What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2023-11-30 15:00:00 | 8 conseils sur la mise en œuvre des outils d'IA sans compromettre la sécurité 8 Tips on Leveraging AI Tools Without Compromising Security (lien direct) |
Les outils d'IA peuvent fournir des résultats rapides et faciles et offrir d'énormes avantages commerciaux - mais ils apportent également des risques cachés.
AI tools can deliver quick and easy results and offer huge business benefits - but they also bring hidden risks. |
Tool | ★★ | |
 |
2023-11-30 14:00:00 | Les logiciels malveillants du voleur Redline déploient via l'outil d'évasion Scrubcrypt RedLine Stealer Malware Deployed Via ScrubCrypt Evasion Tool (lien direct) |
Le nouvel outil d'obscurcissement des broussailles est conçu pour éviter les protections antivirus
The new ScrubCrypt obfuscation tool is designed to avoid antivirus protections |
Malware Tool | ★★★ | |
 |
2023-11-30 13:00:15 | L'information est le pouvoir, mais la désinformation est tout aussi puissante Information is power, but misinformation is just as powerful (lien direct) |
> Les techniques de désinformation et de manipulation employées par les cybercriminels deviennent de plus en plus sophistiquées en raison de la mise en œuvre de l'intelligence artificielle dans leurs systèmes que l'ère post-vérité a atteint de nouveaux sommets avec l'avènement de l'intelligence artificielle (IA).Avec la popularité croissante et l'utilisation d'outils d'IA génératifs tels que Chatgpt, la tâche de discerner entre ce qui est réel et faux est devenu plus compliqué, et les cybercriminels tirent parti de ces outils pour créer des menaces de plus en plus sophistiquées.Vérifier Pont Software Technologies a constaté qu'une entreprise sur 34 a connu une tentative d'attaque de ransomware au cours des trois premiers trimestres de 2023, une augmentation [& # 8230;]
>The disinformation and manipulation techniques employed by cybercriminals are becoming increasingly sophisticated due to the implementation of Artificial Intelligence in their systems The post-truth era has reached new heights with the advent of artificial intelligence (AI). With the increasing popularity and use of generative AI tools such as ChatGPT, the task of discerning between what is real and fake has become more complicated, and cybercriminals are leveraging these tools to create increasingly sophisticated threats. Check Pont Software Technologies has found that one in 34 companies have experienced an attempted ransomware attack in the first three quarters of 2023, an increase […] |
Ransomware Tool | ChatGPT ChatGPT | ★★ |
 |
2023-11-30 11:00:00 | Sécration sécurisée: un guide pour parcourir Internet en toute sécurité Secure browsing: A guide to browsing the internet safely (lien direct) |
The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. In an age when the internet is an integral part of our daily lives, ensuring your online safety and privacy is critical. Secure browsing is about protecting sensitive personal information and yourself from cyber threats such as malware, phishing, and hacking. This article delves into the various aspects of web browsing securely, from understanding the risks to implementing best practices and using the right tools to improve your online security. Understanding the risks Before delving into secure browsing techniques, it\'s critical to understand the risks. The internet is full of hazards, and a lack of awareness can leave you vulnerable. Here are a few of the most common dangers: Malware: When you download files, click on untrustworthy links, or visit compromised websites, malicious software can infect your device. Malware can steal your data, damage your system, or track your online activities once infected. Phishing: Phishing attacks involve duping users into disclosing sensitive information such as login credentials, credit card information, or personal information. These attacks frequently disguise themselves as legitimate emails or websites. Data protection: Many websites and online services collect and share your personal information without your permission, which can invade privacy and unwanted tracking. Hacking: Cybercriminals may try to gain unauthorized access to your accounts or devices, resulting in financial loss and damage to your online identity. Unsecured connections: Unsecured Wi-Fi networks expose your data to interception, as attackers can intercept your data. Browsing safely Now that you know the dangers, let\'s look at how to browse the web safely. Use a secure browser: Select a browser with a strong reputation for security features. Google Chrome, Mozilla Firefox, and Microsoft Edge provide regular security updates. Maintain software updates: Regularly update your browser and other software to patch vulnerabilities that cybercriminals may exploit. Use strong, unique passwords: Use solid, one-time passwords for each online account. To keep track of complex passwords, consider using a password manager. Enable two-factor authentication (2FA): Enable two-factor authentication wherever possible to add an extra layer of security to your online accounts. Stay informed: To stay informed about emerging threats and vulnerabilities, keep up with the latest cybersecurity news and best practices. Exercise caution with Email: Unsolicited emails should be avoided, especially those with attachments or links. Check the sender\'s identity before clicking on any links or downloading attachments. Use HTTPS: Look for HTTPS (secure browsing protocol) websites. Most modern browsers display a padlock icon in the address bar for secure sites. Install ad blockers and privacy extensions: Browser extensions such as uBlock Origin, Privacy Badger, and HTTPS Everywhere can help you protect your online privacy by blocking advertisements, tracking scripts, and forcing secure connections. Avoid public Wi-Fi for sensitive transactions: Avoid using public Wi-Fi networks when conducting sensitive transactions such as online banking or shopping. Consider using a Virtual Private Network (VPN) to encrypt your connection if you must use public Wi-Fi. Regularly clear browser data: Clear your browsing history, cookies, and cached data regularly to reduce your digital footprint. Tools for secure browsing Virtual private networks (VPNs): VPNs encrypt your internet connection, ma | Malware Tool Vulnerability Threat | LastPass LastPass | ★★ |
 |
2023-11-30 09:50:48 | Etude Afnic Réussir avec le web : La présence en ligne des TPE et PME françaises progresse, leurs pratiques de cybersécurité aussi (lien direct) | L'étude met en lumière d'importants progrès dans l'approche des micro-entreprises, TPE et PME françaises en matière de cybersécurité de leur présence en ligne. Cependant, elle révèle également un léger recul dans leur appropriation des outils visant à optimiser leur réputation et leur visibilité sur internet. L'Afnic, association en charge de plusieurs extensions parmi lesquelles le .fr, livre aujourd'hui les résultats de la 6ème édition de son étude Réussir avec le web, réalisée via son programme (...) - Points de Vue | Tool | ★★★ | |
 |
2023-11-30 06:00:38 | L'avenir de la conformité: suivre le rythme d'un paysage en constante évolution The Future of Compliance: Keeping Pace with an Ever-Changing Landscape (lien direct) |
Nothing stands still in cybersecurity-and that includes compliance. Just as new threats drive the need for new deterrents, new technologies and evolving business practices drive the need for greater oversight. Over the last few years, compliance, regulation and governance have begun evolving faster than we have seen for some time. This has been in response to rapid changes we\'ve seen ripple across industries caused by new technologies, like artificial intelligence (AI) and machine learning, and new ways of doing business launched in response to the pandemic. In this blog, we explore what has changed within the world of compliance over the last few years and where things are likely heading. On compliance trends Like many industries, compliance and regulation tend to follow market trends. If we go back a few years, we saw a raft of privacy legislation introduced in the wake of the European Union\'s introduction of the General Data Protection Regulation (GDPR). High profile events also tend to shift the attitudes of regulators. For example, financial services companies found themselves in the spotlight following the 2008 economic crash, while the auto industry faced similar scrutiny after the emissions scandal. During these times, regulators tend to turn their attention to enforcement, and they are willing to make an example of a company if that\'s what\'s needed to improve things. Over the years, many regulators have become much more aggressive in this area, expanding their scope and proactively applying their rules. Of course, technology drives regulatory change, too. The pandemic has recently accelerated the mass adoption of collaborative technologies and communication channels like Microsoft Teams, Zoom, Slack and many more. The availability and advancement of these channels have changed how we communicate and how we access and share data, both inside and outside of our organizations. In turn, compliance requirements have had to adapt to accommodate new ways of working. On AI and ML compliance Over the last two or three years, we have seen exciting advances in generative AI. But it has also made possible some fundamental capabilities that will become incredibly important. For example, in a world with so many claims of fake news and misrepresentation, the ability to retain immutable records is a big deal. “Immutable” effectively means that something cannot be changed and cannot be hacked. This is huge not just from a source of truth perspective but also regarding reproducibility. As we use AI tools en masse, questions will be asked about why specific systems are making certain decisions. Is AI discriminating against specific ZIP codes, for example? And if not, can those in charge of these systems prove that? In many cases, doing so will take work. AI could be better at explaining how it gets to its decisions. In order to do so, businesses will need to return to the original, immutable data. And as they become increasingly information-intensive, getting back to that source data sets a high bar of capability. AI\'s ability to process vast data sets will also raise concerns around testing. Before any organization puts a system or platform into the world, potential users want to be confident that it has been suitably tested. But even if a company spends millions of dollars testing a system, it will still sometimes fail-and errors will get through. In the past, we could accept a failure rate of, say, one in a million. But today\'s software is much more complex than anything we\'ve been able to produce in the past. So, a one-in-a-million failure rate in a system running 100, 200 or 300 million events in a day quickly adds up to widespread failures. Regulators will need to iron out how they intend to protect consumers and the markets from issues like these and set clear guidelines regarding who, ultimately, is accountable. On the future of compliance Current trends are likely to continue to drive the development of compliance management. Currently, we\'re seeing a lot of instability. While t | Tool Legislation | ★★ | |
|
2023-11-30 01:00:00 | Rundown of Security News d'Aws Re: Invent 2023 Rundown of Security News from AWS re:Invent 2023 (lien direct) |
Amazon Web Services a annoncé des améliorations à plusieurs de ses outils de sécurité, notamment GuardDuty, Inspector, Detective, IAM Access Analyzer et Secrets Manager, pour n'en nommer que quelques-uns lors de son événement Re: Invent.
Amazon Web Services announced enhancements to several of its security tools, including GuardDuty, Inspector, Detective, IAM Access Analyzer, and Secrets Manager, to name a few during its re:Invent event. |
Tool | ★★ | |
 |
2023-11-29 21:05:00 | CISA warns of attacks on Unitronics tool used by water utilities, wastewater systems (lien direct) |
Le gouvernement fédéral avertit que les pirates ciblent un outil spécifique utilisé par les systèmes d'eau et d'eaux usées après que deux services publics ont annoncé des attaques cette semaine.L'Agence de sécurité de la cybersécurité et de l'infrastructure (CISA) a déclaré qu'elle répondait au Exploitation active des contrôleurs logiques programmables unitroniques (PLC) utilisés par de nombreuses organisations du secteur de l'eau.Cisa
The federal government is warning that hackers are targeting a specific tool used by water and wastewater systems after two utilities announced attacks this week. The Cybersecurity and Infrastructure Security Agency (CISA) said it is responding to the active exploitation of Unitronics programmable logic controllers (PLCs) used by many organizations in the water sector. CISA |
Tool Industrial | ★★★ | |
|
2023-11-29 20:16:43 | La mise à jour de Mitre ATT & CK comprend la découverte Wi-Fi, l'évasion de la défense et les tactiques de mascarading MITRE ATT&CK Update Includes Wi-Fi Discovery, Defense Evasion and Masquerading Tactics (lien direct) |
Ce matin, cardinalops a annoncé leur contribution à mitre att & amp; ck v14, le cadre standard de l'industrie pour comprendre les catégories de jeu et le comportement.
-
nouvelles commerciales
This morning, CardinalOps announced their contribution to MITRE ATT&CK v14, the industry-standard framework for understanding cyber adversary playbooks and behavior. - Business News |
Tool | ★★★★ | |
|
2023-11-29 17:45:00 | Extension de surveillance temporaire pour rouler sur le projet de loi sur la politique de défense Temporary surveillance extension to ride on defense policy bill (lien direct) |
Les législateurs américains devraient joindre une prolongation à court terme d'un outil de surveillance controversé au projet de loi final de politique de défense de cette année, a déclaré une source de future nouvelle enregistrée.En atteignant un renouvellement temporaire de l'article 702 de la Foreign Intelligence Surveillance Act - qui devrait expirer à la fin de l'année civile
U.S. lawmakers are expected to attach a short-term extension of a controversial surveillance tool to this year\'s final defense policy bill, a congressional source told Recorded Future News. By hitching a temporary renewal of Section 702 of the Foreign Intelligence Surveillance Act - which is set to expire at the end of the calendar year |
Tool | ★★ | |
 |
2023-11-29 15:45:49 | Les centres de données, moteurs invisibles du changement (lien direct) | En plus d'être des outils essentiels de notre société numérique, les centres de données deviennent aujourd'hui des outils essentiels de la décarbonisation. | Tool | ★★ | |
|
2023-11-29 12:40:09 | Jeux P2E, escroqueries aux œuvres de bienfaisance et deepfakes vocaux : ce que 2024 réserve au grand public (lien direct) | Dans le cadre du Kaspersky Security Bulletin (KSB), les experts en cybersécurité de la société présentent leurs prévisions détaillées pour l'année 2024, portant aujourd'hui sur les menaces auxquelles les consommateurs pourraient être confrontés au cours de l'année à venir. Les prévisions pour 2024 font état d'un large éventail de défis, où les cybercriminels vont de plus en plus tirer profit des sujets tendances et des outils fournis par les technologies de pointe. Augmentation des escroqueries aux œuvres de (...) - Malwares | Tool Threat | ★★ | |
 |
2023-11-29 11:43:49 | CISA prévoit de lancer l'outil ReadySetcyber au début de 2024 pour intégrer la cybersécurité dans les décisions commerciales CISA plans to launch ReadySetCyber tool in early 2024 to integrate cybersecurity into business decisions (lien direct) |
L'Agence américaine de sécurité de la cybersécurité et de l'infrastructure (CISA) a fourni mardi un aperçu du lancement de ...
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) provided on Tuesday a sneak peek into the launch of... |
Tool Industrial | ★★★ | |
 |
2023-11-29 08:15:46 | Filmora 13, le logiciel de montage vidéo assisté par IA, sort sa nouvelle version (lien direct) | — Article en partenariat avec Wondershare — Vous vous souvenez de mon article de présentation du logiciel de montage vidéo Filmora 12 il y a 5 mois ? Et bien comme c’est le cas pour de nombreux outils utilisant l’intelligence artificielle, les choses avancent vite. Parfois très très vite. Du coup, Filmora 13 est déjà … Suite | Tool | ★★ | |
 |
2023-11-29 00:00:00 | Les prédictions cyber 2024 du Threat Lab WatchGuard (lien direct) | Paris, le 29 novembre 2023 – WatchGuard® Technologies, l'un des leaders mondiaux de la cybersécurité unifiée publie ses prévisions pour 2024 en matière de cybersécurité. Le rapport couvre les attaques et les tendances en matière de sécurité de l'information qui, selon l'équipe de recherche du WatchGuard Threat Lab, émergeront en 2024, telles que : la manipulation des modèles linguistiques basés sur l'IA (les LLM ou Large Language Model qui ont donné naissance à des outils tels que ChatGPT ) ; les " Vishers " qui étendent leurs opérations malveillantes grâce aux chatbots vocaux basés sur l'IA ; les piratages de casques VR/MR modernes. Corey Nachreiner, Chief Security Officer chez WatchGuard Technologies explique : " Chaque nouvelle tendance technologique ouvre de nouveaux vecteurs d'attaque pour les cybercriminels. En 2024, les menaces émergentes ciblant les entreprises et les particuliers seront encore plus intenses, complexes et difficiles à gérer. Face à la pénurie de profils qualifiés en cybersécurité, le besoin de fournisseurs de services managés (MSP), de sécurité unifiée et de plateformes automatisées pour renforcer la cybersécurité et protéger les entreprises contre un éventail de menaces en constante évolution n'a jamais été aussi grand ". Voici un résumé des principales prévisions de l'équipe du WatchGuard Threat Lab en matière de cybersécurité pour 2024 : L'ingénierie de pointe permettra de manipuler les grands modèles de langages (LLM) : Les entreprises et les particuliers ont recours aux LLM pour améliorer leur efficacité opérationnelle. Or, les acteurs de la menace apprennent à exploiter les LLM à leurs propres fins malveillantes. En 2024, le WatchGuard Threat Lab prévoit qu'un ingénieur de requêtes avisé, qu'il s'agisse d'un attaquant criminel ou d'un chercheur, pourra déchiffrer le code et manipuler un LLM pour qu'il divulgue des données privées. Les ventes d'outils d'hameçonnage ciblé basés sur l'IA vont exploser sur le dark web : Les cybercriminels peuvent d'ores et déjà acheter sur le marché noir des outils qui envoient des emails non sollicités, rédigent automatiquement des textes convaincants et épluchent Internet et les médias sociaux à la recherche d'informations et de connaissances relatives à une cible particulière. Toutefois, bon nombre de ces outils sont encore manuels et les attaquants doivent cibler un seul utilisateur ou groupe de personnes à la fois. Les tâches clairement formatées de ce type se prêtent parfaitement à l'automatisation par le biais de l'intelligence artificielle et de l'apprentissage automatique. Il est donc probable que les outils alimentés par l'IA deviendront des best-sellers sur le dark web en 2024. L'hameçonnage vocal (vishing) basé sur l'IA aura le vent en poupe en 2024 : Bien que la voix sur IP (VoIP) et la technologie de l'automatisation facilitent la composition en masse de milliers de numéros, une fois qu'une victime potentielle se présente, un escroc humain est toujours nécessaire pour l'attirer dans ses filets. Ce système limite l'ampleur des opérations de vishing. Mais en 2024, la situation pourrait changer. WatchGuard prévoit que la combinaison de deepfake audio convaincants et de LLM capables de mener des conversations avec des victimes peu méfiantes augmentera considérablement l'ampleur et le volume des appels de vishing. Qui plus est, ces appels pourraient même ne p | Tool Threat Prediction | ChatGPT ChatGPT | ★★★ |
|
2023-11-28 23:05:04 | Prédictions 2024 de Proofpoint \\: Brace for Impact Proofpoint\\'s 2024 Predictions: Brace for Impact (lien direct) |
In the ever-evolving landscape of cybersecurity, defenders find themselves navigating yet another challenging year. Threat actors persistently refine their tactics, techniques, and procedures (TTPs), showcasing adaptability and the rapid iteration of novel and complex attack chains. At the heart of this evolution lies a crucial shift: threat actors now prioritize identity over technology. While the specifics of TTPs and the targeted technology may change, one constant remains: humans and their identities are the most targeted links in the attack chain. Recent instances of supply chain attacks exemplify this shift, illustrating how adversaries have pivoted from exploiting software vulnerabilities to targeting human vulnerabilities through social engineering and phishing. Notably, the innovative use of generative AI, especially its ability to improve phishing emails, exemplifies a shift towards manipulating human behavior rather than exploiting technological weaknesses. As we reflect on 2023, it becomes evident that cyber threat actors possess the capabilities and resources to adapt their tactics in response to increased security measures such as multi-factor authentication (MFA). Looking ahead to 2024, the trend suggests that threats will persistently revolve around humans, compelling defenders to take a different approach to breaking the attack chain. So, what\'s on the horizon? The experts at Proofpoint provide insightful predictions for the next 12 months, shedding light on what security teams might encounter and the implications of these trends. 1. Cyber Heists: Casinos are Just the Tip of the Iceberg Cyber criminals are increasingly targeting digital supply chain vendors, with a heightened focus on security and identity providers. Aggressive social engineering tactics, including phishing campaigns, are becoming more prevalent. The Scattered Spider group, responsible for ransomware attacks on Las Vegas casinos, showcases the sophistication of these tactics. Phishing help desk employees for login credentials and bypassing MFA through phishing one-time password (OTP) codes are becoming standard practices. These tactics have extended to supply chain attacks, compromising identity provider (IDP) vendors to access valuable customer information. The forecast for 2024 includes the replication and widespread adoption of such aggressive social engineering tactics, broadening the scope of initial compromise attempts beyond the traditional edge device and file transfer appliances. 2. Generative AI: The Double-Edged Sword The explosive growth of generative AI tools like ChatGPT, FraudGPT and WormGPT bring both promise and peril, but the sky is not falling as far as cybersecurity is concerned. While large language models took the stage, the fear of misuse prompted the U.S. president to issue an executive order in October 2023. At the moment, threat actors are making bank doing other things. Why bother reinventing the model when it\'s working just fine? But they\'ll morph their TTPs when detection starts to improve in those areas. On the flip side, more vendors will start injecting AI and large language models into their products and processes to boost their security offerings. Across the globe, privacy watchdogs and customers alike will demand responsible AI policies from technology companies, which means we\'ll start seeing statements being published about responsible AI policies. Expect both spectacular failures and responsible AI policies to emerge. 3. Mobile Device Phishing: The Rise of Omni-Channel Tactics take Centre Stage A notable trend for 2023 was the dramatic increase in mobile device phishing and we expect this threat to rise even more in 2024. Threat actors are strategically redirecting victims to mobile interactions, exploiting the vulnerabilities inherent in mobile platforms. Conversational abuse, including conversational smishing, has experienced exponential growth. Multi-touch campaigns aim to lure users away from desktops to mobile devices, utilizing tactics like QR codes and fraudulent voice calls | Ransomware Malware Tool Vulnerability Threat Mobile Prediction Prediction | ChatGPT ChatGPT | ★★★ |
|
2023-11-28 15:15:00 | DeepFake Digital Identity Fraud est décuplé, SumSub Report est constaté Deepfake Digital Identity Fraud Surges Tenfold, Sumsub Report Finds (lien direct) |
Les outils alimentés par l'IA sont parmi les principales techniques de fraude utilisées par les acteurs de la menace en 2023, selon le troisième rapport annuel de fraude d'identité de SumSub \\
AI-powered tools are among the top fraud techniques used by threat actors in 2023, according to Sumsub\'s third annual Identity Fraud Report |
Tool Threat | ★★ | |
|
2023-11-28 11:40:00 | Les cybercriminels hésitent à utiliser l'IA génératrice Cybercriminals Hesitant About Using Generative AI (lien direct) |
Une analyse des forums Web Dark a révélé que de nombreux acteurs de menace sont sceptiques quant à l'utilisation d'outils comme Chatgpt pour lancer des attaques
An analysis of dark web forums revealed many threat actors are skeptical about using tools like ChatGPT to launch attacks |
Tool Threat | ChatGPT ChatGPT | ★★ |
 |
2023-11-27 23:27:00 | Comment gérer la sécurité du SAAS de vente au détail le cyber lundi How to Handle Retail SaaS Security on Cyber Monday (lien direct) |
Si les prévisionnistes ont raison, au cours de la journée, les consommateurs dépenseront 13,7 milliards de dollars.À peu près tous les clics, la vente et l'engagement seront capturés par une plate-forme CRM.Les applications d'inventaire déclencheront des récompenses automatisées;Les outils de communication enverront des e-mails et des SMS automatisés confirmant les ventes et le partage des informations d'expédition.
Les applications SaaS soutenant les efforts de vente au détail hébergeront
If forecasters are right, over the course of today, consumers will spend $13.7 billion. Just about every click, sale, and engagement will be captured by a CRM platform. Inventory applications will trigger automated re-orders; communication tools will send automated email and text messages confirming sales and sharing shipping information. SaaS applications supporting retail efforts will host |
Tool Cloud | ★★ | |
|
2023-11-27 22:00:00 | Systèmes AI \\ 'soumis à de nouveaux types de vulnérabilités, \\' British and US Cyber Agencies Warn AI systems \\'subject to new types of vulnerabilities,\\' British and US cyber agencies warn (lien direct) |
Les autorités britanniques et américaines de la cybersécurité ont publié lundi des conseils sur la façon de développer des systèmes d'intelligence artificielle d'une manière qui minimisera les risques auxquels ils sont confrontés des méfaits aux pirates parrainés par l'État.«Les systèmes d'IA sont soumis à de nouveaux types de vulnérabilités», les 20 pagesDocument prévient - se référant spécifiquement aux outils d'apprentissage automatique.Les nouvelles directives ont
British and U.S. cybersecurity authorities published guidance on Monday about how to develop artificial intelligence systems in a way that will minimize the risks they face from mischief-makers through to state-sponsored hackers. “AI systems are subject to new types of vulnerabilities,” the 20-page document warns - specifically referring to machine-learning tools. The new guidelines have |
Tool Vulnerability | ★★★ | |
|
2023-11-27 09:26:51 | 8 sujets essentiels de cybersécurité à inclure dans votre programme de formation 8 Essential Cybersecurity Topics to Include in Your Training Program (lien direct) |
Your employees have a critical role to play as a first line of defense against cyberthreats. But to be effective, they need to know what those threats are-and stay apprised of how they\'re evolving. A comprehensive security awareness program is the key to helping your users grow their understanding of attackers\' methods and objectives so they can become more proactive defenders. That includes knowing what strategies malicious actors employ to manipulate people so they can use them to enable their campaigns. The importance of security awareness It\'s well worth taking the time to craft a meaningful and engaging security awareness program. By presenting the right mix of information to your users in a compelling way, you can empower them to help you improve your organization\'s security posture as well as create a more robust security culture overall. The cybersecurity topics that you include in your program should be relevant to your business and industry, of course. Companies face different cyberthreat challenges and regulatory compliance requirements related to data protection and data privacy. That said, there are several subjects that almost any modern business, regardless of its industry, will want to ensure its employees understand. We list eight of these cybersecurity topics below. They are the go-to approaches and tools that attackers around the world commonly use to compromise users and their accounts, disrupt normal business operations, steal money or data, and do other damage. Here\'s a high-level overview of these eight must-know cybersecurity topics: 1. Social engineering Social engineering is a collection of techniques malicious actors use to manipulate human psychology. Attackers rely on these strategies to trick or threaten users to take actions such as giving up account credentials, handing over sensitive data, running malicious code and transferring funds. They do this by taking advantage of users\': Emotions, by conveying a sense of urgency, generating excitement about an opportunity, or creating fear around losing money or doing something wrong Trust, by posing as someone familiar to the user or a trusted brand or authority-such as the Internal Revenue Service (IRS), UPS, Amazon or Microsoft Fatigue, by timing attacks when users are likely to be tired or distracted and more inclined to let their “emotional mind” guide their decision-making Common social engineering tactics include phishing-which we cover in the next section-and these others: Social media reconnaissance. Attackers often turn to social media to gather information about users that they target with their campaigns. These efforts can include direct outreach to users. Vishing (voice phishing) and smishing (SMS/text phishing). Vishing is the fraudulent practice of making phone calls or leaving voice messages purporting to be from a trusted brand or authority. With smishing, attackers use text messages to send SMS messages to users or robocall them. The messages often promise gifts or services in exchange for payment. Telephone-oriented attack delivery (TOAD). TOAD attacks start with an email that claims to be from a legitimate source and includes a phone number for customer assistance. Callers are connected to fake customer service representatives who then direct the victim through the attack. They may instruct the victim to let them access their machine remotely or download a file that turns out to be malware. Or they might direct them to a phishing site. Common sense can go a long way toward preventing a social engineering attack. Make sure to reiterate that if a message seems too good to be true, it\'s very likely a scam. And if something doesn\'t look or sound right, it probably isn\'t. 2. Phishing Phishing is an example of social engineering. Most phishing messages are sent by email. But some attackers deliver these messages through other methods, including smishing and vishing. Here are some typical strategies: Malicious links. When a user clicks on a | Ransomware Malware Tool Vulnerability Threat Mobile Cloud | Uber Uber | ★★ |
|
2023-11-22 19:52:00 | Web Shells Gain Sophistication for Stealth, Persistence (lien direct) | Un outil de post-exploitation préféré continue de gagner une sophistication, avec un exemple récent ajoutant des pages de connexion déguisées, du vol d'identification et de la collecte d'informations via des services tels que Virustotal.
A favorite post-exploitation tool continues to gain sophistication, with one recent example adding disguised log-in pages, credential stealing, and information gathering via services such as VirusTotal. |
Tool | ★★ | |
|
2023-11-22 19:52:00 | Les obus Web acquièrent une sophistication pour la furtivité, la persistance Web Shells Gain Sophistication for Stealth, Persistence (lien direct) |
Un outil de post-exploitation préféré continue de gagner une sophistication, avec un exemple récent ajoutant des pages de connexion déguisées, du vol d'identification et de la collecte d'informations via des services tels que Virustotal.
A favorite post-exploitation tool continues to gain sophistication, with one recent example adding disguised log-in pages, credential stealing, and information gathering via services such as VirusTotal. |
Tool | ★★★ | |
 |
2023-11-22 18:26:04 | Tout ce que vous devez savoir sur le cryptage Everything You Need to Know About Encryption (lien direct) |
Data in any shape or form has been one of the most valuable assets ever since the dawn of human beings.
In good hands, data can drastically enhance the development of a nation. While in the wrong hands, data can end up being disastrous for a nation.
Consequently, humans have relied upon Encryption for centuries to prevent valuable data from being stolen, changed, or compromised.
While the methods of encrypting data have come a long way, the core purpose of Encryption has more or less remained the same.
Utilizing Encryption, data (plaintext) is scrambled into a secret code (ciphertext), and it can only be unlocked and accessed by authorized parties.
In this article, we have shared everything you need to know about Encryption.
Encryption: Where Did It All Begin
You will be surprised to know that Encryption existed during the ancient and medieval periods.
As revealed by ExpressVPN, the Spartans in the 7th century developed a tool, namely, Scytale, that helped them encode a message.
Scytale was a wooden rod with parchment wrapped around it.
During the preparation phase, the sender wrote and encoded the message while the parchment was on the rod.
When the receiver took off the parchment, the words would automatically get jumbled. So, to decode it, the receiver wrapped the parchment around a rod with the same diameter.
Encryption witnessed massive developments during the Two World Wars. During the Second World War, Germans developed one of the most feature-packed and reliable encryption tools, The Enigma Machine.
The Enigma Machine used rotor mechanics that scrambled the 26 letters of the alphabet and converted the actual message into a complex puzzle. During the early- to mid-20th century, The Enigma Machine was considered super secure, and it was used to encode the most top-secret messages.
|
Tool | ★★ | |
|
2023-11-22 16:38:00 | Les solutions AI sont la nouvelle ombre IT AI Solutions Are the New Shadow IT (lien direct) |
Les employés ambitieux vantent de nouveaux outils d'IA, ignorent les risques de sécurité SaaS sérieux comme le SaaS l'ombre du passé, l'IA place les CISO et les équipes de cybersécurité dans un endroit dur mais familier.
Les employés utilisent secrètement l'IA avec peu de considération pour les procédures de révision informatique et de cybersécurité établies.Considérant que la fulguration de Chatgpt \\ est de 100 millions d'utilisateurs dans les 60 jours suivant le lancement, en particulier avec peu
Ambitious Employees Tout New AI Tools, Ignore Serious SaaS Security RisksLike the SaaS shadow IT of the past, AI is placing CISOs and cybersecurity teams in a tough but familiar spot. Employees are covertly using AI with little regard for established IT and cybersecurity review procedures. Considering ChatGPT\'s meteoric rise to 100 million users within 60 days of launch, especially with little |
Tool Cloud | ChatGPT | ★★★ |
 |
2023-11-22 11:30:00 | BUG BYTES # 217 & # 8211;Comment soumettre des vulnérabilités, rédiger un excellent article et 2 ans de prime de bogue Bug Bytes #217 – How to Submit Vulnerabilities, Writing a Great WriteUp and 2 years of Bug Bounty (lien direct) |
> Bug Bytes est une newsletter hebdomadaire organisée par les membres de la communauté Bug Bounty.La deuxième série est organisée par InsiderPhd.Chaque semaine, elle nous tient à jour avec une liste complète des articles, des outils, des tutoriels et des ressources.Ce numéro couvre les semaines du 6 novembre au 19 novembre Intigriti News de mon cahier
>Bug Bytes is a weekly newsletter curated by members of the bug bounty community. The second series is curated by InsiderPhD. Every week, she keeps us up to date with a comprehensive list of write-ups, tools, tutorials and resources. This issue covers the weeks from November 6th to November 19th Intigriti News From my notebook |
Tool Vulnerability | ★★ | |
|
2023-11-22 11:00:00 | Cyber Fête de Thanksgiving: sauvegarde contre les escroqueries saisonnières Thanksgiving Cyber feast: Safeguarding against seasonal scams (lien direct) |
The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. As the Thanksgiving season rapidly approaches, many look forward to the warmth of family gatherings, the aroma of roasted turkey, and the joy of gratitude. Yet, just as we prepare our homes and hearts for this festive season, cybercriminals are gearing up to unleash a different kind of feast—a cyber feast—rife with sophisticated scams targeting unsuspecting individuals and businesses alike. This article will take a closer look at various Thanksgiving-themed cyber threats, illuminating the nature and impact of devious digital deceptions while unpacking the methodologies these digital bad actors try to use. But fear not, because we’ll also offer some key strategies to help you secure and fortify your digital domains throughout the holidays. The rise of seasonal cyber threats As November and the holiday season roll around, a surge in online activity sweeps across the United States, both good and bad. Thanksgiving not only signifies a time of family gatherings and festive meals but also marks the beginning of the holiday shopping season, especially with Black Friday and Cyber Monday right around the corner—in response to this, cybercriminals see a ripe opportunity to scam. According to the New Jersey Cybersecurity & Communications Integration Cell, recent reports had indicated. “spoofed emails were sent appearing to originate from legitimate organizations and contained [Thanksgiving-themed subject lines]’” noting how criminals and bad actors exploit the spirit of the season. Furthermore, they highlight that ”an Emotet banking trojan campaign was [also] observed using Thanksgiving lures.” Criminals know that with increased online transactions comes increased vulnerability, so they capitalize on the holiday spirit, designing scams that blend seamlessly with genuine promotional content, making it harder for individuals to distinguish between what\'s authentic and what\'s not. The risks of phishing One of the primary ways cybercriminals target individuals and businesses is through phishing attacks. Around Thanksgiving time, these types of scams might manifest as emails purporting to offer massive discounts, invitations to exclusive Thanksgiving events, or even charitable appeals meant to tug at the heartstrings to draw you in. However, phishing isn’t restricted to just email—with their vast user bases, social media platforms are also prime targets for scams of all kinds. Cybercriminals often create fake profiles or pages promoting too-good-to-be-true Thanksgiving deals, leading unsuspecting and unknowing victims to phishing websites or even tricking them into sharing personal information that can be further exploited. The hidden benefits of cybersecurity When businesses transform their robust cybersecurity processes into content, it becomes a powerful tool for brand awareness and elevation. Sharing with your audience the measures you\'ve implemented reassures them of the sanctity of their data. It\'s not just about telling them they\'re safe; it\'s about showing them. For potential customers, especially in niche markets, tangible information is a beacon of trust. So when they can actively see and better understand | Malware Tool Vulnerability Threat | ★★ | |
|
2023-11-22 09:21:21 | LM Studio – Pour faire tourner des LLMs en local et les utiliser directement dans votre code (lien direct) | Face aux évolutions d'OpenAI, l'auteur explore des alternatives pour intégrer une IA similaire à ChatGPT dans ses scripts sans trop de modifications. Il teste OpenChat et d'autres outils comme llamacpp et Ollama, mais rencontre des problèmes techniques. LM Studio est présenté comme une solution prometteuse qui permet de faire fonctionner des modèles de langage en local et de les intégrer facilement via une API, bien que certains réglages soient encore nécessaires. | Tool | ChatGPT | ★★★ |
 |
2023-11-21 21:19:53 | Agent Tesla: le format d'archive ZPAQ inhabituel fournit des logiciels malveillants Agent Tesla: Unusual ZPAQ Archive Format Delivers Malware (lien direct) |
#### Description
Une nouvelle variante de l'agent Tesla a été découverte qui utilise l'extension de fichier archive ZPAQ et .wav pour infecter les systèmes et voler des informations à environ 40 navigateurs Web et divers clients de messagerie.ZPAQ est un format de compression de fichiers qui offre un meilleur rapport de compression et une fonction de journalisation par rapport à des formats largement utilisés comme ZIP et RAR.Cependant, le ZPAQ a un support logiciel limité, ce qui rend difficile le travail, en particulier pour les utilisateurs sans expertise technique.Le fichier exécutable .NET est gonflé avec zéro octets, ce qui permet aux acteurs de menace de contourner les mesures de sécurité traditionnelles et d'augmenter l'efficacité de leur attaque.
L'utilisation du format de compression ZPAQ soulève plus de questions que de réponses.Les hypothèses ici sont que les acteurs de la menace ciblent un groupe spécifique de personnes qui ont des connaissances techniques ou utilisent des outils d'archives moins connus, ou ils testent d'autres techniques pour diffuser plus rapidement les logiciels malveillants et contourner les logiciels de sécurité.
Le malware utilise Telegram en tant que C&C en raison de son utilisation juridique généralisée et du fait que son trafic est souvent autorisé à travers des pare-feu, ce qui en fait un support utile pour une communication secrète.Comme tout autre voleur, l'agent Tesla peut nuire non seulement aux particuliers mais aussi aux organisations.Il a gagné en popularité parmi les cybercriminels pour de nombreuses raisons, notamment la facilité d'utilisation, la polyvalence et l'abordabilité sur le Dark Web.
#### URL de référence (s)
1. https://www.gdatasoftware.com/blog/2023/11/37822-agent-Tesla-zpaq
#### Date de publication
20 novembre 2023
#### Auteurs)
Anna Lvova
#### Description A new variant of Agent Tesla has been discovered that uses the ZPAQ archive and .wav file extension to infect systems and steal information from approximately 40 web browsers and various email clients. ZPAQ is a file compression format that offers a better compression ratio and journaling function compared to widely used formats like ZIP and RAR. However, ZPAQ has limited software support, making it difficult to work with, especially for users without technical expertise. The .NET executable file is bloated with zero bytes, which allows threat actors to bypass traditional security measures and increase the effectiveness of their attack. The usage of the ZPAQ compression format raises more questions than answers. The assumptions here are that either threat actors target a specific group of people who have technical knowledge or use less widely known archive tools, or they are testing other techniques to spread malware faster and bypass security software. The malware uses Telegram as a C&C due to its widespread legal usage and the fact that its traffic is often allowed through firewalls, making it a useful medium for covert communication. Like any other stealer, Agent Tesla can harm not only private individuals but also organizations. It has gained popularity among cybercriminals for many reasons including ease of use, versatility, and affordability on the Dark Web. #### Reference URL(s) 1. https://www.gdatasoftware.com/blog/2023/11/37822-agent-tesla-zpaq #### Publication Date November 20, 2023 #### Author(s) Anna Lvova |
Malware Tool Threat Technical | ★★★ | |
|
2023-11-21 15:32:19 | Guardz a présenté son centre de croissance pour les fournisseurs de services gérés Guardz introduced its Growth Hub for Managed Service Providers (lien direct) |
Guardz lance Growth Hub pour autonomiser les MSP avec le soutien des ventes de cybersécurité, les rapports de retour sur investissement et les outils de prospection
La dernière offre de Cybersecurity Company \\ permet aux MSP de mieux protéger et servir les clients des PME existants et favoriser la conversion de nouvelles entreprises
-
revues de produits
Guardz Launches Growth Hub to Empower MSPs with Cybersecurity Sales Support, ROI Reports, and Prospecting Tools The cybersecurity company\'s latest offering enables MSPs to better protect and serve existing SME customers and foster new business conversion - Product Reviews |
Tool | ★★ | |
 |
2023-11-21 12:48:00 | Top 5 des meilleures applications clients télégrammes pour Android Top 5 Best Telegram Client Apps for Android (lien direct) |
> Par owais sultan
Classé et décrit les fonctionnalités des 5 meilleures applications clients télégrammes pour Android.Telegram Messenger est & # 8230;
Ceci est un article de HackRead.com Lire la publication originale: Top 5 des meilleures applications client télégrammes pour Android
>By Owais Sultan Ranked and described the functionality of the top 5 best Telegram client applications for Android. Telegram messenger is… This is a post from HackRead.com Read the original post: Top 5 Best Telegram Client Apps for Android |
Tool Mobile | ★★★ | |
|
2023-11-21 11:00:00 | 7 Questions incontournables pour les leaders sur la culture de la sécurité 7 must-ask questions for leaders on security culture (lien direct) |
The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. It\'s not uncommon in today\'s corporate world to see a creative marketer launching catchy security awareness campaigns, steering the entire company towards robust online safety practices. Elsewhere, job reviews increasingly assess how well employees are performing on the cybersecurity front. The shift in focus is clear. Organizations have come to understand that sophisticated tech tools aren\'t the ultimate solution. People are the weak spot. In fact, researchers from Stanford University revealed that roughly 88% of data breaches are caused by employee mistakes. Not to mention that we\'ve observed a surging trend of attacks that sidestep technology and instead, zero in on people. The strategy is proving effective. Prominent ransomware incidents, such as those affecting Colonial Pipeline, JBS Foods, and Kaseya, have dominated headlines. As our tech-driven defenses become more advanced, malicious actors are adapting, always looking for the easiest entry point. Seeking efficiency and reduced effort, these cyberattackers often find employees to be the most appealing targets. So, training everyone to have better awareness about cybersecurity isn\'t just a good idea; it\'s a must. Based on all this, we\'ve got some recommendations for what leaders need to know and smart questions they should keep in mind for their next big meeting. Five things leaders need to know about cybersecurity culture Understanding security culture The ambiguity surrounding the term "security culture" often stems from a foundational problem: its frequent usage without a clear definition. This lack of clarity paves the way for varied interpretations and assumptions. With this work, we aim to bring clarity to the concept. Security culture is described as the beliefs, traditions, and collective behaviors of a group that shape its security posture. Why does security culture matter? Sometimes, employees adopt poor security habits, either independently or due to a lack of proper guidance from the organization. Addressing these habits can be challenging. However, establishing a robust security culture can change their behaviors, enabling an organization to safeguard its reputation, brand, and financial well-being. What does a good security culture look like? Suppose an employee, Alex, receives an email from a bank filled with typos and featuring a suspicious link. At a workplace lacking a security culture, Alex thinks, "This is odd. I\'ll set it aside for now." However, in a company with a solid security culture, Alex’s immediate reaction is, "This could be dangerous. I need to inform IT." Such a prompt action gives the tech team an early warning, allowing them to act before more damage occurs. It isn\'t about turning every employee into a cybersecurity specialist; it\'s about ensuring each individual acts responsibly, embodying the qualities of a "security champion." Prioritizing values, attitudes, and beliefs over rules and policies Cyber threats often catch organizations off-guard because a significant portion of their workforce isn\'t adequately informed or prepared for these risks. Leaders hope for their teams to act responsibly, like locking an unattended computer or reporting suspicious emails. However, just organizing train | Ransomware Tool Prediction | ★★★ | |
|
2023-11-21 08:35:02 | Prévenir les attaques de fatigue du MFA: sauvegarder votre organisation Preventing MFA Fatigue Attacks: Safeguarding Your Organization (lien direct) |
Gaining access to critical systems and stealing sensitive data are top objectives for most cybercriminals. Social engineering and phishing are powerful tools to help them achieve both. That\'s why multifactor authentication (MFA) has become such an important security measure for businesses and users. Without MFA as part of the user authentication process, it is much less challenging for an attacker with stolen credentials to authenticate a user\'s account. The primary goal of MFA is to reduce the risk of unauthorized access, especially in situations where passwords alone may not provide enough protection. Even if an attacker steals a user\'s password, with MFA they still need the second factor (and maybe others) to gain access to an account. Examples of MFA factors include biometrics, like fingerprints, and signals from user devices, like GPS location. MFA isn\'t a perfect solution, though-it can be bypassed. Adversaries are relentless in their efforts to undermine any security defenses standing in the way of their success. (The evolution of phish kits for stealing MFA tokens is evidence of that.) But sometimes, attackers will choose to take an in-your-face approach that is not very creative or technical. MFA fatigue attacks fall into that category. What are MFA fatigue attacks-and how do they work? MFA fatigue attacks, also known as MFA bombing or MFA spamming, are a form of social engineering. They are designed to wear down a user\'s patience so that they will accept an MFA request out of frustration or annoyance-and thus enable an attacker to access their account or device. Many people encounter MFA requests daily, or even multiple times per day, as they sign-in to various apps, sites, systems and platforms. Receiving MFA requests via email, phone or other devices as part of that process is a routine occurrence. So, it is logical for a user to assume that if they receive a push notification from an account that they know requires MFA, it is a legitimate request. And if they are very busy at the time that they receive several push notifications in quick succession to authenticate an account, they may be even more inclined to accept a request without scrutinizing it. Here\'s an overview of how an MFA attack works: A malicious actor obtains the username and password of their target. They can achieve this in various ways, from password-cracking tactics like brute-force attacks to targeted phishing attacks to purchasing stolen credentials on the dark web. The attacker then starts to send MFA notifications to the user continuously, usually via automation, until that individual feels overwhelmed and approves the login attempt just to make the requests stop. (Usually, the push notifications from MFA solutions require the user to simply click a “yes” button to authenticate from the registered device or email account.) Once the attacker has unauthorized access to the account, they can steal sensitive data, install malware and do other mischief, including impersonating the user they have compromised-taking their actions as far as they can or want to go. 3 examples of successful MFA fatigue attacks To help your users understand the risk of these attacks, you may want to include some real-world examples in your security awareness program on this topic. Here are three notable incidents, which are all associated with the same threat actor: Uber. In September 2022, Uber reported that an attacker affiliated with the threat actor group Lapsus$ had compromised a contractor\'s account. The attacker may have purchased corporate account credentials on the dark web, Uber said in a security update. The contractor received several MFA notifications as the attacker tried to access the account-and eventually accepted one. After the attacker logged in to the account, they proceeded to access other accounts, achieving privilege escalation. One action the attacker took was to reconfigure Uber\'s OpenDNS to display a graphic image on some of the company\'s internal sites. Cisco. Cisco suffer | Ransomware Data Breach Malware Tool Threat Technical | Uber | ★★★ |
|
2023-11-20 20:25:28 | Une plongée profonde dans le ransomware de Phobos, récemment déployé par le groupe 8Base A Deep Dive into Phobos Ransomware, Recently Deployed by 8Base Group (lien direct) |
#### Description
Cisco Talos a récemment observé une augmentation de l'activité menée par 8Base, un groupe de ransomwares qui utilise une variante des ransomwares Phobos et d'autres outils accessibles au public pour faciliter leurs opérations.
La plupart des variantes Phobos du groupe \\ sont distribuées par SmokeLoader, un cheval de Troie de porte dérobée.Ce chargeur de marchandises baisse ou télécharge généralement des charges utiles supplémentaires lors du déploiement.Dans les campagnes 8Base, cependant, il a le composant Ransomware intégré à ses charges utiles cryptées, qui est ensuite déchiffrée et chargée dans la mémoire du processus smokeloader \\ '.
####URL de référence (s)
1. https://blog.talosintelligence.com/deep-dive-into-phobos-ransomware/
2. https://blog.talosintelligence.com/Understanding-the-phobos-affiliate-structure/
#### Date de publication
17 novembre 2023
#### Auteurs)
Guilherme Veree
#### Description Cisco Talos has recently observed an increase in activity conducted by 8Base, a ransomware group that uses a variant of the Phobos ransomware and other publicly available tools to facilitate their operations. Most of the group\'s Phobos variants are distributed by SmokeLoader, a backdoor trojan. This commodity loader typically drops or downloads additional payloads when deployed. In 8Base campaigns, however, it has the ransomware component embedded in its encrypted payloads, which is then decrypted and loaded into the SmokeLoader process\' memory. #### Reference URL(s) 1. https://blog.talosintelligence.com/deep-dive-into-phobos-ransomware/ 2. https://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/ #### Publication Date November 17, 2023 #### Author(s) Guilherme Venere |
Ransomware Tool | ★★★ | |
 |
2023-11-20 18:38:02 | Éliminer les tâches répétitives et accélérer la réponse avec la fusion Falcon Eliminate Repetitive Tasks and Accelerate Response with Falcon Fusion (lien direct) |
Les adversaires deviennent de plus en plus sophistiqués et plus rapidement avec leurs attaques.Selon le rapport de chasse aux menaces Crowdsstrike 2023, le temps d'évasion ECRIME moyen n'est que de 79 minutes.Cela est dû en partie au fait que les adversaires tirent parti des outils qui tirent parti de l'automatisation comme des outils de craquage de mot de passe, des kits d'exploitation pour les vulnérabilités du navigateur Web et des marchés qui vendent des données volées.[& # 8230;]
Adversaries are becoming more sophisticated and faster with their attacks. According to the CrowdStrike 2023 Threat Hunting Report, the average eCrime breakout time is just 79 minutes. This is partly due to adversaries taking advantage of tools that leverage automation like password-cracking tools, exploit kits for web browser vulnerabilities, and marketplaces that sell stolen data. […] |
Tool Vulnerability Threat | ★★ | |
 |
2023-11-20 11:57:37 | Utilisation de l'IA génératrice pour la surveillance Using Generative AI for Surveillance (lien direct) |
L'IA générative sera un outil puissant pour l'analyse et la résumé des données.Ici & # 8217; est un Exemple Il est utilisé pour l'analyse des sentiments.Je suppose que ce n'est pas encore très bon, mais qu'il ira mieux.
Generative AI is going to be a powerful tool for data analysis and summarization. Here’s an example of it being used for sentiment analysis. My guess is that it isn’t very good yet, but that it will get better. |
Tool | ChatGPT | ★★★ |
|
2023-11-20 11:00:00 | Comment effectuer la criminalistique numérique de base sur un ordinateur Windows How to perform basic digital forensics on a Windows computer (lien direct) |
The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. Digital forensics is a critical field in the investigation of cybercrimes, data breaches, and other digital incidents. As our reliance on computers continues to grow, the need for skilled digital forensics professionals is more crucial than ever. In this guide, we will explore the basics of performing digital forensics on a Windows computer, including key steps, tools, and techniques. The digital forensics process Performing digital forensics on a Windows computer involves a structured process to ensure the integrity and admissibility of evidence. The process typically includes the following steps: Identification: The first step is to identify the target computer or storage device that needs to be investigated. This could be a desktop computer, laptop, external hard drive, or even a cloud storage account. Collection: Once identified, digital evidence is collected in a forensically sound manner. This often involves creating a bit-for-bit copy (image) of the storage device to ensure that the original data remains intact. Preservation: To maintain the integrity of the evidence, the collected data is preserved in a secure environment. This includes ensuring that the evidence remains unaltered during storage. Analysis: Forensic analysts examine the collected data to extract relevant information. This step includes examining files, system logs, and other digital artifacts for evidence. Documentation: Detailed documentation is essential throughout the process. It includes the chain of custody, actions taken, and the tools and techniques used. Reporting: A detailed forensic report is generated, summarizing the findings and the methodology used. This report may be used as evidence in legal proceedings. Basic digital forensics tools for Windows To perform digital forensics on a Windows computer, you\'ll need a set of specialized tools. Here are some of the basic tools that can aid in the process: Forensic imaging tools: FTK Imager: A user-friendly tool that allows you to create disk images and analyze them. dc3dd: A command-line tool for creating disk images. WinHex: A versatile hex editor and disk editor that can be used for forensic analysis. File Analysis Tools: Autopsy: An open-source digital forensic platform that provides various modules for file analysis, keyword search, and registry analysis. Encase: A commercial digital forensics tool that offers extensive file analysis capabilities. Memory Analysis Tools: Volatility: A popular tool for analyzing memory dumps to identify suspicious processes, network connections, and more. Rekall: An open-source memory analysis framework that is compatible with Windows memory dumps. Registry Analysis Tools: Registry Explorer: A tool for viewing and analyzing Windows registry hives. RegRipper: A command-line tool for parsing Windows registry hives and extracting useful information. Network Analysis Tools: Wireshark: A powerful network protocol analyzer that allows you to capture and analyze network traffic. NetworkMiner: A tool for network forensics that can extract files, emails, and other artifacts from captured network traffic. We have covered FTK, | Tool Cloud Commercial | ★★★ | |
 |
2023-11-19 20:36:10 | Quelle est l'extension McRypt en PHP et pourquoi a-t-elle été obsolète? What Is the Mcrypt Extension in PHP and Why Was It Deprecated? (lien direct) |
Comprenant le rôle de McRypt dans le développement de PHP dans le domaine du développement de PHP, l'extension McRypt était autrefois un outil crucial pour les données [Plus ...]
Understanding the Role of Mcrypt in PHP Development In the realm of PHP development, the mcrypt extension once stood as a crucial tool for data [more...] |
Tool Threat | ★★★ | |
|
2023-11-17 14:00:00 | Détection et réponse qui évolue: une approche à 4 volets Detection & Response That Scales: A 4-Pronged Approach (lien direct) |
La construction d'une équipe de réponse aux incidents résilientes nécessite plus qu'une simple combinaison d'outils et de rotations sur appel.
Building a resilient incident response team requires more than a simple combination of tools and on-call rotations. |
Tool | ★★★ | |
|
2023-11-17 13:46:00 | Remcos, encore une fois: les agences ukrainiennes ciblées dans une nouvelle campagne d'espionnage Remcos, again: Ukrainian agencies targeted in a new spying campaign (lien direct) |
Un groupe de piratage qui cible l'Ukraine depuis un certain temps a lancé une nouvelle campagne sur les agences gouvernementales en utilisant un outil de surveillance familier - Remcos.Le logiciel sophistiqué d'accès à distance, commercialisé comme un outil administratif légitime, peut être abusé par des pirates pour prendre le contrôle total d'un système infecté.Dans une récente campagne, les pirates
A hacking group that has been targeting Ukraine for a while has launched a new campaign on government agencies using a familiar surveillance tool - Remcos. The sophisticated remote access software, marketed as a legitimate administrative tool, can be abused by hackers to gain full control over an infected system. In a recent campaign, hackers |
Tool | ★★ | |
|
2023-11-17 13:00:07 | Décrypting Danger: Vérifier les recherches sur le point de plongée en profondeur dans les tactiques de cyber-espionnage par les attaquants d'origine russe ciblant les entités ukrainiennes Decrypting Danger: Check Point Research deep-dive into cyber espionage tactics by Russian-origin attackers targeting Ukrainian entities (lien direct) |
> Faits saillants: Gamaredon, un joueur approprié distinct de l'espionnage russe, se distingue par ses campagnes à grande échelle ciblant principalement les entités ukrainiennes.Le ver USB, Litterdrifter, révèle un impact mondial avec des infections potentielles dans des pays comme les États-Unis, le Vietnam, le Chili, la Pologne, l'Allemagne et Hong Kong, s'étendant au-delà de ses cibles d'origine.Récemment déployé par Gamaredon, Litterdrifter est un ver rédigé par VBS conçu pour se propager à travers des disques USB, démontrant les tactiques évolutives du groupe dans le maintien d'une infrastructure flexible et volatile.Les principaux résultats sur Litterdrifter: Litterdrifter, le dernier outil de Gamaredon & # 8217; dans son cyber arsenal, est un ver écrit par VBS avec deux fonctionnalités.Ses principaux objectifs sont la propagation automatique sur [& # 8230;]
>Highlights: Gamaredon, a distinct APT player in Russian espionage, stands out for its large-scale campaigns primarily targeting Ukrainian entities. The USB worm, LitterDrifter, reveals a global impact with potential infections in countries like the USA, Vietnam, Chile, Poland, Germany, and Hong Kong, expanding beyond its original targets. Recently deployed by Gamaredon, LitterDrifter is a VBS-written worm designed to spread through USB drives, demonstrating the group’s evolving tactics in maintaining a flexible and volatile infrastructure. Key Findings on LitterDrifter: LitterDrifter, Gamaredon’s latest tool in its cyber arsenal, is a VBS-written worm with dual functionalities. Its primary objectives are automatic spreading over […] |
Tool | ★★ | |
|
2023-11-17 12:01:12 | Démystifier l'IA et ML: six questions critiques à poser à votre fournisseur de cybersécurité Demystifying AI and ML: Six Critical Questions to Ask Your Cybersecurity Vendor (lien direct) |
As cyber threats continue to evolve at an unprecedented pace, many organizations are turning to artificial intelligence (AI) and machine learning (ML) in hopes of keeping up. While these advanced technologies hold immense promise, they\'re also more complex and far less efficient than traditional threat detection approaches. The tradeoff isn\'t always worth it. And not all AI and ML processes are created equal. The models used, the size and quality of the data sets they\'re trained on-and whether an advanced computational process is suitable for the problem at hand-are all critical factors to consider when deciding how both AI and ML fit into your cybersecurity strategy. In this blog post, we explore the vital questions you should ask your cybersecurity vendor about these technologies. We will also demystify their role in safeguarding your people, data and environment. Note: Though often conflated, AL and ML are related but distinct concepts. For simplicity, we\'re using AI when discussing the broader technology category and ML to discuss narrower learning models used in AI. Question 1: Why is AI suitable for this security problem? You\'ve probably heard the old saying that when your only tool is a hammer, every problem looks like a nail. While AI has rightly generated enthusiasm in cybersecurity, it may not be the optimal approach to every task. On one hand, the technologies can help analyze large amounts of data and find anomalies, trends and behaviors that indicate potential attacks. And the technologies can automate response and mitigation of security incidents. But depending on the size and complexity of the learning model, they can also be computationally intensive (read: expensive) to maintain. And worse, execution time can be much longer than less complex approaches such as rules and signatures. On the other hand, rules and signatures are static, so they don\'t automatically evolve to detect new threats. But they\'re also fast, easy on computing resources and highly effective for certain aspects of threat detection. Other signals, such as email sender reputation and IP addresses, can also be as effective as AI for many detections-and in most cases are faster and much more cost-effective. Getting AI right starts with understanding what cybersecurity tasks they\'re best suited to and applying them to the right problems. In the same vein, how the technology is applied matters. In cybersecurity, every second counts. Making decisions in real time and blocking malicious content before it can be delivered is today\'s key challenge. If the processing time of the vendor\'s AI means the technology is relegated solely to post-delivery inspection and remediation, that\'s a major drawback. Question 2: Where do you get your training data? The performance of ML models hinges on the source and quality of their data. That\'s because AI models learn from examples and patterns, not rules. And that requires a large amount of data. The more data, and the higher the quality of that data, the better the model can learn and generalize to new conditions. Like any ML model, those used in cybersecurity need a wide-ranging, diverse data set that accurately reflects the real world. Or more precisely, the data used to train your vendor\'s AI model should reflect your world-the threats targeting your organization and users. Finding data for general-purpose AI applications is easy. It\'s all over the internet. But threat data-especially data well-suited for the type of ML model the vendor intends to use- is scarcer. Gaining malware samples is a lot harder than acquiring data used in applications such as image and natural language processing. First, not much attack data is publicly available. Most security vendors hold on tightly to the threat data they collect, and for good reason. Beyond the obvious competitive advantages it offers, threat data is sensitive and comes with a bevy of privacy concerns. As a result, few cybersecurity vendors have a dataset large enough to trai | Malware Tool Vulnerability Threat | ★★ | |
|
2023-11-17 11:00:00 | Procurations gratuites et dangers cachés Free proxies and the hidden dangers (lien direct) |
The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article. Data privacy continues to be a growing concern for all internet users. While the internet gives us so much more freedom and access to information we might not have otherwise, online privacy continues to be a significant risk. It’s not just cybercriminals that invade your privacy, but businesses as well. Data has become more valuable than ever, and companies will do whatever they can to collect your information. Proxies have been a popular option for protecting your online privacy. Now, these proxies offer even more benefits and specific use cases. You might even be looking into getting one and considering a free proxy. In this article, we’ll look at free proxies and why they can be a bigger danger than you might realize. We’ll also examine why residential proxies from a reliable provider like Smartproxy are better if security and privacy are your goals. Keep reading to discover how free proxies work and the dangers they pose. What is a proxy? A proxy is an intermediary server that accepts and forwards all your requests to the web server. This means that instead of connecting directly to the internet, you first connect to the proxy server. You might be wondering why using an intermediary server like a proxy is effective. Usually, it’s better to cut out the middleman, right? In this case, by connecting to the proxy first, your personal information, such as your IP and other associated data, is replaced by a new IP. This completely hides your information from the websites you visit. By changing your IP address through a proxy, websites or apps cannot track you, and your data is more secure. However, that’s not all a proxy does. What can you use a proxy for? By now, we know that proxies are great tools when it comes to online security and privacy. By hiding your real IP, the websites that you visit won’t be able to collect the data associated with your IP. This usually includes your name, location, ISP, devices, operating system, and more. Residential proxies, in particular, are great for anonymity because they use the IPs from real devices. As such, they don’t look like proxies and are much less likely to be detected as such. However, proxies can be used for many other ways aside from security and privacy. Another use is managing multiple social media accounts. Social media platforms are quick to issue IP bans if they find the same IP address creating multiple accounts. Account limits are usually only a handful per IP address, and the moment you create too many, you might receive an IP ban. This is frustrating if you’re a digital marketer who creates and manages accounts for clients. However, by using a proxy, you can change the IP that creates the accounts and avoid IP bans. Another use of proxies is related to automation. This can affect a wide range of automated tools, from sneaker bots to data scrapers and even social media automation. Many websites and social media platforms block automation tools as part of their anti-bot protection. However, by linking residential proxies to these tools, you can make them appear like natural users and bypass these limitations. However, to be successful, you’ll need to use residential proxies with a real IP. Finally, proxies can also help improve your connection speed and stabilize it. This is because you’re routing all your traffic through larger servers instead of your own device. These servers are much more capa | Malware Tool Vulnerability Threat | ★★ | |
|
2023-11-16 21:32:00 | Coutums et protection des frontières acquises \\ 'Énorme quantité de puissance de surveillance \\' Customs and Border Protection acquired \\'huge amount of surveillance power\\' (lien direct) |
Un contrat signé l'année dernière par les douanes et la patrouille frontalière des États-Unis (CBP) semble donner à l'agence le package le plus agressif et le plus vaste d'outils de surveillance qu'il ait jamais utilisés, selon un groupe de plaidoyer.L'accord avec le courtier de données LexisNexis Risk Solutions a fourni à CBP des capacités telles que la collecte de données de géolocalisation, la surveillance sociale
A contract signed last year by U.S. Customs and Border Patrol (CBP) appears to give the agency the most aggressive and expansive package of surveillance tools it has ever used, according to an advocacy group. The deal with the data broker LexisNexis Risk Solutions provided CBP with capabilities such as collecting geolocation data, monitoring social |
Tool | ★★ | |
|
2023-11-16 17:30:00 | Meridianlink confirme la cyberattaque après que le gang de ransomware prétend signaler la société à la SEC MeridianLink confirms cyberattack after ransomware gang claims to report company to SEC (lien direct) |
La société de logiciels financiers Meridianlink a confirmé qu'elle faisait face à une cyberattaque après que les pirates derrière l'incident aient pris des mesures extraordinaires pour faire pression sur l'entreprise pour payer une rançon.Meridianlink, qui a déclaré plus de 76 millions de dollars de revenus au dernier trimestre, fournit des outils aux banques, aux coopératives de crédit, aux prêteurs hypothécaires et aux agences de rapports de consommation aux États-Unis
Financial software company MeridianLink confirmed that it is dealing with a cyberattack after the hackers behind the incident took extraordinary measures to pressure the company into paying a ransom. MeridianLink, which reported more than $76 million in revenue last quarter, provides tools to banks, credit unions, mortgage lenders and consumer reporting agencies in the United |
Ransomware Tool | ★★ | |
|
2023-11-16 17:00:00 | Le comité de renseignement de la maison propose sa propre réécriture de pouvoirs de surveillance House Intelligence panel proposes its own rewrite of surveillance powers (lien direct) |
Pour la deuxième fois en autant de semaines, un groupe de législateurs américains a dévoilé jeudi une législation pour renouveler un puissant outil d'espionnage avant une date limite critique et de fin d'année.Le comité du renseignement de la Chambre dirigée par les républicains a lancé une introduction aux réformes réautoriser l'article 702 du
For the second time in as many weeks, a group of U.S. lawmakers on Thursday unveiled legislation to renew a powerful spy tool before a critical, year-end deadline. The Republican-led House Intelligence Committee rolled out a primer on the reforms that will be proposed in a forthcoming bipartisan measure to reauthorize Section 702 of the |
Tool Legislation | ★★ | |
|
2023-11-16 16:28:21 | Ignite 2023 : dans la " boîte à outils IA " de Microsoft (lien direct) | La conférence Ignite 2023 offre une vitrine sur l'évolution de l'offre Azure AI sous l'angle " LLMOps ". En voici quelques marqueurs. | Tool | ★★ | |
|
2023-11-16 14:15:19 | Informations exploitables: simplifier l'explication des menaces via le résumé de la condamnation Actionable Insights: Simplifying Threat Explainability via the Condemnation Summary (lien direct) |
In this blog series we cover how to improve your company\'s security posture with actionable insights. Actionable insights are a critical tool to help you improve your security posture and stop initial compromise in the attack chain. You can use them to identify and respond to potential risks, enhance your incident response capabilities, and make more informed security decisions. In previous actionable insights blog posts, we covered these topics: People risk Origin risk Business email compromise (BEC) risk Ensuring proper risk context Risk efficacy Telephone-oriented attack delivery (TOAD) risk Threat intelligence Your risk profile In this post, we are excited to announce the new TAP Condemnation Summary-which is available to all Proofpoint Targeted Attack Protection (TAP) customers who use the Proofpoint Aegis threat protection platform. We\'ll explain why it is an invaluable resource and we\'ll explore some of its key reports. Threat explainability: Introducing the Condemnation Summary In the ever-evolving cybersecurity landscape, clear communication and rapid understanding of email threats are essential. Proofpoint introduced the Condemnation Summary to enhance threat visibility and explain-in plain, everyday language-why a particular threat is condemned. The summary makes it easier for both technical and nontechnical users to comprehend email threats. You can find the TAP Condemnation Summary in the Evidence section of the threat details page for any individual threat within your Aegis platform. Let\'s explore how this new feature can help your business. Insights: What you can learn from the Condemnation Summary The Condemnation Summary helps demystify email threats and streamline the decision-making process for threat remediation. Here\'s what you can expect from this innovative feature. User and VIP insights The Condemnation Summary includes a highlights card that spotlights impacted users and VIPs. With drilldown options and actionable items, you can quickly determine who is affected. You can use these insights to understand the steps you need to take to mitigate the threat. Details about affected users shown in the Condemnation Summary. Threat state overview This section of the summary breaks down the state of the threat or campaign, complete with timestamps. A chronological view provides you with a clear understanding of how the threat evolved, so you can assess its severity and impact. The threat state overview section in the Condemnation Summary. User-friendly descriptions The Condemnation Summary offers high-level observations from our behavioral and machine learning detection layers. Threats are described in everyday language. So nontechnical users can better grasp the nature of a threat and its potential consequences. High-level observations in plain language in the Condemnation Summary. Source attribution It\'s helpful to understand where a threat originated. Condemnation Sources gives you insight into which sources contributed to the detection and condemnation of the threat. The Condemnation Sources section in the Condemnation Summary. Targeted controls: Taking action The Condemnation Summary isn\'t just a feature for visibility or explainability. It\'s a tool for action. Here\'s how to make the most of this new feature: Mitigate threats faster. With user and VIP insights, you can respond promptly to threats that are impacting specific individuals. Take immediate actions to protect these users and mitigate risks. Improve your communication about threats. The user-friendly descriptions in the Condemnation Summary make it easier to communicate threat details to nontechnical stakeholders. This, in turn, helps to foster better collaboration around security across your business. See how threats evolve. When you have a timeline of a threat\'s progression, you can assess how a threat evolved and whether it is part of a broader campaign. Track where threats come from. It is cruci | Tool Threat Technical | ★★★ | |
|
2023-11-16 11:00:00 | Histoires du SOC: étapes proactives pour protéger les clients contre le MFA mal configuré Stories from the SOC: Proactive steps to protect customers from misconfigured MFA (lien direct) |
Résumé de l'exécutif
Authentification multifactrice, ou MFA, offre aux utilisateurs une couche de sécurité ajoutée lors de la connexion aux applications Web.Dépassant son prédécesseur, l'authentification à deux facteurs, en 2023, le MFA est une option standard pour une autre couche de sécurité pour les comptes en ligne..
En mai 2022, la cybersécurité et l'ampli;Infrastructure Security Agency (CISA) a publié le conseil en sécurité aa22-074a & nbsp; décrire comment les configurations par défaut dans les applications MFA sont considérées comme une vulnérabilité.La tactique a été utilisée par les cyber-acteurs parrainés par l'État russe dès mai 2021 dans un compromis réussi d'une organisation américaine.
Sur la base de ces directives de la CISA, les AT & amp; T cybersecurity a géré la détection gérée par la cybersecurity.et réponse (MDR) Centre d'opérations de sécurité (SOC) a analysé de manière proactive dans notre flotte de clients et a découvert un client qui utilisait la configuration par défaut, qui peut être exploitée.Les analystes de SOC ont contacté le client pour l'informer du risque et ont fourni des recommandations sur la façon de sécuriser leur réseau.
Investigation
Recherche d'événements
Les analystes ont utilisé l'outil open-source, Elastic Stack, pour rechercher nos clients pour & ldquo; défaillance, & rdquo; qui est la configuration par défaut dans les applications MFA qui rend possible un accès non autorisé.
 & nbsp; & nbsp;
Événement Deep-Dive
La recherche a révélé un client avec son ensemble de candidatures MFA sur Rectendopen = 1, qui est le paramètre qui permet à un acteur malveillant de contourner l'authentification lorsqu'il est exploité.Le & ldquo; défaillance & rdquo;Le paramètre permet une tentative incorrecte de connexion, ce qui permettrait alors un accès sans entrave à un compte avec ce paramètre sur le réseau client.
Revue pour des indicateurs supplémentaires
De là, les analystes SOC ont pivoté pour rechercher l'environnement client pour toutes les informations qui identifieraient les actifs et les comptes des clients associés et qui indiqueraient une activité malveillante extérieure.Ils ont découvert que l'utilisateur responsable était répertorié comme administrateur dans l'environnement client.
Réponse
Construire l'enquête
Les analystes ont ouvert une enquête pour traiter la mauvaise configuration de l'application mobile MFA ainsi que pour confirmer si l'activité associée à l'utilisateur identifié a été autorisée.L'enquête comprenait une explication de la vulnérabilité ainsi qu'un résumé de l'activité de l'utilisateur impliqué sur les actifs identifiés au cours des 30 derniers jours.
Interaction client
Les analystes ont créé une enquête à faible sévérité, ce qui, dans ce cas, signifiait qu'ils n'étaient pas tenus de contacter le client.(Nos clients MDR déterminent quand et comment le SOC communique avec eux.)
Cependant, pour s'assurer que le problème a été résolu en temps opportun, les analystes ont également informé le groupe Hu |
Tool Vulnerability Threat | ★★★ | |
|
2023-11-15 21:25:29 | #Stopransomware: ransomware Rhysida #StopRansomware: Rhysida Ransomware (lien direct) |
#### Description
Les variants de ransomwares émergents de Rhysida, ont été principalement déployés contre les secteurs de l'éducation, des soins de santé, de la fabrication, des technologies de l'information et du gouvernement depuis mai 2023. Les acteurs de la menace tirent parti des ransomwares de Rhysida sont connus pour avoir un impact sur les «objectifs d'opportunité», y compris les victimes de l'éducation,Les secteurs de la santé, de la fabrication, des technologies de l'information et du gouvernement.Les rapports open source détaillent les similitudes entre l'activité de la vice Society (Dev-0832) et les acteurs ont observé le déploiement du ransomware de Rhysida.De plus, les rapports open source ont confirmé que les cas observés d'acteurs de Rhysida opérant dans une capacité de ransomware en tant que service (RAAS), où les outils de ransomware et l'infrastructure sont loués dans un modèle de renseignement.Toutes les rançons payées sont ensuite divisées entre le groupe et les affiliés.
#### URL de référence (s)
1. https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a
#### Date de publication
15 novembre 2023
#### Auteurs)
Cisa
#### Description Rhysida-an emerging ransomware variant-has predominately been deployed against the education, healthcare, manufacturing, information technology, and government sectors since May 2023. Threat actors leveraging Rhysida ransomware are known to impact “targets of opportunity,” including victims in the education, healthcare, manufacturing, information technology, and government sectors. Open source reporting details similarities between Vice Society (DEV-0832) activity and the actors observed deploying Rhysida ransomware. Additionally, open source reporting has confirmed observed instances of Rhysida actors operating in a ransomware-as-a-service (RaaS) capacity, where ransomware tools and infrastructure are leased out in a profit-sharing model. Any ransoms paid are then split between the group and the affiliates. #### Reference URL(s) 1. https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a #### Publication Date November 15, 2023 #### Author(s) CISA |
Ransomware Tool Threat | ★★ |
To see everything:
Our RSS (filtrered)
