FreshRSS

πŸ”’
❌ Secure Planet Training Courses Updated For 2019 - Click Here
There are new available articles, click to refresh the page.
Today β€” May 3rd 2024Security

It may take decade to shore up software supply chain security, says infosec CEO

Sure, we're waking to the risk, but we gotta get outta bed, warns Endor Labs founder Varun Badhwar

interview The more cybersecurity news you read, the more often you seem to see a familiar phrase: Software supply chain (SSC) vulnerabilities. Varun Badhwar, founder and CEO at security firm Endor Labs, doesn't believe that's by coincidence. …

Expert-Led Webinar - Uncovering Latest DDoS Tactics and Learn How to Fight Back

In today's rapidly evolving digital landscape, the threat of Distributed Denial of Service (DDoS) attacks looms more significant than ever. As these cyber threats grow in sophistication, understanding and countering them becomes crucial for any business seeking to protect its online presence. To address this urgent need, we are thrilled to announce our upcoming webinar, "Uncovering Contemporary

Hackers Increasingly Abusing Microsoft Graph API for Stealthy Malware Communications

Threat actors have been increasingly weaponizing Microsoft Graph API for malicious purposes with the aim of evading detection. This is done to "facilitate communications with command-and-control (C&C) infrastructure hosted on Microsoft cloud services," the Symantec Threat Hunter Team, part of Broadcom, said in a report shared with The Hacker News.

New Guide Explains How to Eliminate the Risk of Shadow SaaS and Protect Corporate Data

SaaS applications are dominating the corporate landscape. Their increased use enables organizations to push the boundaries of technology and business. At the same time, these applications also pose a new security risk that security leaders need to address, since the existing security stack does not enable complete control or comprehensive monitoring of their usage.

NSA, FBI Alert on N. Korean Hackers Spoofing Emails from Trusted Sources

The U.S. government on Thursday published a new cybersecurity advisory warning of North Korean threat actors' attempts to send emails in a manner that makes them appear like they are from legitimate and trusted parties. The joint bulletin was published by the National Security Agency (NSA), the Federal Bureau of Investigation (FBI), and the Department of State. "The

These Dangerous Scammers Don’t Even Bother to Hide Their Crimes

β€œYahoo Boy” cybercriminals are openly running dozens of scams across Facebook, WhatsApp, Telegram, TikTok, YouTube, and more.

Google Announces Passkeys Adopted by Over 400 Million Accounts

Google on Thursday announced that passkeys are being used by over 400 million Google accounts, authenticating users more than 1 billion times over the past two years. "Passkeys are easy to use and phishing resistant, only relying on a fingerprint, face scan or a pin making them 50% faster than passwords," Heather Adkins, vice president of security engineering at Google, said.

Europol op shutters 12 scam call centers and cuffs 21 suspected fraudsters

Cops prevented crims from bilking victims out of more than €10m - but couldn't stop crime against art

A Europol-led operation dubbed β€œPandora” has shut down a dozen phone scam centers, and arrested 21 suspects. The cops reckon the action prevented criminals from bilking victims out of more than €10 million (Β£8.6 million, $11 million).…

Four Critical Vulnerabilities Expose HPE Aruba Devices to RCE Attacks

HPE Aruba Networking (formerly Aruba Networks) has released security updates to address critical flaws impacting ArubaOS that could result in remote code execution (RCE) on affected systems. Of the 10 security defects, four are rated critical in severity - CVE-2024-26304 (CVSS score: 9.8) - Unauthenticated Buffer Overflow Vulnerability in the L2/L3 Management Service Accessed via

Indonesia sneakily buys spyware, claims Amnesty International

A 'murky' web sees many purchases run through Singapore in a way that hides potential users

Indonesia has acquired spyware and surveillance technologies through a "murky network" that extends into Israel, Greece, Singapore and Malaysia for equipment sourcing, according to Amnesty International.…

Chinese government website security is often worryingly bad, say Chinese researchers

Bad configurations, insecure versions of jQuery, and crummy cookies are some of myriad problems

Exclusive Five Chinese researchers examined the configurations of nearly 14,000 government websites across the country and found worrying lapses that could lead to malicious attacks, according to a not-yet-peer-reviewed study released last week.…

Adding insult to injury: crypto recovery scams

Once your crypto has been stolen, it is extremely difficult to get back – be wary of fake promises to retrieve your funds and learn how to avoid becoming a victim twice over

Weekly Update 398

Weekly Update 398

How many different angles can you have on one data breach? Facial recognition (which probably isn't actual biometrics), gambling, offshore developers, unpaid bills, extortion, sloppy password practices and now, an arrest. On pondering it more after today's livestream, it's the unfathomable stupidity of publishing this data publicly that really strikes me. By all means, have contractual disputes, get lawyers involved and showdown in the courts if you need to, but take data in this fashion and chuck it up online and you're well into criminal territory. It's just nuts, and I suspect there's a lot more yet to play out in this saga.

Weekly Update 398
Weekly Update 398
Weekly Update 398
Weekly Update 398

References

  1. Sponsored by:Β Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSite
  2. Outabox - where do I even begin with this one?! (that's a link to the tweet thread, stay tuned for more there)
  3. Qantas wasn't breached in any sort of malicious fashion, but they've still had a breach (looks like a classic cache key cock-up to me)
  4. Did Bandcamp really email people with their passwords mail-merged into where their name should be? (no, but someone accidentally put their password in the username field and it then appeared in the mail merge... which is also funny 🀣)

McAfee Dominates AV-Comparatives PC Performance Test

In our digital age, a computer is not just a tool; it’s a gateway to a world of possibilities, entertainment, and creativity. The speed of everyday tasks from gaming, and streaming TV shows to editing images and videos can make us more productive but also make our computers more fun to use. When exploring our software choices, it’s vital to choose apps and services, such as online protection tools that have a minimal impact on your computer, allowing you to live your best life online, without the concerns of your PC slowing down.Β 

McAfee has once again proven its excellence by securing the #1 spot in the AV-Comparatives PC Performance Test. With an impressive overall impact score of only 2.8, McAfee Total Protection outperformed all other security vendors, showcasing its lightweight design and exceptional performance. Download the full report from AV-Comparatives here.

The AV-Comparatives Performance TestΒ 

AV-Comparatives, an Austria-based test-lab renowned for its comprehensive evaluations, conducted an extensive Performance Test to measure the impact of consumer security software on system performance. In this test, 16 security products, including McAfee Total Protection, were rigorously evaluated on a low-end PC with an Intel Core i3 CPU, 4GB of RAM, and SSD system drives. The tests were conducted on a clean Windows 10, 64-Bit system with the security software installed using default settings.Β 

Β 

With an overall impact score of 2.8, McAfee Total Protection emerged as the lightest product in the test, surpassing the industry average of 12.3. This outstanding performance has earned McAfee Total Protection the highest possible ranking: ADVANCED+ 3 Stars. This achievement reaffirms McAfee’s commitment to delivering top-notch security solutions that prioritize both protection and performance.Β McAfee has consistently received the highest ADVANCED+ ratings for performance in all AV-Comparatives Performance Tests since October 2016. This track record of excellence demonstrates McAfee’s dedication to continuous improvement and delivering exceptional products.Β 

How a Faster Computer Can Help You Achieve MoreΒ 

To ensure the accuracy of the results, AV-Comparatives examined various activities such as file copying, application installation and launching, file downloading, and web browsing. All tests were conducted with an active internet connection, allowing for the evaluation of the real-world impact of cloud services and features. McAfee Total Protection excelled in all these areas, showcasing its ability to provide robust security without compromising system performance. Whether you’re a gamer, a movie buff, a budding photographer, or a video editor, the enhanced performance can significantly refine how you engage with your hobbies and passions. Learn how your computer can also be more fun!Β 

Gaming: A Seamless Escape into Virtual WorldsΒ 

For gamers, the benefits of a faster computer are immediately noticeable. Modern games require substantial system resources, including fast processors and powerful graphics cards, to run smoothly. Online protection with a minimal impact on your computer’s performance, lets you enjoy games as the developers intended, with minimal lag and stunning visuals.Β 

Streaming: Enjoying Your Favorite Shows in High DefinitionΒ 

Streaming TV shows and movies has become a staple of home entertainment. Platforms like Netflix and Disney Plus offer 4K streaming for many titles and an optimized computer can mean enjoying the best streaming content without buffering. Β 

Image Editing: Unleashing Creative PotentialΒ 

Photography enthusiasts and graphic designers know that image editing can be resource-intensive, especially with high-resolution images and complex effects. A more efficient computer speeds up the performance of software like Adobe Photoshop, allowing for quicker loading of images, smoother application of effects, and more responsive overall editing. This not only saves time but also makes the creative process more enjoyable.Β Β 

Video Editing: Crafting Stories with PrecisionΒ 

Video editing is perhaps the most demanding task that regular consumers undertake on their computers. Editing software such as Adobe Premiere Pro or Final Cut Pro can leverage the additional power of a faster computer to render video faster, apply effects more smoothly, and improve the playback of high-resolution footage in real time. This means less time waiting and more time creating.Β Β 

Protection with World-Class Performance

Investing in robust, tried, and tested online security solutions offers peace of mind, without compromises to your system performance. If you find your current computer lagging in your digital aspirations, it might be time to consider stepping up to more capable online protection. Stay protected with McAfee and experience the perfect balance of security and efficiency.Β 

Β 

Β 

The post McAfee Dominates AV-Comparatives PC Performance Test appeared first on McAfee Blog.

Microsoft, Google do a victory lap around passkeys

Windows giant extends passwordless tech to everyone else

Microsoft today said it will now let us common folk β€” not just commercial subscribers β€” signΒ into their Microsoft accounts and apps using passkeys with their face, fingerprint, or device PIN.…

Yesterday β€” May 2nd 2024Security

Florida man gets 6 years behind bars for flogging fake Cisco kit to US military

Operation busted after dodgy devices ended up at Air Force

Miami resident Onur Aksoy has been sentenced to six and a half years in prison for running a multi-million-dollar operation selling fake Cisco equipment that ended up in the US military.…

Patch up – 4 critical bugs in ArubaOS lead to remote code execution

Ten vulnerabilities in total for admins to apply

Network admins are being urged to patch a bundle of critical vulnerabilities in ArubaOS that lead to remote code execution as a privileged user.…

Two years in, Google says passkeys now protect more than 400 million accounts

Google Account users have authenticated themselves using passkeys more than 1 billion times, but passwords are likely to be around for years.

The Breach of a Face Recognition Firm Reveals a Hidden Danger of Biometrics

Outabox, an Australian firm that scanned faces for bars and clubs, suffered a breach that shows the problems with giving companies your biometric data.

Popular Android Apps Like Xiaomi, WPS Office Vulnerable to File Overwrite Flaw

Several popular Android applications available in Google Play Store are susceptible to a path traversal-affiliated vulnerability codenamed the Dirty Stream attack that could be exploited by a malicious app to overwrite arbitrary files in the vulnerable app's home directory. "The implications of this vulnerability pattern include arbitrary code execution and token theft,

Federal frenzy to patch gaping GitLab account takeover hole

Warning comes exactly a year after the vulnerability was introduced

The US Cybersecurity and Infrastructure Security Agency (CISA) is forcing all federal agencies to patch a critical vulnerability in GitLab's Community and Enterprise editions, confirming it is very much under "active exploit."…

Ukrainian REvil Hacker Sentenced to 13 Years and Ordered to Pay $16 Million

A Ukrainian national has been sentenced to more than 13 years in prison and ordered to pay $16 million in restitution for carrying out thousands of ransomware attacks and extorting victims. Yaroslav Vasinskyi (aka Rabotnik), 24, along with his co-conspirators part of the REvil ransomware group orchestrated more than 2,500 ransomware attacks and demanded ransom payments in

When is One Vulnerability Scanner Not Enough?

Like antivirus software, vulnerability scans rely on a database of known weaknesses. That’s why websites like VirusTotal exist, to give cyber practitioners a chance to see whether a malware sample is detected by multiple virus scanning engines, but this concept hasn’t existed in the vulnerability management space. The benefits of using multiple scanning engines Generally speaking

Dropbox Discloses Breach of Digital Signature Service Affecting All Users

Cloud storage services provider Dropbox on Wednesday disclosed that Dropbox Sign (formerly HelloSign) was breached by unidentified threat actors, who accessed emails, usernames, and general account settings associated with all users of the digital signature product. The company, in a filing with the U.S. Securities and Exchange Commission (SEC), said it became aware of the "

New "Goldoon" Botnet Targets D-Link Routers With Decade-Old Flaw

A never-before-seen botnet called Goldoon has been observed targeting D-Link routers with a nearly decade-old critical security flaw with the goal of using the compromised devices for further attacks. The vulnerability in question is CVE-2015-2051 (CVSS score: 9.8), which affects D-Link DIR-645 routers and allows remote attackers to execute arbitrary

Think tank: China's tech giants refine and define Beijing's propaganda push

Taking down TikTok won't stop the CCP's attempt to control global narratives

Chinese tech companies that serve as important links in the world's digital supply chains are helping Beijing to execute and refine its propaganda strategy, according to an Australian think tank.…

REvil ransomware scum sentenced to almost 14 years inside, ordered to pay $16 million

After extorting $700 million from thousands of victims

A Ukrainian man has been sentenced to almost 14 years in prison and ordered to pay more than $16 million in restitution for his role in infecting thousands of victims with REvil ransomware.…

CISA Warns of Active Exploitation of Severe GitLab Password Reset Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical flaw impacting GitLab to its Known Exploited Vulnerabilities (KEV) catalog, owing to active exploitation in the wild. Tracked as CVE-2023-7028 (CVSS score: 10.0), the maximum severity vulnerability could facilitate account takeover by sending password reset emails to an unverified email

Inside Ukraine’s Killer-Drone Startup Industry

Ukraine needs small drones to combat Russian forcesβ€”and is bootstrapping its own industry at home.

New Cuttlefish Malware Hijacks Router Connections, Sniffs for Cloud Credentials

A new malware called Cuttlefish is targeting small office and home office (SOHO) routers with the goal of stealthily monitoring all traffic through the devices and gather authentication data from HTTP GET and POST requests. "This malware is modular, designed primarily to steal authentication material found in web requests that transit the router from the adjacent

A million Australian pubgoers wake up to find personal info listed on leak site

Man arrested and blackmail charges expected after allegations of unpaid contractors and iffy infosec

Updated Over a million records describing Australians who visited local pubs and clubs have apparently been posted online.…

Dropbox dropped the ball on security, haemorrhaging customer and third-party info

Only from its digital doc-signing service, which is isolated from its cloudy storage

Dropbox has revealed a major attack on its systems that saw customers' personal information accessed by unknown and unauthorized entities.…

Block accused of mass compliance failures that saw digi-dollars reach terrorists

Developer of Square and Cash App reportedly has big back-end problems it was slow to fix

Fintech biz Block is reportedly under investigation by US prosecutors over claims by a former employee that lax compliance checks mean its Square and Cash App services may have been used by terrorists – or in countries that US orgs are not permitted to do business.…

Before yesterdaySecurity

Red Hat's latest enterprise Linux distro has new features to tackle hybrid cloud complexity

In addition to unveiling RHEL 9.4, the company says it will support RHEL 7 for an extra four years.

Infosec biz boss accused of BS'ing the world about his career, anti-crime product, customers

Intrusion investors went through Blount farce trauma, says SEC

Jack Blount, the now-ex CEO of Intrusion, has settled with the SEC over allegations he made false and misleading statements about his infosec firm's product as well as his own background and experience.…

US charges 16 over 'depraved' grandparent scams

Vulnerable elderly people tricked into paying tens of thousands over fake car accidents

Sixteen people are facing charges from US prosecutors for allegedly preying on the elderly and scamming them out of millions of dollars.…

The US Government Is Asking Big Tech to Promise Better Cybersecurity

The Biden administration is asking tech companies to sign a pledge, obtained by WIRED, to improve their digital security, including reduced default password use and improved vulnerability disclosures.

Qantas app glitch sees boarding passes fly to other accounts

Issue now resolved and isn't thought to be the work of criminals

Aussie airline Qantas says its app is now stable following a data breach that saw boarding passes take off from passengers' accounts.…

❌