IT Security News Daily Summary 2023-10-27

• Lockbit ransomware gang claims to have stolen data from Boeing

• Canadian government issues call for proposals to support fight against misinformation

• Safari Side-Channel Attack Enables Browser Theft

• Combating retail theft & fraud

• The Importance of Transparency in Protecting Our Networks and Data

• The Federal Partnership for Interoperable Communications (FPIC) Releases the Transition to Advanced Encryption Standard White Paper

• The Destruction of Gaza’s Internet Is Complete

• The Top 6 Enterprise VPN Solutions to Use in 2023

• Apple Vulnerability Can Expose iOS and macOS Passwords, Safari Browsing History

• Octo Tempest Group Threatens Physical Violence as Social Engineering Tactic

• DEF CON 31 Policy Panel: Navigating the Digital Frontier Advancing Cyber Diplomacy

• Cyber Security Today, Week in Review for the week ending Friday, Oct. 27, 2023

• Mass exploitation of CitrixBleed vulnerability, including a ransomware group

• Singapore wants banks and telcos to bear losses if found negligent in phishing scams

• CCleaner says hackers stole users’ personal data during MOVEit mass-hack

• F5 hurriedly squashes BIG-IP remote code execution bug

• Understand the True Cost of a UEM Before Making the Switch

• Heimdal® Announces New Partnership with ResenNet, displacing ResenNet’s long-standing RMM provider, N-able

• Google Expands Bug Bounty Program to Find Generative AI Flaws

• Top 12 IT security frameworks and standards explained

• New Cyberattack From Winter Vivern Exploits a Zero-Day Vulnerability in Roundcube Webmail

• After the Deal Closes: Lessons Learned in M&A Cybersecurity

• Eclypsium Named Most Innovative Software Supply Chain Security Company in Coveted Top InfoSec Innovator Awards for 2023

• Enhancing Online Privacy: Google Trials IP Address Masking Option

• Google Maps Utilises AI For Immersive View Tool

• Going Beyond MFA: How Okta is Redefining Enterprise Identity

• Hacktivist Activity Related to Gaza Conflict Dwindles

• More Than a Cryptominer, StripedFly Malware Infects 1 Million PCs

• Okta Data Breach Highlights Hackers’ Untapped Gold Mine

• Healey-Driscoll Awards $2.3M to CyberTrust Massachusetts to Strengthen Municipal Cybersecurity Efforts

• Unlocking API Security Excellence: Wallarm at OWASP Global AppSec DC 2023

• Report: September Sees Record Ransomware Attacks Surge

• The Dark Side of AI: How Cyberthreats Could Get Worse, Report Warns

• Five Canada Hospitals hit by cyber attack, ransomware suspected

• VMware Tools Flaw Let Attackers Escalate Privileges

• Apple fixes bug that undermined iOS privacy feature for years

• Empowering Partner Success: How Cisco’s PXP Transforms the Partner Experience

• Imperva Customers are Protected Against the Latest F5 BIG-IP Vulnerability

• N. Korean Lazarus Group Targets Software Vendor Using Known Flaws

• And the phishing Oscar goes to…

• Patch…later? Safari iLeakage bug not fixed

• Internet access in Gaza is collapsing as ISPs fall offline

• Cisco report reveals observability as the new strategic priority for IT leaders

• Protecting Small and Medium-Sized Businesses from Cyberthreats

• CISA Announces New Release of Logging Made Easy

• France agency ANSSI warns of Russia-linked APT28 attacks on French entities

• European Governments Email Servers Targeted by Threat Actors

• Watch out for StripedFly malware

• What Lurks in the Dark: Taking Aim at Shadow AI

• CISA Announces Launch of Logging Made Easy

• Sophisticated StripedFly Spy Platform Masqueraded for Years as Crypto Miner

• AridViper, an intrusion set allegedly associated with Hamas

• Kazakhstan-associated YoroTrooper disguises origin of attacks as Azerbaijan

• 9 vulnerabilities found in VPN software, including 1 critical issue that could lead to remote code execution

• How helpful are estimates about how much cyber attacks cost?

• Expert Cybersecurity Awareness: Test Your Attack Knowledge

• How to Defend Against Account Opening Abuse

• When PAM Goes Rogue: Malware Uses Authentication Modules for Mischief

• The evolution of 20 years of cybersecurity awareness

• Empowering Cybersecurity: A Generative AI Revolution

• Getting to Know: Kim Forsthuber

• compliance officer

• Staying Ahead of Social Engineering Threats

• Downtown Toronto hospital investigating ‘data security incident’

• 8 Tips for Best Results in Red-Teaming

• Microsoft unveils shady shenanigans of Octo Tempest and their cyber-trickery toolkit

• Apple Drops Urgent Patch Against Obtuse TriangleDB iPhone Malware

• iLeakage Attack Exploits Safari To Steal Sensitive Data From Macs, iPhones

• Hackers Earn $350k On Second Day Of Pwn2Own Toronto 2023

• iPhones Have Been Exposing Your Unique MAC Despite Apple’s Promises Elsewise

• Crypto King Tells Judge He Acted On Legal Advice

• Bankman-Fried Says He Acted On Legal Advise

• IT, Security Leaders Play Catch-Up With Generative AI Threats

• Malicious Android Apps on Google Play With Over 2 Million Installs

• Cyber Security Today, Oct. 27, 2023 – Malware hiding as a cryptominer may have infected 1 million PCs since 2017

• Adtran tackles GPS vulnerabilities with Satellite Time and Location technology

• Google Expands Its Bug Bounty Program to Tackle Artificial Intelligence Threats

• How to Keep Your Business Running in a Contested Environment

• PM Rishi Sunak Outlines AI Risks, Cautions Against Rush To Regulation

• Oktane 2023: Okta Unveils New Identity Innovations To Secure the AI Era

• The Rise of Superclouds: The Latest Trend in Cloud Computing

• How to Collect Market Intelligence with Residential Proxies?

• #ISC2Congress: Generative AI A Boon for Organizations Despite the Risks, Experts Say

• Tor Browser Security Audit reveals 2 high security issues

• How to remotely help an elderly relative struggling with a smartphone or a tablet?

• Messaging Service Wiretap Discovered through Expired TLS Cert

• TeamViewer Tensor enhancements improve security and productivity

• Service Mesh and Management Practices in Microservices

• How to add a GUI for your Ubuntu firewall (and why you should)

• Protect Your Passwords for Life for Just $25

• F5 urges to address a critical flaw in BIG-IP

• How Kopeechka, an Automated Social Media Accounts Creation Service, Can Facilitate Cybercrime

• King Charles III signs off on UK Online Safety Act, with unenforceable spying clause

• Germany wins the 2023 European Cybersecurity Challenge

• Toumei – 76,682 breached accounts

• Zero-Day Exploits Cheat Sheet: Definition, Examples & How It Works

• Security Agency Rolls Out Protective DNS for Schools

• TOTOLINK X2000R buffer overflow | CVE-2023-46544

• TOTOLINK X2000R buffer overflow | CVE-2023-46559

• TOTOLINK X2000R buffer overflow | CVE-2023-46562

• TOTOLINK X2000R buffer overflow | CVE-2023-46564

• TOTOLINK X2000R buffer overflow | CVE-2023-46554

• Apple news: iLeakage attack, MAC address leakage bug

• What is Advanced Persistent Threat? Uncover the Hidden Dangers!

• Microsoft Sounds Alarm Over English-Speaking Octo Tempest

• Authentication vs. Authorization

• Hello Alfred app exposes user data

• Knight Ransomware Victim: Michels Markisen GmbH

• Nigerian Police Dismantle Major Cybercrime Hub

• OpenSSL 3.2 Release Candidate

• You know what? Everyone gets a virus now and then.

• American Family Insurance Suffered Cyber Attack

• Demystifying cybersecurity terms: Policy, Standard, Procedure, Controls, Framework, Zero Trust

• Want your endpoint security product in the Microsoft Consumer Antivirus Providers for Windows?

• Silicon UK Pulse: Your Tech News Update: Episode 24

• Managing Cloud Sprawl: A Key Defense Against Cybersecurity Threats

• The Critical Need to Defend Against Unauthorized Apps

• Hunter International Ransomware Group hacks plastic surgery clinic

• A cascade of compromise: unveiling Lazarus’ new campaign

• Raven: Open-source CI/CD pipeline security scanner

• Abyss Ransomware Victim: apexga[.]bank

• New infosec products of the week: October 27, 2023

• F5 Issues Warning: BIG-IP Vulnerability Allows Remote Code Execution

• France says Russian state hackers breached numerous critical networks

• Android adware apps on Google Play amass two million installs

• Nigerian Police dismantle cybercrime recruitment, mentoring hub

• Cloudflare sees surge in hyper-volumetric HTTP DDoS attacks

• New iLeakage attack steals emails, passwords from Apple Safari

• IoT security threats highlight the need for zero trust principles

• Cybersecurity: The Cornerstone of Business Success

• AI strengthens banking’s defense against fraud

• SMBs at risk as AI misconceptions lead to overconfidence

• iLeakage: New Safari Exploit Impacts Apple iPhones and Macs with A- and M-Series CPUs

• 2023-10-25 – DarkGate infection from malspam

• Introduction to WAF Exception Policy

• AI-related security fears drive 2024 IT spending

• How to Begin Observability at the Data Source

• Navigating the Complex World of Platform Engineering

• SMBs Need to Balance Cybersecurity Needs and Resources

• CISA: CISA Releases Fact Sheet on Effort to Revise the National Cyber Incident Response Plan (NCIRP)

• CISA: CISA Adds One Known Exploited Vulnerability to Catalog

• CISA: CISA Releases One Industrial Control Systems Advisory

• Lumen Q3 DDoS Report: Banking Was the Most Targeted Industry for the First Time

• Successful Cyber Risk Quantification: Webinar Takeaways

• Surviving a ransomware attack begins by acknowledging it’s inevitable

• Malwarebytes Announces Consumer Identity Theft Protection Solution

• WatchGuard Launches MDR Service, Helps MSPs Accelerate Cybersecurity Service Delivery

• IT Security News Daily Summary 2023-10-26

• Apple drops urgent patch against obtuse TriangleDB iPhone malware

• TunnelBear VPN Review 2023: Pricing, Ease of Use & Security

• iLeakage attack exploits Safari to steal data from Apple devices

• PathFinder – Tool That Provides Information About A Website

• The top 20 admin passwords will have you facepalming hard

• What the !#@% is a Passkey?

• Passkeys and Privacy

• Cranium raises $25M to fund enterprise AI monitoring, security, and compliance platform

• Forget the outside hacker, the bigger threat is inside by the coffee machine

• DEF CON 31 – India McKinney’s ‘The Coming War on Encryption Part 3’

• MapleSEC: VMware’s Chad Skipper sheds light on security measures

• Why Quality Assurance Testers Are Essential in a Software Development Team

• What Is Multi-Cloud Security? Everything to Know

• Iran APT Targets the Mediterranean With Watering-Hole Attacks

• Rockwell’s Verve Buy Enlivens Critical Infrastructure Security

• Cloudflare mitigated 89 hyper-volumetric HTTP distributed DDoS attacks exceeding 100 million rps

• How to Remove Malware: Removal Steps for Windows & Mac

• Randall Munroe’s XKCD ‘Daylight Saving Choice’

• Citrix Urges Immediate Patch for Critical NetScaler Vulnerability

• Microsoft: 0ktapus Cyberattackers Evolve to ‘Most Dangerous’ Status

• TikTok Streamers Are Staging ‘Israel vs. Palestine’ Live Matches to Cash In on Virtual Gifts

• Mentorship Programs: A Crucial Element in Retaining Cybersecurity Talent

• Celebrating the Internet Freedom Movement at the EFF Awards

• 1Password’s Swift Response to Okta Data Breach

• Online Safety Act Becomes Law In Blow To Campaigners

• Side channel attacks take bite out of Apple silicon with iLeakage exploit

• NCC Group details 153% spike in September ransomware attacks

• HackerOne Bug Bounty Disclosure: b-rce-on-ingress-nginx-controller-via-ingress-spec-rules-http-paths-path-field-b-ginoah

• HackerOne Bug Bounty Disclosure: b-flickr-api-key-leaked-in-github-commit-b-m-y-nk

• iLeakage: New Safari Exploit Impacts Apple iPhones and Macs with A and M-Series CPUs

• Sam Bankman-Fried Begins Defence In FTX Fraud Trial

• Opinion | Can we Afford the Risk? Measuring the cost of the Expiration of the Chemical Facilities Anti-Terrorism Standards Program

• Play Ransomware Victim: Laiho Group

• CISA: CISA Releases Nine Industrial Control Systems Advisories

• CISA: Apple Releases Security Advisories for Multiple Products

• Ransomware Kingpin Behind Ragnar Locker Arrested in Paris

• Canada Reports Targeting of Trudeau and Others by Chinese Bots

• Firefox Memory Corruption Flaw Let Attacker Execute Arbitrary Code

• Longer Support Periods Raise the Bar for Mobile Security

• Guarding Paradise: Strategies for Cybersecurity in Exclusive Enclaves

• US Energy Service Shared Details on How Akira Ransomware Hacked its Network

• Ransomware news headlines trending on Google

• Cybersecurity month: Why we need to talk about online identities

• Everything You Need to Know About Microsoft’s New $5 Billion Investment in Australia

• Addressing Executive & Social Media Impersonation: Protecting Leaders That Lack an Online Presence

• New Data ‘Poisoning’ Tool Empowers Artist to Combat AI Scraping

• ServiceNow Data Exposure Flaw Raises Concerns

• Nigerian Cybercrime Hub Shut Down With 6 Arrests

• 12 Best Vulnerability Management Systems & Tools 2023

• RSA Conference™ 2023 Security Operations Center Findings Report

• Customer Experience (CX) and Partners are Greater Together at Cisco Partner Summit 2023

• Be You, With Us: Empowering Diverse Authentic Voices in Corporate Spaces

• Evolve to Cloud-Enforced Security to Empower Your Anywhere Workforce

• What Is Two-Factor Authentication (2FA) and Why Should You Use It?

• How Cybersecurity Can Be a Catalyst for Technology Innovation

• CISA and HHS Pull Together Cybersecurity Toolkit for Healthcare Sector

• #iLeakage: All Apple CPUs Vulnerable — No Patch in Sight

• At-Bay Stance MDR improves cyber resilience for SMBs

• Operation Triangulation iOS Attack Details Revealed

• Elon Musk’s X Deploys Audio, Video Calling Option

• Why cybersecurity training isn’t working (and how to fix it)

• Announcing NEW Malwarebytes Identity Theft Protection

• Face search engine PimEyes stops searches of children’s faces

• Cyberattack hits 5 hospitals

• Update vCenter Server now! VMWare fixes critical vulnerability

• Phony job vacancy targets LinkedIn users with DarkGate malware

• RSA Conference™ 2023 Security Operations Center Findings Report

• Octo Tempest Attacking Organizations to Steal Financial Data

• Quishing is the new phishing: What you need to know

• Maine Mass Shooting Disinformation Floods Social Media as Suspect Remains at Large

• Rockwell Automation FactoryTalk View Site Edition

• Centralite Pearl Thermostat

• Sielco Radio Link and Analog FM Transmitters

• Rockwell Automation Arena

• Dingtian DT-R002

• RSA Conference™ 2023 Security Operations Center Findings Report

• Pro-Russian Hackers Target XSS In Roundcube

• BeyondTrust, Cloudflare And 1Password Targeted After Okta Breach

• Google Announces Bug Bounty Program And Other Initiatives To Secure AI

• ServiceNow Quietly Addresses Unauthenticated Data Exposure Flaw From 2015

• You Should Probably Buy A Flipper Zero Before It’s Too Late

• Darktrace Extends AI Reach to Secure AWS Clouds

• Cado Security launches Cloud Incident Readiness Dashboard for proactive response

• Record-Breaking 100 Million RPS DDoS Attack Exploits HTTP/2 Rapid Reset Flaw

• Microsoft Warns as Scattered Spider Expands from SIM Swaps to Ransomware

• CISA Issues Request for Comment on Software Identification Ecosystem Analysis White Paper

• ScamClub’s Deceptive Landing Pages

• Why Compliance Matters When Dealing with AI and Finances

• Unifying threat context with VirusTotal connectors

• BT Clocks 530 Cyberattacks Every Second

• DUCKTAIL Malware Employs LinkedIn Messages to Execute Attacks

• Giving Power Back to Your Users With Flow’s Account Model

• Cisco Patches 2 Dangerous Zero-Day Vulnerabilities

• What Would a Government Shutdown Mean for Cybersecurity?

• RSA Conference™ 2023 Security Operations Center Findings Report

• Monetization of Partner Led Managed Services Model

• Darktrace/Cloud solution based on self-learning AI provides cyber resilience for cloud environments

• The Financial Implications of Cyber Security: How Catch Rates Impact Organizational Risk

• Complex Spy Platform StripedFly Bites 1M Victims

• RSA Conference™ 2023 Security Operations Center Findings Report

• Physical Security Operations: The Costs of not Being Enterprise-Ready

• Progress Flowmon ADS 12.2 AI offers advanced security event monitoring

• #ISC2Congress: CISO Best Practices for Managing Cyber Risk

• Horse Racing Game NEOBRED Integrates with Avalanche for Elite Gaming Experience

• RSA Conference™ 2023 Security Operations Center Findings Report

• Google’s reward criteria for reporting bugs in AI products

• Increasing transparency in AI security

• Effective Workplace Education is Built Around Incentives

• Beware of the Flipper Zero Bluetooth spam attacks

• Google adds generative AI threats to its bug bounty program

• RSA Conference™ 2023 Security Operations Center Findings Report

• Critical Flaw in NextGen’s Mirth Connect Could Expose Healthcare Data

• The Danger of Forgotten Pixels on Websites: A New Case Study

• Four Steps to Integrate Zero-Trust

• Tufin Orchestration Suite R23-2 helps enterprises to fully optimize SASE approach

• Humans are still better than AI at crafting phishing emails, but for how long?

• UK IT Pros Worried About C-Suite Training Gap Ahead of AI Safety Summit

• #ISC2Congress: CISOs Can Elevate Their Role with New Cyber Regulations

• The Haunted House of IoT: When Everyday Devices Turn Against You

• How to craft a password meticulously

• Apple Lends Support To Biden’s Federal Right To Repair Push

• Seiko confirmed a data breach after BlackCat attack

• New NSA Information from (and About) Snowden

• Fortinet expands Universal SASE offering to empower today’s hybrid workforce

• Authorities Seize 17 North Korean Hacker Websites Used for Scamming

• Dual Pillars of Embedded Systems: Ensuring Safety and Security

• Meta Profit Soars From Ongoing Strong Ad Spending

• Indian National Arrested for Stealing $150,000 via Computer Hacking

• Spain Arrests 34 Cybercriminals Who Stole Data of 4 Million People

• How to catch a wild triangle

• Seemplicity integrates with Wiz to accelerate remediation

• SEIKO Cyber Attack: Customers Personal Data Exposed

• Don’t Get Spooked Into Falling For These Phishing Scams

• Europol: Police Must Start Planning For Post-Quantum Future

• Donation fraud: Scammers Exploit Generosity in Gaza Conflict

• Aruba Networks ClearPass Policy Manager privilege escalation | CVE-2023-43508

• Aruba Networks ClearPass Policy Manager privilege escalation | CVE-2023-43506

• Aruba Networks ClearPass Policy Manager command execution | CVE-2023-43510

• Aruba Networks ClearPass Policy Manager open redirect | CVE-2023-43509

• Aruba Networks ClearPass Policy Manager SQL injection | CVE-2023-43507

• Silicon Insights: Integrated B2B Marketing Strategies that Succeed: Part 2

• Citrix Bleed: PoC Released for Citrix NetScaler Zero-Day Vulnerability

• ServiceNow quietly addresses unauthenticated data exposure flaw from 2015

• Citrix NetScaler ADC and Gateway Sensitive Information Disclosure Vulnerability (CVC-2023-4966) Notification

• CISA Releases Cybersecurity Toolkit For Healthcare

• iOS 17.1 and MacOS Sonoma 14.1 Released With Bug Fixes Including Arbitrary Code Execution

• Iranian Group Tortoiseshell Launches New Wave of IMAPLoader Malware Attacks

• YoroTrooper: Researchers Warn of Kazakhstan’s Stealthy Cyber Espionage Group

• Humans Need to Rethink Trust in the Wake of Generative AI

• UK Parliament Opens Inquiry into Cyber-Resilience

• Quishing: Tricks to look out for

• Do you know what your supply chain is and if it is secure?

• 8 Base Ransomware Victim: Carter Transport Claims

• 8 Base Ransomware Victim: Harmann Studios Inc

• 8 Base Ransomware Victim: AVA Limited

• New Undetected Python-Based Info-stealer Offered Via Dedicated Website

• The fallout from the Okta breach continues

• Winter Vivern APT exploited zero-day in Roundcube webmail software in recent attacks

• AtlasReaper command-line Suite Developed For Offensive Security Purposes

• CISA: CISA Releases Guidance for Addressing Cisco IOS XE Web UI Vulnerabilities

• Citrix Bleed exploit lets hackers hijack NetScaler accounts

• Seiko says ransomware attack exposed sensitive customer data

• VMware fixes critical code execution flaw in vCenter Server

• European govt email servers hacked using Roundcube zero-day

• Ransomware isn’t going away – the problem is only getting worse

• OT cyber attacks proliferating despite growing cybersecurity spend

• Winter Vivern exploits zero-day vulnerability in Roundcube Webmail servers

• Building Cyber Warriors: The World of Cybersecurity Training and Certifications

• StripedFly: Perennially flying under the radar

• GOAD: Vulnerable Active Directory environment for practicing attack techniques

• CISOs struggling to understand value of security controls data

• Ransomware groups continue to increase their operational tempo

• 41 States Sue Facebook For Allegedly Being Harmful And Addictive For Kids

• NSFOCUS Achieves Three Certifications, Paving the Path to Sustainable and Environmentally Responsible Development

• How Cyber Risk Quantification can Help Align CISOs with the Board.

• Stronger Together: Attack Surface Management and Security Validation

• BHI Energy Releases Details of Akira Ransomware Attack

• Ripcord Transforms, Anitian Empowers, Agencies Win

Generated on 2023-10-27 23:55:55.243963