Category: Uncategorized
-
Chinese Hackers Target Semiconductor Firms in East Asia with Cobalt Strike [email protected] (The Hacker News)
Threat actors have been observed targeting semiconductor companies in East Asia with lures masquerading as Taiwan Semiconductor Manufacturing Company (TSMC) that are designed to deliver Cobalt Strike beacons. The intrusion set, per EclecticIQ, leverages a backdoor called HyperBro, which is then used as a conduit to deploy the commercial attack simulation software and post-exploitation toolkit.Read More
-
In Other News: Funding Increase, Abuse of Smartphone Location Data, Legal Matters SecurityWeek News
Noteworthy stories that might have slipped under the radar: cybersecurity funding increases, new laws, and government’s illegal use of smartphone location data. The post In Other News: Funding Increase, Abuse of Smartphone Location Data, Legal Matters appeared first on SecurityWeek. Read More
-
Organizations Warned of Top 10 Cybersecurity Misconfigurations Seen by CISA, NSA Ionut Arghire
CISA and the NSA are urging network defenders and software developers to address the top ten cybersecurity misconfigurations. The post Organizations Warned of Top 10 Cybersecurity Misconfigurations Seen by CISA, NSA appeared first on SecurityWeek. Read More
-
Nonprofit Service Provider Blackbaud Settles Data Breach Case for $49.5M With States Associated Press
The fundraising software company Blackbaud has agreed to pay $49.5 million to settle claims brought by the attorneys general of 49 states and Washington, D.C., related to a 2020 data breach. The post Nonprofit Service Provider Blackbaud Settles Data Breach Case for $49.5M With States appeared first on SecurityWeek. Read More
-
New OS Tool Tells You Who Has Access to What Data [email protected] (The Hacker News)
Ensuring sensitive data remains confidential, protected from unauthorized access, and compliant with data privacy regulations is paramount. Data breaches result in financial and reputational damage but also lead to legal consequences. Therefore, robust data access security measures are essential to safeguard an organization’s assets, maintain customer trust, and meet regulatory requirements. ARead More
-
CISA Reverses Course on Malicious Exploitation of Video Conferencing Device Flaws Eduard Kovacs
CISA has removed from its KEV catalog five Owl Labs video conferencing flaws that require the attacker to be in Bluetooth range. The post CISA Reverses Course on Malicious Exploitation of Video Conferencing Device Flaws appeared first on SecurityWeek. Read More
-
GitHub’s Secret Scanning Feature Now Covers AWS, Microsoft, Google, and Slack [email protected] (The Hacker News)
GitHub has announced an improvement to its secret scanning feature that extends validity checks to popular services such as Amazon Web Services (AWS), Microsoft, Google, and Slack. Validity checks, introduced by the Microsoft subsidiary earlier this year, alert users whether exposed tokens found by secret scanning are active, thereby allowing for effective remediation measures. It was firstRead More
-
Supermicro’s BMC Firmware Found Vulnerable to Multiple Critical Vulnerabilities [email protected] (The Hacker News)
Multiple security vulnerabilities have been disclosed in the Intelligent Platform Management Interface (IPMI) firmware for Supermicro baseboard management controllers (BMCs) that could result in privilege escalation and execution of malicious code on affected systems. The seven flaws, tracked from CVE-2023-40284 through CVE-2023-40290, vary in severity from High to Critical, according to BinarlyRead More
-
Cisco Plugs Gaping Hole in Emergency Responder Software Ryan Naraine
Cisco warns that unauthenticated, remote attackers can log into devices using root account, which has default, static credentials that cannot be changed or deleted. The post Cisco Plugs Gaping Hole in Emergency Responder Software appeared first on SecurityWeek. Read More
-
GitHub Improves Secret Scanning Feature With Expanded Token Validity Checks Ionut Arghire
GitHub beefs up its secret scanning feature, now allowing users to check the validity of exposed credentials for major cloud services. The post GitHub Improves Secret Scanning Feature With Expanded Token Validity Checks appeared first on SecurityWeek. Read More