What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2024-05-08 16:28:00 | Le logiciel malveillant Hijack Loader utilise des creux de processus, contournement UAC dans la dernière version Hijack Loader Malware Employs Process Hollowing, UAC Bypass in Latest Version (lien direct) |
Une version plus récente d'un chargeur de logiciels malveillants appelée & nbsp; Hijack Loader & nbsp; a & nbsp; a été observé & nbsp; incorporant un ensemble mis à jour de techniques d'anti-analyse pour voler sous le radar.
"Ces améliorations visent à augmenter la furtivité des logiciels malveillants, restant ainsi non détecté pendant de plus longues périodes", a déclaré le chercheur Zscaler à menace Muhammed Irfan v a & nbsp; dit & nbsp; dans un rapport technique.
"Détourner
A newer version of a malware loader called Hijack Loader has been observed incorporating an updated set of anti-analysis techniques to fly under the radar. "These enhancements aim to increase the malware\'s stealthiness, thereby remaining undetected for longer periods of time," Zscaler ThreatLabz researcher Muhammed Irfan V A said in a technical report. "Hijack |
Malware Technical | ★★★ | |
 |
2024-05-07 12:05:00 | 2024 Cyber Resilience Research révèle un terrain complexe 2024 Cyber Resilience Research Reveals a Complex Terrain (lien direct) |
Les nouvelles données aident les chefs d'entreprise à comprendre comment et pourquoi prioriser la résilience.
Dans le paysage en constante évolution de l'innovation numérique, les entreprises se retrouvent à l'intersection du progrès et du péril.Les données révèlent que les compromis ne sont pas seulement dramatiques, mais ils mettent également l'organisation à risque significatif.
L'un des principaux obstacles est la déconnexion entre les cadres supérieurs et les priorités de cybersécurité.Alors que la cyber-résilience est reconnue comme un impératif critique, de nombreuses organisations ont du mal à recueillir le soutien et les ressources nécessaires du leadership supérieur.Ce manque d'engagement entrave non seulement les progrès, mais laisse également les entreprises vulnérables aux violations potentielles.
Pendant ce temps, la technologie progresse à un rythme effréné, tout comme les risques posés par les cybermenaces.Le rapport FUTURESTM de niveau 2024 révèle cet acte d'équilibrage délicat entre l'innovation et la sécurité.Nous avons examiné l'ensemble des problèmes commerciaux impliqués dans la résilience cyber et de cybersécurité et découvert le leadership exécutif et le leadership technique ont des opportunités pour un alignement beaucoup plus profond.
Obtenez votre copie gratuite du rapport. & nbsp;
La quête insaisissable de la cyber-résilience.
Imaginez un monde où les entreprises sont imperméables aux cybermenaces & mdash; un monde où chaque aspect d'une organisation est sauvegardé contre les perturbations potentielles.C'est l'idéal élevé de la cyber-résilience, mais pour de nombreuses entreprises, elle reste un objectif insaisissable.L'évolution rapide de l'informatique a transformé le paysage informatique, brouillant les lignes entre les logiciels propriétaires et open-source, les systèmes hérités, les initiatives de transformation numérique du cloud computing.Bien que ces progrès apportent des avantages indéniables, ils introduisent également des risques sans précédent.
Selon nos recherches, 85% des leaders informatiques reconnaissent que l'innovation informatique a le prix d'un risque accru.Dans un monde où les cybercriminels deviennent de plus en plus sophistiqués, le besoin de cyber-résilience n'a jamais été aussi urgent.Des attaques de ransomwares massives aux incidents DDOS débilitants, les entreprises opèrent dans un climat où une seule cyber violation peut avoir des conséquences catastrophiques.
Exploration de la relation entre le leadership exécutif et la cyber-résilience.
Notre enquête auprès de 1 050 C-suite et cadres supérieurs comprenait 18 pays et sept industries: énergie et services publics, services financiers, soins de santé, fabrication, commerce de détail, transport et SLED américain (État, gouvernement local et enseignement supérieur).Dans les prochains mois, nous publierons un rapport vertical pour chaque marché.Ce rapport Landmark a été conçu pour aider les organisations à commencer à parler plus de manière réfléchie des vulnérabilités et des opportunités d'amélioration.
Dans le rapport, vous & rsquo; ll:
Découvrez pourquoi les chefs d'entreprise et les chefs de technologie ont besoin de hiérarchiser la cyber-résilience.
découvrez les obstacles critiques à la cyber-résilience.
Découvrez les défis concernant la résilience de la cybersécurité.
|
Ransomware Vulnerability Medical Cloud Technical | ★★★ | |
 |
2024-05-05 21:55:43 | Electronic Cash entièrement hors ligne: est-ce un problème insoluble? Fully Offline Electronic Cash: Is It an Intractable Problem? (lien direct) |
> Par contributeurs quotidiens
est-il vraiment hors ligne en espèces électroniques hors ligne possible?Contrairement à Bitcoin, les experts approfondissent les obstacles techniques de la création de trésorerie logicielle qui fonctionne sans Internet.Découvrez pourquoi y parvenir pourrait être un écrou plus difficile à casser que prévu.
Ceci est un article de HackRead.com Lire le post original: Electronic Cash entièrement hors ligne: est-ce un problème insoluble?
>By Daily Contributors Is truly offline offline electronic Cash possible? Unlike Bitcoin, experts dig deeper into the technical hurdles of creating software-based cash that works without the internet. Discover why achieving this might be a tougher nut to crack than expected. This is a post from HackRead.com Read the original post: Fully Offline Electronic Cash: Is It an Intractable Problem? |
Technical | ★★★ | |
 |
2024-05-03 23:29:59 | La collection Artefacte et la thésaurisation pour le bien de l'exclusivité médico-légale… & # 8211;Partie 2 The art of artifact collection and hoarding for the sake of forensic exclusivity… – Part 2 (lien direct) |
Dans la première partie, j'avais promis de démontrer que le piratage est bon!(Parfois) J'ai un peu menti là-bas, mais je ne vais pas mentir aujourd'hui: je vais tout vous dire dans la partie & # 8230; Continuer la lecture & # 8594;
In the first part I had promised that I would demonstrate that the piracy is good! (sometimes) I kinda lied back there, but I am not going to lie today: I will tell you all about it in the part … Continue reading → |
Technical | ★★★★ | |
 |
2024-05-03 20:14:15 | Les acteurs menacés attaquent les serveurs MS-SQL pour déployer des ransomwares Threat Actors Attacking MS-SQL Servers to Deploy Ransomware (lien direct) |
## Instantané
Les professionnels de la cybersécurité de GBhackers ont découvert une série de cyberattaques ciblant les serveurs Microsoft SQL (MS-SQL) mal gérés pour installer les ransomwares de Mallox sur les systèmes.
** En savoir plus sur la couverture de Microsoft \\ pour [MalloxRansomware ici.] (Https://sip.security.microsoft.com/intel-profiles/7fbe39c998c8a495a1652ac6f8bd34852c00f97dc61278cafc56dca1d443131e) **
##Description
Le modus operandi du groupe des acteurs de la menace implique d'exploiter les vulnérabilités dans des serveurs MS-SQL mal gérés.En utilisant des attaques de force brute et du dictionnaire, les attaquants obtiennent un accès non autorisé, ciblant principalement le compte SA (administrateur système système).
Une fois à l'intérieur, ils déploient l'outil d'accès à distance REMCOS (RAT) pour prendre le contrôle du système infecté.Remcos Rat, initialement utilisé pour la violation et le contrôle du système, a été réutilisé par des attaquants pour des activités malveillantes, avec des capacités telles que le keylogging, la capture de capture d'écran et le contrôle sur les webcams et les microphones.De plus, un logiciel malveillant à télécommande sur mesure est déployé, permettant aux attaquants d'accéder au système infecté à l'aide de l'ID AnyDesk obtenu à partir du serveur de commande et de contrôle.
Le ransomware de Mallox, connu pour cibler les serveurs MS-SQL, a ensuite été installé pour crypter le système.Mallox Ransomware, utilise des algorithmes de cryptage AES-256 et SHA-256, ajoutant une extension ".rmallox" aux fichiers cryptés.
Les modèles d'attaque observés dans cette campagne ressemblent à une ressemblance frappante avec les incidents précédents impliquant le Coinmin Tor2mine et le ransomware Bluesky, suggérant le travail du même groupe de menaces.
## Recommandations
La documentation technique Microsoft SQL Server et les étapes pour sécuriser les serveurs SQL peuvent être trouvées ici:
[Documentation de sécurité pour SQL Server & Azure SQL Base de données - SQL Server |Microsoft Learn] (https://learn.microsoft.com/en-us/sql/relationd-databases/security/security-center-for-sql-server-database-engine-and-azure-sql-database?view=SQL-Server-Ver16)
## Les références
["Les acteurs de la menace attaquant les serveurs MS-SQL pour déployer les ransomwares"] (https://gbhackers.com/ms-sql-deploy-ransomware/) GBHACKERS (consulté en 2024-05-03).
## Snapshot Cybersecurity professionals at GBHackers have discovered a series of cyberattacks targeting poorly managed Microsoft SQL (MS-SQL) servers to install Mallox Ransomware on systems. **Read more about Microsoft\'s coverage for [Mallox Ransomware here.](https://sip.security.microsoft.com/intel-profiles/7fbe39c998c8a495a1652ac6f8bd34852c00f97dc61278cafc56dca1d443131e)** ## Description The threat actor group\'s modus operandi involves exploiting vulnerabilities in improperly managed MS-SQL servers. By employing brute force and dictionary attacks, the attackers gain unauthorized access, primarily targeting the SA (System Administrator) account. Once inside, they deploy the Remcos Remote Access Tool (RAT) to take control of the infected system. Remcos RAT, initially used for system breach and control, has been repurposed by attackers for malicious activities, featuring capabilities such as keylogging, screenshot capture, and control over webcams and microphones. Additionally, a custom-made remote screen control malware is deployed, allowing attackers to gain access to the infected system using the AnyDesk ID obtained from the command and control server. Mallox ransomware, known for targeting MS-SQL servers, was then installed to encrypt the system. Mallox ransomware, utilizes AES-256 and SHA-256 encryption algorithms, appending a ".rmallox" extension to encrypted files. The attack patterns observed in this campaign bear a striking resemblance to |
Ransomware Malware Tool Vulnerability Threat Technical | ★★★ | |
|
2024-05-02 00:18:27 | La collection Artefacte et la thésaurisation pour le bien de l'exclusivité médico-légale… The art of artifact collection and hoarding for the sake of forensic exclusivity… (lien direct) |
Ce message va vous épater & # 8211;Je vais démontrer que le piratage est bon!(Parfois) J'aime défier les processus médico-légaux du jour.Au moins dans ma tête.Aujourd'hui, nous utilisons souvent ce médecin médico-légal & # 8230; Continuer la lecture & # 8594;
This post is going to blow your mind – I am going to demonstrate that the piracy is good! (sometimes) I like to challenge the forensic processes du jour. At least in my head. Today we often use this forensic … Continue reading → |
Technical | ★★★ | |
 |
2024-05-01 23:25:26 | Les logiciels malveillants ciblent les routeurs pour voler les mots de passe des demandes Web Malware Targets Routers To Steal Passwords From Web Requests (lien direct) |
Les chercheurs ont récemment suivi un nouveau malware, "Sweetfish", qui cible les équipements de mise en réseau, en particulier les petits routeurs de bureau / bureau à domicile (SOHO), pour voler le matériel d'authentification trouvé dans les demandes Web qui transitent le routeur de la locale adjacenteréseau régional (LAN). Lumen Technologies & # 8217;Black Lotus Labs, qui a examiné les logiciels malveillants, a déclaré que la seiche crée un tunnel proxy ou VPN via un routeur compromis pour exfiltrer les données en contournant l'analyse basée sur la connexion anormale, puis utilise des informations d'identification volées pour accéder aux ressources ciblées. Le malware a également la capacité d'effectuer un détournement HTTP et DNS pour les connexions aux adresses IP privées, qui sont normalement associées aux communications dans un réseau interne. Les chercheurs déclarent que la plate-forme de logiciels malveillants de secteur offre une approche zéro clique pour capturer les données des utilisateurs et des appareils derrière le bord du réseau ciblé. «Toutes les données envoyées sur les équipements réseau infiltrés par ce malware sont potentiellement exposés.Ce qui rend cette famille de logiciels malveillants si insidie-the-cuttlefish-malware / "data-wpel-link =" external "rel =" nofollow nopenner noreferrer "> avertir dans un article de blog . «La seiche est en attente, reniflant passivement les paquets, n'agissant que lorsqu'il est déclenché par un ensemble de règles prédéfini.Le renifleur de paquets utilisé par la seiche a été conçu pour acquérir du matériel d'authentification, en mettant l'accent sur les services publics basés sur le cloud. » | Malware Threat Cloud Technical | APT 32 | ★★★★ |
|
2024-05-01 19:46:49 | Attaque "Stream Dirty": découvrir et atténuer un modèle de vulnérabilité commun dans les applications Android “Dirty stream” attack: Discovering and mitigating a common vulnerability pattern in Android apps (lien direct) |
## Snapshot Microsoft discovered a path traversal-affiliated vulnerability pattern in multiple popular Android applications that could enable a malicious application to overwrite files in the vulnerable application\'s home directory. The implications of this vulnerability pattern include arbitrary code execution and token theft, depending on an application\'s implementation. Arbitrary code execution can provide a threat actor with full control over an application\'s behavior. Meanwhile, token theft can provide a threat actor with access to the user\'s accounts and sensitive data. We identified several vulnerable applications in the Google Play Store that represented over four billion installations. We anticipate that the vulnerability pattern could be found in other applications. We\'re sharing this research so developers and publishers can check their apps for similar issues, fix as appropriate, and prevent introducing such vulnerabilities into new apps or releases. As threats across all platforms continue to evolve, industry collaboration among security researchers, security vendors, and the broader security community is essential in improving security for all. Microsoft remains committed to working with the security community to share vulnerability discoveries and threat intelligence to protect users across platforms. After discovering this issue, we identified several vulnerable applications. As part of our responsible disclosure policy, we notified application developers through Coordinated Vulnerability Disclosure (CVD) via Microsoft Security Vulnerability Research (MSVR) and worked with them to address the issue. We would like to thank the Xiaomi, Inc. and WPS Office security teams for investigating and fixing the issue. As of February 2024, fixes have been deployed for the aforementioned apps, and users are advised to keep their device and installed applications up to date. Recognizing that more applications could be affected, we acted to increase developer awareness of the issue by collaborating with Google to publish an article on the Android Developers website, providing guidance in a high-visibility location to help developers avoid introducing this vulnerability pattern into their applications. We also wish to thank Google\'s Android Application Security Research team for their partnership in resolving this issue. In this post, we continue to raise developer and user awareness by giving a general overview of the vulnerability pattern, and then focusing on Android share targets, as they are the most prone to these types of attacks. We go through an actual code execution case study where we demonstrate impact that extends beyond the mobile device\'s scope and could even affect a local network. Finally, we provide guidance to users and application developers and illustrate the importance of collaboration to improve security for all. ## Activity Overview ### Data and file sharing on Android The Android operating system enforces isolation by assigning each application its own dedicated data and memory space. To facilitate data and file sharing, Android provides a component called a content provider, which acts as an interface for managing and exposing data to the rest of the installed applications in a secure manner. When used correctly, a content provider provides a reliable solution. However, improper implementation can introduce vulnerabilities that could enable bypassing of read/write restrictions within an application\'s home directory. The Android software development kit (SDK) includes the [FileProvider](https://developer.android.com/reference/androidx/core/content/FileProvider) class, a subclass of ContentProvider that enables file sharing between installed applications. An application that needs to share its files with other applications can declare a FileProvider in its app manifest and declare the specific paths to share. Every file provider has a property called authority, which identifies it system-wide, and can b | Tool Vulnerability Threat Studies Mobile Technical | ★★★ | |
|
2024-04-30 10:00:00 | Acquisition de données volatiles à partir de systèmes linux en direct: partie I Volatile Data Acquisition from Live Linux Systems: Part I (lien direct) |
The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article.
In the domain of digital forensics, volatile data assumes a paramount role, characterized by its ephemeral nature. Analogous to fleeting whispers in a bustling city, volatile data in Linux systems resides transiently within the Random Access Memory (RAM), encapsulating critical system configurations, active network connections, running processes, and traces of user activities. Once a Linux machine powers down, this ephemeral reservoir of information dissipates swiftly, rendering it irretrievable.
Recognizing the significance of timely incident response and the imperative of constructing a detailed timeline of events, this blog embarks on an exhaustive journey, delineating a systematic approach fortified with best practices and indispensable tools tailored for the acquisition of volatile data within the Linux ecosystem.
Conceptually, volatile data serves as a mirror reflecting the real-time operational landscape of a system. It embodies a dynamic tapestry of insights, ranging from system settings and network connectivity to program execution and user interactions. However, the transient nature of this data necessitates proactive measures to capture and analyse it before it evaporates into the digital void.
In pursuit of elucidating this intricate process, we delve into a meticulous exploration, elucidating each facet with precision and clarity. Through a curated synthesis of established methodologies and cutting-edge tools, we equip forensic practitioners with the requisite knowledge and skills to navigate the complexities of volatile data acquisition in live Linux environments.
Join us as we unravel the intricacies of digital forensics, embark on a journey of discovery, and empower ourselves with the tools and techniques necessary to unlock the secrets concealed within live Linux systems.
Before proceeding, it\'s vital to grasp what volatile data encompasses and why it\'s so important in investigations:
System Essentials:
Hostname: Identifies the system ·
Date and Time: Contextualizes events ·
Timezone: Helps correlate activities across regions
Uptime: Reveals system state duration
Network Footprint:
Network Interfaces: Active connections and configurations
Open Ports: Potential entry points and services exposed
Active Connections: Shows live communication channels
Process Ecosystem:
Running Processes: Active programs and their dependencies
Process Memory: May uncover hidden execution or sensitive data
Open Files:
Accessed Files: Sheds light on user actions
Deleted Files: Potential evidence recovery point
Kernel Insights
Loaded Modules: Core extensions and potential rootkits
Kernel Ring Buffers (dmesg): Reveals driver or hardware events
User Traces
Login History: User activity tracking
Command History: Executed commands provide insights
Before diving into the acquisition process, it\'s essential to equip yourself with the necessary tools and commands for gathering volatile data effectively, for purpose of demonstration I will be using Linux Mint:
Hostname, Date, and Time:
hostname: Retrieves the system\'s hostname.
date: Displays the current date and time.
|
Tool Technical | ★★★ | |
|
2024-04-29 20:07:15 | De ransomware icedid à Dagon Locker en 29 jours From IcedID to Dagon Locker Ransomware in 29 Days (lien direct) |
## Instantané
Le rapport DFIR fournit un compte rendu détaillé d'une intrusion sophistiquée qui a commencé avec une campagne de phishing utilisant PromEthEustDS pour distribuer des logiciels malveillants icedid en août 2023.
## Description
Le malware icedid a établi la persistance, communiqué avec les serveurs C2 et a abandonné une balise de frappe de cobalt, qui a été utilisée pour le mouvement latéral, l'exfiltration des données et le déploiement des ransomwares.L'acteur de menace a également utilisé une suite d'outils tels que Rclone, NetScan, NBTScan, Anydesk, Seatt Libt, Sharefinder et Adfinind.L'intrusion a abouti au déploiement de ransomwares Dagon Locker après 29 jours.
Les acteurs de la menace ont utilisé diverses techniques pour obscurcir le fichier JavaScript et le coquille de cobalt grève, échapper à la détection, maintenir la persistance et effectuer des activités d'énumération du réseau.Les activités de l'acteur de menace comprenaient l'abus de fonctionnalités de mouvement latérale telles que le psexec et le protocole de bureau à distance (RDP), l'exfiltration des fichiers, le dumping et l'exfiltration des journaux d'événements de sécurité Windows et l'utilisation des commandes PowerShell exécutées à partir de la grève de Cobaltbalise.
De plus, l'acteur de menace a utilisé plusieurs techniques d'exfiltration, y compris l'utilisation de RClone et AWS CLI pour exfiltrer les données de l'infrastructure compromise.Le déploiement du ransomware Dagon Locker a été facilité par l'utilisation d'un script PowerShell personnalisé, AWScollector et un module Locker, avec une commande PowerShell spécifique exécutée à partir d'un contrôleur de domaine pour déployer le ransomware à différents systèmes.L'impact de cet incident a permis à tous les systèmes d'être affectés par les ransomwares Dagon Locker.
## Les références
[https://thedfirreport.com/2024/04/29/from-iced-to-dagon-locker-ransomware-in-29 days/-IDIDID-to-dagon-locker-ransomware en 29 jours /)
## Snapshot The DFIR report provides a detailed account of a sophisticated intrusion that began with a phishing campaign using PrometheusTDS to distribute IcedID malware in August 2023. ## Description The IcedID malware established persistence, communicated with C2 servers, and dropped a Cobalt Strike beacon, which was used for lateral movement, data exfiltration, and ransomware deployment. The threat actor also utilized a suite of tools such as Rclone, Netscan, Nbtscan, AnyDesk, Seatbelt, Sharefinder, and AdFind. The intrusion culminated in the deployment of Dagon Locker ransomware after 29 days. The threat actors employed various techniques to obfuscate the JavaScript file and the Cobalt Strike shellcode, evade detection, maintain persistence, and perform network enumeration activities. The threat actor\'s activities included the abuse of lateral movement functionalities such as PsExec and Remote Desktop Protocol (RDP), exfiltration of files, dumping and exfiltration of Windows Security event logs, and the use of PowerShell commands executed from the Cobalt Strike beacon. Additionally, the threat actor employed multiple exfiltration techniques, including the use of Rclone and AWS CLI to exfiltrate data from the compromised infrastructure. The deployment of the Dagon Locker ransomware was facilitated through the use of a custom PowerShell script, AWScollector, and a locker module, with a specific PowerShell command run from a domain controller to deploy the ransomware to different systems. The impact of this incident resulted in all systems being affected by the Dagon Locker ransomware. ## References [https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/](https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/) |
Ransomware Malware Tool Threat Technical | ★★★ | |
 |
2024-04-29 13:58:51 | Claroty \\'s Team82 Détails Exploitation de la vulnérabilité de désérialisation classique dans la ligne Siemens Enmpro Claroty\\'s Team82 details exploitation of classic deserialization vulnerability in Siemens EnMPro line (lien direct) |
> Les chercheurs de Team82 de Claroty \\ ont découvert une vulnérabilité de désérialisation, CVE-2022-23450, dans Siemens & # 8217;Produit Simatic Energy Manager (Enmpro).La critique ...
>Researchers from Claroty\'s Team82 discovered a deserialization vulnerability, CVE-2022-23450, in Siemens’ SIMATIC Energy Manager (EnMPro) product. The critical... |
Vulnerability Technical | ★★★★ | |
 |
2024-04-29 10:50:00 | Présentation du mappeur erroné Introducing Misconfig Mapper (lien direct) |
> Au cas où vous l'auriez manqué sur notre chaîne Twitter, nous avons récemment lancé des erreurs de configurations (ou mal-figmapper pour faire court)!Misconfig Mapper est un nouveau projet conçu par l'équipe des pirates d'Intigriti pour vous aider à trouver des erreurs de sécurité dans les services populaires utilisés dans vos objectifs de tests de prime / pénétration de bogue (tels que Atlassian, Jenkins, etc.). De plus, il peut vous aider à trouver [& # 8230;]
>In case you missed it on our Twitter channel, we’ve recently launched Misconfigurations Mapper (or MisconfigMapper for short)! Misconfig Mapper is a new project designed by Intigriti Hackers Team to help you find security misconfigurations in popular services used at your bug bounty/penetration testing targets (such as Atlassian, Jenkins, etc.).Additionally it can help you find […] |
Technical | ★★★★ | |
|
2024-04-26 23:40:21 | Une licence (métadonnées) à tuer (pour)… A license (metadata) to kill (for)… (lien direct) |
De nombreux artefacts médico-légaux peuvent être examinés sous de nombreux angles différents.Il y a quelques années, j'ai proposé un concept de volant qui a tenté de résoudre un problème de recherche de fichiers inhabituels, orphelins et potentiellement malveillants déposés dans des répertoires qui contiennent & # 8230; continuer à lire &# 8594;
Many forensic artifacts can be looked at from many different angles. A few years ago I proposed a concept of filighting that tried to solve a problem of finding unusual, orphaned and potentially malicious files dropped inside directories that contain … Continue reading → |
Technical | ★★★★ | |
 |
2024-04-25 10:03:58 | Ransomware "pistolet indésirable": la nouvelle menace bon marché pour les petites entreprises "Junk gun" ransomware: the cheap new threat to small businesses (lien direct) |
Que se passe-t-il?Une vague de ransomwares bon marché, brut et amateur a été repérée sur la toile sombre - et bien qu'elle ne fasse pas autant de gros titres que Lockbit, Rhysida et BlackSuit, il présente toujours une menace sérieuse pour les organisations.Qu'est-ce que le ransomware "pistolet indésirable" de \\?C'est un nom inventé par des chercheurs de Sophos pour des ransomwares non sophistiqués qui sont souvent vendus à moindre coût comme achat unique.Le ransomware "pistolet indésirable" fait appel à un criminel qui veut fonctionner de manière indépendante mais manque de compétences techniques.Peux-tu donner quelques exemples?Bien sûr.Le ransomware de Kryptina a été mis à disposition à la vente en décembre ...
What\'s going on? A wave of cheap, crude, amateurish ransomware has been spotted on the dark web - and although it may not make as many headlines as LockBit , Rhysida , and BlackSuit , it still presents a serious threat to organizations. What\'s "junk gun" ransomware? It\'s a name coined by Sophos researchers for unsophisticated ransomware that is often sold cheaply as a one-time purchase. "Junk gun" ransomware is appealing to a criminal who wants to operate independently but lacks technical skills. Can you give some examples? Sure. The Kryptina ransomware was made available for sale in December... |
Ransomware Threat Technical | ★★ | |
 |
2024-04-23 07:00:00 | Flyde – Comme scratch mais pour les vrais dev (lien direct) | Flyde, un nouvel outil de programmation visuelle pour les développeurs, permet de faciliter la collaboration, la documentation et le débogage du code en s'intégrant parfaitement à la base de code existante. Cet outil offre de nombreux avantages pour différents profils. | Technical | ★★★★ | |
|
2024-04-19 16:08:26 | Mateusz Jurczyk – L\'expert en sécurité qui a exploré la base de registre Windows pour y trouver des failles (lien direct) | Mateusz Jurczyk, chercheur en sécurité de Google Project Zero, a passé près de 2 ans à auditer en profondeur la base de registre Windows. Il a découvert de nombreuses vulnérabilités pouvant mener à des élévations de privilèges. Son travail met en lumière la complexité de cette partie ancienne mais cruciale de Windows. | Tool Threat Technical | ★★★ | |
 |
2024-04-19 03:20:00 | Evil XDR: Le chercheur transforme le logiciel Palo Alto en logiciel malveillant parfait Evil XDR: Researcher Turns Palo Alto Software Into Perfect Malware (lien direct) |
Il s'avère qu'une solution de sécurité puissante peut doubler en tant que logiciels malveillants encore plus puissants, capable d'accorder un accès complet sur une machine ciblée.
It turns out that a powerful security solution can double as even more powerful malware, capable of granting comprehensive access over a targeted machine. |
Malware Technical | ★★★★ | |
|
2024-04-18 16:01:00 | Nouveau Android Trojan \\ 'Soumnibot \\' Évite la détection avec des astuces intelligentes New Android Trojan \\'SoumniBot\\' Evades Detection with Clever Tricks (lien direct) |
Un nouveau chevalier Android appelé & nbsp; soumnibot & nbsp; a été détecté dans les utilisateurs de ciblage sauvage en Corée du Sud en tirant parti des faiblesses dans la procédure d'extraction et d'analyse manifeste.
Le malware est "notable pour une approche non conventionnelle pour échapper à l'analyse et à la détection, à savoir l'obscurcissement du manifeste Android", le chercheur de Kaspersky Dmitry Kalinin & nbsp; dit & nbsp; dans une analyse technique.
A new Android trojan called SoumniBot has been detected in the wild targeting users in South Korea by leveraging weaknesses in the manifest extraction and parsing procedure. The malware is "notable for an unconventional approach to evading analysis and detection, namely obfuscation of the Android manifest," Kaspersky researcher Dmitry Kalinin said in a technical analysis. |
Malware Mobile Technical | ★★ | |
 |
2024-04-18 09:46:51 | The Windows Registry Adventure # 2: Une brève histoire de la fonctionnalité The Windows Registry Adventure #2: A brief history of the feature (lien direct) |
Posted by Mateusz Jurczyk, Google Project Zero Before diving into the low-level security aspects of the registry, it is important to understand its role in the operating system and a bit of history behind it. In essence, the registry is a hierarchical database made of named "keys" and "values", used by Windows and applications to store a variety of settings and configuration data. It is represented by a tree structure, in which keys may have one or more sub-keys, and every subkey is associated with exactly one parent key. Furthermore, every key may also contain one or more values, which have a type (integer, string, binary blob etc.) and are used to store actual data in the registry. Every key can be uniquely identified by its name and the names of all of its ascendants separated by the special backslash character (\'\\'), and starting with the name of one of the top-level keys (HKEY_LOCAL_MACHINE, HKEY_USERS, etc.). For example, a full registry path may look like this: HKEY_CURRENT_USER\Software\Microsoft\Windows. At a high level, this closely resembles the structure of a file system, where the top-level key is equivalent to the root of a mounted disk partition (e.g. C:\), keys are equivalent to directories, and values are equivalent to files. One important distinction, however, is that keys are the only type of securable objects in the registry, and values play a much lesser role in the database than files do in the file system. Furthermore, specific subtrees of the registry are stored on disk in binary files called registry hives, and the hive mount points don\'t necessarily correspond one-to-one to the top-level keys (e.g. the C:\Windows\system32\config\SOFTWARE hive is mounted under HKEY_LOCAL_MACHINE\Software, a one-level nested key). Fundamentally, there are only a few basic operations that can be performed in the registry. These operations are summarized in the table below: Hives Load hive Unload hive Flush hive to disk Keys Open key Create key Delete key | Tool Prediction Technical | ★★★★ | |
 |
2024-04-17 18:00:31 | Réduire le désabonnement d'incitation avec une composition de modèle explosive Reducing Prompting Churn with Exploding Template Composition (lien direct) |
Engineering Insights is an ongoing blog series that gives a behind-the-scenes look into the technical challenges, lessons and advances that help our customers protect people and defend data every day. Each post is a firsthand account by one of our engineers about the process that led up to a Proofpoint innovation. In the nascent world of large language models (LLMs), prompt engineering has emerged as a critical discipline. However, as LLM applications expand, it is becoming a more complex challenge to manage and maintain a library of related prompts. At Proofpoint, we developed Exploding Prompts to manage the complexity through exploding template composition. We first created the prompts to generate soft labels for our data across a multitude of models and labeling concerns. But Exploding Prompts has also enabled use cases for LLMs that were previously locked away because managing the prompt lifecycle is so complex. Recently, we\'ve seen exciting progress in the field of automated prompt generation and black-box prompt optimization through DSPy. Black-box optimization requires hand-labeled data to generate prompts automatically-a luxury that\'s not always an option. You can use Exploding Prompts to generate labels for unlabeled data, as well as for any prompt-tuning application without a clear (or tractable) objective for optimization. In the future, Exploding Prompts could be used with DSPy to achieve a human-in-the-loop feedback cycle. We are also thrilled to announce that Exploding Prompts is now an open-source release. We encourage you to explore the code and consider how you might help make it even better. The challenge: managing complexity in prompt engineering Prompt engineering is not just about crafting queries that guide intelligent systems to generate the desired outputs; it\'s about doing it at scale. As developers push the boundaries of what is possible with LLMs, the need to manage a vast array of prompts efficiently becomes more pressing. Traditional methods often need manual adjustments and updates across numerous templates, which is a process that\'s both time-consuming and error-prone. To understand this problem, just consider the following scenario. You need to label a large quantity of data. You have multiple labels that can apply to each piece of data. And each label requires its own prompt template. You timebox your work and find a prompt template that achieves desirable results for your first label. Happily, most of the template is reusable. So, for the next label, you copy-paste the template and change the portion of the prompt that is specific to the label itself. You continue doing this until you figure out the section of the template that has persisted through each version of your labels can be improved. Now you now face the task of iterating through potentially dozens of templates to make a minor update to each of the files. Once you finish, your artificial intelligence (AI) provider releases a new model that outperforms your current model. But there\'s a catch. The new model requires another small update to each of your templates. To your chagrin, the task of managing the lifecycle of your templates soon takes up most of your time. The solution: exploding prompts from automated dependency graphs Prompt templating is a popular way to manage complexity. Exploding Prompts builds on prompt templating by introducing an “explode” operation. This allows a few single-purpose templates to explode into a multitude of prompts. This is accomplished by building dependency graphs automatically from the directory structure and the content of prompt template files. At its core, Exploding Prompts embodies the “write it once” philosophy. It ensures that every change made in a template correlates with a single update in one file. This enhances efficiency and consistency, as updates automatically propagate across all relevant generated prompts. This separation ensures that updates can be made with speed and efficiency so you can focus on innovation rather th | Malware Tool Threat Studies Cloud Technical | ★★★ | |
|
2024-04-17 12:52:50 | Hexagon et Dragos annoncent une alliance technique pour stimuler la cybersécurité industrielle, réduire le cyber-risque global Hexagon and Dragos announce technical alliance to boost industrial cybersecurity, reduce overall OT cyber risk (lien direct) |
dragos et hexagon ont uni leurs forces pour fournir aux organisations industrielles une visibilité et un contexte complet de l'ICS / OT ...
Dragos and Hexagon have joined forces to provide industrial organizations with the comprehensive visibility and context of ICS/OT... |
Industrial Technical | ★★ | |
|
2024-04-16 10:00:00 | Facteur humain de la cybersécurité: fusion de la technologie avec des stratégies centrées sur les personnes Cybersecurity\\'s Human Factor: Merging Tech with People-Centric Strategies (lien direct) |
The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. In a digital era marked by rapidly evolving threats, the complexity of cybersecurity challenges has surged, pressing organizations to evolve beyond traditional, tech-only defense strategies. As the cyber landscape grows more intricate, there\'s a pivotal shift towards embracing methods that are not just robust from a technical standpoint but are also deeply human-centric. This also means that a significant percentage of employees, driven by the high demands of operational pressures, may engage in risky cybersecurity behaviors. Such statistics illuminate the urgent need for a more nuanced approach to cybersecurity—one that not only fortifies defenses but also resonates with and supports the people behind the screens. Integrating human-centric design with continuous threat management emerges as a forward-thinking strategy, promising a balanced blend of technical excellence and user empathy to navigate the complex cybersecurity challenges of today and tomorrow. Embracing the Human Element in Cybersecurity Diving into the realm of human-centric security design and culture, it\'s clear that the future of cybersecurity isn\'t just about the latest technology—it\'s equally about the human touch. This approach puts the spotlight firmly on enhancing the employee experience, ensuring that cybersecurity measures don\'t become an unbearable burden that drives people to take shortcuts. By designing systems that people can use easily and effectively, the friction often caused by stringent security protocols can be significantly reduced. Gartner\'s insights throw a compelling light on this shift, predicting that by 2027, half of all Chief Information Security Officers (CISOs) will have formally embraced human-centric security practices. This isn\'t just a hopeful guess but a recognition of the tangible benefits these practices bring to the table—reducing operational friction and bolstering the adoption of essential controls. This strategic pivot also acknowledges a fundamental truth. When security becomes a seamless part of the workflow, its effectiveness skyrockets. It\'s a win-win, improving both the user experience and the overall security posture. CTEM: Your Cybersecurity Compass in Stormy Seas Imagine that your organization\'s cybersecurity landscape isn\'t just a static battleground. Instead, it’s more like the open sea, with waves of threats coming and going, each with the potential to breach your defenses. That\'s where Continuous Threat Exposure Management (CTEM) sails in, serving as your trusted compass, guiding you through these treacherous waters. CTEM isn\'t your average, run-of-the-mill security tactic. It\'s about being proactive, scanning the horizon with a spyglass, looking for potential vulnerabilities before they even become a blip on a hacker\'s radar. Think of it as your cybersecurity early-warning system, constantly on the lookout for trou | Vulnerability Threat Studies Prediction Medical Technical | ★★ | |
|
2024-04-11 06:23:43 | FAQS de l'état de l'État 2024 du rapport Phish, partie 1: Le paysage des menaces FAQs from the 2024 State of the Phish Report, Part 1: The Threat Landscape (lien direct) |
In this two-part blog series, we will address many of the frequently asked questions submitted by attendees. In our first installment, we address questions related to the threat landscape. Understanding the threat landscape is paramount in crafting a human-centric security strategy. That\'s the goal behind our 10th annual State of the Phish report. When you know what threats are out there and how people are interacting with them, you can create a modern cybersecurity strategy that puts the complexity of human behavior and interaction at the forefront. Our report was launched a month ago. Since then, we\'ve followed up with a few webinars to discuss key findings from the report, including: Threat landscape findings: Over 1 million phishing threats involved EvilProxy, which bypasses multifactor authentication (MFA). Yet, 89% of security pros still believe that MFA provides complete protection against account takeover. BEC threat actors benefit from generative AI. Proofpoint detected and stopped over 66 million targeted business email compromise (BEC) attacks per month on average in 2023. User behavior and attitude findings: 71% of surveyed users took at least one risky action, and 96% of them knew that those actions were associated with risk. 58% of those risky actions were related to social engineering tactics. 85% of security pros believed that most employees know they are responsible for security. Yet nearly 60% of employees either weren\'t sure or disagreed. These findings inspired hundreds of questions from audiences across the world. What follows are some of the questions that repeatedly came up. Frequently asked questions What are the definitions of BEC and TOAD? Business email compromise (BEC) essentially means fraud perpetrated through email. It can take many forms, such as advance fee fraud, payroll redirection, fraudulent invoicing or even extortion. BEC typically involves a deception, such as the spoofing of a trusted third party\'s domain or the impersonation of an executive (or literally anyone the recipient trusts). BEC is hard to detect because it is generally pure social engineering. In other words, there is often no credential harvesting portal or malicious payload involved. Threat actors most often use benign conversation to engage the victim. Once the victim is hooked, attackers then convince that person to act in favor of them, such as wiring money to a specified account. Similarly, telephone-oriented attack delivery (TOAD) attacks also use benign conversations. But, in this case, a threat actor\'s goal is to motivate the victim to make a phone call. From there, they will walk their target through a set of steps, which usually involve tricking the victim into giving up their credentials or installing a piece of malware on their computer. TOAD attacks have been associated with high-profile malware families known to lead to ransomware, as well as with a wide variety of remote access tools like AnyDesk that provide the threat actors direct access to victims\' machines. The end goal might still be fraud; for example, there have been cases where payment was solicited for “IT services” or software (Norton LifeLock). But the key differentiator for TOAD, compared with BEC, is the pivot out of the email space to a phone call., is the pivot out of the email space to the phone. What is the difference between TOAD and vishing? TOAD often starts with an email and requires victims to call the fraudulent number within that email. Vishing, on the other hand, generally refers to fraudulent solicitation of personally identifiable information (PII) and may or may not involve email (it could result from a direct call). Some TOAD attempts may fall into this category, but most perpetrators focus on getting software installed on a victim\'s machine. How do you see artificial intelligence (AI) affecting phishing? What are security best practices to help defend against these novel phishing attacks? AI allows threat actors to tighten up grammatical and s | Ransomware Malware Tool Threat Cloud Technical | ★★★ | |
|
2024-04-10 02:58:51 | Vie en cybersécurité: des soins infirmiers à menace analyste Life in Cybersecurity: From Nursing to Threat Analyst (lien direct) |
À mesure que les menaces numériques augmentent, nous voyons plus de professionnels passer à la cybersécurité.Certains proviennent de rôles techniques précédents, et d'autres non.Cependant, parce que la cybersécurité est principalement une industrie de résolution de problèmes, ceux qui passent des autres postes à haute pression et hautes performances sont souvent mieux préparés pour le travail.Prenez Gina D \\ 'Addamio, par exemple, une ancienne infirmière devenue analyste des menaces.J'ai parlé avec Gina de sa transition de carrière.Ses réponses montrent comment elle a exploité son expérience précédente pour réussir dans un nouveau rôle passionnant dans l'espace de cybersécurité.Découvrez notre conversation ci-dessous ...
As digital threats increase, we see more professionals transition into cybersecurity. Some come from previous technical roles, and some do not. However, because cybersecurity is primarily a problem-solving industry, those who switch from other high-pressure, high-performance positions are often best prepared for the job. Take Gina D\'Addamio , for example, a former nurse turned threat analyst. I spoke with Gina about her career transition. Her responses show how she leveraged her previous experience to succeed in an exciting new role in the cybersecurity space. Check out our conversation below... |
Threat Technical | ★★ | |
|
2024-04-08 19:21:00 | Google Chrome ajoute V8 Sandbox - une nouvelle défense contre les attaques de navigateur Google Chrome Adds V8 Sandbox - A New Defense Against Browser Attacks (lien direct) |
Google a annoncé la prise en charge de ce qui est appelé A & NBSP; V8 Sandbox & NBSP; dans le navigateur Web Chrome dans le but de résoudre les problèmes de corruption de la mémoire.
Le bac à sable, selon le lead technique de la sécurité V8 Samuel Gro & szlig;, & nbsp; AIMS & NBSP; pour empêcher la "corruption de la mémoire dans le V8 de se propager dans le processus de l'hôte".
Le géant de recherche a & nbsp; décrit & nbsp; v8 sandbox comme un bac à sable léger et en cours
Google has announced support for what\'s called a V8 Sandbox in the Chrome web browser in an effort to address memory corruption issues. The sandbox, according to V8 Security technical lead Samuel Groß, aims to prevent "memory corruption in V8 from spreading within the host process." The search behemoth has described V8 Sandbox as a lightweight, in-process sandbox |
Technical | ★★ | |
|
2024-04-05 13:39:39 | Même cibles, nouveaux manuels: les acteurs de la menace en Asie de l'Est utilisent des méthodes uniques Same targets, new playbooks: East Asia threat actors employ unique methods (lien direct) |
## Snapshot Microsoft has observed several notable cyber and influence trends from China and North Korea since June 2023 that demonstrate not only doubling down on familiar targets, but also attempts to use more sophisticated influence techniques to achieve their goals. Chinese cyber actors broadly selected three target areas over the last seven months. - One set of Chinese actors extensively targeted entities across the South Pacific Islands. - A second set of Chinese activity continued a streak of cyberattacks against regional adversaries in the South China Sea region. - Meanwhile, a third set of Chinese actors compromised the US defense industrial base. Chinese influence actors-rather than broadening the geographic scope of their targets-honed their techniques and experimented with new media. Chinese influence campaigns continued to refine AI-generated or AI-enhanced content. The influence actors behind these campaigns have shown a willingness to **both amplify AI-generated media that benefits their strategic narratives, as well as create their own video, memes, and audio content**. Such tactics have been used in campaigns stoking divisions within the United States and exacerbating rifts in the Asia-Pacific region-including Taiwan, Japan, and South Korea. These campaigns achieved varying levels of resonance with no singular formula producing consistent audience engagement. North Korean cyber actors made headlines for **increasing software supply chain attacks and cryptocurrency heists over the past year**. While strategic spear-phishing campaigns targeting researchers who study the Korean Peninsula remained a constant trend, North Korean threat actors appeared to make greater use of legitimate software to compromise even more victims. ## Activity Overview ### Chinese cyber operations target strategic partners and competitors #### Gingham Typhoon targets government, IT, and multinational entities across the South Pacific Islands **** *Figure 1: Observed events from Gingham Typhoon from June 2023 to January 2024 highlights their continued focus on South Pacific Island nations. However, much of this targeting has been ongoing, reflecting a yearslong focus on the region. Geographic locations and diameter of symbology are representational. * During the summer of 2023, Microsoft Threat Intelligence observed extensive activity from China-based espionage group Gingham Typhoon that targeted nearly every South Pacific Island country. Gingham Typhoon is the most active actor in this region, hitting international organizations, government entities, and the IT sector with complex phishing campaigns. Victims also included vocal critics of the Chinese government. Diplomatic allies of China who were victims of recent Gingham Typhoon activity include executive offices in government, trade-related departments, internet service providers, as well as a transportation entity. Heightened geopolitical and diplomatic competition in the region may be motivations for these offensive cyber activities. China pursues strategic partnerships with South Pacific Island nations to expand economic ties and broker diplomatic and security agreements. Chinese cyber espionage in this region also follows economic partners. For example, Chinese actors engaged in large-scale targeting of multinational organizations in Papua New Guinea, a longtime diplomatic partner that is benefiting from multiple Belt and Road Initiative (BRI) projects including the construction of a major highway which links a Papua New Guinea government building to the capital city\'s main road. (1) #### Chinese threat actors retain focus on South China Sea amid Western military exercises China-based threat actors continued to target entities related to China\'s economic and military interests in a | Malware Tool Vulnerability Threat Studies Industrial Prediction Technical | Guam | ★★★ |
|
2024-04-05 13:18:00 | Nouvelle vague de logiciels malveillants jsoutprox ciblant les sociétés financières en APAC et MENA New Wave of JSOutProx Malware Targeting Financial Firms in APAC and MENA (lien direct) |
Les organisations financières de l'Asie-Pacifique (APAC) et du Moyen-Orient et de l'Afrique du Nord (MENA) sont ciblées par une nouvelle version d'une "menace évolutive" appelée & nbsp; jsoutprox.
"JSOutProx est un cadre d'attaque sophistiqué utilisant à la fois JavaScript et .NET", Resesecurity & NBSP; Said & NBSP; dans un rapport technique publié cette semaine.
"Il utilise la fonction de sérialisation .net (DE) pour interagir avec un noyau
Financial organizations in the Asia-Pacific (APAC) and Middle East and North Africa (MENA) are being targeted by a new version of an "evolving threat" called JSOutProx. "JSOutProx is a sophisticated attack framework utilizing both JavaScript and .NET," Resecurity said in a technical report published this week. "It employs the .NET (de)serialization feature to interact with a core |
Malware Technical | ★★ | |
|
2024-03-28 19:11:03 | Android Malware Vultur étend son envergure Android Malware Vultur Expands Its Wingspan (lien direct) |
#### Description
The authors behind Android banking malware Vultur have been spotted adding new technical features, which allow the malware operator to further remotely interact with the victim\'s mobile device. Vultur has also started masquerading more of its malicious activity by encrypting its C2 communication, using multiple encrypted payloads that are decrypted on the fly, and using the guise of legitimate applications to carry out its malicious actions.
#### Reference URL(s)
1. https://research.nccgroup.com/2024/03/28/android-malware-vultur-expands-its-wingspan/
#### Publication Date
March 28, 2024
#### Author(s)
Joshua Kamp
#### Description The authors behind Android banking malware Vultur have been spotted adding new technical features, which allow the malware operator to further remotely interact with the victim\'s mobile device. Vultur has also started masquerading more of its malicious activity by encrypting its C2 communication, using multiple encrypted payloads that are decrypted on the fly, and using the guise of legitimate applications to carry out its malicious actions. #### Reference URL(s) 1. https://research.nccgroup.com/2024/03/28/android-malware-vultur-expands-its-wingspan/ #### Publication Date March 28, 2024 #### Author(s) Joshua Kamp |
Malware Mobile Technical | ★★★ | |
 |
2024-03-28 18:16:18 | Adressez désinfectant pour le firmware à métal nu Address Sanitizer for Bare-metal Firmware (lien direct) |
Posted by Eugene Rodionov and Ivan Lozano, Android Team With steady improvements to Android userspace and kernel security, we have noticed an increasing interest from security researchers directed towards lower level firmware. This area has traditionally received less scrutiny, but is critical to device security. We have previously discussed how we have been prioritizing firmware security, and how to apply mitigations in a firmware environment to mitigate unknown vulnerabilities. In this post we will show how the Kernel Address Sanitizer (KASan) can be used to proactively discover vulnerabilities earlier in the development lifecycle. Despite the narrow application implied by its name, KASan is applicable to a wide-range of firmware targets. Using KASan enabled builds during testing and/or fuzzing can help catch memory corruption vulnerabilities and stability issues before they land on user devices. We\'ve already used KASan in some firmware targets to proactively find and fix 40+ memory safety bugs and vulnerabilities, including some of critical severity. Along with this blog post we are releasing a small project which demonstrates an implementation of KASan for bare-metal targets leveraging the QEMU system emulator. Readers can refer to this implementation for technical details while following the blog post. Address Sanitizer (ASan) overview Address sanitizer is a compiler-based instrumentation tool used to identify invalid memory access operations during runtime. It is capable of detecting the following classes of temporal and spatial memory safety bugs: out-of-bounds memory access use-after-free double/invalid free use-after-return ASan relies on the compiler to instrument code with dynamic checks for virtual addresses used in load/store operations. A separate runtime library defines the instrumentation hooks for the heap memory and error reporting. For most user-space targets (such as aarch64-linux-android) ASan can be enabled as simply as using the -fsanitize=address compiler option for Clang due to existing support of this target both in the toolchain and in the libclang_rt runtime. However, the situation is rather different for bare-metal code which is frequently built with the none system targets, such as arm-none-eabi. Unlike traditional user-space programs, bare-metal code running inside an embedded system often doesn\'t have a common runtime implementation. As such, LLVM can\'t provide a default runtime for these environments. To provide custom implementations for the necessary runtime routines, the Clang toolchain exposes an interface for address sanitization through the -fsanitize=kernel-address compiler option. The KASan runtime routines implemented in the Linux kernel serve as a great example of how to define a KASan runtime for targets which aren\'t supported by default with -fsanitize=address. We\'ll demonstrate how to use the version of address sanitizer originally built for the kernel on other bare-metal targets. KASan 101 Let\'s take a look at the KASan major building blocks from a high-level perspective (a thorough explanation of how ASan works under-the-hood is provided in this whitepaper). The main idea behind KASan is that every memory access operation, such as load/store instructions and memory copy functions (for example, memm | Tool Vulnerability Mobile Technical | ★★ | |
 |
2024-03-28 14:41:47 | EDR vs XDR: les principales différences EDR vs XDR: The Key Differences (lien direct) |
> Et le nouveau XDR vaut-il le prix?& # 8211;Aimei Wei, directeur technique, stellaire Cyber San Jose, Californie & # 8211;27 mars 2024 Alors que la détection et la réponse des points finaux (EDR) et la détection et la réponse prolongées (XDR) représentent toutes deux des outils cruciaux dans l'arsenal de cybersécurité d'aujourd'hui, il peut
>And is the newer XDR worth the price? – Aimei Wei, Chief Technical Officer, Stellar Cyber San Jose, Calif. – Mar. 27, 2024 While Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) both represent crucial tools in today\'s cybersecurity arsenal, it can |
Tool Technical | ★★★ | |
|
2024-03-28 14:29:57 | Approche de Google Public DNS \\ pour lutter contre les attaques d'empoisonnement au cache Google Public DNS\\'s approach to fight against cache poisoning attacks (lien direct) |
Tianhao Chi and Puneet Sood, Google Public DNSThe Domain Name System (DNS) is a fundamental protocol used on the Internet to translate human-readable domain names (e.g., www.example.com) into numeric IP addresses (e.g., 192.0.2.1) so that devices and servers can find and communicate with each other. When a user enters a domain name in their browser, the DNS resolver (e.g. Google Public DNS) locates the authoritative DNS nameservers for the requested name, and queries one or more of them to obtain the IP address(es) to return to the browser.When DNS was launched in the early 1980s as a trusted, content-neutral infrastructure, security was not yet a pressing concern, however, as the Internet grew DNS became vulnerable to various attacks. In this post, we will look at DNS cache poisoning attacks and how Google Public DNS addresses the risks associated with them.DNS Cache Poisoning AttacksDNS lookups in most applications are forwarded to a caching resolver (which could be local or an open resolver like. Google Public DNS). The path from a client to the resolver is usually on a local network or can be protected using encrypted transports like DoH, DoT. The resolver queries authoritative DNS servers to obtain answers for user queries. This communication primarily occurs over UDP, an insecure connectionless protocol, in which messages can be easily spoofed including the source IP address. The content of DNS queries may be sufficiently predictable that even an off-path attacker can, with enough effort, forge responses that appear to be from the queried authoritative server. This response will be cached if it matches the necessary fields and arrives before the authentic response. This type of attack is called a cache poisoning attack, which can cause great harm once successful. According to RFC 5452, the probability of success is very high without protection. Forged DNS responses can lead to denial of service, or may even compromise application security. For an excellent introduction to cache poisoning attacks, please see “ | Technical | ★★ | |
 |
2024-03-27 08:00:00 | L'impact de la dette technique sur la vitesse de développement et la qualité du code Technical debt\\'s impact on development speed and code quality (lien direct) |
En reconnaissant l'impact de la dette technique et en adoptant des solutions proactives comme le sonar, les équipes de développement peuvent atténuer ses effets et créer des logiciels résilients, fiables et évolutifs.
By acknowledging the impact of technical debt and embracing proactive solutions like Sonar, development teams can mitigate its effects and build software that is resilient, reliable, and scalable. |
Technical | ★★★ | |
|
2024-03-26 17:11:47 | Campagne à grande échelle de Strelaslateal au début de 2024 Large-Scale StrelaStealer Campaign in Early 2024 (lien direct) |
#### Description
Strelastealer est un logiciel malveillant qui cible les clients de messagerie pour voler des données de connexion, en l'envoyant au serveur de l'attaquant \\ pour des attaques potentielles supplémentaires.Depuis l'émergence de Strelaslealer \\ en 2022, l'acteur de menace a lancé plusieurs campagnes de messagerie à grande échelle, ses dernières campagnes ayant un impact sur 100 organisations à travers l'UE et les attaquants américains ont ciblé des organisations dans une variété d'industries, mais des organisations dans laL'industrie de la haute technologie a été la plus grande cible.L'analyse technique de Strelaslaster révèle une chaîne d'infection en évolution utilisant des pièces jointes ZIP, des fichiers JScript et des charges utiles de DLL mises à jour, démontrant l'adaptabilité du malware \\ et le défi qu'il pose aux analystes et produits de sécurité.
#### URL de référence (s)
1. https: // Unit42.paloaltonetworks.com/strelastealer-campage/
#### Date de publication
22 mars 2024
#### Auteurs)
Benjamin Chang, Goutam Tripathy, Pranay Kumar Chhapurwal, Anmol Maurya et Vishwa Thothathri
#### Description StrelaStealer is a malware that targets email clients to steal login data, sending it to the attacker\'s server for potential further attacks. Since StrelaStealer\'s emergence in 2022, the threat actor has launched multiple large-scale email campaigns, with its most recent campaigns impacting over 100 organizations across the EU and U.S. Attackers have targeted organizations in a variety of industries, but organizations in the high tech industry have been the biggest target. Technical analysis of StrelaStealer reveals an evolving infection chain using ZIP attachments, JScript files, and updated DLL payloads, demonstrating the malware\'s adaptability and the challenge it poses to security analysts and products. #### Reference URL(s) 1. https://unit42.paloaltonetworks.com/strelastealer-campaign/ #### Publication Date March 22, 2024 #### Author(s) Benjamin Chang, Goutam Tripathy, Pranay Kumar Chhaparwal, Anmol Maurya, and Vishwa Thothathri |
Malware Threat Technical | ★★ | |
|
2024-03-26 03:49:14 | Sécurité du navigateur en 2024: technologies et tendances Browser Security in 2024: Technologies and Trends (lien direct) |
Qu'est-ce que la sécurité du navigateur?La sécurité du navigateur est un ensemble de mesures et de processus destinés à protéger les utilisateurs et leurs données lors de l'utilisation de navigateurs Web.Cela comprend des mécanismes pour prévenir l'accès non autorisé, sauvegarder contre les logiciels malveillants et autres menaces de sécurité du navigateur, et les moyens de protéger la vie privée des activités en ligne.Les composants essentiels de la sécurité du navigateur comprennent des protocoles de communication sécurisés comme HTTPS, qui chiffre les données en transit;fonctionnalités du navigateur qui détectent et bloquent les sites Web malveillants, les tentatives de phishing et les logiciels malveillants;et des mesures techniques pour isoler le ...
What Is Browser Security? Browser security is a set of measures and processes intended to protect users and their data when using web browsers. This includes mechanisms to prevent unauthorized access, safeguard against malicious software and other browser security threats , and ways to protect the privacy of online activities. Essential components of browser security include secure communication protocols like HTTPS, which encrypts data in transit; features within the browser that detect and block malicious websites, phishing attempts, and malware; and technical measures for isolating the... |
Malware Technical | ★★ | |
|
2024-03-25 17:07:00 | Leçon clé du piratage de pulvérisation de mot de passe de Microsoft \\: sécuriser chaque compte Key Lesson from Microsoft\\'s Password Spray Hack: Secure Every Account (lien direct) |
En janvier 2024, Microsoft a découvert qu'ils étaient les & nbsp; victime d'un hack & nbsp; orchestré par des pirates de blizzard de Midnight à l'état russe (parfois connu sous le nom de Nobelium).Le détail préoccupant de cette affaire est la facilité avec laquelle il était facile de violer le géant du logiciel.Ce n'était pas un hack hautement technique qui a exploité une vulnérabilité zéro-jour & # 8211;Les pirates ont utilisé une simple attaque par pulvérisation de mot de passe pour prendre le contrôle de
In January 2024, Microsoft discovered they\'d been the victim of a hack orchestrated by Russian-state hackers Midnight Blizzard (sometimes known as Nobelium). The concerning detail about this case is how easy it was to breach the software giant. It wasn\'t a highly technical hack that exploited a zero-day vulnerability – the hackers used a simple password spray attack to take control of |
Hack Vulnerability Threat Technical | ★★ | |
 |
2024-03-25 11:04:34 | Licence d'ingénieurs d'IA Licensing AI Engineers (lien direct) |
Le débat sur les ingénieurs logiciels de professionnalisation a des décennies.(L'idée de base est que, comme les avocats et les architectes, il devrait y avoir une exigence de licence professionnelle pour les ingénieurs logiciels.) Ici & # 8217; s Article du journal de droit Recommander la même idée pour les ingénieurs de l'IA.
Cet article propose une autre manière: professionnalisation de l'ingénierie AI.Obliger les ingénieurs d'IA pour obtenir des licences pour construire des produits d'IA commerciaux, les pousser à collaborer sur des normes techniques spécifiques au domaine en faveur scientifique et en appuyant sur le domaine et en facilitant les services de police eux-mêmes.Cette proposition de cette article traite des préjudices de l'IA à leur création, influençant les décisions même d'ingénierie qui leur donnent naissance en premier lieu.En arrachant le contrôle des informations et de la conception du système aux entreprises et en les remettant aux ingénieurs de l'IA, la professionnalisation enget une IA digne de confiance par conception.Au-delà de la recommandation de la solution politique spécifique de la professionnalisation, cet article vise à éloigner le discours sur l'IA de l'accent mis sur les solutions légères et les solutions ex post qui traitent des produits déjà créés à un accent sur les contrôles ex ante qui précèdent le développement de l'IA.Nous avons déjà utilisé ce livre de jeu dans les domaines nécessitant un niveau d'expertise élevé où une obligation pour le bien-être public doit l'emporter sur les motivations commerciales.Et si, comme les médecins, les ingénieurs de l'IA ont également promis de ne pas faire de mal? ...
The debate over professionalizing software engineers is decades old. (The basic idea is that, like lawyers and architects, there should be some professional licensing requirement for software engineers.) Here’s a law journal article recommending the same idea for AI engineers. This Article proposes another way: professionalizing AI engineering. Require AI engineers to obtain licenses to build commercial AI products, push them to collaborate on scientifically-supported, domain-specific technical standards, and charge them with policing themselves. This Article’s proposal addresses AI harms at their inception, influencing the very engineering decisions that give rise to them in the first place. By wresting control over information and system design away from companies and handing it to AI engineers, professionalization engenders trustworthy AI by design. Beyond recommending the specific policy solution of professionalization, this Article seeks to shift the discourse on AI away from an emphasis on light-touch, ex post solutions that address already-created products to a greater focus on ex ante controls that precede AI development. We’ve used this playbook before in fields requiring a high level of expertise where a duty to the public welfare must trump business motivations. What if, like doctors, AI engineers also vowed to do no harm?... |
Technical Commercial | ★★★ | |
|
2024-03-25 10:00:00 | Décodage des implications de cybersécurité de l'avancement rapide de l'AI \\ Decoding the Cybersecurity Implications of AI\\'s Rapid Advancement (lien direct) |
The genius at the heart of AI—its ability to sift through mountains of data, actually spot a needle in a haystack, and act on threats before they blossom into full-scale emergencies—it’s undeniable. However, here’s the rub—every part of that impressive arsenal? It’s also up for grabs by the other side, and can (and will) arm them to launch attacks of unprecedented sophistication and elusiveness, the likes of which we’ve thankfully never seen up to now. How do we wield this impressive technology to fortify our defenses, while preventing it from falling into the wrong hands? Can such a thing even be accomplished? Join me below as we take a closer look at how AI’s rapid rise is changing the landscape of cybersecurity. AI as a Defense Tool AI is a reliable navigator for charting the digital deluge—it has the ability to handle vast quantities of information rapidly on a level that no human could ever hope to match. It doesn’t take a huge leap to come to the conclusion that those capabilities can very easily be leveraged for defense. Automated Threat Detection Think of AI as the ever-watchful eye, tirelessly scanning the horizon for signs of trouble in the vast sea of data. Its capability to detect threats with speed and precision beyond human ken is our first line of defense against the shadows that lurk in the network traffic, camouflaged in ordinary user behavior, or embedded within the seemingly benign activities of countless applications. AI isn’t just about spotting trouble; it’s about understanding it. Through machine learning, it constructs models that learn from the DNA of malware, enabling it to recognize new variants that bear the hallmarks of known threats. This is akin to recognizing an enemy’s tactics, even if their strategy evolves. All of what I’ve said also here applies to incident response—with AI’s ability to automatically meet threats head-on making a holistic cybersecurity posture both easier to achieve and less resource-intensive for organizations of all sizes. Predictive Analytics By understanding the patterns and techniques used in previous breaches, AI models can predict where and how cybercriminals might strike next. This foresight enables organizations to reinforce their defenses before an attack occurs, transforming cybersecurity from a reactive discipline into a proactive strategy that helps prevent breaches rather than merely responding to them. The sophistication of predictive analytics lies in its use of diverse data sources, including threat intelligence feeds, anomaly detection reports, and global cybersecurity trends. This comprehensive view allows AI systems to identify correlations and causations that might elude human analysts. Phishing Detection and Email Filtering AI has stepped up as a pivotal ally in the ongoing skirmish against phishing and other forms of social engineering attacks, which too often lay the groundwork for more invasive security breaches. Through meticulous analysis of email content, context, and even the | Spam Tool Vulnerability Threat Prediction Technical | Deloitte | ★★ |
|
2024-03-23 21:28:48 | Les pirates peuvent débloquer 3 millions de portes hôtelières dans 131 pays Hackers Can Unlock 3 million Hotel Doors In 131 Countries (lien direct) |
Les chercheurs en sécurité ont découvert des vulnérabilités dans la gamme de serrures électroniques RFID de Dormakaba \\, ce qui pourrait permettre à un attaquant d'accéder aux chambres d'hôtel et aux portes de l'unité de logement multifamilial en quelques secondes en utilisant une seule paire de clés forgés. La série de vulnérabilités, surnommée «DeSaflok», a été découverte par les chercheurs Lennert Wouters, Ian Carroll, RQU, Buscanfly, Sam Curry, Shell et Will Caruana en septembre 2022 et divulgués en mars 2024, comme l'a rapporté pour la première fois par | Tool Vulnerability Mobile Technical | ★★ | |
 |
2024-03-20 13:58:32 | La chasse: la chasse aux menaces dans les environnements OT The Hunt: Threat Hunting in OT Environments (lien direct) |
> Bienvenue à & # 8220; The Hunt, & # 8221;Une série de blogs s'est concentrée sur le rôle essentiel de la chasse aux menaces dans les environnements de technologie opérationnelle (OT) ....
Le post The Hunt: Hugen Hunting in OT Environments est apparu pour la première fois sur dragos .
>Welcome to “The Hunt,” a blog series focused on the critical role of threat hunting within operational technology (OT) environments.... The post The Hunt: Threat Hunting in OT Environments first appeared on Dragos. |
Threat Industrial Technical | ★★★ | |
 |
2024-03-18 12:25:43 | Dette de sécurité: une menace croissante pour la sécurité des applications Security Debt: A Growing Threat to Application Security (lien direct) |
Comprendre la dette de sécurité
La dette de sécurité est un problème majeur et croissant dans le développement de logiciels avec des implications importantes pour la sécurité des applications, selon le rapport de l'état de la sécurité des logiciels de Veracode \\.Laissez-vous approfondir un peu plus dans la portée et le risque de dette de sécurité, et obtenir des informations sur les gestionnaires de sécurité des applications pour relever efficacement ce défi.
La dette de sécurité fait référence aux défauts logiciels qui restent non fixés pendant un an ou plus.Ces défauts s'accumulent au fil du temps en raison de divers facteurs, notamment des contraintes de ressources, de la complexité technique ou du manque de priorisation.La dette de sécurité peut être classée comme critique ou non critique et peut exister à la fois dans le code tiers et peut-être plus inquiétant.
Prévalence et impact de la dette de sécurité
Selon des recherches récentes, 42% des applications actives ont une dette de sécurité, 11% portant une dette de sécurité critique qui présente un risque grave pour les organisations.Les grandes applications sont particulièrement sensibles, avec 40% de…
Understanding Security Debt Security debt is a major and growing problem in software development with significant implications for application security, according to Veracode\'s State of Software Security 2024 Report. Let\'s delve a bit deeper into the scope and risk of security debt, and gain some insights for application security managers to effectively address this challenge. Security debt refers to software flaws that remain unfixed for a year or more. These flaws accumulate over time due to various factors, including resource constraints, technical complexity, or lack of prioritization. Security debt can be categorized as critical or non-critical and can exist in both first-party and, maybe more worrying, third-party code. Prevalence and Impact of Security Debt According to recent research, 42% of active applications have security debt, with 11% carrying critical security debt that poses a severe risk to organizations. Large applications are particularly susceptible, with 40% of… |
Threat Technical | ★★★ | |
|
2024-03-16 22:18:38 | Lolbin wow ltd x 2 (lien direct) | J'ai déjà couvert des cas où j'ai abusé de la variable de l'environnement Windir pour lolbiniser certains exécutables wow.Je pensais avoir couvert W32TM.exe auparavant, mais en regardant l'historique de mon blog, je ne peux pas y trouver de référence.Alors, voici:
I have already covered cases where I abused WINDIR environment variable to LOLBINize some WoW executables. I thought I covered w32tm.exe before, but looking at my blog history I can’t find any reference to it. So, here it is: |
Technical | ★★★ | |
|
2024-03-14 06:00:19 | Comment nous avons déployé Github Copilot pour augmenter la productivité des développeurs How We Rolled Out GitHub Copilot to Increase Developer Productivity (lien direct) |
Engineering Insights is an ongoing blog series that gives a behind-the-scenes look into the technical challenges, lessons and advances that help our customers protect people and defend data every day. Each post is a firsthand account by one of our engineers about the process that led up to a Proofpoint innovation. Inspired by the rapid rise of generative artificial intelligence (GenAI), we recently kicked off several internal initiatives at Proofpoint that focused on using it within our products. One of our leadership team\'s goals was to find a tool to help increase developer productivity and satisfaction. The timing was perfect to explore options, as the market had become flush with AI-assisted coding tools. Our project was to analyze the available tools on the market in-depth. We wanted to choose an AI assistant that would provide the best productivity results while also conforming to data governance policies. We set an aggressive timeline to analyze the tools, collaborate with key stakeholders from legal, procurement, finance and the business side, and then deploy the tool across our teams. In the end, we selected GitHub Copilot, a code completion tool developed by GitHub and OpenAI, as our AI coding assistant. In this post, we walk through how we arrived at this decision. We also share the qualitative and quantitative results that we\'ve seen since we\'ve introduced it. Our analysis: approach and criteria When you want to buy a race car-or any car for that matter-it is unlikely that you\'ll look at just one car before making a final decision. As engineers, we are wired to conduct analyses that dive deeply into all the possible best options as well as list all the pros and cons of each. And that\'s what we did here, which led us to a final four list that included GitHub Copilot. These are the criteria that we considered: Languages supported IDEs supported Code ownership Stability AI models used Protection for intellectual property (IP) Licensing terms Security Service-level agreements Chat interface Innovation Special powers Pricing Data governance Support for a broad set of code repositories We took each of the four products on our shortlist for a test drive using a specific set of standard use cases. These use cases were solicited from several engineering teams. They covered a wide range of tasks that we anticipated would be exercised with an AI assistant. For example, we needed the tool to assist not just developers, but also document writers and automation engineers. We had multiple conversations and in-depth demos from the vendors. And when possible, we did customer reference checks as well. Execution: a global rollout Once we selected a vendor, we rolled out the tool to all Proofpoint developers across the globe. We use different code repos, programming languages and IDEs-so, we\'re talking about a lot of permutations and combinations. Our initial rollout covered approximately 50% of our team from various business units and roles for about 30 days. We offered training sessions internally to share best practices and address challenges. We also built an internal community of experts to answer questions. Many issues that came up were ironed out during this pilot phase so that when we went live, it was a smooth process. We only had a few issues. All stakeholders were aware of the progress, from our operations/IT team to our procurement and finance teams. Our journey from start to finish was about 100 days. This might seem like a long time, but we wanted to be sure of our choice. After all, it is difficult to hit “rewind” on an important initiative of this magnitude. Monitoring and measuring results We have been using GitHub Copilot for more than 150 days and during that period we\'ve been collecting telemetry data from the tool and correlating it with several productivity and quality metrics. Our results have been impressive. When it comes to quantitative results, we have seen a general increase in | Tool Cloud Technical | ★★★ | |
|
2024-03-13 19:25:00 | Pixpirate Android Banking Trojan utilisant une nouvelle tactique d'évasion pour cibler les utilisateurs brésiliens PixPirate Android Banking Trojan Using New Evasion Tactic to Target Brazilian Users (lien direct) |
Les acteurs de la menace derrière le Troie bancaire Android Pixpirate tirent parti d'une nouvelle astuce pour échapper à la détection sur des appareils compromis et récoltent des informations sensibles auprès des utilisateurs du Brésil.
L'approche lui permet de masquer l'icône de l'application malveillante à l'écran d'accueil de l'appareil de la victime, a déclaré IBM dans un rapport technique publié aujourd'hui.
«Merci à cette nouvelle technique, pendant la reconnaissance de Pixpirate
The threat actors behind the PixPirate Android banking trojan are leveraging a new trick to evade detection on compromised devices and harvest sensitive information from users in Brazil. The approach allows it to hide the malicious app\'s icon from the home screen of the victim\'s device, IBM said in a technical report published today. “Thanks to this new technique, during PixPirate reconnaissance |
Threat Mobile Technical | ★★ | |
|
2024-03-13 11:17:26 | Un changement opportun: hiérarchiser la sécurité des logiciels dans le paysage numérique 2024 A Timely Shift: Prioritizing Software Security in the 2024 Digital Landscape (lien direct) |
La sortie du rapport technique de février 2024 de la Maison Blanche, de retour aux éléments constitutifs: un chemin vers des logiciels mesurables sécurisés, entraîne un changement en temps opportun dans la hiérarchisation de la sécurité des logiciels.Le logiciel est omniprésent, il devient donc de plus en plus crucial pour aborder la surface d'attaque en expansion, naviguer dans des environnements réglementaires complexes et atténuer les risques posés par des attaques sophistiquées de la chaîne d'approvisionnement des logiciels.
Soit \\ explorer les idées clés du rapport technique de la Maison Blanche et plonger dans les recommandations d'intégration de la sécurité dans le cycle de vie du développement logiciel (SDLC).
Sécuriser les blocs de construction du cyberespace: le rôle des langages de programmation
Le rapport de la Maison Blanche met l'accent sur le langage de programmation comme un élément de construction principal pour sécuriser l'écosystème numérique.Il met en évidence la prévalence des vulnérabilités de la sécurité mémoire et la nécessité d'éliminer de manière proactive des classes de vulnérabilités logicielles.Le rapport préconise l'adoption de…
The release of the February 2024 White House Technical Report, Back to the Building Blocks: A Path Towards Secure Measurable Software, brings about a timely shift in prioritizing software security. Software is ubiquitous, so it\'s becoming increasingly crucial to address the expanding attack surface, navigate complex regulatory environments, and mitigate the risks posed by sophisticated software supply chain attacks. Let\'s explore the key insights from the White House Technical Report and delve into recommendations for integrating security across the software development lifecycle (SDLC). Securing Cyberspace Building Blocks: The Role of Programming Languages The White House\'s report emphasizes the programming language as a primary building block in securing the digital ecosystem. It highlights the prevalence of memory safety vulnerabilities and the need to proactively eliminate entire classes of software vulnerabilities. The report advocates for the adoption of… |
Vulnerability Technical | ★★ | |
|
2024-03-12 07:03:40 | Si vous utilisez l'archivage de Veritas, quelle est votre prochaine étape? If You\\'re Using Veritas Archiving, What\\'s Your Next Step? (lien direct) |
By now, much of the industry has seen the big news about Cohesity acquiring the enterprise data protection business of Veritas Technologies. The transaction will see the company\'s NetBackup technology-software, appliances and cloud (Alta Data Protection)-integrated into the Cohesity ecosystem. But what about other Veritas products? As stated in the Cohesity and Veritas press releases, the “remaining assets of Veritas\' businesses will form a separate company, \'DataCo.\' \'DataCo\' will comprise Veritas\' InfoScale, Data Compliance, and Backup Exec businesses.” Data Compliance includes Veritas Enterprise Vault (EV), which might raise concerns for EV customers. As a new, standalone entity, \'DataCo\' has no innovation track record. In this blog, I provide my opinion on the questionable future of Veritas archiving products, why EV customers should start looking at alternative archiving tools, and why you should trust Proofpoint as your next enterprise archiving solution. EV architecture isn\'t future-proof EV gained a following because it came onto the market just when it was needed. With its big, robust on-premises architecture, EV was ideal to solve the challenges of bloated file and email servers. Companies had on-premises file and email servers that were getting bogged down with too much data. They needed a tool to offload legacy data to keep working and so they could be backed up in a reasonable amount of time. However, with key applications having moved to the cloud over the last decade-plus, storage optimization is no longer a primary use case for archiving customers. While EV has adapted to e-discovery and compliance use cases, its underlying on-premises architecture has struggled to keep up. EV customers still have headaches with infrastructure (hardware and software) planning, budgeting and maintenance, and archive administration. What\'s more, upgrades often require assistance from professional services and support costs are rising. And the list goes on. Today, most cloud-native archives remove virtually all of these headaches. And just like you moved on from DVDs and Blu-ray discs to streaming video, it\'s time to migrate from legacy on-premises archiving architectures, like EV, to cloud-native solutions. Future investments are uncertain When you look back over EV\'s last 5-6 years, you might question what significant innovations Veritas has delivered for EV. Yes, Veritas finally released supervision in the cloud. But that was a direct response to the EOL of AdvisorMail for EV.cloud many years ago. Yes, Veritas added dozens of new data sources for EV. But that was achieved through the acquisition of Globanet-and their product Merge1-in 2020. (They still list Merge1 as an independent product on their website.) Yes, they highlight how EV can store to “Azure, AWS, Google Cloud Storage, and other public cloud repositories” via storage tiering. But that just means that EV extends the physical storage layer of a legacy on-prem archiving architecture to the cloud-it doesn\'t mean it runs a cloud-native archiving solution. Yes, Veritas has cloud-based Alta Archiving. But that\'s just a rebranding and repackaging of EV.cloud, which they retired more than two years ago. Plus, Alta Archiving and Enterprise Vault are separate products. With the Cohesity data protection acquisition, EV customers have a right to question future investments in their product. Will EV revenue alone be able to sustain meaningful, future innovation in the absence of the NetBackup revenue “cash cow”? Will you cling to hope, only to be issued an EOL notice like Dell EMC SourceOne customers? Now is the time to migrate from EV to a modern cloud-native archiving solution. How Proofpoint can help Here\'s why you should trust Proofpoint for your enterprise archiving. Commitment to product innovation and support Year after year, Proofpoint continues to invest a double-digit percentage of revenue into all of our businesses, including Proofpoint Int | Tool Studies Cloud Technical | ★★ | |
 |
2024-03-11 17:27:44 | Des agences gouvernementales françaises frappées par des cyberattaques d'intensité sans précédent \\ ' French government agencies hit by cyberattacks of \\'unprecedented intensity\\' (lien direct) |
Un certain nombre d'agences gouvernementales françaises ont été touchées par des cyberattaques «intenses», a annoncé lundi le bureau du Premier ministre \\.La nature des attaques, qui a commencé dimanche soir, n'a pas été confirmée bien que la description soit conforme aux attaques distribuées en déni de service (DDOS).Le gouvernement français a déclaré que l'attaque était «menée en utilisant des moyens techniques familiers mais
A number of French government agencies have been hit by “intense” cyberattacks, the prime minister\'s office announced on Monday. The nature of the attacks, which began on Sunday night, has not been confirmed although the description is consistent with distributed-denial-of-service (DDoS) attacks. The French government said the attack was “conducted using familiar technical means but |
Technical | ★★★ | |
|
2024-03-11 11:58:00 | Exploit de preuve de concept publié pour le logiciel de progression Vulnérabilité OpenEdge Proof-of-Concept Exploit Released for Progress Software OpenEdge Vulnerability (lien direct) |
Des détails techniques et un exploit de preuve de concept (POC) ont été mis à disposition pour un défaut de sécurité critique récemment divulgué de la passerelle d'authentification OpenEdge et de l'adminsateur, qui pourrait être exploité pour contourner les protections d'authentification.
Suivi en AS & NBSP; CVE-2024-1403, la vulnérabilité a une cote de gravité maximale de 10,0 sur le système de notation CVSS.Il
Technical specifics and a proof-of-concept (PoC) exploit have been made available for a recently disclosed critical security flaw in Progress Software OpenEdge Authentication Gateway and AdminServer, which could be potentially exploited to bypass authentication protections. Tracked as CVE-2024-1403, the vulnerability has a maximum severity rating of 10.0 on the CVSS scoring system. It |
Vulnerability Threat Technical | ★★ | |
|
2024-03-08 03:00:22 | Comment s'assurer que les forfaits open source ne sont pas des mines terrestres How to Ensure Open-Source Packages Are Not Landmines (lien direct) |
CISA et OpenSSF ont publié conjointement de nouveaux conseils recommandant des contrôles techniques pour rendre les développeurs plus difficiles à introduire des composants logiciels malveillants dans le code.
CISA and OpenSSF jointly published new guidance recommending technical controls to make it harder for developers to bring in malicious software components into code. |
Technical | Bahamut | ★★★ |
|
2024-03-07 18:34:58 | La stratégie de cyber-assurance nécessite une collaboration CISO-CFO Cyber Insurance Strategy Requires CISO-CFO Collaboration (lien direct) |
La quantification des cyber-risques rassemble l'expertise technique du CISO \\ et l'accent mis par le CFO \\ sur l'impact financier pour développer une compréhension plus forte et meilleure du cyber-risque.
Cyber risk quantification brings together the CISO\'s technical expertise and the CFO\'s focus on financial impact to develop a stronger and better understanding of cyber risk. |
Technical | ★★★ | |
|
2024-03-07 13:09:00 | Nouveau voleur d'informations de serpent basé sur Python se répandant via les messages Facebook New Python-Based Snake Info Stealer Spreading Through Facebook Messages (lien direct) |
Les messages Facebook sont utilisés par les acteurs de la menace dans un voleur d'informations basé sur Python surnommé un serpent qui a conçu pour capturer des informations d'identification et d'autres données sensibles.
"Les informations d'identification récoltées auprès des utilisateurs sans méfiance sont transmises à différentes plates-formes telles que Discord, Github et Telegram", le chercheur de cyberison Kotaro Ogino & nbsp; a dit & nbsp; dans un rapport technique.
Détails sur la campagne et
Facebook messages are being used by threat actors to a Python-based information stealer dubbed Snake that\'s designed to capture credentials and other sensitive data. “The credentials harvested from unsuspecting users are transmitted to different platforms such as Discord, GitHub, and Telegram,” Cybereason researcher Kotaro Ogino said in a technical report. Details about the campaign& |
Threat Technical | ★★★ |
To see everything:
Our RSS (filtrered)
