IT Security News Daily Summary 2023-09-28

• Pinkerton – An JavaScript File Crawler And Secret Finder Developed In Python

• Feds’ privacy panel backs renewing Feds’ S. 702 spying powers — but with limits

• Cisco patches zero-day vulnerability under attack

• US, Japan warn China-linked ‘BlackTech’ targeting routers

• Johnson Controls International Disrupted by Major Cyberattack

• Vulnerability resolution enhanced by integrations

• EFF to D.C. Circuit: Animal Rights Activists Shouldn’t Be Censored on Government Social Media Pages Because Agency Disagrees With Their Viewpoint

• Dark Web Pedophiles Using Open-Source AI to Generate CSAM

• Safeguard Your AWS Account: IAM Best Practices

• Progress Software Patches Critical Pre-Auth Flaws in WS_FTP Server Product

• External vs Internal Vulnerability Scans: Difference Explained

• Q&A: UK Ambassador on Creating New Cybersecurity Agencies Around the World

• DARPA takes its long-duration Manta undersea drone for a test-dip

• Join the new Microsoft Security experience at Microsoft Ignite 2023

• Novel ZenRAT Scurries Onto Systems via Fake Password Manager Tool

• CIA Builds Own Artificial Intelligence Tool – Report

• Apple Releases Security Updates for Multiple Products

• CISA Kicks Off 20th Anniversary of Cybersecurity Awareness Month with New Public Awareness Campaign to Secure Our World

• GitHub Repositories Hit by Password-Stealing Commits Disguised as Dependabot Contributions

• HackerOne Bug Bounty Disclosure: b-reflected-xss-in-oauth-complete-endpoints-b-zerodivisi-n

• How To Turn Off Google’s “Privacy Sandbox” Ad Tracking—and Why You Should

• FCC Proposes To Restore Net Neutrality Laws In US

• How To Implement Zero Trust: Best Practices and Guidelines

• Cisco urges to patch actively exploited IOS zero-day CVE-2023-20109

• Apple Ordered To Face Apple Pay Antitrust Lawsuit

• Phishing via Dropbox

• Asian banks are a favorite target of cybercooks, and malicious bots their preferred tool

• Looking Beyond the Hype Cycle of AI/ML in Cybersecurity

• NordVPN Review (2023): Pricing, Security & Performance

• Budworm APT Evolves Toolset, Targets Telecoms and Government

• US Justice Department Urged to Investigate Gunshot Detector Purchases

• Fake Bitwarden Site Distributes Novel RAT Malware

• Chinese Hackers Stole Emails From US State Dept In MS Breach

• Cisco Warns Of IOS Software Zero-Day Exploitation Attempts

• After Failing At Privacy Again, Google Is Working To Keep Bard Chats Out Of Search

• Right Wing Elon Scraps Tool To Report Electoral Fake News

• Wi-Fi Eavesdropping: Risks and How to Stay Secure

• AI Boom: Cybercriminals Winning Early

• RansomedVC Ransomware Group Claims to Have Breached Sony Network

• Digital identity: Dispelling the myths

• Sir Jony Ive And OpenAI Discuss AI Hardware Project – Report

• Unpatched Cisco Catalyst SD-WAN Manager Systems Exposed to DoS Attacks

• Post-Pandemic Cybersecurity: Lessons Learned and Predictions

• Booking.com Customers Targeted in Major Phishing Campaign

• Cyber Attack paralysis IT operations at Volkswagen

• Google to launch Android Earthquake Alerts in India

• Android Banking Trojan Zanubis Evolves to Target Peruvian Users

• DEXMA DexGate

• Rockwell Automation PanelView 800

• CISA Releases Three Industrial Control Systems Advisories

• CISA Adds One Known Exploited Vulnerability to Catalog

• Google patches zero-day exploited by commercial spyware vendor

• Swissbit releases N5200 Enterprise SSD

• Armilla AI AutoGuard makes generative AI safer for enterprises

• Veriti Agentless OS-Level Remediation boosts scalability and resiliency

• Malicious ad served inside Bing’s AI chatbot

• Nexusflow raises $10.5 to build a conversational interface for security tools

• Meta Connect 2023: Meta Quest 3, Ray-Ban Meta Smart Glasses

• Why Organizations Struggle With Vulnerability Management?

• Demystifying the SEC’s Enhanced Cybersecurity Disclosure Requirements

• Sony Launches Investigation After Hackers Threaten to Sell Stolen Data on Dark Web

• What Is Web App Penetration Testing?

• How I got started: SIEM engineer

• Moving From Qualitative to Quantitative Cyber Risk Modeling

• Government Shutdown Could Bench 80% of CISA Staff

• Lumu Raises $30 Million for Threat Detection and Response Platform

• Verisoul Raises $3.25 Million in Seed Funding to Detect Fake Users

• Supply Chain Attackers Escalate With GitHub Dependabot Impersonation

• 4 Legal Surprises You May Encounter After a Cybersecurity Incident

• China’s BlackTech Hacking Group Exploited Routers to Target U.S. and Japanese Companies

• Norton Small Business offers protection against scams and phishing threats

• Linksys announces Cognitive Security capability

• Kong Insomnia 8.0 accelerates API design and developer efficiency

• ZYXEL Buffer Overflow vulnerability Let Attacker Launch DoS Attack

• Case Study: Blocking Botnet-Driven Low-Rate HTTP DDoS Attacks

• US Lawmaker: Government Shutdown Will Leave Americans Exposed to Cyber-Attacks

• Dark Angels Team ransomware group hit Johnson Controls

• Sysdig Launches Realtime Attack Graph for Cloud Environments

• Russian Zero-Day Acquisition Firm Offers $20 Million for Android, iOS Exploits

• Cisco Warns of IOS Software Zero-Day Exploitation Attempts

• Yet another Chrome zero-day exploited in the wild! (CVE-2023-5217)

• Panzura Edge minimizes the risk of data leakage and exfiltration

• Heimdal® Achieves ISAE 3000 SOC 2 Type II Certification, Demonstrating Compliance with the Highest Security Standards

• Akira Ransomware Victim: Civic San Diego

• Akira Ransomware Victim: The Polish American
  Association

• Critical Chrome Update Counters Spyware Vendor’s Exploits

• The Dark Side of Browser Isolation – and the Next Generation Browser Security Technologies

• Meta Connect 2023: Meta Launches AI Chatbots With Personalities

• Snatch Ransomware Group Leaked User’s Location and Internal Data

• Critical Cisco WAN Manager Vulnerabilities Let Attacker Conduct DoS Attack

• Simplifying Blockchain Development by using Abstraction

• China-Linked Budworm Targeting Middle Eastern Telco and Asian Government Agencies

• KSOC says it’s tackling cloud-native security in a way that is Kubernetes-first

• PingSafe unveils MSSP partnership with Human Managed

• Apple macOS Ventura security bypass | CVE-2023-41996

• snappy-java denial of service | CVE-2023-43642

• Cookie Notice & Consent Plugin for WordPress cross-site scripting | CVE-2023-41948

• Trellix Endpoint Security (ENS) code execution | CVE-2023-3665

• iFolders plugin for WordPress cross-site scripting | CVE-2023-41949

• China’s chip equipment firms see revenue surge as Beijing seeks semiconductor self-reliance

• Robots: Cybercriminals of the Future?

• Guide to ransomware and how to detect it

• Google Rushes to Patch New Zero-Day Exploited by Spyware Vendor

• How to develop a cybersecurity strategy: Step-by-step guide

• Around the World with Thales: Our Upcoming Events

• Google confirms CVE-2023-5129 is the hidden threat in Libwebp

• What Does Secure by Design Actually Mean?

• Google Patches Chrome Zero-Day Used in Spyware Attacks

• US and Japan Warn of Chinese Router Attacks

• GOOGLE FIXED THE FIFTH CHROME ZERO-DAY OF 2023

• Journey partners with Webex by Cisco to enhance security for customer interactions

• Imagination GPU devices information disclosure | CVE-2023-44216

• Apple macOS Sonoma code execution | CVE-2023-40432

• GLPI information disclosure | CVE-2023-41321

• Apple macOS Sonoma security bypass | CVE-2023-40426

• Apple macOS Sonoma information disclosure | CVE-2023-40429

• UK Logistics Firm Forced to Close After Ransomware Breach

• Actively Exploited Chrome Zero-day Patched: Update Now!

• A cryptor, a stealer and a banking trojan

• After failing at privacy, again, Google is working to keep Bard chats out of Search

• Do you know what your supply chain is and if it is secure?

• BlackTech APT Hackers Break into Cisco Firmware to Attack the US and Japan

• CACTUS Ransomware Victim: www[.]spuncast[.]com

• CACTUS Ransomware Victim: www[.]unitex[.]com

• Daily Vulnerability Trends: Thu Sep 28 2023

• 8 Base Ransomware Victim: Notel

• SIEM in 2024: 7 Trends to Watch Out For

• The hidden costs of neglecting cybersecurity for small businesses

• How to avoid the 4 main pitfalls of cloud identity management

• A Preview of Windows 11’s Passkeys Support

• CAPTCHAs Easy for Humans, Hard for Bots

• Johnson Controls hit by Dark Angels Ransomware

• Ransomware groups are shifting their focus away from larger targets

• The clock is ticking for businesses to prepare for mandated certificate automation

• Kubernetes attacks in 2023: What it means for the future

• Google fixes fifth actively exploited Chrome zero-day of 2023

• SSH keys stolen by stream of malicious PyPI and npm packages

• US and Japan warn of Chinese hackers backdooring Cisco routers

• Modern GPUs vulnerable to new GPU.zip side-channel attack

• GitHub repos bombarded by info-stealing commits masked as Dependabot

• Update Chrome Now: Google Releases Patch for Actively Exploited Zero-Day Vulnerability

• China’s national security minister rates fake news among most pressing cyber threats

• Google Chrome Multiple Vulnerabilities

• AWS Graviton Use Cases

• Using GenAI in Your Business? Here Is What You Need To Know

• Malwarebytes Admin update: New Detection screens to manage threats!

• Malwarebytes MDR wins G2 awards for “Best ROI,” “Easiest to Use,” and more

• Xenomorph hunts cryptocurrency logins on Android

• Pegasus spyware and how it exploited a WebP vulnerability

• Top 8 Secure Access Service Edge (SASE) Providers in 2023

• Snapchat Safety for Parents: How to Safeguard Your Child

• How to Obtain a Virtual Phone Number and Why You Need One

• Netscout Identified Nearly 7.9M DDOS Attacks in the First Half of 2023

• Fortinet Announces Formation of Veterans Program Advisory Council to Narrow the Cybersecurity Skills Gap With Military Veteran Talent

• Radiant Logic Announces Expanded Identity Analytics and Data Management Platform Capabilities

• Russian zero-day broker is willing to pay $20M for zero-day exploits for iPhones and Android devices

• IT teams are taking on more responsibilities with hybrid work and cloud adoption

• US-CERT Vulnerability Summary for the Week of September 11, 2023

• IT Security News Daily Summary 2023-09-27

• Researchers Release Details of New RCE Exploit Chain for SharePoint

• China-linked APT BlackTech was spotted hiding in Cisco router firmware

• WMIExec – Set Of Python Scripts Which Perform Different Ways Of Command Execution Via WMI Protocol

• The Cost of Cybercrime in the US: Facts and Figures

• Protecting customer trust with AI is the future of e-commerce

• E-commerce fraud to cost $48 billion globally this year as attacks skyrocket, report says

• China APT Cracks Cisco Firmware in Attacks Against the US and Japan

• Security researcher warns of chilling effect after feds search phone at airport

• How to View Incognito History on Android Without Them Knowing

• Apple Zero-Day Flaws Exploited For Predator Spyware Attacks

• Why a DevOps approach is crucial to securing containers and Kubernetes

• Facebook Reportedly Caved To Government Pressure Overseas And Allowed Hate Speech To Thrive

• This startup wants to verify your ID without storing your personal data

• Multi-Tenancy With Keycloak, Angular, and SpringBoot

• SwiftData Dependency Injection in SwiftUI Application

• Tequila OS 2.0: The first forensic Linux distribution in Latin America

• Fake Bitwarden Password Manager Website Drops Windows ZenRAT

• Smart Contract Language Comparison: Solidity vs. Cadence vs. Move

• CISA and FEMA Open the Application Process for the Tribal Cybersecurity Grant Program

• RATs, rootkits, and ransomware (oh my!)

• Check Point Research Uncovers Critical Vulnerabilities in Friend.tech WEB3 Platform

• Chinese Gov Hackers Caught Hiding in Cisco Router Firmware

• SoundThinking, Maker of ShotSpotter, Is Buying Parts of PredPol Creator Geolitica

• Bitwarden adds passkey 2FA to keep online accounts protected

• SpecterOps introduces Purple Team Assessments Services

• Cybertech Europe 2023 will explore innovation, new possibilities in cyber technology

• HackerOne Bug Bounty Disclosure: b-missing-function-level-access-control-in-mozilla-formula-containsregular-expression-denial-of-service-cve-b-unexpectedbuffercon

• HackerOne Bug Bounty Disclosure: b-subdomain-takeover-on-mozaws-net-b-mikey

• HackerOne Bug Bounty Disclosure: b-curl-cve-http-header-allocation-dos-b-selmelc

• Publisher’s Spotlight: Radiant Security: Your AI-powered SOC Co-pilot

• Amazon Hires Former Microsoft Head Panos Panay As Device Boss

• Malware Concealed as Dependabot Contributions Strikes GitHub Projects

• SMS Security & Privacy Gaps Make It Clear Users Need a Messaging Upgrade

• Exploring ScamClub Payloads via Deobfuscation Using Abstract Syntax Trees

• ‘ASTORS’ Nominee Partners to Bring Unified SASE to EMEA Enterprises

• Your Bard conversations are someone else’s Google results

• NYC rights groups say no to grocery store spycams and snooping landlords

• Simple Membership Plugin Flaws Expose WordPress Sites

• ZoobeTek unveils CRA to fight mobile hacking risks and quantum threats

• SeeMetrics releases customizable Cybersecurity Performance Boards

• Cyxtera launches COE for exploring AI and quantum computing

• TikTok Blow As Indonesia Bans E-commerce Transactions

• The latest Windows 11 update is rolling out now. Here’s what’s new

• Ransomed.vc Group Hits NTT Docomo After Sony Breach Claims

• Red Cross-Themed Phishing Attacks Distributing DangerAds and AtlasAgent Backdoors

• Russian zero-day seller offers $20M for hacking Android and iPhones

• EFF’s Comment to the Meta Oversight Board on Polish Anti-Trans Facebook Post

• Ethics in the Age of Ransomware: Challenges and Strategies for Negotiation

• AtlasCross Hackers Target Organizations with Red Cross Phishing Lures

• RasomedVC: Ransomware Group Claims to Have Breached Sony’s Computer Systems

• Lawsuit against MGM and Ceasars Entertainment Ransomware Attack

• CISA Unveils New HBOM Framework to Track Hardware Components

• BEC Attacks Increase By 279% in Healthcare

• MOVEit Breach Delivers Bundle Of 3.4 Million Baby Records

• Google Quietly Corrects Previously Submitted Disclosure For Critical Webp 0-Day

• GPUs From All Major Suppliers Are Vulnerable To New Pixel Stealing Attack

• Misconfigured TeslaMate Instances Put Tesla Car Owners At Risk

• Firefox 118 Patches High Severity Vulnerabilities

• Sony`s Systems Breached. Ransomed.vc Claims Stealing 260 GB of Data

• Ransomware Attack Blamed As Logistics Firm Collapses

• Lu0Bot Node.js Malware Takes Complete Control Over Victim’s Computer

• Atlas VPN Review (2023): Features, Pricing, Alternatives

• EchoMark launches AI-driven solution to improve data privacy standards

• FileCloud partners with OPSWAT to strengthen data security posture for customers

• Baffle Data Protection for AI secures private data for use in GenAI projects

• New Relic Session Replay aids engineers in issue resolution with video-like playback

• Arrcus and NVIDIA join forces to deliver high-performance, zero-trust networking for datacenters

• Liberals to add ‘fundamental right to privacy’ to proposed law, but no details yet

• Watch out! CVE-2023-5129 in libwebp library affects millions applications

• Strategies for Merchant Ransomware Protection

• Data Mapping vs. Data Lineage: Understanding The Differences

• Embracing Innovation: AI-Driven Service Management for IT Professionals

• Medusa Locker Ransomware Victim: LANDSTAR POWER ONTARIO INC

• Medusa Locker Ransomware Victim: Acoustic Center

• How AI and better pay can address the ongoing cyber talent shortage

• TalkTalk To Split Into Three Companies, With CEO To Step Down

• JetBrains Patches Severe TeamCity Flaw Allowing RCE and Server Hijacking

• Stolen GitHub Credentials Used to Push Fake Dependabot Commits

• Firefox 118 Patches High-Severity Vulnerabilities

• Misconfigured TeslaMate Instances Put Tesla Car Owners at Risk

• Gem Security Lands $23 Million Series A Funding

• Leading CISO Creates Model for Ransomware Payment Decisions

• CISA, NSA, FBI and Japan Release Advisory Warning of BlackTech, PRC-Linked Cyber Activity

• Researchers Uncover New GPU Side-Channel Vulnerability Leaking Sensitive Data

• Gem Security raises $23M for its cloud security platform

• Celebrating Over 20,000 Hours of Cyber Hacking Training via the Check Point MIND and NotSoSecure Partnership

• Apple rolls out fix for data transfer bug to all compatible iPhones and iPads

• Protected Extensible Authentication Protocol (PEAP)

• NSA, FBI, CISA, and Japanese Partners Release Advisory on PRC-Linked Cyber Actors

• People’s Republic of China-Linked Cyber Actors Hide in Router Firmware

• New twist on ZeroFont phishing technique spotted in the wild

• stackArmor ATO for AI accelerates safe AI adoption for public sector organizations

• Musk’s X Disabled Electoral Misinformation Reporting Feature, Researcher Claims

• Apple Security Fixes for iPhone, iPad, Safari, Watch & Sonoma14: Update Now!

• Cost of a data breach 2023: Geographical breakdowns

• Will Government Secure Open Source or Muck It Up?

• Cybersecurity firm Lumu raises $30M to detect network intrusions

• PikaBot C2 Detected – 148[.]153[.]34[.]82:2078

• Soaring Cyber Insurance Claims are Hurting firms with Ransomware Attacks and Compromised Emails

• The Rise of Biometric Security: Protecting Data in the Future of Cybercrime

• macOS 14 Sonoma Patches 60 Vulnerabilities

• Google Open Sources Binary File Comparison Tool BinDiff

• Research reveals 80% of applications developed in EMEA contain security flaws

• OneTrust AI Governance helps organizations manage AI systems and mitigate risk

• Google “confirms” that exploited Chrome zero-day is actually in libwebp (CVE-2023-5129)

• Appdome unveils mobile anti-malware protections

• Which Industries Use Document Translation Services?

• Cyber Security Today, Sept. 27 2023 – Hackers are targeting luxury hotels, a Red Cross scam and more

• North Korean and Chinese Hackers Attacking Healthcare Industries

• The Rise of Automotive Hacking: How to Secure Your Vehicles Against Hacking

• ‘Snatch’ Ransom Group Exposes Visitor IP Addresses

• New Survey Uncovers How Companies Are Confronting Data Security Challenges Head-On

• Akamai Research Finds the Number of Cyberattacks on European Financial Services More Than Doubled in 2023

• Half of organisations with cyber insurance implemented additional security measures to qualify for the policy or reduce its cost

• What You Must Know About Rate Limiting

• Cyber-Attacks on Ukraine Surge 123%, But Success Rates Plummet

• DarkBeam leaks billions of email and password combinations

• Critical Vulnerability in libwebp Library

• LockBit 3.0 Ransomware Victim: cochraninc[.]com

• ICS Reconnaissance Attacks – Introduction to Exploiting Modbus

• The Weather Network Faces Ransomware Attack, Faces Data Leak Threat

• Google To Sunset Gmail’s Basic HTML View In 2024

• Closing Integrity Gaps with NIST CSF

• ‘Ransomed.vc’ in the Spotlight – What is Known About the Ransomware Group Targeting Sony and NTT Docomo

• Fake Bitwarden installation packages delivered RAT to Windows users

• TeamViewer and Ivanti simplify the complex task of managing and securing remote devices

• Phobos Ransomware: Everything You Need to Know and More

• Upgrade Your Cybersecurity With This VPN That’s Only $89 for Three Years

• Regulator Warns Breaches Can Cost Lives

• New ZenRAT Malware Targeting Windows Users via Fake Password Manager Software

• QR codes in email phishing

• Keeper Security study shows cultural changes imperative to improve cyber incident reporting

• New GPU Side-Channel Attack Allows Malicious Websites to Steal Data

• Attacks on European Financial Services Double in a Year

• Booking.com Customers Hit by Phishing Campaign Delivered Via Compromised Hotels Accounts

• Poll Maker Plugin for WordPress cross-site scripting | CVE-2023-41872

• Online Job Portal SQL injection | CVE-2023-43468

• szvone vmqphp SQL injection | CVE-2023-43132

• Order Delivery Date for WooCommerce Plugin for WordPress cross-site scripting | CVE-2023-41874

• PeproDev CF7 Database Plugin for WordPress cross-site scripting | CVE-2023-41863

• How do you spook cyber criminals?

• Quick Glossary: Malware

• NCSC Launches Cyber Incident Exercise Scheme

• Attacks on EMEA Financial Services Double in a Year

• Love in the Digital Age: How Technology Transformed Dating

• Identity Theft Protection Policy

• Why performing security testing on your products and systems is a good idea

• Top 5 Problems Solved by Data Lineage

• CACTUS Ransomware Victim: www[.]astrolighting[.]com

• CACTUS Ransomware Victim: www[.]orthumbau[.]de

• 8 Base Ransomware Victim: Muenz-Engineered Sales

• New AtlasCross APT Using Weaponized Word Documents to Deploy Malware

• Cyber Attacks Arising from Microsoft Office Software

• Critical libwebp Vulnerability Under Active Exploitation – Gets Maximum CVSS Score

• Indian government reports Security Vulnerabilities in Apple devices

• High number of security flaws found in EMEA-developed apps

• Best Practices for Data Protection

• Hackers actively exploiting Openfire flaw to encrypt servers

• New AtlasCross hackers use American Red Cross as phishing lure

• ShadowSyndicate hackers linked to multiple ransomware ops, 85 servers

• Can we fix the weaknesses in password-based authentication?

• SickKids impacted by BORN Ontario data breach that hit 3.4 million

• Guide: SaaS Offboarding Checklist

• Cloud service inefficiencies drain IT budgets

• Network Flight Simulator: Open-source adversary simulation tool

• Is your identity safe? Exploring the gaps in threat protection

• The pitfalls of neglecting security ownership at the design stage

• ChromeOS Multiple Vulnerabilities

• Apple Products Multiple Vulnerabilities

• Artificial Intelligence — Beyond the Algorithms

• Google Indexed Trove of Bard AI User Chats in Search Results

• Credit card thieves target Booking.com customers

• Child health data stolen in registry breach

• Webinar: Bridging digital transformation & cybersecurity

Generated on 2023-09-28 23:55:46.443606