCE) à deux jours zéro jour pour infecter les routeurs et les enregistreurs vidéo (NVR).[...]
A new Mirai-based malware botnet named \'InfectedSlurs\' has been exploiting two zero-day remote code execution (RCE) vulnerabilities to infect routers and video recorder (NVR) devices. [...] |
Malware Vulnerability | ★★ | |
 |
2023-11-22 12:20:58 | Microsoft offre jusqu'à 20 000 $ pour les vulnérabilités dans les produits de défenseur Microsoft Offers Up to $20,000 for Vulnerabilities in Defender Products (lien direct) |
> Microsoft invite les chercheurs à un nouveau programme de primes de bogues axé sur les vulnérabilités de ses produits de défenseur.
>Microsoft invites researchers to new bug bounty program focused on vulnerabilities in its Defender products. |
Vulnerability | ★★ | |
|
2023-11-22 11:45:00 | Les affiliés de Lockbit exploitent Citrix Said, avertissent les agences gouvernementales LockBit Affiliates are Exploiting Citrix Bleed, Government Agencies Warn (lien direct) |
Des groupes d'acteurs de menaces multiples, y compris les affiliés de Lockbit
Multiple threat actor groups including Lockbit affiliates are found to be exploiting a vulnerability in Citrix NetScaler gateway appliances, government agencies have warned |
Vulnerability Threat | ★★ | |
|
2023-11-22 11:44:53 | ATLASSIAN PATCES RCE Vulnérabilités dans le centre de données et le serveur de bambou et de foule: CVE-2023-22516, CVE-2023-22521 Atlassian Patches RCE Vulnerabilities in Bamboo & Crowd Data Center and Server: CVE-2023-22516, CVE-2023-22521 (lien direct) |
Atlassian a émis de toute urgence des avis de sécurité pour deux produits distincts: Centre de données en bambou et serveur, ...
Atlassian has urgently issued security advisories for two separate products: Bamboo Data Center and Server,... |
Vulnerability | ★★★ | |
 |
2023-11-22 11:30:00 | BUG BYTES # 217 & # 8211;Comment soumettre des vulnérabilités, rédiger un excellent article et 2 ans de prime de bogue Bug Bytes #217 – How to Submit Vulnerabilities, Writing a Great WriteUp and 2 years of Bug Bounty (lien direct) |
> Bug Bytes est une newsletter hebdomadaire organisée par les membres de la communauté Bug Bounty.La deuxième série est organisée par InsiderPhd.Chaque semaine, elle nous tient à jour avec une liste complète des articles, des outils, des tutoriels et des ressources.Ce numéro couvre les semaines du 6 novembre au 19 novembre Intigriti News de mon cahier
>Bug Bytes is a weekly newsletter curated by members of the bug bounty community. The second series is curated by InsiderPhD. Every week, she keeps us up to date with a comprehensive list of write-ups, tools, tutorials and resources. This issue covers the weeks from November 6th to November 19th Intigriti News From my notebook |
Tool Vulnerability | ★★ | |
|
2023-11-22 11:00:00 | Cyber Fête de Thanksgiving: sauvegarde contre les escroqueries saisonnières Thanksgiving Cyber feast: Safeguarding against seasonal scams (lien direct) |
The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. As the Thanksgiving season rapidly approaches, many look forward to the warmth of family gatherings, the aroma of roasted turkey, and the joy of gratitude. Yet, just as we prepare our homes and hearts for this festive season, cybercriminals are gearing up to unleash a different kind of feast—a cyber feast—rife with sophisticated scams targeting unsuspecting individuals and businesses alike. This article will take a closer look at various Thanksgiving-themed cyber threats, illuminating the nature and impact of devious digital deceptions while unpacking the methodologies these digital bad actors try to use. But fear not, because we’ll also offer some key strategies to help you secure and fortify your digital domains throughout the holidays. The rise of seasonal cyber threats As November and the holiday season roll around, a surge in online activity sweeps across the United States, both good and bad. Thanksgiving not only signifies a time of family gatherings and festive meals but also marks the beginning of the holiday shopping season, especially with Black Friday and Cyber Monday right around the corner—in response to this, cybercriminals see a ripe opportunity to scam. According to the New Jersey Cybersecurity & Communications Integration Cell, recent reports had indicated. “spoofed emails were sent appearing to originate from legitimate organizations and contained [Thanksgiving-themed subject lines]’” noting how criminals and bad actors exploit the spirit of the season. Furthermore, they highlight that ”an Emotet banking trojan campaign was [also] observed using Thanksgiving lures.” Criminals know that with increased online transactions comes increased vulnerability, so they capitalize on the holiday spirit, designing scams that blend seamlessly with genuine promotional content, making it harder for individuals to distinguish between what\'s authentic and what\'s not. The risks of phishing One of the primary ways cybercriminals target individuals and businesses is through phishing attacks. Around Thanksgiving time, these types of scams might manifest as emails purporting to offer massive discounts, invitations to exclusive Thanksgiving events, or even charitable appeals meant to tug at the heartstrings to draw you in. However, phishing isn’t restricted to just email—with their vast user bases, social media platforms are also prime targets for scams of all kinds. Cybercriminals often create fake profiles or pages promoting too-good-to-be-true Thanksgiving deals, leading unsuspecting and unknowing victims to phishing websites or even tricking them into sharing personal information that can be further exploited. The hidden benefits of cybersecurity When businesses transform their robust cybersecurity processes into content, it becomes a powerful tool for brand awareness and elevation. Sharing with your audience the measures you\'ve implemented reassures them of the sanctity of their data. It\'s not just about telling them they\'re safe; it\'s about showing them. For potential customers, especially in niche markets, tangible information is a beacon of trust. So when they can actively see and better understand | Malware Tool Vulnerability Threat | ★★ | |
|
2023-11-22 10:19:00 | Ransomware de verrouillage exploitant la vulnérabilité critique de saignement Citrix à rompre LockBit Ransomware Exploiting Critical Citrix Bleed Vulnerability to Break In (lien direct) |
Les acteurs de la menace multiple, y compris les affiliés des ransomwares de lockbit, exploitent activement un défaut de sécurité critique récemment divulgué dans Citrix NetScaler Application Control (ADC) et les appareils Gateway pour obtenir un accès initial aux environnements cibles.
L'avis conjoint provient de l'Agence américaine de sécurité de la cybersécurité et de l'infrastructure (CISA), Federal Bureau of Investigation (FBI),
Multiple threat actors, including LockBit ransomware affiliates, are actively exploiting a recently disclosed critical security flaw in Citrix NetScaler application delivery control (ADC) and Gateway appliances to obtain initial access to target environments. The joint advisory comes from the U.S. Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), |
Ransomware Vulnerability Threat | ★★ | |
|
2023-11-21 21:35:00 | AutoZone Files Moveit Data Breach Avis avec l'état du Maine AutoZone Files MOVEit Data Breach Notice With State of Maine (lien direct) |
La société a temporairement désactivé la demande et corrigé la vulnérabilité, bien que les personnes touchées devraient toujours rester vigilantes.
The company temporarily disabled the application and patched the vulnerability, though affected individuals should still remain vigilant. |
Data Breach Vulnerability | ★★★ | |
|
2023-11-21 21:29:00 | Exploit for Critical Windows Defender Bypass Goes Public (lien direct) | Les acteurs de la menace exploitaient activement CVE-2023-36025 dans Windows SmartScreen en tant que vulnérabilité zéro jour avant que Microsoft ne le corrige en novembre.
Threat actors were actively exploiting CVE-2023-36025 in Windows SmartScreen as a zero-day vulnerability before Microsoft patched it in November. |
Vulnerability Vulnerability Threat | ★★★ | |
|
2023-11-21 21:29:00 | Exploiter pour le pontage critique de Windows Defender devient public Exploit for Critical Windows Defender Bypass Goes Public (lien direct) |
Les acteurs de la menace exploitaient activement CVE-2023-36025 dans Windows SmartScreen en tant que vulnérabilité zéro jour avant que Microsoft ne le corrige en novembre.
Threat actors were actively exploiting CVE-2023-36025 in Windows SmartScreen as a zero-day vulnerability before Microsoft patched it in November. |
Vulnerability Threat | ★★ | |
|
2023-11-21 19:15:00 | \\ 'Citrix Bleed \\' Vulnérabilité ciblée par les pirates de natation et les pirates criminels: CISA \\'Citrix Bleed\\' vulnerability targeted by nation-state and criminal hackers: CISA (lien direct) |
Les pirates d'État-nation et les gangs de cybercrimins exploitent une vulnérabilité affectant les produits Citrix, ont averti mardi des cyber-responsables fédéraux.Le \\ 'citrix saigne \' bug a provoqué une alarme pendant des semaines comme Les experts de la sécurité de la sécurité ont averti que de nombreuses agences gouvernementales et grandes entreprises laissaient leurs appareils exposés à Internet - s'ouvrant aux attaques.La cybersécurité
Both nation-state hackers and cybercriminal gangs are exploiting a vulnerability affecting Citrix products, federal cyber officials warned on Tuesday. The \'Citrix Bleed\' bug has caused alarm for weeks as cybersecurity experts warned that many government agencies and major companies were leaving their appliances exposed to the internet - opening themselves up to attacks. The Cybersecurity |
Vulnerability | ★★★ | |
 |
2023-11-21 18:51:36 | Des portefeuilles obsolètes menaçant des milliards d'actifs cryptographiques Outdated Wallets Threatening Billions in Crypto Assets (lien direct) |
> Par waqas
La vulnérabilité est surnommée Randstorm, impactant les portefeuilles générés par le navigateur créés entre 2011 et 2015.
Ceci est un article de HackRead.com Lire le post original: Des portefeuilles obsolètes menaçant des milliards d'actifs cryptographiques
>By Waqas The vulnerability is dubbed Randstorm, impacting browser-generated wallets created between 2011 and 2015. This is a post from HackRead.com Read the original post: Outdated Wallets Threatening Billions in Crypto Assets |
Vulnerability Threat | ★★★★ | |
|
2023-11-21 15:30:00 | Kinsing Hackers Exploit Apache ActiveMQ Vulnérabilité pour déployer Linux Rootkits Kinsing Hackers Exploit Apache ActiveMQ Vulnerability to Deploy Linux Rootkits (lien direct) |
Les acteurs de la menace de Kinsing exploitent activement un défaut de sécurité critique dans les serveurs APCACH ACCACE vulnérables pour infecter les systèmes Linux avec des mineurs de crypto-monnaie et des rootkits.
"Une fois que le kins infecte un système, il déploie un script d'exploration de crypto-monnaie qui exploite les ressources de l'hôte pour exploiter les crypto-monnaies comme le bitcoin, entraînant des dommages importants à l'infrastructure et un négatif
The Kinsing threat actors are actively exploiting a critical security flaw in vulnerable Apache ActiveMQ servers to infect Linux systems with cryptocurrency miners and rootkits. "Once Kinsing infects a system, it deploys a cryptocurrency mining script that exploits the host\'s resources to mine cryptocurrencies like Bitcoin, resulting in significant damage to the infrastructure and a negative |
Vulnerability Threat | ★★★ | |
|
2023-11-21 14:29:05 | Malware Dev dit qu'ils peuvent relancer les cookies Google Auth expirés Malware dev says they can revive expired Google auth cookies (lien direct) |
Le logiciel malveillant du voleur d'informations Lumma (aka \\ 'Lummac2 \') fait la promotion d'une nouvelle fonctionnalité qui permettait prétendument sur les cybercriminels de restaurer les cookies Google expirés, qui peuvent être utilisés pour détourner les comptes Google.[...]
The Lumma information-stealer malware (aka \'LummaC2\') is promoting a new feature that allegedly allows cybercriminals to restore expired Google cookies, which can be used to hijack Google accounts. [...] |
Malware Vulnerability | ★★★★ | |
 |
2023-11-21 14:00:06 | Qu'est-ce que l'ingénierie sociale? What is Social Engineering? (lien direct) |
> 
Dans le domaine de la cybersécurité, il y a une vulnérabilité qui est souvent négligée & # 8211;l'élément humain.Pendant les pare-feu, le cryptage, ...
> 
In the realm of cybersecurity, there is one vulnerability that is often overlooked – the human element. While firewalls, encryption,...
|
Vulnerability | ★★ | |
|
2023-11-21 14:00:00 | Black Friday: lacunes importantes de sécurité dans les applications Web de commerce électronique Black Friday: Significant Security Gaps in E-Commerce Web Apps (lien direct) |
Les chercheurs avertissent que des millions de consommateurs \\ 'PII pourraient être en danger en raison de vulnérabilités exploitables et d'un manque de protocoles de sécurité de base dans les applications Web de commerce électronique
Researchers warn that millions of consumers\' PII could be at risk due to exploitable vulnerabilities and a lack of basic security protocols in e-commerce web apps |
Vulnerability | ★★★ | |
 |
2023-11-21 12:05:07 | Flaw de sécurité par e-mail trouvé dans la nature Email Security Flaw Found in the Wild (lien direct) |
GROUPE D'ANALYSE DE MONAGES DE GOORD & # 8217; S annoncé A zéro-day contre le serveur de messagerie de collaboration Zimbra qui a été utilisé contregouvernements du monde entier.
La balise a observé quatre groupes différents exploitant le même bogue pour voler les données de messagerie, les informations d'identification des utilisateurs et les jetons d'authentification.La majeure partie de cette activité s'est produite après que le correctif initial est devenu public sur Github.Pour assurer la protection contre ces types d'exploits, Tag exhorte les utilisateurs et les organisations à garder les logiciels entièrement à jour et à appliquer des mises à jour de sécurité dès qu'elles deviennent disponibles.
La vulnérabilité a été découverte en juin.Il a été corrigé ...
Google’s Threat Analysis Group announced a zero-day against the Zimbra Collaboration email server that has been used against governments around the world. TAG has observed four different groups exploiting the same bug to steal email data, user credentials, and authentication tokens. Most of this activity occurred after the initial fix became public on Github. To ensure protection against these types of exploits, TAG urges users and organizations to keep software fully up-to-date and apply security updates as soon as they become available. The vulnerability was discovered in June. It has been patched... |
Vulnerability Threat | ★★ | |
 |
2023-11-21 00:00:00 | Présentation du programme Bounty Microsoft Defender Introducing the Microsoft Defender Bounty Program (lien direct) |
Nous sommes ravis d'annoncer le nouveau programme Microsoft Defender Bounty avec des prix allant jusqu'à 20 000 USD.
La marque Microsoft Defender comprend une variété de produits et services conçus pour améliorer la sécurité de l'expérience client Microsoft.Le programme Microsoft Defender Bounty invite des chercheurs à travers le monde à identifier les vulnérabilités dans les produits et services de défenseur et les partager avec notre équipe.
We are excited to announce the new Microsoft Defender Bounty Program with awards of up to $20,000 USD. The Microsoft Defender brand encompasses a variety of products and services designed to enhance the security of the Microsoft customer experience. The Microsoft Defender Bounty Program invites researchers across the globe to identify vulnerabilities in Defender products and services and share them with our team. |
Vulnerability | ★★ | |
 |
2023-11-20 23:00:00 | Sécurité du code Visual Studio: trouver de nouvelles vulnérabilités dans l'intégration NPM (3/3) Visual Studio Code Security: Finding New Vulnerabilities in the NPM Integration (3/3) (lien direct) |
Il est temps de terminer notre série sur la sécurité du code Visual Studio avec de nouvelles vulnérabilités dans l'intégration NPM, en contournant la fonction de sécurité de la confiance de l'espace de travail.
It\'s time to wrap up our series on the security of Visual Studio Code with new vulnerabilities in the NPM integration, bypassing the Workspace Trust security feature. |
Vulnerability | ★★★ | |
|
2023-11-20 19:16:03 | Les vulnérabilités exploitées peuvent prendre des mois pour faire la liste KEV Exploited Vulnerabilities Can Take Months to Make KEV List (lien direct) |
Le catalogue connu des vulnérabilités exploités (KEV) est une source d'informations de haute qualité sur les défauts logiciels exploités dans la nature, mais les mises à jour sont souvent retardées, de sorte que les entreprises ont besoin d'autres sources d'intelligence des menaces.
The Known Exploited Vulnerabilities (KEV) catalog is a high-quality source of information on software flaws being exploited in the wild, but updates are often delayed, so companies need other sources of threat intelligence. |
Vulnerability Threat | ★★★ | |
 |
2023-11-20 18:38:02 | Éliminer les tâches répétitives et accélérer la réponse avec la fusion Falcon Eliminate Repetitive Tasks and Accelerate Response with Falcon Fusion (lien direct) |
Les adversaires deviennent de plus en plus sophistiqués et plus rapidement avec leurs attaques.Selon le rapport de chasse aux menaces Crowdsstrike 2023, le temps d'évasion ECRIME moyen n'est que de 79 minutes.Cela est dû en partie au fait que les adversaires tirent parti des outils qui tirent parti de l'automatisation comme des outils de craquage de mot de passe, des kits d'exploitation pour les vulnérabilités du navigateur Web et des marchés qui vendent des données volées.[& # 8230;]
Adversaries are becoming more sophisticated and faster with their attacks. According to the CrowdStrike 2023 Threat Hunting Report, the average eCrime breakout time is just 79 minutes. This is partly due to adversaries taking advantage of tools that leverage automation like password-cracking tools, exploit kits for web browser vulnerabilities, and marketplaces that sell stolen data. […] |
Tool Vulnerability Threat | ★★ | |
 |
2023-11-20 13:00:29 | Le facteur humain de la cybersécurité The Human Factor of Cyber Security (lien direct) |
> Au cours de ma carrière de 2 décennies en cybersécurité, j'ai observé de première main que si la technologie joue un rôle important protégeant les organisations, l'élément humain est tout aussi crucial.On dit souvent que les protocoles de sécurité les plus sophistiqués peuvent être compromis par un seul clic par rapport à un employé non informé ou imprudent.Dans cet article, je vise à faire la lumière sur le facteur humain souvent négligé & # 8216;et fournir des recommandations pour aider les entreprises à renforcer ce maillon le plus faible de la chaîne de cybersécurité.Le paysage des menaces actuel Le paysage mondial de la cybersécurité est complexe et en constante évolution, avec de nouvelles vulnérabilités et menaces surfaçant presque quotidiennement.Nous venons un long [& # 8230;]
>In my 2 decade career in cybersecurity, I have observed firsthand that while technology plays a significant role protecting organizations, the human element is equally crucial. It is often said that the most sophisticated security protocols can be undermined by a single click from an uninformed or careless employee. In this article, I aim to shed light on the often-overlooked ‘human factor’ and provide recommendations to help businesses bolster this weakest link in the cybersecurity chain. The current threat landscape The global cybersecurity landscape is complex and ever-changing, with new vulnerabilities and threats surfacing almost daily. We’ve come a long […] |
Vulnerability Threat | ★★★ | |
 |
2023-11-20 12:23:23 | La montée des manifestations en temps de guerre The Rising of Protestware During Times of War (lien direct) |
Dans le paysage en constante évolution des menaces de cybersécurité, un phénomène déconcertant a émergé, ce qui remet en question les notions conventionnelles de logiciel malveillant.Entrez & # 8220; Protestware & # 8221;- Un terme qui envoie des frissons dans les épines des experts en cybersécurité et des individus.Contrairement aux logiciels malveillants traditionnels, Protestware n'est pas conçu dans le seul but d'exploiter les vulnérabilités ou de voler des informations sensibles.Au lieu de cela, c'est [& # 8230;]
In the ever-evolving landscape of cybersecurity threats, a disconcerting phenomenon has emerged, challenging the conventional notions of malicious software. Enter “protestware” - a term that sends shivers down the spines of cybersecurity experts and individuals alike. Unlike traditional malware, protestware isn’t designed with the sole purpose of exploiting vulnerabilities or stealing sensitive information. Instead, it […] |
Malware Vulnerability | ★★★ | |
|
2023-11-20 11:54:44 | Kinsing malware exploite Apache activemq rce pour planter rootkits Kinsing malware exploits Apache ActiveMQ RCE to plant rootkits (lien direct) |
L'opérateur de logiciels malveillants Kinsing exploite activement la vulnérabilité critique CVE-2023-46604 dans le courtier de messages open-source Apache ActiveMQ pour compromettre les systèmes Linux.[...]
The Kinsing malware operator is actively exploiting the CVE-2023-46604 critical vulnerability in the Apache ActiveMQ open-source message broker to compromise Linux systems. [...] |
Malware Vulnerability | ★★ | |
 |
2023-11-20 11:49:31 | Deux ans plus tard: une base de référence qui fait grimper la sécurité de l'industrie Two years later: a baseline that drives up security for the industry (lien direct) |
Royal Hansen, Vice President of Privacy, Safety and Security Engineering, GoogleNearly half of third-parties fail to meet two or more of the Minimum Viable Secure Product controls. Why is this a problem? Because "98% of organizations have a relationship with at least one third-party that has experienced a breach in the last 2 years."In this post, we\'re excited to share the latest improvements to the Minimum Viable Secure Product (MVSP) controls. We\'ll also shed light on how adoption of MVSP has helped Google improve its security processes, and hope this example will help motivate third-parties to increase their adoption of MVSP controls and thus improve product security across the industry.About MVSPIn October 2021, Google publicly launched MVSP alongside launch partners. Our original goal remains unchanged: to provide a vendor-neutral application security baseline, designed to eliminate overhead, complexity, and confusion in the end-to-end process of onboarding third-party products and services. It covers themes such as procurement, security assessment, and contract negotiation. Improvements since launchAs part of MVSP\'s annual control review, and our core philosophy of evolution over revolution |
Vulnerability Conference | ★★ | |
|
2023-11-20 08:47:33 | Campagne d'attaque de cryptojacking contre les serveurs Web Apache à l'aide de Cobalt Strike Cryptojacking Attack Campaign Against Apache Web Servers Using Cobalt Strike (lien direct) |
Ahnlab Security Emergency Response Center (ASEC) surveillait les attaques contre les serveurs Web vulnérables qui ont des vulnérabilités non corrigées ouêtre mal géré.Étant donné que les serveurs Web sont exposés à l'extérieur dans le but de fournir des services Web à tous les utilisateurs disponibles, ceux-ci deviennent des objectifs d'attaque majeurs pour les acteurs de la menace.Les principaux exemples de services Web qui prennent en charge les environnements Windows incluent les services d'information Internet (IIS), Apache, Apache Tomcat et Nginx.Bien que le service Web Apache soit généralement utilisé dans les environnements Linux, il y en a ...
AhnLab Security Emergency response Center (ASEC) is monitoring attacks against vulnerable web servers that have unpatched vulnerabilities or are being poorly managed. Because web servers are externally exposed for the purpose of providing web services to all available users, these become major attack targets for threat actors. Major examples of web services that support Windows environments include Internet Information Services (IIS), Apache, Apache Tomcat, and Nginx. While the Apache web service is usually used in Linux environments, there are some... |
Vulnerability Threat Technical | ★★★ | |
|
2023-11-20 00:00:00 | Célébrer dix ans du programme Bounty Microsoft Bug et plus de 60 millions de dollars Celebrating ten years of the Microsoft Bug Bounty program and more than $60M awarded (lien direct) |
Cette année marque le dixième anniversaire du programme Bounty Microsoft Bug, une partie essentielle de notre stratégie proactive pour protéger les clients contre les menaces de sécurité.Depuis sa création en 2013, Microsoft a attribué plus de 60 millions de dollars à des milliers de chercheurs en sécurité de 70 pays.Ces individus ont découvert et signalé des vulnérabilités sous une divulgation de vulnérabilité coordonnée, aidant Microsoft à naviguer dans le paysage et les technologies émergentes des menaces de sécurité en constante évolution.
This year marks the tenth anniversary of the Microsoft Bug Bounty Program, an essential part of our proactive strategy to protect customers from security threats. Since its inception in 2013, Microsoft has awarded more than $60 million to thousands of security researchers from 70 countries. These individuals have discovered and reported vulnerabilities under Coordinated Vulnerability Disclosure, aiding Microsoft in navigating the continuously evolving security threat landscape and emerging technologies. |
Vulnerability Threat | ★★★ | |
 |
2023-11-20 00:00:00 | CVE-2023-46604 (Apache ActiveMQ) exploité pour infecter les systèmes avec des cryptomineurs et des rootkits CVE-2023-46604 (Apache ActiveMQ) Exploited to Infect Systems With Cryptominers and Rootkits (lien direct) |
Nous avons découvert l'exploitation active de la vulnérabilité Apache ActiveMQ CVE-2023-46604 pour télécharger et infecter les systèmes Linux avec les logiciels malveillants (également connus sous le nom de H2Miner) et le mineur de crypto-monnaie.
We uncovered the active exploitation of the Apache ActiveMQ vulnerability CVE-2023-46604 to download and infect Linux systems with the Kinsing malware (also known as h2miner) and cryptocurrency miner. |
Malware Vulnerability | ★★ | |
|
2023-11-19 11:14:25 | Les pirates russes utilisent la fonctionnalité Ngrok et l'exploit Winrar pour attaquer les ambassades Russian hackers use Ngrok feature and WinRAR exploit to attack embassies (lien direct) |
Après Sandworm et APT28 (connu sous le nom de Fancy Bear), un autre groupe de pirates russes parrainé par l'État, APT29, tire parti de la vulnérabilité CVE-2023-38831 dans Winrar pour les cyberattaques.[...]
After Sandworm and APT28 (known as Fancy Bear), another state-sponsored Russian hacker group, APT29, is leveraging the CVE-2023-38831 vulnerability in WinRAR for cyberattacks. [...] |
Vulnerability Threat | APT 29 APT 28 | ★★★ |
|
2023-11-17 22:01:40 | Vendredi blogging Squid: Vulnérabilités non lues dans le proxy de mise en cache de calmar Friday Squid Blogging: Unpatched Vulnerabilities in the Squid Caching Proxy (lien direct) |
Dans un post rare SQUID / Sécurité, ici & # 8217; est un Article sur les vulnérabilités non fourreusesdans le proxy de mise en cache de calmar.
Comme d'habitude, vous pouvez également utiliser ce post de calmar pour parler des histoires de sécurité dans les nouvelles que je n'ai pas couvertes. .
Lisez mes directives de publication de blog ici .
In a rare squid/security post, here’s an article about unpatched vulnerabilities in the Squid caching proxy. As usual, you can also use this squid post to talk about the security stories in the news that I haven\'t covered. Read my blog posting guidelines here. |
Vulnerability | ★★★ | |
|
2023-11-17 18:30:27 | Google révèle la vulnérabilité \\ 'reptar \\' menaçant les processeurs Intel Google Reveals \\'Reptar\\' Vulnerability Threatening Intel Processors (lien direct) |
par deeba ahmed
La vulnérabilité Intel CPU a un impact sur les environnements virtualisés multi-locataires.
Ceci est un article de HackRead.com Lire le post original: Google révèle& # 8216; Reptar & # 8217;Vulnérabilité menaçant les processeurs Intel
By Deeba Ahmed Intel CPU Vulnerability Impacts Multi-Tenant Virtualized Environments. This is a post from HackRead.com Read the original post: Google Reveals ‘Reptar’ Vulnerability Threatening Intel Processors |
Vulnerability | ★★★ | |
|
2023-11-17 12:01:12 | Démystifier l'IA et ML: six questions critiques à poser à votre fournisseur de cybersécurité Demystifying AI and ML: Six Critical Questions to Ask Your Cybersecurity Vendor (lien direct) |
As cyber threats continue to evolve at an unprecedented pace, many organizations are turning to artificial intelligence (AI) and machine learning (ML) in hopes of keeping up. While these advanced technologies hold immense promise, they\'re also more complex and far less efficient than traditional threat detection approaches. The tradeoff isn\'t always worth it. And not all AI and ML processes are created equal. The models used, the size and quality of the data sets they\'re trained on-and whether an advanced computational process is suitable for the problem at hand-are all critical factors to consider when deciding how both AI and ML fit into your cybersecurity strategy. In this blog post, we explore the vital questions you should ask your cybersecurity vendor about these technologies. We will also demystify their role in safeguarding your people, data and environment. Note: Though often conflated, AL and ML are related but distinct concepts. For simplicity, we\'re using AI when discussing the broader technology category and ML to discuss narrower learning models used in AI. Question 1: Why is AI suitable for this security problem? You\'ve probably heard the old saying that when your only tool is a hammer, every problem looks like a nail. While AI has rightly generated enthusiasm in cybersecurity, it may not be the optimal approach to every task. On one hand, the technologies can help analyze large amounts of data and find anomalies, trends and behaviors that indicate potential attacks. And the technologies can automate response and mitigation of security incidents. But depending on the size and complexity of the learning model, they can also be computationally intensive (read: expensive) to maintain. And worse, execution time can be much longer than less complex approaches such as rules and signatures. On the other hand, rules and signatures are static, so they don\'t automatically evolve to detect new threats. But they\'re also fast, easy on computing resources and highly effective for certain aspects of threat detection. Other signals, such as email sender reputation and IP addresses, can also be as effective as AI for many detections-and in most cases are faster and much more cost-effective. Getting AI right starts with understanding what cybersecurity tasks they\'re best suited to and applying them to the right problems. In the same vein, how the technology is applied matters. In cybersecurity, every second counts. Making decisions in real time and blocking malicious content before it can be delivered is today\'s key challenge. If the processing time of the vendor\'s AI means the technology is relegated solely to post-delivery inspection and remediation, that\'s a major drawback. Question 2: Where do you get your training data? The performance of ML models hinges on the source and quality of their data. That\'s because AI models learn from examples and patterns, not rules. And that requires a large amount of data. The more data, and the higher the quality of that data, the better the model can learn and generalize to new conditions. Like any ML model, those used in cybersecurity need a wide-ranging, diverse data set that accurately reflects the real world. Or more precisely, the data used to train your vendor\'s AI model should reflect your world-the threats targeting your organization and users. Finding data for general-purpose AI applications is easy. It\'s all over the internet. But threat data-especially data well-suited for the type of ML model the vendor intends to use- is scarcer. Gaining malware samples is a lot harder than acquiring data used in applications such as image and natural language processing. First, not much attack data is publicly available. Most security vendors hold on tightly to the threat data they collect, and for good reason. Beyond the obvious competitive advantages it offers, threat data is sensitive and comes with a bevy of privacy concerns. As a result, few cybersecurity vendors have a dataset large enough to trai | Malware Tool Vulnerability Threat | ★★ | |
|
2023-11-17 11:27:00 | CISA ajoute trois défauts de sécurité avec une exploitation active au catalogue KEV CISA Adds Three Security Flaws with Active Exploitation to KEV Catalog (lien direct) |
Jeudi, l'Agence américaine de sécurité de la cybersécurité et de l'infrastructure (CISA) a ajouté trois défauts de sécurité à son catalogue connu sur les vulnérabilités exploitées (KEV) basée sur des preuves d'exploitation active dans la nature.
Les vulnérabilités sont les suivantes -
CVE-2023-36584 (CVSS Score: 5.4) - Microsoft Windows Mark-of-the-Web (MOTW) Fonctionnement de sécurité Vulnérabilité
CVE-2023-1671 (score CVSS: 9.8) -
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added three security flaws to its Known Exploited Vulnerabilities (KEV) catalog based on evidence of active exploitation in the wild. The vulnerabilities are as follows - CVE-2023-36584 (CVSS score: 5.4) - Microsoft Windows Mark-of-the-Web (MotW) Security Feature Bypass Vulnerability CVE-2023-1671 (CVSS score: 9.8) - |
Vulnerability | ★★★ | |
|
2023-11-17 11:00:00 | Procurations gratuites et dangers cachés Free proxies and the hidden dangers (lien direct) |
The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. Data privacy continues to be a growing concern for all internet users. While the internet gives us so much more freedom and access to information we might not have otherwise, online privacy continues to be a significant risk. It’s not just cybercriminals that invade your privacy, but businesses as well. Data has become more valuable than ever, and companies will do whatever they can to collect your information. Proxies have been a popular option for protecting your online privacy. Now, these proxies offer even more benefits and specific use cases. You might even be looking into getting one and considering a free proxy. In this article, we’ll look at free proxies and why they can be a bigger danger than you might realize. We’ll also examine why residential proxies from a reliable provider like Smartproxy are better if security and privacy are your goals. Keep reading to discover how free proxies work and the dangers they pose. What is a proxy? A proxy is an intermediary server that accepts and forwards all your requests to the web server. This means that instead of connecting directly to the internet, you first connect to the proxy server. You might be wondering why using an intermediary server like a proxy is effective. Usually, it’s better to cut out the middleman, right? In this case, by connecting to the proxy first, your personal information, such as your IP and other associated data, is replaced by a new IP. This completely hides your information from the websites you visit. By changing your IP address through a proxy, websites or apps cannot track you, and your data is more secure. However, that’s not all a proxy does. What can you use a proxy for? By now, we know that proxies are great tools when it comes to online security and privacy. By hiding your real IP, the websites that you visit won’t be able to collect the data associated with your IP. This usually includes your name, location, ISP, devices, operating system, and more. Residential proxies, in particular, are great for anonymity because they use the IPs from real devices. As such, they don’t look like proxies and are much less likely to be detected as such. However, proxies can be used for many other ways aside from security and privacy. Another use is managing multiple social media accounts. Social media platforms are quick to issue IP bans if they find the same IP address creating multiple accounts. Account limits are usually only a handful per IP address, and the moment you create too many, you might receive an IP ban. This is frustrating if you’re a digital marketer who creates and manages accounts for clients. However, by using a proxy, you can change the IP that creates the accounts and avoid IP bans. Another use of proxies is related to automation. This can affect a wide range of automated tools, from sneaker bots to data scrapers and even social media automation. Many websites and social media platforms block automation tools as part of their anti-bot protection. However, by linking residential proxies to these tools, you can make them appear like natural users and bypass these limitations. However, to be successful, you’ll need to use residential proxies with a real IP. Finally, proxies can also help improve your connection speed and stabilize it. This is because you’re routing all your traffic through larger servers instead of your own device. These servers are much more capa | Malware Tool Vulnerability Threat | ★★ |
To see everything:
Our RSS (filtrered)
