What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2023-10-20 18:39:23 | Les pirates ont volé des jetons d'accès à l'unité de support d'Okta \\ Hackers Stole Access Tokens from Okta\\'s Support Unit (lien direct) |
Okta, une entreprise qui fournit des outils d'identité comme l'authentification multi-facteurs et l'authentification unique à des milliers d'entreprises, a subi une violation de sécurité impliquant un compromis de son unité de support client, a appris KrebsSoncurity.Okta dit que l'incident a affecté un "très petit nombre" de clients, mais il semble que les pirates responsables ont eu accès à la plate-forme de support d'Okta \\ pendant au moins deux semaines avant que la société ne contienne pleinement l'intrusion.
Okta, a company that provides identity tools like multi-factor authentication and single sign-on to thousands of businesses, has suffered a security breach involving a compromise of its customer support unit, KrebsOnSecurity has learned. Okta says the incident affected a "very small number" of customers, however it appears the hackers responsible had access to Okta\'s support platform for at least two weeks before the company fully contained the intrusion. |
Tool | ★★★ | |
 |
2023-10-19 15:15:09 | CVE-2023-5654 (lien direct) | L'extension React Developer Tools enregistre un auditeur de message avec Window.AddeventListener (\\ 'message \', ) dans un script de contenu accessible à toute page Web active dans le navigateur.Au sein de l'auditeur se trouve un code qui demande une URL dérivée du message reçu via fetch ().L'URL n'est pas validée ou désinfectée avant qu'elle ne soit récupérée, permettant ainsi à une page Web malveillante de récupérer arbitrairement URL & acirc; & euro; & échange via le navigateur de la victime.
The React Developer Tools extension registers a message listener with window.addEventListener(\'message\', ) in a content script that is accessible to any webpage that is active in the browser. Within the listener is code that requests a URL derived from the received message via fetch(). The URL is not validated or sanitised before it is fetched, thus allowing a malicious web page to arbitrarily fetch URL’s via the victim\'s browser. |
Tool | ||
 |
2023-10-19 10:00:00 | Pourquoi les organisations ne détectent-elles pas les menaces de cybersécurité? Why are organizations failing to detect cybersecurity threats? (lien direct) |
The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. With the changing security landscape, the most daunting task for the CISO and CIO is to fight an ongoing battle against hackers and cybercriminals. Bad actors stay ahead of the defenders and are always looking to find new vulnerabilities and loopholes to exploit and enter the business network. Failing to address these threats promptly can have catastrophic consequences for the organization. A survey finds that, on average, it takes more than five months to detect and remediate cyber threats. This is a significant amount of time, as a delayed response to cyber threats can result in a possible cyber-attack. One can never forget the devastating impacts of the Equifax breach in 2017 and the Target breach in 2013 due to delayed detection and response. This is concerning and highlights the need for proactive cybersecurity measures to detect and mitigate rising cyber threats. Amidst this, it\'s also crucial to look into why it is challenging to detect cyber threats. Why do organizations fail to detect cyber threats? Security teams are dealing with more cyber threats than before. A report also confirmed that global cyber attacks increased by 38% in 2022 compared to the previous year. The increasing number and complexity of cyber-attacks make it challenging for organizations to detect them. Hackers use sophisticated techniques to bypass security systems and solutions - like zero-day vulnerabilities, phishing attacks, business email compromises (BEC), supply chain attacks, and Internet of Things (IoT) attacks. Some organizations are unaware of the latest cyber threat trends and lack the skills and resources to detect them. For instance, hackers offer professional services like ransomware-as-a-service (RaaS) to launch ransomware attacks. Surprisingly, two out of three ransomware attacks are facilitated by the RaaS setup, but still, companies fail to have a defensive strategy against them. Enterprises relying on legacy devices and outdated software programs are no longer effective at recognizing certain malicious activities, leaving the network vulnerable to potential threats. Additionally, the lack of trained staff, insider threats, and human errors are other reasons why many organizations suffer at the hands of threat actors. Besides this, much of the company\'s data is hidden as dark data. As the defensive teams and employees may be unaware of it, the hackers take complete advantage of dark data and either replicate it or use it to fulfill their malicious intentions. Moreover, cloud migration has rapidly increased in recent years, putting cybersecurity at significant risk. The complexity of the cloud environments, poorly secured remote and hybrid work environments, and sharing security responsibilities between cloud service providers and clients have complicated the situation. In addition, cloud vulnerabilities, which have risen to 194% from the previous year, have highlighted the need for organizations to look out for ways to strengthen their security infrastructure. Security measures to consider to prevent cyber threats Since businesses face complex cyber threats, mitigating them require | Threat Ransomware Data Breach Cloud Tool Vulnerability | Equifax | ★★ |
 |
2023-10-19 09:32:00 | Google Tag détecte les acteurs de la menace soutenus par l'État exploitant Winrar Flaw Google TAG Detects State-Backed Threat Actors Exploiting WinRAR Flaw (lien direct) |
Un certain nombre d'acteurs de menaces d'État de Russie et de Chine ont été observés exploitant une récente faille de sécurité dans l'outil d'archiver Winrar pour Windows dans le cadre de leurs opérations.
La vulnérabilité en question est CVE-2023-38831 (score CVSS: 7.8), qui permet aux attaquants d'exécuter du code arbitraire lorsqu'un utilisateur tente d'afficher un fichier bénin dans une archive zip.La lacune a été active
A number of state-back threat actors from Russia and China have been observed exploiting a recent security flaw in the WinRAR archiver tool for Windows as part of their operations. The vulnerability in question is CVE-2023-38831 (CVSS score: 7.8), which allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The shortcoming has been actively |
Threat Tool Vulnerability | ★★★ | |
 |
2023-10-19 07:00:00 | Seal – L\'outil ultime pour télécharger vidéos et audios sur Android (lien direct) | Salut à tous ! Aujourd'hui, je vous présente Seal, un téléchargeur vidéo/audio tout-en-un pour Android. Il permet de télécharger du contenu de différentes plateformes, d'organiser vos fichiers avec des métadonnées, et d'ajouter des sous-titres. Il est également possible de télécharger des listes de lecture entières. Seal est gratuit, open-source et disponible sur GitHub et F-Droid. | Tool General Information | ★★ | |
 |
2023-10-19 02:00:00 | Startup de sécurité AirGap Networks apporte des technologies de télécommunications au LAN Security startup Airgap Networks brings telco technologies to the LAN (lien direct) |
Les logiciels malveillants générateurs de l'AI, l'usurpation de faux identité profonde et les ransomwares parrainés par l'État ne sont que quelques-unes des dernières méthodes que les attaquants utilisent pour contourner les outils de cybersécurité traditionnels.Ritesh Agrawal, PDG de Cybersecurity Startup AirGap Networks, a remarqué que de nombreuses attaques qui compromettent les réseaux d'entreprise ne parviennent pas à pénétrer les réseaux de télécommunications et de prestataires de services. «Même s'ils déploient les mêmes routeurs, les mêmes routeurs, les commutateurs, et des pare-feu, il y a quelque chose de fondamentalement différent dans les réseaux de télécommunications qui les protègent de nombreuses menaces pour les Lans d'entreprise », a déclaré Argawal.Agrawal a 20 ans d'expérience avec la cybersécurité, le réseautage d'entreprise et le cloud computing, la plupart du temps passé avec les réseaux de genévriers en se concentrant sur les télécommunications et les grands clients d'entreprise. Pour lire cet article en totalité, veuillez cliquer ici
AI-generating malware, deep fake identity spoofing, and state-sponsored ransomware are just a few of the latest methods that attackers are using to bypass traditional cybersecurity tools. Ritesh Agrawal, CEO of cybersecurity startup Airgap Networks, noticed that many of the attacks that compromise enterprise networks fail to penetrate telco and service provider networks.“Even though they\'re deploying the same routers, switches, and firewalls, there\'s something fundamentally different about telco networks that shields them from many threats to enterprise LANs,” Argawal said. Agrawal has 20 years of experience with cybersecurity, enterprise networking, and cloud computing, most of that time spent with Juniper Networks focusing on telco and large enterprise clients.To read this article in full, please click here |
Ransomware Malware Cloud Tool | ★★ | |
 |
2023-10-18 15:45:00 | La Russie et les pirates liés à la Chine exploitent Winrar Bug Russia and China-linked hackers exploit WinRAR bug (lien direct) |
Les pirates liés aux gouvernements de la Russie et de la Chine utiliseraient une vulnérabilité dans un outil Windows populaire pour attaquer des cibles dans le monde, y compris en Ukraine et en Papouasie-Nouvelle-Guinée.Le groupe d'analyse des menaces de Google \\ a déclaré que ces dernières semaines, il a vu plusieurs groupes soutenus par le gouvernement exploitant CVE-2023-38831, une vulnérabilité affectant les fenêtres
Hackers connected to the governments of Russia and China are allegedly using a vulnerability in a popular Windows tool to attack targets around the world, including in Ukraine and Papua New Guinea. Google\'s Threat Analysis Group\'s (TAG) said that in recent weeks it has seen multiple government-backed groups exploiting CVE-2023-38831, a vulnerability affecting the Windows |
Threat Tool Vulnerability | ★★ | |
 |
2023-10-18 13:13:00 | Guardz présente un nouvel outil de prospection de cyber-risque alimentée par l'IA pour les MSP Guardz Introduces New AI-Powered Cyber Risk Prospecting Tool For MSPs (lien direct) |
Guardz introduit un nouvel outil de prospection de cyber-risque alimenté par l'IA pour les MSP
L'outil permet aux MSP de traiter leur point de douleur numéro un - attirant de nouveaux clients - en fournissant un aperçu complet de la posture de cybersécurité d'une PME \\, sans frais
-
revues de produits
Guardz Introduces New AI-Powered Cyber Risk Prospecting Tool For MSPs The tool enables MSPs to address their number one pain point - attracting new clients - by providing a thorough overview of an SME\'s cybersecurity posture, at no cost - Product Reviews |
Tool | ★★ | |
|
2023-10-17 13:15:58 | Céquence Security a annoncé que la solution CEQUENCE UNIFIED API Protection (UAP) est désormais disponible sur le HPE Greenlake Marketplace Cequence Security announced the Cequence Unified API Protection (UAP) solution is now available on the HPE GreenLake Marketplace (lien direct) |
Céquence devient le premier fournisseur de sécurité de l'API sur le HPE Greenlake Marketplace
Céquence Unified API Protection sur HPE Greenlake améliore considérablement la visibilité et la protection tout en réduisant les coûts et en minimisant la fraude, la perturbation des entreprises, les pertes de données et la non-conformité
-
revues de produits
Cequence Becomes the First API Security Vendor on the HPE GreenLake Marketplace Cequence Unified API Protection on HPE GreenLake significantly improves visibility and protection while reducing costs and minimising fraud, business disruption, data losses and non-compliance - Product Reviews |
Tool | ★★ | |
|
2023-10-17 10:00:00 | Réévaluer les risques dans l'âge de l'intelligence artificielle Re-evaluating risk in the artificial intelligence age (lien direct) |
Introduction It is common knowledge that when it comes to cybersecurity, there is no one-size-fits all definition of risk, nor is there a place for static plans. New technologies are created, new vulnerabilities discovered, and more attackers appear on the horizon. Most recently the appearance of advanced language models such as ChatGPT have taken this concept and turned the dial up to eleven. These AI tools are capable of creating targeted malware with no technical training required and can even walk you through how to use them. While official tools have safeguards in place (with more being added as users find new ways to circumvent them) that reduce or prevent them being abused, there are several dark web offerings that are happy to fill the void. Enterprising individuals have created tools that are specifically trained on malware data and are capable of supporting other attacks such as phishing or email-compromises. Re-evaluating risk While risk should always be regularly evaluated it is important to identify when significant technological shifts materially impact the risk landscape. Whether it is the proliferation of mobile devices in the workplace or easy access to internet-connected devices with minimal security (to name a few of the more recent developments) there are times when organizations need to completely reassess their risk profile. Vulnerabilities unlikely to be exploited yesterday may suddenly be the new best-in-breed attack vector today. There are numerous ways to evaluate, prioritize, and address risks as they are discovered which vary between organizations, industries, and personal preferences. At the most basic level, risks are evaluated by multiplying the likelihood and impact of any given event. These factors may be determined through numerous methods, and may be affected by countless elements including: Geography Industry Motivation of attackers Skill of attackers Cost of equipment Maturity of the target’s security program In this case, the advent of tools like ChatGPT greatly reduce the barrier to entry or the “skill” needed for a malicious actor to execute an attack. Sophisticated, targeted, attacks can be created in minutes with minimal effort from the attacker. Organizations that were previously safe due to their size, profile, or industry, now may be targeted simply because it is easy to do so. This means all previously established risk profiles are now out of date and do not accurately reflect the new environment businesses find themselves operating in. Even businesses that have a robust risk management process and mature program may find themselves struggling to adapt to this new reality. Recommendations While there is no one-size-fits-all solution, there are some actions businesses can take that will likely be effective. First, the business should conduct an immediate assessment and analysis of their currently identified risks. Next, the business should assess whether any of these risks could be reasonably combined (also known as aggregated) in a way that materially changes their likelihood or impact. Finally, the business must ensure their executive teams are aware of the changes to the businesses risk profile and consider amending the organization’s existing risk appetite and tolerances. Risk assessment & analysis It is important to begin by reassessing the current state of risk within the organization. As noted earlier, risks or attacks that were previously considered unlikely may now be only a few clicks from being deployed in mass. The organization should walk through their risk register, if one exists, and evaluate all identified risks. This may be time consuming, and the organization should of course prioritize critical and high risks first, but it is important to ensure the business has the information they need to effectively address risks. Risk aggregation Onc | Malware Tool Vulnerability | ChatGPT | ★★★★ |
 |
2023-10-17 09:05:59 | Qu'est-ce qu'un CMDB? What is a CMDB? (lien direct) |
Il existe d'innombrables outils et technologies disponibles pour aider une organisation à rester au-dessus de ses actifs informatiques, et une base de données de gestion de la configuration (CMDB) est extrêmement utile.La base de données garde une trace des informations pertinentes concernant divers composants matériels et logiciels et les relations entre eux.Il permet aux équipes d'avoir une vue organisée des éléments de configuration (CIS) qui peuvent permettre des processus plus rationalisés en ce qui concerne le fonctionnement.L'infrastructure et l'architecture des sociétés \\ 'Les actifs informatiques continuent de devenir plus complexes, et avoir une base de données centralisée fournit un moyen ...
There are countless tools and technologies available to help an organization stay on top of its IT assets, and a configuration management database (CMDB) is an extremely useful one. The database keeps track of relevant information regarding various hardware and software components and the relationships between them. It allows IT teams to have an organized view of configuration items (CIs) that can enable more streamlined processes when it comes to IT work. The infrastructure and architecture of companies\' IT assets continue to grow more complex, and having a centralized database provides a way... |
Tool | ★★ | |
 |
2023-10-17 05:00:21 | Êtes-vous sûr que votre navigateur est à jour?Le paysage actuel des fausses mises à jour du navigateur Are You Sure Your Browser is Up to Date? The Current Landscape of Fake Browser Updates (lien direct) |
Key Takeaways Proofpoint is tracking multiple different threat clusters that use similar themes related to fake browser updates. Fake browser updates abuse end user trust with compromised websites and a lure customized to the user\'s browser to legitimize the update and fool users into clicking. Threat actors do not send emails to share the compromised websites. The threat is only in the browser and can be initiated by a click from a legitimate and expected email, social media site, search engine query, or even just navigating to the compromised site. The different campaigns use similar lures, but different payloads. It is important to identify which campaign and malware cluster the threat belongs to help guide defender response. Overview Proofpoint is currently tracking at least four distinct threat clusters that use fake browser updates to distribute malware. Fake browser updates refer to compromised websites that display what appears to be a notification from the browser developer such as Chrome, Firefox, or Edge, informing them that their browser software needs to be updated. When a user clicks on the link, they do not download a legitimate browser update but rather harmful malware. Based on our research, TA569 has used fake browser updates for over five years to deliver SocGholish malware, but recently other threat actors have been copying the lure theme. Each threat actor uses their own methods to deliver the lure and payload, but the theme takes advantage of the same social engineering tactics. The use of fake browser updates is unique because it abuses the trust end users place in both their browser and the known sites that they visit. Threat actors that control the fake browser updates use JavaScript or HTML injected code that directs traffic to a domain they control, which can potentially overwrite the webpage with a browser update lure specific to the web browser that the potential victim uses. A malicious payload will then automatically download, or the user will receive a prompt to download a “browser update,” which will deliver the payload. Fake browser update lure and effectiveness The fake browser update lures are effective because threat actors are using an end-user\'s security training against them. In security awareness training, users are told to only accept updates or click on links from known and trusted sites, or individuals, and to verify sites are legitimate. The fake browser updates abuse this training because they compromise trusted sites and use JavaScript requests to quietly make checks in the background and overwrite the existing, website with a browser update lure. To an end user, it still appears to be the same website they were intending to visit and is now asking them to update their browser. Proofpoint has not identified threat actors directly sending emails containing malicious links, but, due to the nature of the threat, compromised URLs are observed in email traffic in a variety of ways. They are seen in normal email traffic by regular end users who are unaware of the compromised websites, in monitoring emails such as Google alerts, or in mass automated email campaigns like those distributing newsletters. This creates a situation where these emails are considered to be malicious during the time the site is compromised. Organizations should not treat the fake browser update threats as only an email problem, as end users could visit the site from another source, such as a search engine, social media site, or simply navigate to the site directly and receive the lure and potentially download the malicious payload. Each campaign uniquely filters traffic to hide from researchers and delay discovery, but all the methods are effective at filtering. While this may reduce the potential spread of malicious payloads, it enables actors to maintain their access to the compromised sites for longer periods of time. This can complicate the response, because with the multiple campaigns and changing payloads, responders must take time to | Threat Malware Studies Tool | ★★★★ | |
 |
2023-10-16 15:30:00 | Ransomware cible les serveurs WS_FTP non corrigés Ransomware Targets Unpatched WS_FTP Servers (lien direct) |
Les acteurs de la menace ont tenté d'escalader les privilèges en utilisant l'outil open source Godpotato
The threat actors attempted to escalate privileges using the open-source GodPotato tool |
Threat Ransomware Tool | ★★ | |
 |
2023-10-16 13:28:19 | 8 Meilleur stress IP gratuit à utiliser en 2023 8 Best Free IP Stresser to Use in 2023 (lien direct) |
avez-vous besoin de tester votre site Web et recherchez-vous les meilleurs contraintes IP gratuites à utiliser?Cet article vous guidera pour faire la meilleure sélection qui correspond à vos besoins.Il devient crucial pour les propriétaires de sites Web - lors de la configuration de leurs sites - pour déterminer si le serveur hébergeant leur site [& hellip;]
Do you need to stress test your website, and are you looking for the best free IP stresses to use? This article will guide you in making the best selection that fits your needs. It becomes crucial for website owners - when setting up their sites - to determine whether the server hosting their site […] |
Tool Industrial | ★★★ | |
 |
2023-10-16 13:00:58 | Présentation de Playblocks Horizon Point Point: la plate-forme d'automatisation et de collaboration ultime Introducing Check Point Horizon Playblocks: The Ultimate Security Automation and Collaboration Platform (lien direct) |
> En 2023, les CISO prièrent la priorité à la mise en œuvre de l'automatisation dans leurs mesures de cybersécurité, selon le Forbes Technology Council.L'automatisation peut réduire considérablement la charge de travail des centres d'opérations de sécurité (SOC) et améliorer la sécurité globale.Cependant, pour lutter efficacement contre les cyber-menaces, la collaboration entre les produits, les personnes et les processus est crucial.Les équipes qui collaborent surpassent celles où chaque membre travaille seul.La collaboration à la recherche et à d'autres initiatives mène à de meilleures découvertes et à des percées plus rapides.Ce principe peut également être appliqué au paysage de menace d'une organisation.Le risque de silos de sécurité même avec des outils de sécurité sophistiqués déployés, la collaboration peut déverrouiller la prochaine [& # 8230;]
>In 2023, CISOs will prioritize the implementation of automation in their cybersecurity measures, according to the Forbes Technology Council. Automation can significantly reduce the workload of Security Operations Centers (SOCs) and enhance overall security. However, to effectively combat cyber threats, collaboration among products, people, and processes is crucial. Teams that collaborate out-perform those where each member works on their own. Collaborating on research and other initiatives leads to better findings and faster breakthroughs. This principle can also be applied to an organization\'s threat landscape. The Risk of Security Silos Even with sophisticated security tools deployed, collaboration can unlock the next […] |
Threat Tool | ★★ | |
|
2023-10-16 12:00:00 | Une tour de surveillance au Mexique devient un point de repère troublant pour les défenseurs de la vie privée A surveillance tower in Mexico becomes an unsettling landmark for privacy advocates (lien direct) |
Le bâtiment aura 1 791 lecteurs de plaques d'immatriculation automatisés.3 065 caméras panilon-zoom.74 drones.Les flux en direct des caméras appartenant aux entreprises du quartier et aux résidents.Les filtres biométriques fonctionnant constamment pour soutenir la reconnaissance faciale.Connexions avec les infrastructures dans toute la ville.Ces outils de surveillance et bien d'autres seront intégrés à Torre Centinela du Mexique (tour Sentinel), un presque
The building will have 1,791 automated license plate readers. 3,065 pan-tilt-zoom cameras. 74 drones. Live feeds from cameras owned by neighborhood businesses and residents. Biometric filters running constantly to support facial recognition. Connections to infrastructure throughout the city. Those monitoring tools and many others will be embedded in Mexico\'s Torre Centinela (Sentinel Tower), a nearly |
Tool General Information | ★★ | |
|
2023-10-16 10:00:00 | Renforcement de la cybersécurité: multiplication de force et efficacité de sécurité Strengthening Cybersecurity: Force multiplication and security efficiency (lien direct) |
In the ever-evolving landscape of cybersecurity, the battle between defenders and attackers has historically been marked by an asymmetrical relationship. Within the cybersecurity realm, asymmetry has characterized the relationship between those safeguarding digital assets and those seeking to exploit vulnerabilities. Even within this context, where attackers are typically at a resource disadvantage, data breaches have continued to rise year after year as cyber threats adapt and evolve and utilize asymmetric tactics to their advantage. These include technologies and tactics such as artificial intelligence (AI), and advanced social engineering tools. To effectively combat these threats, companies must rethink their security strategies, concentrating their scarce resources more efficiently and effectively through the concept of force multiplication. Asymmetrical threats, in the world of cybersecurity, can be summed up as the inherent disparity between adversaries and the tactics employed by the weaker party to neutralize the strengths of the stronger one. The utilization of AI and similar tools further erodes the perceived advantages that organizations believe they gain through increased spending on sophisticated security measures. Recent data from InfoSecurity Magazine, referencing the 2023 Checkpoint study, reveals a disconcerting trend: global cyberattacks increased by 7% between Q1 2022 and Q1 2023. While not significant at first blush, a deeper analysis reveals a more disturbing trend specifically that of the use of AI. AI\'s malicious deployment is exemplified in the following quote from their research: "...we have witnessed several sophisticated campaigns from cyber-criminals who are finding ways to weaponize legitimate tools for malicious gains." Furthermore, the report highlights: "Recent examples include using ChatGPT for code generation that can help less-skilled threat actors effortlessly launch cyberattacks." As threat actors continue to employ asymmetrical strategies to render organizations\' substantial and ever-increasing security investments less effective, organizations must adapt to address this evolving threat landscape. Arguably, one of the most effective methods to confront threat adaptation and asymmetric tactics is through the concept of force multiplication, which enhances relative effectiveness with fewer resources consumed thereby increasing the efficiency of the security dollar. Efficiency, in the context of cybersecurity, refers to achieving the greatest cumulative effect of cybersecurity efforts with the lowest possible expenditure of resources, including time, effort, and costs. While the concept of efficiency may seem straightforward, applying complex technological and human resources effectively and in an efficient manner in complex domains like security demands more than mere calculations. This subject has been studied, modeled, and debated within the military community for centuries. Military and combat efficiency, a domain with a long history of analysis, | Threat Studies Tool Prediction Vulnerability | ChatGPT | ★★★ |
|
2023-10-16 07:29:59 | Navigation du cyber-risque: ce qu'il faut rechercher dans la couverture de la cyber-assurance Navigating Cyber Risk: What to Look for in Cyber Insurance Coverage (lien direct) |
Modern threats like phishing, ransomware and data breaches cast a dark cloud over businesses across sectors. For most bad actors, the goal of an attack is financial. As Proofpoint noted in the 2023 State of the Phish report, 30% of businesses that endured a successful attack experienced a direct monetary loss, such as a fraudulent invoice, wire transfer or payroll redirection. That is an increase of 76% year over year. A cyber insurance policy can protect you from the financial losses caused by cybersecurity incidents and data breaches. And when businesses pair cyber insurance with the prowess of Proofpoint solutions, they can build a formidable defense strategy. In this blog, we\'ll go over some best practices for choosing and managing you cyber insurance policy so you can protect yourself from risk. Actions that cyber criminals monetize Our research for the latest State of the Phish report shows that the three most common consequences of a cyber attack are: Data breach (44%) Ransomware infection (43%) Account compromise (36%) Notably, cyber criminals can monetize all these actions. Most common results of successful phishing attacks. (Source: 2023 State of the Phish report from Proofpoint.) Just one cybersecurity incident can cost tens of thousands of dollars. So, it\'s easy to understand why insurers see these incidents as too costly to cover in their general liability policies. But with cyber insurance, your business has a tool to help manage risk. Why cyber insurance can be a vital financial safety net While firewalls and endpoint protections remain vital, the truth is that a level of residual risk always exists. No matter how fortified your security is, breaches can happen due to ingenious adversaries, human error or just unfortunate circumstances. This is where cyber insurance comes to the rescue. It is the safety net that catches your business when your defenses fall short. It can help you cover costs like ransomware payments, legal fees, and costs associated with crisis management and revenue loss. In the graphic below, we can see how often cyber insurance covered losses from ransomware attacks among those surveyed for our 2023 State of the Phish report. Nearly three-quarters (73%) of businesses with cyber insurance policies said their insurers paid at least some of their ransomware-related losses. (Source: 2023 State of the Phish report from Proofpoint.) Cyber insurance best practices Now that we\'ve covered why cyber insurance can be a vital financial safety net, let\'s look at some essential best practices for cyber insurance. These measures can help your business become more effective at managing cybersecurity risks. Find an expert and ask for support and guidance. Specialized brokers are your allies in the intricate world of cyber insurance. Insurers vary in risk appetite, claim acceptance rates and expertise. Brokers have an in-depth grasp of this landscape, and they will assess your options meticulously. They will help ensure that the policy you choose is the right fit for your industry, size, risk profile and more. Be prepared for a rigorous assessment. Today, insurers want more insight into your company\'s security protocols and controls before they issue a cyber insurance policy. So preparedness is key. Be ready to provide evidence, like external audits, penetration test results and compliance certifications to insurers. If you implement access controls that insurers deem vital, such as multifactor authentication (MFA) and privileged access management (PAM), it may help to reduce your premiums. Closely examine coverage scope. Coverage specifics vary globally. But you will find that most cyber insurance policies cover a portion of losses from ransomware attacks and expenses linked to crisis responses. You need to have a thorough understanding of the breach scenarios your policy does or does not cover. Take note of any exclusions. Also, be sure to scrutinize services like breach investigation support, legal | Threat Ransomware Guideline Cloud Tool | ★★★ | |
 |
2023-10-13 22:43:54 | Dakar F. Dexray v2.33 (lien direct) |
Même en 2023, Dexray semble fournir de la valeur aux praticiens du DFIR.Je suis toujours très humilié par des ajouts non sollicités au code Dexray, car cela signifie que l'outil est toujours en vie, malgré le fait qu'il a été écrit en archaïque (par & # 8230; Continuer la lecture & # 8594;
Even in 2023 Dexray seems to be delivering value to DFIR practitioners. I am always very humbled by unsolicited additions to Dexray code, because it means the tool is still alive, despite the fact it was written in archaic (by … Continue reading → |
Tool | ★★★ | |
|
2023-10-13 17:23:00 | Les chercheurs dévoilent le nouvel ensemble d'outils de Todckat \\ Researchers Unveil ToddyCat\\'s New Set of Tools for Data Exfiltration (lien direct) |
L'acteur avancé de menace persistante (APT) connue sous le nom de Toddycat a été lié à un nouvel ensemble d'outils malveillants conçus pour l'exfiltration de données, offrant un aperçu plus profond de la tactique et des capacités de l'équipe de piratage.
Les résultats proviennent de Kaspersky, qui a d'abord mis en lumière l'adversaire l'année dernière, le liant aux attaques contre des entités de haut niveau en Europe et en Asie pour près de trois
The advanced persistent threat (APT) actor known as ToddyCat has been linked to a new set of malicious tools that are designed for data exfiltration, offering a deeper insight into the hacking crew\'s tactics and capabilities. The findings come from Kaspersky, which first shed light on the adversary last year, linking it to attacks against high-profile entities in Europe and Asia for nearly three |
Threat Tool | ★★ | |
|
2023-10-13 08:01:34 | Un aperçu des modèles d'apprentissage automatique en point de preuve automatise An Overview of Machine Learning Models in Proofpoint Automate (lien direct) |
Did you know that, based on IDC\'s research, 39% of businesses say that improving operational efficiency is the top primary business objective for using artificial intelligence (AI)? At Proofpoint, there is tremendous interest in augmenting our product portfolio with AI and machine learning (ML) to produce benefits for our customers. In fact, today many of our Intelligent Compliance customers use our AI/ML technology to improve their operational efficiency and mitigate their compliance risk. When they report back to us about their quantitative and qualitative benefits, their results are impressive. In this blog, we\'ll give you an overview of why highly regulated firms choose the Proofpoint Intelligent Compliance platform. And then we\'ll go into details about how ML works in several solutions in the Intelligent Compliance product family. Proofpoint Intelligent Compliance is a comprehensive solution Our Intelligent Compliance platform offers a way for businesses to stay protected and compliant in a dynamic, virtual environment. It provides them with: AI-driven data visibility Information control Records retention and oversight Robust e-discovery capabilities (built-in and advanced) to satisfy requirements set by corporate mandates and regulatory bodies The platform includes these solutions: Proofpoint Archive Proofpoint Automate Proofpoint Capture Proofpoint Discover Proofpoint Patrol Proofpoint Supervision Proofpoint Track A must-have for highly regulated firms The Proofpoint Intelligent Compliance platform can benefit businesses in highly regulated industries. For example, financial services firms that are doing business in the U.S. must follow rules about supervision and monitoring set out by the Financial Industry Regulatory Authority (FINRA) and the Securities and Exchange Commission (SEC). Many of these firms now use Proofpoint Supervision technology to enable regulatory compliance with FINRA and the SEC. And Proofpoint Automate and Proofpoint Supervision work together to help these businesses supervise their digital communications. Reducing false positives with ML models Automate makes a big impact with helping businesses to reduce false positives. These are flagged, archived items, like email messages, which turn out to be of low or no risk after a review. They are a significant problem for companies that need to supervise digital communications. Automate uses ML models with Supervision to reduce false positives from supervisory review queues. This helps customers streamline processes and reduce human fatigue and errors. Teams manage and review much less low-risk content, which means reviewers can focus on real issues. One Proofpoint client reported that after deploying Supervision and Automate, they cut their review queue volume by a third. They reduced their flagged but not reviewed items from nearly 30 days to about 14 days out, which is now within their internal service-level agreements. Automate provides ML models and the tools to build ML models trained on your data to help reduce false positives. You have the option to: Build your own models Work with Proofpoint professional services to develop customized models Start with any of the models included with Automate The models that come with Automate are Low-Risk Content Model (LRCM), Disclaimer Detection Model or Customer Complaints Model. Let\'s take a closer look at the first one-LRCM. What does the LRCM do? You can use LRCM to remove low-risk content in two different ways-through exclusion detection or Auto-Clear. For sender and subject line exclusion detection, the model will make suggestions that an administrator can review, accept or decline. (See Figure 1.) Figure 1. Proofpoint Automate uses exclusion detection to surface subject line suggestions to add to the Supervision policy. If the administrator accepts the subject line, that line is added to the Supervision policy. Subsequent messages with the respective subject line will not be ev | Tool | ★★ | |
 |
2023-10-13 03:47:17 | Une analyse d'une webcontent de safari iOS dans la fenêtre dans l'exploit de processus GPU An analysis of an in-the-wild iOS Safari WebContent to GPU Process exploit (lien direct) |
By Ian Beer
A graph representation of the sandbox escape NSExpression payload
In April this year Google\'s Threat Analysis Group, in collaboration with Amnesty International, discovered an in-the-wild iPhone zero-day exploit chain being used in targeted attacks delivered via malicious link. The chain was reported to Apple under a 7-day disclosure deadline and Apple released iOS 16.4.1 on April 7, 2023 fixing CVE-2023-28206 and CVE-2023-28205.
Over the last few years Apple has been hardening the Safari WebContent (or "renderer") process sandbox attack surface on iOS, recently removing the ability for the WebContent process to access GPU-related hardware directly. Access to graphics-related drivers is now brokered via a GPU process which runs in a separate sandbox.
Analysis of this in-the-wild exploit chain reveals the first known case of attackers exploiting the Safari IPC layer to "hop" from WebContent to the GPU process, adding an extra link to the exploit chain (CVE-2023-32409).
On the surface this is a positive sign: clear evidence that the renderer sandbox was hardened sufficiently that (in this isolated case at least) the attackers needed to bundle an additional, separate exploit. Project Zero has long advocated for attack-surface reduction as an effective tool for improving security and this would seem like a clear win for that approach.
On the other hand, upon deeper inspection, things aren\'t quite so rosy. Retroactively sandboxing code which was never designed with compartmentalization in mind is rarely simple to do effectively. In this case the exploit targeted a very basic buffer overflow vulnerability in unused IPC support code for a disabled feature - effectively new attack surface which exists only because of the introduced sandbox. A simple fuzzer targeting the IPC layer would likely have found this vulnerability in seconds.
|
Threat Tool Vulnerability | ★★ | |
 |
2023-10-12 21:17:00 | AppDome annonce des outils d'évaluation des attaques dans l'économie numérique \\'s Mobile XDR Appdome Announces Attack Evaluation Tools in Digital Economy\\'s Mobile XDR (lien direct) |
By Ian Beer
A graph representation of the sandbox escape NSExpression payload
In April this year Google\'s Threat Analysis Group, in collaboration with Amnesty International, discovered an in-the-wild iPhone zero-day exploit chain being used in targeted attacks delivered via malicious link. The chain was reported to Apple under a 7-day disclosure deadline and Apple released iOS 16.4.1 on April 7, 2023 fixing CVE-2023-28206 and CVE-2023-28205.
Over the last few years Apple has been hardening the Safari WebContent (or "renderer") process sandbox attack surface on iOS, recently removing the ability for the WebContent process to access GPU-related hardware directly. Access to graphics-related drivers is now brokered via a GPU process which runs in a separate sandbox.
Analysis of this in-the-wild exploit chain reveals the first known case of attackers exploiting the Safari IPC layer to "hop" from WebContent to the GPU process, adding an extra link to the exploit chain (CVE-2023-32409).
On the surface this is a positive sign: clear evidence that the renderer sandbox was hardened sufficiently that (in this isolated case at least) the attackers needed to bundle an additional, separate exploit. Project Zero has long advocated for attack-surface reduction as an effective tool for improving security and this would seem like a clear win for that approach.
On the other hand, upon deeper inspection, things aren\'t quite so rosy. Retroactively sandboxing code which was never designed with compartmentalization in mind is rarely simple to do effectively. In this case the exploit targeted a very basic buffer overflow vulnerability in unused IPC support code for a disabled feature - effectively new attack surface which exists only because of the introduced sandbox. A simple fuzzer targeting the IPC layer would likely have found this vulnerability in seconds.
|
Tool | ★★ | |
|
2023-10-12 19:15:00 | Logiciel de progrès confronté à des dizaines de recours collectifs, enquête SEC à la suite de l'incident de Moveit Progress Software facing dozens of class action lawsuits, SEC investigation following MOVEit incident (lien direct) |
La société derrière un outil de transfert de fichiers populaire fait face à des dizaines de poursuites et d'enquêtes par plusieurs agences américaines à la suite de l'exploitation d'une vulnérabilité critique en mai.Progress Software & # 8211;L'entreprise qui possède l'outil de transfert de fichiers Moveit & # 8211;a déclaré ses résultats trimestriels cette semaine et a fourni une ventilation détaillée des coûts
The company behind a popular file transfer tool is facing dozens of lawsuits and investigations by several U.S. agencies following the exploitation of a critical vulnerability in May. Progress Software – the company that owns the MOVEit file transfer tool – reported its quarterly earnings this week and provided a detailed breakdown of the costs |
Tool Vulnerability | ★★ | |
|
2023-10-12 17:51:58 | Semperis élargit l'outil d'analyse du chemin d'attaque du druide forestier pour se prémunir contre les attaques d'identification ENTRA Semperis Expands Forest Druid Attack Path Analysis Tool to Guard Against Entra ID Attacks (lien direct) |
La nouvelle capacité étend le support multi-directory pour les druides forestiers pour aider les défenseurs de cybersécurité à fermer rapidement les voies d'attaque risquées vers les actifs de niveau 0 dans les environnements d'identité hybride
-
revues de produits
New capability extends multi-directory support for Forest Druid to help cybersecurity defenders rapidly close risky attack paths to Tier 0 assets across hybrid identity environments - Product Reviews |
Tool | ★★★ | |
|
2023-10-12 10:52:45 | Une journée dans la vie d'un analyste de cybersécurité A Day in the Life of a Cybersecurity Analyst (lien direct) |
The day-to-day experience of cybersecurity professionals can vary widely, even though we face similar threats and have many of the same tools at our disposal. In this post, I\'d like to shine a light on what a typical day looks like for a business information security analyst in the world of cybersecurity-a role I know well. Getting started in cybersecurity I\'m a musician-a bagpiper. It\'s a strange one, I know, but that\'s how I started my career. For a couple of years after leaving school, I taught and performed pipe music. But after finishing my music diploma, I knew that there were only so many hours in the week, and only so many people to teach. So, perhaps I should learn another skill, too. It was my dad who suggested cybersecurity. From the outside, it looked interesting and seemed like an industry on the up and up. So I applied for a cybersecurity course at Robert Gordon University in Aberdeen, Scotland. At that time, I didn\'t have much technical knowledge. However, after a chance meeting with the head of the cybersecurity course on a university open day, I felt it was an area I could potentially break into. Within a few weeks, I had signed up for a five-year course with the option of a placement after the second year. Fast-forward to today, and here I am two years into the job, and I\'ve just finished my third year at university. My work placement transitioned into a full-time role, which I still balance with my full-time studies. What does a “normal” day look like for a cybersecurity analyst? No two days are ever the same. It\'s typical for people new to this role to ask, “What are my tasks?” The honest answer is that they\'re hard to define. It depends on what\'s going on in the business at that time, and who you know and work with regularly. While we have great security tools in place to flag suspicious activity, a lot of the time I\'m dealing with situations where I must trust my gut instincts. A task I have grown into managing in my current role is the security training program and phishing simulations across the company. Just yesterday, I issued approvals for a new training campaign that we\'re running for our operations team in Iraq. We aim to carry out targeted team training quarterly in shorter bites, 20 minutes here and there, to try to keep people engaged more than once a year. I\'ll usually spend part of my day managing our external support teams and service providers, too. I manage our security exceptions process, which involves vetting and approving requests from the business. For me, it\'s a case of making sure we have the right information from our users, asking the “Why?” to their wants, and finding out if there are more secure alternatives for providing a solution. Indicator of compromise (IOC) checks are an ongoing task. We\'re part of a service organisation forum, so we often gather and share important information with our industry peers. We have a shared spreadsheet that\'s automatically tracked, and we always receive possible indicators internally from our ever-growing network of security champions. I just need to make sure that our email security and firewall security are ticked off, blocked and managed. Measuring success Being part of the service organisation forum means that we are constantly sharing information with our peers. It allows us to compare the results of our training programs over time to see how we trend against each other. We also look back at how we have performed in these areas internally over the last few years to make sure we\'re always improving. We\'re also passionate about data governance. We want to ensure that our users not only understand risk but also how to appropriately manage company and client data. We want to always use best practices and build an internal security culture from the ground up. There\'s that saying, “You\'re only as good as your weakest player.” When it comes to cybersecurity issues, an organization is like a football team. You have 40,000 employees-and if just one of them doesn\'t know what | Tool Prediction | ★★★ | |
|
2023-10-12 10:00:00 | L'évolution des attaques de phishing The evolution of phishing attacks (lien direct) |
A practical guide to phishing and best practices to avoid falling victim. Introduction Over the past several years, remote and hybrid work has quickly gained popularity amongst those seeking a to reduce the amount of time on the road or an improved work/life balance. To accomplish this, users are often working from multiple devices, some of which may be company issued, but others may be privately owned. Cyberattackers have leveraged this trend to bypass traditional security controls using social engineering, with phishing attacks being a favored tactic. In fact, the FBI Internet Crime Report issued in 2022 reported phishing as the top reported internet crime for the past 5 years. Its ability to persuade individuals to divulge sensitive information to seemingly familiar contacts and companies over email and/or SMS text messages has resulted in significant data breaches, both personal and financial, across all industries. Mobile phishing, in particular, is quickly becoming a preferred attack vector among hackers seeking to use them as a jump point to gain access to proprietary data within a company’s network. This article provides an overview of the origins of phishing, its impact on businesses, the types of mobile phishing attacks hackers employ, and ways in which companies can best defend themselves against such attacks. The origins of phishing The belief among many in the cybersecurity industry is that phishing attacks first emerged in the mid-90s when dial-up was the only means of gaining access to the internet. Hackers posing as ISP administrators used fake screen names to establish credibility with the user, enabling them to “phish” for personal log-in data. Once successful, they were able to exploit the victim’s account by sending out phishing emails to other users in their contact list, with the goal of scoring free internet access or other financial gain. Awareness of phishing was still limited until May 2000 when Love Bug entered the picture. Love Bug, a highly effective and contagious virus designed to take advantage of the user’s psyche was unleashed in the Philippines, impacting an estimated 45 million Window PCs globally. Love Bug was sent via email with the subject line reading “ILOVEYOU”. The body of the message simply read “Kindly check the attached LOVELETTER coming from me”. Users who couldn’t resist opening the message unleashed a worm virus infecting and overwriting user’s files with copies of the virus. When the user opened the file, they would reinfect the system. Lovebug elevated phishing to a new level as it demonstrated the ability to target a user’s email mailing list for the purpose of spamming acquaintances thereby incentivizing the reader to open his/her email. This enabled the lovebug worm to infect computer systems and steal other user’s passwords providing the hacker the opportunity to log-in to other user accounts providing unlimited internet access. Since Love Bug, the basic concept and primary goal of phishing tactics has remained consistent, but the tactics and vectors have evolved. The window of opportunity has increased significantly for hackers with the increased use of social media (e.g., Linkedin, Twitter, Facebook). This provides more personal data to the hackers enabling them to exploit their targets with more sophisticated phishing tactics while avoiding detection. Phishing’s impact in the marketplace today Phishing attacks present a significant threat for organizations as their ability to capture proprietary business and financial data are both costly and time consuming for IT organizations to detect and remediate. Based on a | Threat Ransomware Malware Tool Prediction | ★★★ | |
 |
2023-10-12 09:45:41 | Métiers IT – Développeur web : définition, formation, salaire (lien direct) | Le développeur web est en charge de la conception de sites et applications web. Il contrôle la fiabilité et les performances des fonctionnalités mises en oeuvre. Il maîtrise les outils et les langages du développement web. | Tool | ★★★ | |
|
2023-10-12 09:27:20 | J'ai été frappé par les ransomwares-temps quoi?Étapes pour gérer les conséquences I\\'ve Been Hit by Ransomware-Now What? Steps for Dealing with the Aftermath (lien direct) |
The following is an excerpt from the Ransomware Survival Guide, our free handbook on preventing, managing and recovering from ransomware threats at every stage of the attack chain. This blog post provides general tips-it is not a substitute for professional cybersecurity and incident response services. The best ransomware strategy is to avoid it in the first place. But increasingly advanced attacks against the software supply chain and end users have shown that even the best-prepared companies can be caught out. Ransomware may not even be the first malware payload to infect your system, because many ransomware gangs now prefer to buy access to targets already infected with Trojans or loader malware. During an attack, you have short-term problems to resolve, like getting computers, phones and networks back online and dealing with ransom demands. But a panicked response won\'t help-and may make things worse. Here are some general steps you can take to contain the threat and start on the road to recovery. Questions to answer during a ransomware attack Before you react to an attack, it\'s important to take a step back and ask questions that will inform your response. Your answers should help network administrators scope the problem, devise an action plan and possibly curtail the spread. Who in your environment is compromised? How widespread are the infections? Is a threat actor actively scouting your environment, exfiltrating data or ready to drop ransomware on other devices? What network permissions do compromised accounts or devices have? Ransomware may have been installed only after attackers had already moved laterally within the network or stolen credentials and other data. What type of attack is it? Is this attack a secondary infection? Did it come from downloaders, remote access Trojans (RATs) or other malware installed on the infected machine or others on the network? Keep in mind that ransomware spreads quickly and is often a byproduct of other threats. If you see one infection, there are probably others that you don\'t see. Proactively look for other issues within your environment. Now as you take action, there are three general step to follow: Step 1: Isolate infected systems The second employees see the ransomware demand or notice something\'s odd-such as suddenly losing access to their own files-they should disconnect from the network and take the infected machine to the IT department. To prepare for this scenario, we recommend that you keep valuable data and systems separated so that a security issue on one system doesn\'t affect other systems. For example, your sensitive research or business data should not reside on the same server and network segment as your email environment. We advise against having employees reboot their system. Only the IT security team should attempt a reboot, and even that will work only in the event that it is “scareware,” or fake ransomware. "Scareware" is malware that appears to be ransomware but isn\'t. It may lock the user\'s screen with a ransom demand and payment instructions, but the data is not actually encrypted. In those scenarios, standard anti-malware tools can help. Knowing the difference isn\'t always easy. Determine the scope of the problem using threat intelligence and external incident responders or forensic analysts when necessary. While all ransomware is bad, some attacks are worse than others. Your response-including whether to pay the ransom-hinges on several factors. Step 2: Call law enforcement Ransomware-like other forms of theft and extortion-is a crime. Nobody has the right to seize devices, networks or data-let alone demand a ransom in exchange for it. Notifying the proper authorities is a necessary first step. Contact local or federal law enforcement right away. Special departments exist specifically to aid cyber crime victims, so do not be afraid to pick up your phone and call them. They are there to help you and may have access to decryption keys or information on payment recovery after | Threat Ransomware Malware Tool | ★★★ | |
|
2023-10-11 22:08:45 | AppDome annonce de nouveaux outils d'évaluation des attaques dans le premier XDR mobile de l'économie numérique \\ Appdome Announces New Attack Evaluation Tools in Digital Economy\\'s First Mobile XDR (lien direct) |
AppDome annonce de nouveaux outils d'évaluation des attaques dans le premier XDR mobile de l'économie numérique
menace-inspect ™, menaces et instantanés font du mobile XDR le bon choix pour les marques du monde
-
revues de produits
Appdome Announces New Attack Evaluation Tools in Digital Economy\'s First Mobile XDR Threat-Inspect™, Threat-Views and Snapshots Make Mobile XDR the Right Choice for Brands Globally - Product Reviews |
Tool | ★★ | |
|
2023-10-11 11:00:00 | Protéger les versions de l'IA 3 outils de sécurité AI / ML en tant que open source Protect AI Releases 3 AI/ML Security Tools as Open Source (lien direct) |
La société a publié NB Defence, ModelsCan et Rebuff, qui détectent les vulnérabilités dans les systèmes d'apprentissage automatique, sur GitHub.
The company released NB Defense, ModelScan, and Rebuff, which detect vulnerabilities in machine learning systems, on GitHub. |
Tool Vulnerability | ★★ | |
|
2023-10-10 18:15:16 | CVE-2023-36720 (lien direct) | Windows Mixe Reality Developer Tools Denial of Service Vulnérabilité
Windows Mixed Reality Developer Tools Denial of Service Vulnerability |
Tool Vulnerability | ||
 |
2023-10-10 15:39:40 | Échelle au-delà ducorp avec les politiques de contrôle d'accès assistées par l'IA Scaling BeyondCorp with AI-Assisted Access Control Policies (lien direct) |
Ayush Khandelwal, Software Engineer, Michael Torres, Security Engineer, Hemil Patel, Technical Product Expert, Sameer Ladiwala, Software EngineerIn July 2023, four Googlers from the Enterprise Security and Access Security organizations developed a tool that aimed at revolutionizing the way Googlers interact with Access Control Lists - SpeakACL. This tool, awarded the Gold Prize during Google\'s internal Security & AI Hackathon, allows developers to create or modify security policies using simple English instructions rather than having to learn system-specific syntax or complex security principles. This can save security and product teams hours of time and effort, while helping to protect the information of their users by encouraging the reduction of permitted access by adhering to the principle of least privilege.Access Control Policies in BeyondCorpGoogle requires developers and owners of enterprise applications to define their own access control policies, as described in BeyondCorp: The Access Proxy. We have invested in reducing the difficulty of self-service ACL and ACL test creation to encourage these service owners to define least privilege access control policies. However, it is still challenging to concisely transform their intent into the language acceptable to the access control engine. Additional complexity is added by the variety of engines, and corresponding policy definition languages that target different access control domains (i.e. websites, networks, RPC servers).To adequately implement an access control policy, service developers are expected to learn various policy definition languages and their associated syntax, in addition to sufficiently understanding security concepts. As this takes time away from core developer work, it is not the most efficient use of developer time. A solution was required to remove these challenges so developers can focus on building innovative tools and products.Making it WorkWe built a prototype interface for interactively defining and modifying access control policies for the | Tool Vulnerability | ★★★ | |
|
2023-10-10 10:00:00 | & timide; histoires du SOC: Quishing & # 8211;Combattre les codes QR malveillants intégrés Stories from the SOC: Quishing – Combatting embedded malicious QR codes (lien direct) |
James Rodriguez – Senior Specialist, Cybersecurity
Executive summary
Over the past several months, AT&T Managed Detection and Response (MTDR) security operations center (SOC) analysts have seen an increase in the usage of phishing emails containing malicious QR codes. In a recent example, a customer that was victimized by a phishing attempt provided the AT&T analysts with an email that was circulated to several of its internal users. The analysts reviewed the email and its included attachment, a PDF containing a QR code and an urgent message claiming to be from Microsoft.
When the targeted user scanned the QR code, they were directed to a counterfeit Microsoft login page designed to harvest usernames and passwords. This type of attack is called “quishing.”
Unfortunately, several users fell victim to the attack, and their credentials were compromised. However, our analysts were able to engage with the customer and guide them through the proper remediation steps.
Encouraging targeted users to act quickly and scan the code using their phone (which often is not as secure as the rest of a company’s network) is a standard tactic employed by threat actors. By doing this, they hope to convince the user to act without thinking and forgo proper security practices allowing the threat actor to bypass traditional security measures in place on a company network.
Threat actor tactics
The threat actor used a Windows authentication setup for multi-factor authentication (MFA) to initiate the attack. The targeted users received a phishing email indicating MFA needed to be set up on their account. The email included a PDF attachment with instructions directing them to scan the included QR code, which was malicious.
Once the users scanned the QR code, they were redirected to a fake Microsoft sign-in page on their phone. Here, they entered their legitimate login credentials,which were then stored and made available to the threat actor.
Investigation
Once the customer suspected the email was malicious, they contacted the AT&T team and provided a copy of the PDF file with the included QR code. The team analyzed the file and the QR code (see Image 1) and identified the associated destination as “srvc1[.]info/mcrsft2fasetup/index.html.”
Image 1: PDF file from customer containing malicious QR code
The QR codes associated URL sends the user to a credential harvester masquerading as a Microsoft login page. (See Image 2.)
Image 2: Credential harvester masquerading as login page
AT&T SOC analysts analyzed the credential harvester using a fake email and the Google Chrome Inspector tool to record any outbound connections when clicking the “Sign In” button (see Image 2). Only one network connection was made, which resulted in a 404 HTTP response code to the external domain “logo.clearbit[.]com/email.com.” Research into clearbit[.]com found it is associated with Clearbit B2B Marketing Intelligence, which is listed as a legitimate marketing tool for identifying customers and sales exchanges.
Analysts used open-source intelligence (OSINT) to further research the initial associated domain “srvc1[.]info” but found no additional information as the domain was recently purchased. Further investigation revealed that the owner’s identity was hidden, and there was no additional data available. The customer confirmed that neither the Clearbit nor the srvc1 external domains were known or a part of normal business use within their environment.
Remediation
AT&T SOC analysts worked closely with the customer to identify w |
Threat Tool | ★★★★ | |
 |
2023-10-10 04:42:35 | Infostaler avec un certificat anormal en cours de distribution Infostealer with Abnormal Certificate Being Distributed (lien direct) |
Récemment, il y a eu un taux de distribution élevé de logiciels malveillants en utilisant des certificats anormaux.Les logiciels malveillants se déguisent souvent avec des certificats normaux.Cependant, dans ce cas, les logiciels malveillants ont saisi les informations de certificat au hasard, le nom du sujet et les champs de noms émetteur ayant des chaînes inhabituellement longues.En conséquence, les informations sur le certificat ne sont pas visibles dans les systèmes d'exploitation Windows, et un outil ou une infrastructure spécifique est nécessaire pour inspecter la structure de ces certificats.Bien sûr, ces certificats échouent en vérification de signature depuis ...
Recently, there has been a high distribution rate of malware using abnormal certificates. Malware often disguise themselves with normal certificates. However, in this case, the malware entered the certificate information randomly, with the Subject Name and Issuer Name fields having unusually long strings. As a result, the certificate information is not visible in Windows operating systems, and a specific tool or infrastructure is required to inspect the structure of these certificates. Of course, these certificates fail in signature verification since... |
Malware Tool | ★★★ | |
|
2023-10-09 19:47:00 | Le fonctionnement derrière les logiciels espions mobiles de Predator est \\ 'échelle industrielle \\' Operation Behind Predator Mobile Spyware Is \\'Industrial Scale\\' (lien direct) |
L'Intellexa Alliance utilise une gamme d'outils pour intercepter et renverser les technologies mobiles et Wi-Fi pour déployer ses outils de surveillance, selon une enquête d'Amnesty International et d'autres.
The Intellexa alliance has been using a range of tools for intercepting and subverting mobile and Wi-Fi technologies to deploy its surveillance tools, according to an investigation by Amnesty International and others. |
Tool | ★★ | |
|
2023-10-09 15:21:57 | Dévoilant \\ 'STESIN \\' Alive \\ ': un examen plus approfondi d'une campagne en cours en Asie ciblant les télécommunications et les entités gouvernementales Unveiling \\'Stayin\\' Alive\\': A Closer Look at an Ongoing Campaign in Asia Targeting Telecom and Governmental Entities (lien direct) |
 Faits saillants: Check Point Research a suivi "STESHIN \\ 'Alive", une campagne d'espionnage en cours opérant en Asie, et ciblant principalement l'industrie des télécommunications, ainsi que des organisations gouvernementales.La campagne «Stayin \\ 'Alive» utilisée contre des organisations asiatiques de grande envergure, ciblait initialement des organisations au Vietnam, en Ouzbékistan et au Kazakhstan.Alors que nous effectuons notre analyse, nous avons réalisé que cela faisait partie d'une campagne beaucoup plus large ciblant la région.Les outils observés dans la campagne sont liés à \\ 'Toddycat \' - un acteur affilié chinois opérant dans la région des clients de point de contrôle en utilisant le point final de Check Point Harmony et l'émulation de menace restent protégés contre la campagne détaillée dans ce rapport [& # 8230;]
 Highlights: Check Point Research has been tracking “Stayin\' Alive”, an ongoing espionage campaign operating in Asia, and primarily targeting the Telecom industry, as well as government organizations. The “Stayin\' Alive” campaign used against high-profile Asian organizations, initially targeted organizations in Vietnam, Uzbekistan, and Kazakhstan. As we conducted our analysis, we realized that it is part of a much wider campaign targeting the region. Tools observed in the campaign are linked to \'ToddyCat\'- a Chinese affiliated actor operating in the region Check Point customers using Check Point Harmony Endpoint and Threat Emulation remain protected against the campaign detailed in this report […]
|
Threat Tool | ★★ | |
|
2023-10-09 14:19:54 | Découvrez l\'adresse IP de vos contacts Telegram facilement avec ce script (lien direct) | Un script permet de trouver l'adresse IP d'un interlocuteur sur Telegram pour résoudre des problèmes réseau ou collaborer. Il faut installer Telegram Desktop et l'outil d'analyse réseau tshark. Le script, destiné à des fins éducatives, doit être utilisé avec l'autorisation de la personne concernée. | Tool | ★★★★ | |
|
2023-10-09 12:30:13 | Rust à métal nu dans Android Bare-metal Rust in Android (lien direct) |
Posted by Andrew Walbran, Android Rust Team
Last year we wrote about how moving native code in Android from C++ to Rust has resulted in fewer security vulnerabilities. Most of the components we mentioned then were system services in userspace (running under Linux), but these are not the only components typically written in memory-unsafe languages. Many security-critical components of an Android system run in a “bare-metal” environment, outside of the Linux kernel, and these are historically written in C. As part of our efforts to harden firmware on Android devices, we are increasingly using Rust in these bare-metal environments too.
To that end, we have rewritten the Android Virtualization Framework\'s protected VM (pVM) firmware in Rust to provide a memory safe foundation for the pVM root of trust. This firmware performs a similar function to a bootloader, and was initially built on top of U-Boot, a widely used open source bootloader. However, U-Boot was not designed with security in a hostile environment in mind, and there have been numerous security vulnerabilities found in it due to out of bounds memory access, integer underflow and memory corruption. Its VirtIO drivers in particular had a number of missing or problematic bounds checks. We fixed the specific issues we found in U-Boot, but by leveraging Rust we can avoid these sorts of memory-safety vulnerabilities in future. The new Rust pVM firmware was released in Android 14.
As part of this effort, we contributed back to the Rust community by using and contributing to existing crates where possible, and publishing a number of new crates as well. For example, for VirtIO in pVM firmware we\'ve spent time fixing bugs and soundness issues in the existing virtio-drivers crate, as well as adding new functionality, and are now helping maintain this crate. We\'ve published crates for making PSCI and other Arm SMCCC calls, and for managing page tables. These are just a start; we plan to release more Rust crates to support bare-metal programming on a range of platforms. These crates are also being used outside of Android, such as in Project Oak and the bare-metal section of our Comprehensive Rust course.
Training engineers
Many engineers have been positively surprised by how p |
Tool Vulnerability | ★★ | |
|
2023-10-09 10:00:00 | Mois de sensibilisation à la cybersécurité: Habitudes scolaires pour vous protéger, vous et votre famille, Cybersecurity Awareness Month: School habits to protect you and your family (lien direct) |
Retour à l'école est le moment idéal pour se souvenir des meilleures pratiques de base de la cybersécurité pour vous protéger, vous et votre famille.Ceux-ci ne surprennent que quiconque a été parent depuis quelques années, mais ce qui pourrait vous surprendre, c'est à quelle vitesse les choses changent, ce qui peut augmenter votre risque de donner accès aux cybercriminels.C'est principalement autour de toutes les applications, et même des micro-applications, qui fournissent le plus souvent les niveaux de sécurité les plus bas. applications, applications, applications, tout a une application. Les écoles travaillent dur pour moderniser, améliorer la communication, rationaliser l'apprentissage, etc.Pour ce faire, de nombreuses écoles utilisent des applications.L'utilisation d'applications mobiles, en particulier pour les téléphones, est un effort pour démocratiser l'accès à l'information, car vous ne devez pas utiliser un ordinateur ou un Wi-Fi pour accéder à ces applications.Tout ce dont vous avez besoin est un appareil mobile. La bonne nouvelle consiste à utiliser ces applications pour consommer des informations est généralement sûre.Vous pouvez voir les notes, la fréquentation, les annonces scolaires, etc., et parce qu'elle est principalement à sens unique et ndash;partager des informations avec vous & ndash;vous & rsquo; est généralement sûr.Voir la note sur les mots de passe ci-dessous, mais sur ce front, vous pouvez vous détendre. La mauvaise nouvelle, ou zone de danger, est lorsque vous entrez des informations dans cette application.Cela commence à devenir plus compliqué parce que les menaces de sécurité commencent à avoir des niveaux.Voici comment y penser: Assurez-vous que l'application que vous utilisez est légitime.Des choses comme les codes QR (ces boîtes sur lesquelles vous pointez votre appareil photo, et un site Web lance) et les e-mails sont souvent comment vous avez dit d'obtenir une application.Les deux outils et ndash;Codes QR et e-mail & ndash;peut être truqué.Si vous cliquez et suivez, vous pouvez vous retrouver dans un endroit dangereux.Au lieu de cela, vous devez vérifier l'emplacement que vous visitez est authentique.Parfois, ce n'est pas facile. La meilleure façon de vous assurer que vous êtes au bon endroit n'est pas d'utiliser des codes QR ou de suivre les liens électroniques qui sont ouverts afin que vous puissiez voir l'URL .Il vaut mieux entrer l'adresse URL directement dans votre navigateur, garantissant qu'il suit les conventions normales (les écoles utilisent généralement .edu, .gov, etc.).Les applications commerciales auront des URL .com;Vous devriez également être en mesure de rechercher le nom de l'application en ligne pour confirmer l'adresse. ne pas utiliser le même mot de passe que vous utilisez pour des choses importantes.Même si l'application semble légitime, créez un mot de passe que vous utilisez pour les choses scolaires.Vous voulez que ce soit différent parce que s'il y a une brèche, les méchants sont en association de votre nom à un mot de passe que vous utilisez pour votre carte bancaire, votre carte de crédit ou même votre e-mail. Don & rsquo; t n'entrez pas d'informations personnelles sur vous ou votre enfant. Si elle est requise pour l'école, l'école doit avoir vos informations en auto-peuplées (déjà remplies).C'est leur responsabilité.De nombreuses applications vous permettent de faire plus pour personnaliser des informations sur votre enfant et votre famille, et nous vous exhortons à considérer ce que vous êtes prêt à partager.Le dicton est ce qui est partagé sur Internet sur Internet.Il existe des nuances et des moyens de supprimer les informations, mais généralement, en particulier aux États-Unis, où les lois sur la confidentialité sont toujours en développement, il est sûr de supposer que c'est le cas. Cela signifie que vous ne souhaitez pas joindre aucune infor | Tool | ★★ | |
|
2023-10-08 18:00:00 | Les mainteneurs mettent en garde contre la vulnérabilité affectant l'outil de source ouverte fondamentale Maintainers warn of vulnerability affecting foundational open-source tool (lien direct) |
Les mainteneurs d'un outil open source populaire qui sert de support fondamental pour de nombreux protocoles de réseau comme SSL, TLS, HTTP, FTP, SMTP avertissent deux vulnérabilités qui seront annoncées la semaine prochaine.Les problèmes Centre de Curl, un outil de ligne de commande open source qui, selon les chercheurs, est largement utilisé par les développeurs et le système
The maintainers of a popular open source tool that serves as a foundational support for many network protocols like SSL, TLS, HTTP, FTP, SMTP are warning of two vulnerabilities that will be announced this coming week. The issues center on curl, an open-source command-line tool that researchers said is used widely by developers and system |
Tool Vulnerability | ★★★ | |
|
2023-10-06 19:59:00 | RIT est la première université à recevoir le soutien du Google Cybersecurity Clinics Fund RIT Is the First University to Receive Support From the Google Cybersecurity Clinics Fund (lien direct) |
Les mainteneurs d'un outil open source populaire qui sert de support fondamental pour de nombreux protocoles de réseau comme SSL, TLS, HTTP, FTP, SMTP avertissent deux vulnérabilités qui seront annoncées la semaine prochaine.Les problèmes Centre de Curl, un outil de ligne de commande open source qui, selon les chercheurs, est largement utilisé par les développeurs et le système
The maintainers of a popular open source tool that serves as a foundational support for many network protocols like SSL, TLS, HTTP, FTP, SMTP are warning of two vulnerabilities that will be announced this coming week. The issues center on curl, an open-source command-line tool that researchers said is used widely by developers and system |
Ransomware Tool | ★★ | |
|
2023-10-06 15:51:00 | Un nouvel outil d'OS vous indique qui a accès à quelles données New OS Tool Tells You Who Has Access to What Data (lien direct) |
Assurer que les données sensibles restent confidentielles, protégées contre l'accès non autorisé et conforme aux réglementations de confidentialité des données sont primordiales.Les violations de données entraînent des dommages financiers et de réputation, mais entraînent également des conséquences juridiques.Par conséquent, des mesures de sécurité d'accès aux données robustes sont essentielles pour protéger les actifs d'une organisation, maintenir la confiance des clients et répondre aux exigences réglementaires.
UN
Ensuring sensitive data remains confidential, protected from unauthorized access, and compliant with data privacy regulations is paramount. Data breaches result in financial and reputational damage but also lead to legal consequences. Therefore, robust data access security measures are essential to safeguard an organization\'s assets, maintain customer trust, and meet regulatory requirements. A |
Tool | ★★★ | |
|
2023-10-06 14:15:12 | CVE-2023-42445 (lien direct) | Gradle est un outil de construction en mettant l'accent sur l'automatisation de la construction et la prise en charge du développement multi-langues.Dans certains cas, lorsque Gradle analyse les fichiers XML, la résolution des entités externes XML n'est pas désactivée.Combiné avec une attaque XXE hors bande (OOB-XXE), le simple d'analyse XML peut conduire à l'exfiltration de fichiers texte locaux sur un serveur distant.Gradle analyse les fichiers XML à plusieurs fins.La plupart du temps, les fichiers XML Gradle parses qu'il ont générés ou étaient déjà présents localement.Seuls les descripteurs XML IVY et les fichiers Maven POM peuvent être récupérés à partir de référentiels distants et analysés par Gradle.Dans Gradle 7.6.3 et 8.4, la résolution des entités externes XML a été désactivée pour tous les cas d'utilisation pour se protéger contre cette vulnérabilité.Gradle refusera désormais d'analyser les fichiers XML qui ont des entités externes XML.
Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, when Gradle parses XML files, resolving XML external entities is not disabled. Combined with an Out Of Band XXE attack (OOB-XXE), just parsing XML can lead to exfiltration of local text files to a remote server. Gradle parses XML files for several purposes. Most of the time, Gradle parses XML files it generated or were already present locally. Only Ivy XML descriptors and Maven POM files can be fetched from remote repositories and parsed by Gradle. In Gradle 7.6.3 and 8.4, resolving XML external entities has been disabled for all use cases to protect against this vulnerability. Gradle will now refuse to parse XML files that have XML external entities. |
Tool | ||
|
2023-10-06 14:08:16 | Certains méta-employés et agents de sécurité ont piraté des comptes d'utilisateurs Some Meta Employees and Security Guards Hacked User Accounts (lien direct) |
> Par deeba ahmed
Les personnes licenciées comprenaient des agents de sécurité sur le contrat qui travaillaient pour Meta et pouvaient accéder à un outil interne pour les employés.
Ceci est un article de HackRead.com Lire le post original: Certains méta-employés etLes gardes de sécurité ont piraté des comptes d'utilisateurs
>By Deeba Ahmed The fired individuals included on-contract security guards who worked for Meta and could access an internal tool for employees. This is a post from HackRead.com Read the original post: Some Meta Employees and Security Guards Hacked User Accounts |
Tool | ★★★ | |
|
2023-10-06 08:54:04 | " Utiliser l\'IA pour combattre les cyberattaques " (lien direct) | " Utiliser l'IA pour combattre les cyberattaques " Pour Olivier Dedieu, Directeur technique et co-fondateur de Jalios, l'IA générative permet aux entreprises de limiter les risques de fuite de données à condition d'entretenir une gouvernance forte et d'utiliser des outils souverains. - Points de Vue | Tool | ★★ | |
|
2023-10-06 07:52:00 | IBM s'appuie sur l'IA pour les services de sécurité gérés IBM leans into AI for managed security services (lien direct) |
IBM déploie les services gérés basés sur l'IA qui promettent d'aider les équipes de réseau et d'opérations de sécurité plus rapidement et efficacement à répondre aux cyber-menaces d'entreprise. Géré par le groupe IBM Consulting, la détection et la réponse des menaces(TDR) Les services offrant des promesses promettent une surveillance, une enquête et une correction automatisées des alertes de sécurité des outils de sécurité existants ainsi que du cloud, des systèmes de technologie sur site et de la technologie opérationnelle en utilisant le réseau d'entreprise.Les Services peuvent intégrer des informations de plus de 15 outils de gestion de la sécurité et de gestion des incidents (SIEM) et plusieurs packages de détection et de réponse de la détection et de réponse de réseau tiers, par exemple. Pour lire cet article en entier, veuillez cliquer ici
IBM is rolling out AI-based managed services that promise to help network and security operations teams more quickly and effectively respond to enterprise cyber threats.Managed by the IBM Consulting group, the Threat Detection and Response (TDR) Services offering promises 24x7 monitoring, investigation, and automated remediation of security alerts from existing security tools as well as cloud, on-premises, and operational technology systems utilizing the enterprise network. The services can integrate information from more than 15 security event and incident management (SIEM) tools and multiple third-party endpoint and network detection and response packages, for example.To read this article in full, please click here |
Threat Tool | ★★ | |
 |
2023-10-06 03:20:54 | Top outils de test de pénétration de la cybersécurité pour 2023 (triée sur le volet) Top Cybersecurity Penetration Testing Tools for 2023 (Handpicked) (lien direct) |
Introduction: Pourquoi les outils de test de pénétration sont-ils indispensables?Dans un paysage numérique chargé de cyber-menaces en évolution, la question n'est pas
Introduction: Why Are Penetration Testing Tools Indispensable? In a digital landscape fraught with evolving cyber threats, the question is no |
Tool | ★★★★ | |
|
2023-10-05 21:14:00 | Exploite de l'annulation de l'EDR / XDR avec ces contre-mesures Quash EDR/XDR Exploits With These Countermeasures (lien direct) |
Avec des outils et des groupes de pirates en train d'échapper aux défenses, l'élargissement de la cybersécurité au-delà de la sécurité des points finaux devient cruciale.
With tools and hacker groups constantly evading defenses, expanding cybersecurity beyond endpoint security becomes crucial. |
Tool | ★★★ | |
|
2023-10-05 21:08:00 | Microsoft: les attaques de ransomwares opérationnelles humaines ont triplé au cours de l'année dernière Microsoft: Human-operated ransomware attacks tripled over past year (lien direct) |
Les attaques de ransomwares opérationnelles humaines ont augmenté de plus de 200% depuis septembre 2022, selon des chercheurs de Microsoft, qui ont averti qu'il pourrait représenter un changement dans la cybercriminalité souterraine.Les attaques axées sur l'human
Human-operated ransomware attacks are up more than 200% since September 2022, according to researchers from Microsoft, who warned that it could represent a shift in the cybercrime underground. Human-operated attacks typically involve the active abuse of remote monitoring and management tools that allow hackers to leave behind less evidence - as opposed to automated attacks |
Ransomware Tool | ★★ |
To see everything:
Our RSS (filtrered)
