Credential-stuffing attacks against online accounts are still popular, and they work thanks to continuing password reuse.
If you've never added encryption to your email, Jack Wallen explains why you should and demonstrates how it works with the Thunderbird open-source email client.
Twitter is charged with using emails and phone numbers ostensibly collected for account security to sell targeted ads.
The new draft guidance on premarket submissions incorporates quality system regulations and doubles down on a life-cycle approach to product security.
Global ransomware incidents target everything from enterprise servers to grounding an airline, with one India-based group even taking a Robin Hood approach to extortion with the "GoodWill" strain.
The new Chrome Enterprise Connectors Framework is a collection of plug-and-play integrations with popular IT security tools.
Schrems III on the cards unless negotiators protect better oversight of US data access requests European privacy campaigner Max Schrems is warning that enhancements to the EU-US Privacy Shield data-sharing arrangements might face a legal challenge if nego ...
Let the threat landscape guide your company's timeline for complying with new data security standards for credit cards. Use the phase-in time to improve security overall — security as a process — not just comply with new standards.
You are 60 seconds away from removing one of your phone's most annoying annoyances.
The vulnerability, now patched, was issued a critical severity score of 9.8.
Researchers discover three-year-old critical firmware vulnerability running in popular cloud servers used to power hyperscalers and cloud providers alike.
Brian Krebs has an interesting story of a smart ID card reader with a malware-infested Windows driver, and US government employees who inadvertently buy and use them. But by all accounts, the potential attack surface here is enormous, as many federal empl ...
Google is urging Chrome users to update the browser now in order to fix a critical flaw.
Actors claiming to be the defunct ransomware group are targeting one of Akami’s customers with a Layer 7 attack, demanding an extortion payment in Bitcoin.
Microsoft is warning Windows domain admins to implement mitigations against an authentication weakness related to Active Directory.
We're only here for DBIRs The cybersecurity landscape continues to expand and evolve rapidly, fueled in large part by the cat-and-mouse game between miscreants trying to get into corporate IT environments and those hired by enterprises and security vendor ...
Interpol, cops swoop with intel from cybersecurity bods Interpol and cops in Africa have arrested a Nigerian man suspected of running a multi-continent cybercrime ring that specialized in phishing emails targeting businesses.…
A 'Very English Coop (sic) d'Etat' Emails between leading pro-Brexit figures in the UK have seemingly been stolen and leaked online by what could be a Kremlin cyberespionage team.…
Incident comes a week after 'SAP glitch' kept some planes on the taxiway Indian budget airline SpiceJet on Wednesday attributed delayed flights to a ransomware attack.…
After mandating essential eight controls.
Speaking at the World Economic Forum in Davos, the CEO was upbeat about her company's role in Russia, whilst a panel of experts tackled the issue of health data privacy.
Meanwhile, Twitter coughs up $150m after using account security contact details for advertising Miscreants have dumped on Telegram more than 142 million customer records stolen from MGM Resorts, exposing names, postal and email addresses, phone numbers, a ...
Supply chain and ransomware attacks increased dramatically this year, which explains why so many data breaches in this year's DBIR were grouped as system intrusion.
Takes on health sector and government roles.
Everything from cookies to keyloggers.
Captured data deleted and not used, attacker claims.
New threat hunting and risk identification service provides organizations with an enterprise-wide baseline of their threat landscape and risk exposure.
Gartner's security service edge fundamentally changes how companies should be delivering data protection in a cloud and mobile first world.
A sprawling, multiyear operation nabs a suspected SilverTerrier BEC group ringleader, exposing a massive attack infrastructure and sapping the group of a bit of its strength.
Open source software community initiative utilizes blockchain technology.
Experience Centre features emerging Mastercard products and solutions for securing digital payments on a global scale, including those developed locally in Vancouver.
Company will detail enhancements to Vulnerability Management, Detection and Response solution next month.
Corelight Investigator aids threat hunting and investigation through intelligent alert aggregation, built-in queries and scalable search
Cylance co-founder Ryan Permeh has joined full time as an operating partner.
According to the findings, vishing attacks have overtaken business email compromise as the second most reported response-based email threat since Q3 2021.
Google has disclosed a nasty set of six bugs affecting Zoom chat that can be chained together for MitM and RCE attacks, no user interaction required.
This year's finalists tackle such vital security concerns as permissions management, software supply chain vulnerability, and data governance. Winners will be announced June 6.
Purporting to publish leaked emails of pro-Brexit leadership in the UK, a new site's operations have been traced to Russian cyber-threat actors, Google says.
Implement zero-trust policies for greater control, use BYOD management tools, and take proactive steps such as keeping apps current and training staff to keep sensitive company data safe and employees' devices secure.
In just one month, the ransomware group's activity rose by 2,100%, a new report finds.
Occasional gaping hole and overprivileged users still blight the Beast of Redmond Despite a record number of publicly disclosed security flaws in 2021, Microsoft managed to improve its stats, according to research from BeyondTrust.…
Car manufacturer says bad actors used stolen credentials to break into GM owner accounts Car manufacturer General Motors has confirmed the credential stuffing attack it suffered last month exposed customers' names, personal email addresses, and destinatio ...
Yet another adversarial ML attack: Most deep neural networks are trained by stochastic gradient descent. Now “stochastic” is a fancy Greek word for “random”; it means that the training data are fed into the model in random order. So what happens i ...
The US government must clean up ransomware reporting and data collection if it wants to devise adequate policy responses.
With manufacturing ranking as the fourth most targeted sector, manufacturers that understand their exposure will be able to build the necessary security maturity.
A DDoS campaign observed by Akamai from actors claiming to be REvil would represent a major pivot in tactics for the gang.
A slip-up by a malware author has allowed researchers to taxonomize three ransomware variations going by different names.
The Google Project Zero researcher found a bug in XML parsing on the Zoom client and server.
2022’s DBIR also highlighted the far-reaching impact of supply-chain breaches and how organizations and their employees are the reasons why incidents occur.
The 2022 Data Breach Investigations Report repeatedly makes the point that criminals are stealing credentials to carry out their attacks.
Paper authors warn Elon Musk's 2,400 machines could be used offensively A researcher from the Beijing Institute of Tracking and Telecommunications advocated for Chinese military capability to take out Starlink satellites on the grounds of national securit ...
But think tank says its past attempts at working together haven't gone well Leaders of the Quad alliance – Australia, India, Japan, and the USA – met on Tuesday and revealed initiatives to strengthen collaboration on emerging technologies and cybersec ...
In detail: Ocean's Eleven-grade ruse in which victims' profiles are rigged from the start Two security researchers have identified five related techniques for hijacking internet accounts by preparing them to be commandeered in advance.…
Another rush job for busy Indian IT shops Indian IT shops have been handed another extraordinarily short deadline within which to perform significant infosec work.…
Hacked PyPI ctx and PHP phpass libraries steal environment variables.
Google Project Zero researcher finds holes in the different ways XML was parses on the Zoom client and server.
Or so says Google after tracking 30+ vendors peddling surveillance malware Spyware vendor Cytrox sold zero-day exploits to government-backed snoops who used them to deploy the firm's Predator spyware in at least three campaigns in 2021, according to Googl ...
Ransomware has become so efficient, and the underground economy so professional, that traditional monetization of stolen data may be on its way out.
But there was a substantial drop in the overall number of critical vulnerabilities that the company disclosed last year, new analysis shows.
Notable new infection chain uses PDF to embed malicious files, load remote exploits, shellcode encryption, and more, new research shows.
Decentralized finance lost $1.8 billion to cyberattacks last year — and 80% of those events were the result of vulnerable code, analysts say.
As states address privacy with ad-hoc laws, corporate compliance teams try to balance yet another set of similar but diverging requirements.
Company to debut its AD capabilities at the 2022 RSA Conference.
New analysis reveals basic regulatory password requirements fall far short of providing protection from compromise.
Here’s why relying on manual tooling is like putting your hands up Webinar Hackers have a tendency to return to the scene of their crimes over and over again. But it’s not because they’re unimaginative creatures of habit. It’s because infosec te ...
Facebook builds FORT to protect against onslaught of regulation, investigation Meta's ad transparency tools will soon reveal another treasure trove of data: advertiser targeting choices for political, election-related, and social issue spots.…
New features include context-aware, zero-trust data protection on local peripherals and devices.
New funding led by global cyber investor Paladin Capital Group, alongside existing investors Columbia Capital and Skylab Capital.
Million-dollar crypto heists are becoming more common as the currency starts to go mainstream; prevention and enforcement haven't kept pace.
Fronton botnet has far more ability than launching DDOS attack, can track social media trends and launch suitable propaganda.
Most losses were due to 'unsophisticated
Following a recent Supreme Court ruling, the Justice Department will no longer prosecute “good faith” security researchers with cybercrimes: The policy for the first time directs that good-faith security research should not be charged. Good faith secu ...
Attackers are using image files with hidden malicious PHP script to manipulate e-commerce checkout pages and capture payment card details.
The SolarWinds supply chain attack was one of the biggest cyber incidents there's ever been. Here's how the company has dealt with the aftermath.
Crafty file names, encrypted malicious code, Office flaws – ah, it's like the Before Times HP's cybersecurity folks have uncovered an email campaign that ticks all the boxes: messages with a PDF attached that embeds a Word document that upon opening inf ...
The goal is to improve cybersecurity defenses in public sector schools.
If the failures of this version of the internet are not learned, what will happen in a world of full sensory haptic suits, hyper-realistic experiences and teledildonics, asks Julie Inman Grant.
Chinese officials describe the Indo-Pacific Economic Framework, which has 12 participating Asia-Pacific nations, as the US government's attempts to "contain" China as well as create divisions, arguing that the initiative ultimately will fail.
5G standards also on the table.
The framework boasts four essential pillars -- trade, supply chains, sustainable energy, and infrastructure -- as well as tax and anti-corruption.
The orders conclude a two-year joint investigation the ICO carried out with the Office of Australian Information Commissioner.
School-friendly tool still not fully protected, privacy guru warns Screencastify, a popular Chrome extension for capturing and sharing videos from websites, was recently found to be vulnerable to a cross-site scripting (XSS) flaw that allowed arbitrary we ...
If you want to better secure your Linux desktop, but don't want to have to learn complicated firewall rules, Jack Wallen wants to introduce you to the Uncomplicated Firewall.
An analysis from Google TAG shows that Android zero-day exploits were packaged and sold for state-backed surveillance.
NIST may be on the brink of revealing which post-quantum computing encryption algorithms it is endorsing, solidifying commercial developments like QuProtect.
The PyPI "pymafka" package is the latest example of growing attacker interest in abusing widely used open source software repositories.
Analysts have seen a massive spike in malicious activity by the XorDdos trojan in the last six months, against Linux cloud and IoT infrastructures .
A culture of trust, combined with tools designed around EX, can work in tandem to help organizations become more resilient and secure.
Next I.T. is the sixth and largest acquisition to date for Valeo Networks.
IronKey Vault Privacy 80 External SSD safeguards against brute-force attacks and BadUSB with digitally-signed firmware.
What subsequent protections do you have in place when your first line of defense goes down?
Researchers find a malware campaign that uses file-naming trickery to get victims to download malicious files from the internet.
I would have called the Instagram tech support number, except -- surprise! -- there's no such thing. Oh foolish, foolish me.
Mohit Tiwari, CEO of Symmetry Systems, explores Zero Trust, data objects and the NIST framework for cloud and on-prem environments.
Microsoft Word also leveraged in the email campaign, which uses a 22-year-old Office RCE bug.
The New South Wales digital driver’s license has multiple implementation flaws that allow for easy forgeries. This file is encrypted using AES-256-CBC encryption combined with Base64 encoding. A 4-digit application PIN (which gets set during the initial ...
Security engineer outlines self-help strategy for keeping software supply chain safe Following the recent disclosure of a technique for hijacking certain NPM packages, security engineer Danish Tariq has proposed a defensive strategy for those looking to a ...
Redmond claims the numbers are scary, but won't release them Microsoft has sounded the alarm on DDoS malware called XorDdos that targets Linux endpoints and servers.…
Less than two weeks into his new gig, Yoon cozies up to Biden as China and DPRK loom US president Biden and South Korea's new president Yoon Suk Yeol have pledged further co-operation in many technologies, including joint efforts to combat North Korea.… ...
IoT Impact will attract more than 500 delegates – decision makers and buyers of IoT systems for business and government and solution providers. But time is running out to get tickets!
Analysis: Ambitious agenda for tech, telco.
Politicians lie, everyone knows it, but when the concept in question is how democracy works, it's a serious matter.
Also, Chinese IT admin jailed for deleting database, and the NSA promises no more backdoors In brief The notorious Russian-aligned Conti ransomware gang has upped the ante in its attack against Costa Rica, threatening to overthrow the government if it d ...
Acknowledging that 2021 was a tough year, SolarWinds CEO says it has bolstered its build model and expanded its systems monitoring capabilities so customers can better manage the complexities of hybrid cloud environments.
Pretty. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here.
Thinking about pursuing cybersecurity training? A cybersecurity degree could boost your future career. Here's what to expect in cybersecurity school.
Because Beijing isn't above covert ops to accomplish its five-year goals Chinese cyberspies targeted two Russian defense institutes and possibly another research facility in Belarus, according to Check Point Research.…
In a new phishing tactic, faux chatbots establish a conversation with victims to guide them to malicious links, researchers say.
Organizations that deploy updates only after a vulnerability is disclosed apply far fewer updates and do so at a lower cost than those that stay up-to-date on all of their software, university researchers say.
“Google Maps Adds Shortcuts through Houses of People Google Knows Aren’t Home Right Now.” Excellent satire.
New versions of QKD use separate wavelengths on the same fiber, improving cost and efficiency, but distance is still a challenge.
Two of Microsoft's Patch Tuesday updates need a do-over after causing certificate-based authentication errors.
Microsoft releases a fix for the May 10 Patch Tuesday update that was causing authentication failures for some.
To succeed against dynamic cybercriminals, organizations must go multiple steps further and build a learning system that evolves over time to keep up with attacker tactics.
May 10 update addressed serious vulns but also had problems of its own Microsoft has released an out-of-band patch to deal with an authentication issue that was introduced in the May 10 Windows update.…
Daniel Kaar, global director application security engineering at Dynatrace, highlights the newfound respect for AppSec-enabled observability in the wake of Log4Shell.
Hexa and IDQL allows organizations using cloud platforms such as Microsoft Azure, Amazon Web Services, and Google Cloud Platform to apply consistent access policy across all applications, regardless of environment.
More than 380,000 of the 450,000-plus servers hosting the open-source container-orchestration engine for managing cloud deployments allow some form of access.
Locks that use Bluetooth Low Energy to authenticate keys are vulnerable to remote unlocking. The research focused on Teslas, but the exploit is generalizable. In a video shared with Reuters, NCC Group researcher Sultan Qasim Khan was able to open and then ...
Got a tech question? Ed Bott and ZDNet's squad of editors and experts probably have the answer. This week: What's the downside of disk encryption? Plus: Do you really need an expensive charger for your electric vehicle, and what's the best way to archive ...
Research claims search engine fails to autofill certain names in Han characters, Microsoft points to technical error Microsoft search engine Bing censors terms deemed sensitive in China from its autosuggestion feature internationally, according to researc ...
Be careful what you are downloading - these files deliver the Vidar infostealer.
Protect your Linux servers from XorDdos, a botnet scanning the internet for SSH servers with weak passwords, Microsoft warns.
Startup QuSecure is the latest vendor to jump into the field with its as-a-service offering Analysis Startup QuSecure will this week introduce a service aimed at addressing how to safeguard cybersecurity once quantum computing renders current public key ...