Security experts are sounding alarms about what some are calling the most sophisticated supply chain attack ever carried out on an open source project: a malicious backdoor planted in xz/liblzma (part of the xz-utils package), a popular open source compression…
Tag: Security Boulevard
Webinar Recap: Cybersecurity Trends to Watch in 2024
Predicting the future of cybersecurity is an impossible task, but getting some expert advice doesn’t… The post Webinar Recap: Cybersecurity Trends to Watch in 2024 appeared first on Security Boulevard. This article has been indexed from Security Boulevard Read the…
HYAS Threat Intel Report April 1 2024
Weekly Threat Intelligence Report Date: April 1, 2024 Prepared by: David Brunsdon, Threat Intelligence – Security Engineer, HYAS Each week, we are sharing what we are seeing in our HYAS Insight threat intelligence and investigation platform, specifically a summary of…
The Cybersecurity Industry Starts Picking Through Malicious XZ Utils Code
The open source community, federal agencies and cybersecurity researchers are busy trying to get their hands around the security near-miss of the backdoor found in versions of the popular XZ Utils data compression library. The malicious code apparently was methodically…
The AI Revolution in Access Management: Intelligent Provisioning and Fraud Prevention
AI revolutionizes access management by enabling intelligent provisioning, dynamic access control, and fraud prevention. Using machine learning and predictive analytics, it ensures consistent access policies and detects anomalous behavior in real time. The post The AI Revolution in Access Management:…
Cybersecurity Industry Starts Picking Through Malicious XZ Utils Code
The open source community, federal agencies, and cybersecurity researchers are still trying to get their hands around the security near-miss of the backdoor found in versions of the popular XZ Utils data compression library, malicious code that apparently was methodically…
Confidence in the Cloud Starts With Visibility and Zero-Trust
The only way organizations can really protect cloud-based IT environments is by putting zero-trust into practice. The post Confidence in the Cloud Starts With Visibility and Zero-Trust appeared first on Security Boulevard. This article has been indexed from Security Boulevard…
Ethics of Cyber Security: To Disclose or Not?
In a recent panel discussion, a thought-provoking question was posed to us, one that delves into the murky waters of cyber security and governmental responsibility. The query centered on the obligation of governments regarding the vulnerabilities they discover and utilize for intelligence…
The Strategic Role of AI in Governance, Risk and Compliance (GRC)
By integrating AI into governance, organizations streamline their security operations and significantly reduce the likelihood of oversight or human error. The post The Strategic Role of AI in Governance, Risk and Compliance (GRC) appeared first on Security Boulevard. This article…
New Hotel Lock Vulnerabilities, Glassdoor Anonymity Issues
In episode 323, the hosts discuss two prominent topics. The first segment discusses a significant vulnerability discovered in hotel locks, branded as ‘Unsaflok,’ affecting 3 million doors across 131 countries. The vulnerability allows attackers to create master keys from a…
XZ Utils Backdoor Vulnerability (CVE-2024-3094) Advisory
Overview NSFOCUS CERT recently detected that a backdoor vulnerability in XZ Utils (CVE-2024-3094) was disclosed from the security community, with a CVSS score of 10. Because the SSH underlying layer relies on liblzma, an attacker could exploit this vulnerability to…
Bombshell in SSH servers! What CVE-2024-3094 means for Kubernetes users
On March 29, 2024, Red Hat disclosed CVE-2024-3094, scoring a critical CVSS rating of 10. Stemming from a The post Bombshell in SSH servers! What CVE-2024-3094 means for Kubernetes users appeared first on ARMO. The post Bombshell in SSH servers!…
Critical Backdoor Found in XZ Utils (CVE-2024-3094) Enables SSH Compromise
The Mend.io research team detected more than 100 malicious packages targeting the most popular machine learning (ML) libraries from the PyPi registry. The post Critical Backdoor Found in XZ Utils (CVE-2024-3094) Enables SSH Compromise appeared first on Mend. The post…
Cybersecurity Tabletop Exercises: How Far Should You Go?
With global cyber threats and other international tensions growing, what scenarios should state and local governments consider when conducting exercises to test their people, processes and technology? The post Cybersecurity Tabletop Exercises: How Far Should You Go? appeared first…
An Accidental Discovery of a Backdoor Likely Prevented Thousands of Infections
… Read more » The post An Accidental Discovery of a Backdoor Likely Prevented Thousands of Infections appeared first on Deepfactor. The post An Accidental Discovery of a Backdoor Likely Prevented Thousands of Infections appeared first on Security Boulevard. This article has…
Understanding and Mitigating the Fedora Rawhide Vulnerability (CVE-2024-3094)
CVE-2024-3094 is a reported supply chain compromise of the xz libraries. The resulting interference with sshd authentication could enable an attacker to gain unauthorized access to the system. Overview Malicious code was identified within the xz upstream tarballs, beginning with…
How did CVE-2024-27198 Lead to Critical Vulnerability in JetBrains?
CVE-2024-27198 Lead to Server Takeover Vulnerabilities The post How did CVE-2024-27198 Lead to Critical Vulnerability in JetBrains? appeared first on Kratikal Blogs. The post How did CVE-2024-27198 Lead to Critical Vulnerability in JetBrains? appeared first on Security Boulevard. This article…
Getting rid of a 20+ year old known vulnerability: It’s like a PSA for Runtime Security
On Wednesday, March 27, CISA and the FBI issued a cry for help: We need to stamp out SQL injection vulnerabilities, and we need to do it yesterday, they said in a joint Secure by Design alert aimed at any…
‘Darcula’ PhaaS Campaign Sinks Fangs into Victims
A sprawling phishing-as-a-service (PhaaS) campaign that has been running since at least last summer is using more than 20,000 fake domains to target a wide range of organizations in more than 100 countries, illustrating the capabilities of an increasingly popular…
PyPI Goes Quiet After Huge Malware Attack: 500+ Typosquat Fakes Found
Emergency stop button: The Python Package Index was drowning in malicious code again, so they had to shut down registration for cleanup. The post PyPI Goes Quiet After Huge Malware Attack: 500+ Typosquat Fakes Found appeared first on Security Boulevard.…