IT Security News Daily Summary 2024-08-08

• Stolen data from scraping service National Public Data leaked online

• Tricky Web Timing Attacks Are Getting Easier to Use—and Abuse

• Weak “Guardrails” on Police Face Recognition Use Make Things Worse

• Reintroducing the EFA

• US ‘laptop farm’ man accused of outsourcing his IT jobs to North Korea to fund weapons programs

• Humans are Top Factor in Cloud Security: CSA Study

• US ‘laptop farm’ man accused of outsourcing his IT jobs to North Koreans to raise funds for weapons

• Top 10 Valimail Alternatives and Competitors in 2024

• Top 10 DMARC Solutions in 2024

• HYPR and Microsoft Partner on Entra FIDO2 Provisioning APIs

• Introducing Secretless Identity and Access for Serverless with AWS Lambda

• USENIX Security ’23 – TAP: Transparent and Privacy-Preserving Data Services

• How to Offer Secure IVR Banking and Authenticate Callers

• How to Become a Cybersecurity Engineer

• Education Sector Common Breaches and Cyber Threats

• Black Hat and DEF CON Roundup 2024: AWS Patched a Vulnerability Affecting Six Cloud Services

• 0.0.0.0 Day flaw allows malicious websites to bypass security in major browsers

• #BHUSA: CISA Director Confident in US Election Security

• Wiz researchers hacked into leading AI infrastructure providers

• Zenity CTO on dangers of Microsoft Copilot prompt injections

• CrowdStrike Class Action Lawsuit for Massive Software Outage

• Microsoft’s AI Can Be Turned Into an Automated Phishing Machine

• The Guide to Zero Trust Data Detection & Response (DDR)

• The Need For A Vulnerability Operations Center (VOC) in Modern Cybersecurity

• The top stories coming out of the Black Hat cybersecurity conference

• Black Hat USA 2024: Chip Flaw ‘GhostWrite’ Steals Data from CPU Memory

• CrowdStrike Dismisses Claims of Exploitability in Falcon Sensor Bug

• How to Perform a Cloud Security Assessment: Checklist & Guide

• Salt Security Extends Scope of API Security Platform

• MCA to Strike Off 400 Chinese Companies for Fraud in India

• How Microsoft and NIST are collaborating to advance the Zero Trust Implementation

• UK To Investigate Amazon’s $4 Billion Investment In Anthropic

• LG unleashes South Korea’s first open-source AI, challenging global tech giants

• Over $40 Million Recovered and Arrests Made Within Days After Firm Discovers Business Email Compromise Scam

• Fake FIM: The Cybersecurity Lie That Could Cost You

• UK Watchdog Clears HPE’s Acquisition Of Juniper

• What is the Coalition for Secure AI (CoSAI)?

• EFF and 12 Organizations Tell Bumble: Don’t Sell User Data Without Opt-In Consent

• Cybercriminals Impersonate Law Enforcement in New ‘Digital Detention’ Scam

• Hackers Steal 6 Terabytes Data, Sells on Dark Web

• University Professors Targeted by North Korean Cyber Espionage Group

• Wordfence Intelligence Weekly WordPress Vulnerability Report (July 29, 2024 to August 4, 2024)

• Meet the ransomware gang that demands $500 million

• Anthropic offers $15,000 bounties to hackers in push for AI safety

• The Critical Role of Data Center Technology in Transforming the Manufacturing Industry

• Google Discontinues Chromecast Portfolio

• Black Hat USA 2024: AWS ‘Bucket Monopoly’ Flaw Led to Account Takeover

• I tested 7 AI content detectors – they’re getting dramatically better at identifying plagiarism

• The Windows 10 clock is ticking: 5 ways to save your old PC in 2025 (most are free)

• Hackers Spreading Malicious Python Packages Through Popular Developer Q&A Platform

• Keytronic Lost Over $17 Million Due to a Ransomware Attack

• USPS Text Scammers Duped His Wife, So He Hacked Their Operation

• Home security giant ADT says it was hacked

• Critical Progress WhatsUp Gold RCE Flaw Now Under Active Exploitation

• Stolen Credentials Have Turned SaaS Apps Into Attackers’ Playgrounds

• #BHUSA: Ransomware Drill Targets Healthcare in Operation 911

• Dorsett Controls InfoScan

• How East Carolina University Uses LoRaWAN to Drive Regional Innovation

• 0.0.0.0 Day: 18-Year-Old Browser Vulnerability Impacts MacOS and Linux Devices

• Alibaba’s T-Head C910 RISC-V Chips Found Vulnerable to GhostWrite Attack

• Using 1Password on Mac? Patch up if you don’t want your Vaults raided

• Ransomware Attack Costs loanDepot Almost $27 Million

• SEC Investigation into Progress MOVEit Hack Ends Without Charges

• Security researcher discovered attack to downgrade Windows permanently

• What Is a Whaling Attack (Whale Phishing) + How Can You Prevent It?

• Tesla Issues Recall For 1.6 Million Cars In China

• STAC6451 Hacker Hijacking Microsoft SQL Servers to Compromise Organizations

• NIS2 Compliance Unveiled: Operational Managers’ Roadmap to Actionable Security Measures

• Cloud Storage From Microsoft, Google Used in Malware Attacks

• US Offering $10 Million Reward for Iranian ICS Hackers

• Operational Technology (OT) Security a Top Priority for CIOs

• Phishing Attack Exploits Google, WhatsApp to Steal Data

• Infinity Global Services and Cysurance Launch a Comprehensive Insurability Assessment Program

• NIS2 Directive in the EU: An imminent deadline, insufficient preparation

• PureHVNC Deployed via Python Multi-stage Loader

• FBI and CISA Uncover Updated TTPs and Activity of the BlackSuit Ransomware Group

• US elections have never been more secure, says CISA chief

• Web-Connected Industrial Control Systems Vulnerable to Attack

• Massive Data Breach Exposes Personal Information of 2.9 Billion People Worldwide

• Microsoft 365 anti-phishing alert “erased” with one simple trick

• Balancing the Scales: Addressing Privacy, Security, and Biases in AI based on the White House Blueprint for an AI Bill of Rights

• Intel Sued By Shareholders After Dividend Suspension, Stock Price Crash

• Thousands of Exposed Industrial Control Systems in US, UK Threaten Water Supplies

• Our Latest Product Updates

• Ronin Network Hacked, $12 Million Returned by “White Hat” Hackers

• Dude, Where’s My Documentation?

• BIND Vulnerabilities: Urgent Security Updates Released

• Automated Security Validation: One (Very Important) Part of a Complete CTEM Framework

• North Korea Kimsuky Launch Phishing Attacks on Universities

• As use of IoT devices grows, so do the associated security risks

• Proton Pass password manager adds identity data, biometric authentication

• One year later: The Flipper Zero is still cool. Here are 7 useful things you can do

• Watch How a Hacker’s Infrared Laser Can Spy on Your Laptop’s Keystrokes

• ISC Stormcast For Thursday, August 8th, 2024 https://isc.sans.edu/podcastdetail/9088, (Thu, Aug 8th)

• Can AI detectors save us from ChatGPT? I tried 7 online tools to find out

• Researcher Discovers Downgrade Attack Abusing Windows Update Process

• Report: Tech misconceptions plague the IT world

• Menlo Zero Trust Access enhancements boost enterprise browsing security

• New Phishing Scam Uses Google Drawings and WhatsApp Shortened Links

• Windows Downgrade Attack Risks Exposing Patched Systems to Old Vulnerabilities

• YouTube Hit By Thousands Of Outages In Russia

• Record Breaking DDoS Attack 419 TB of Malicious Traffic Within 24-Hours

• Mule-as-a-Service Infrastructure Exposed

• Benefits of Adopting Zero-Trust Security

• Get a Lifetime of 1TB Cloud Storage for Only $70 With FolderFort

• SEC Ends Probe Into MOVEit Attacks Impacting 95 Million People

• AWS Patches Vulnerabilities Potentially Allowing Account Takeovers

• Should Deny By Default Be the Cornerstone of Zero Trust?

• Roundcube Flaws Allow Easy Email Account Compromise (CVE-2024-42009, CVE-2024-42008)

• Securonix and Cribl partner to enhance threat detection with advanced data integration

• “Perfect” Windows downgrade attack turns fixed vulnerabilities into zero-days

• BlackSuit/Royal Ransomware Group Has Demanded $500m

• Cybersecurity Headlines: McLaren hospitals disrupted, CrowdStrike improves processes, Ronin Network hacked

• Microsoft 365 Anti-Phishing Feature can be Bypassed with CSS

• Endor Labs launches Upgrade Impact Analysis and Magic Patches for SCA market

• FBI and CISA update a joint advisory on the BlackSuit Ransomware group

• Entrust faces years of groveling to regain browsers’ trust, say rival chiefs

• 7 Best Cyber Risk Management Platforms of 2024

• AI Remediation by ArmorCode reduces DevSecOps friction and accelerates security fixes

• Ethical Hackers Steal and Return $12m to Ronin Network

• AppViewX and Utimaco team up to enhance cloud security with new lifecycle management solutions

• Unlock the Future of Cybersecurity: Exclusive, Next Era AI Insights and Cutting-Edge Training at SANS Network Security 2024

• Optimizing AWS GuardDuty for Enhanced Security Monitoring

• Photos: Black Hat USA 2024 Arsenal

• Critical Cisco Small Business IP Phone Flaws Exposes Users to Remote Attacks

• MFA: Multi-Factor Annoyance? Why MFA’s Days Are Numbered.

• Tor Browser 13.5.2 Released: What’s New!

• Cloud Data Storage Raises New Security Issues

• Photos: Black Hat USA 2024 Startup City

• Provisional £6m Fine Imposed on Software Provider Following NHS Ransomware Attack

• Police Recover Over USD 40 Million from International Email Scam

• RAD Security Combines AI With Behavioral Analytics to Improve Cybersecurity

• SSHamble: Open-source security testing of SSH services

• Critical Security Flaw in WhatsUp Gold Under Active Attack – Patch Now

• FBI and CISA Warn of BlackSuit Ransomware That Demands Up to $500 Million

• The three pillars of the next generation in data security: PostgreSQL, zero trust and web3

• Rhysida Ransomware group claims to have breached Bayhealth Hospital in Delaware

• Ransomware Attack Targets Grand Palais, Paris

• INC Ransomware targets McLaren Health Care Hospitals

• New APT Group Actor240524: A Closer Look at Its Cyber Tactics Against Azerbaijan and Israel

• Traceeshark: Open-source plugin for Wireshark

• Why tech-savvy leadership is key to cyber insurance readiness

• AI security 2024: Key insights for staying ahead of threats

• How network segmentation can strengthen visibility in OT networks

• Securing against GenAI weaponization

• Download: CIS Critical Security Controls v8.1

• Ransomware operators continue to innovate

• Cloud storage lockers from Microsoft and Google used to store and spread state-sponsored malware

• New APK Scam: Protect Your Bank Account from Fraudsters

• Samsung boosts bug bug bounty to a cool million for cracks of the Knox Vault subsystem

• Inside the Dark World of Doxing for Profit

• Critical XSS bug in Roundcube Webmail allows attackers to steal emails and sensitive data

• IT Security News Daily Summary 2024-08-07

• Nexera DeFi Protocol Hacked: $1.8M Stolen in Major Smart Contract Exploit

• From Cybersecurity Practitioner to Advocacy: My Journey Back to Cisco

• Veracode highlights security risks of GenAI coding tools

• Atari Asteroids Hack Sparks Debate on Blockchain Gaming Transparency

• Cybercrime Rapper Sues Bank over Fraud Investigation

• Democracy’s Challenge: Secure Elections Worldwide

• Over 40,000 Internet-Exposed ICS Devices Found in US: Censys

• #BHUSA: CrowdStrike Outage Serves as Dress Rehearsal for China-Led Cyber-Attacks

• AI PCs bring new security protections and risks. Here’s what users need to know

• D3 Introduces Program to Help SOC Teams Migrate Successfully from Legacy SOAR

• Living off the VPN ? Exploring VPN Post-Exploitation Techniques

• Elon Musk Says “No Choice” But To Close X’s San Francisco HQ

• Jumpstart Your Meraki Auto-VPN Journey in the Multi-Cloud Environment

• Student Devices Wiped — Mobile Guardian Hacked AGAIN

• Docker vs. Podman: Exploring Container Technologies for Modern Web Development

• Nvidia AI security architect discusses top threats to LLMs

• Researchers unveil AWS vulnerabilities, ‘shadow resource’ vector

• Announcing BlueHat 2024: Call for Papers now open

• Waymo Expands Ride-Hailing Service, Amid Growing Demand

• A Flaw in Windows Update Opens the Door to Zombie Exploits

• EFF Tells Yet Another Court to Ensure Everyone Has Access to the Law and Reject Private Gatekeepers

• Faulty instructions in Alibaba’s T-Head C910 RISC-V CPUs blow away all security

• Randall Munroe’s XKCD ‘Matter’

• OpenAI’s Tool Can Detect Chat-GPT Written Texts

• Increase in Magniber Ransomware Attacks Affects Home Users Globally

• #BHUSA: New Ransomware Groups Emerge Despite Crackdowns

• Ireland’s DPC Takes Twitter to Court Over AI User Data Concerns

• Recent ProtonVPN Update Brings Discreet Icons, Stealth Protocol

• Can Deaf and Hard of Hearing People Thrive in IT and Tech Careers?

• How To Check and Update Newer Versions for Dependencies in Maven Projects

• Hackers could spy on cell phone users by abusing 5G baseband flaws, researchers say

• UK ICO Fines NHS Supplier For Medical Records Breach

• 12 types of endpoint security

• Cloud Security Strategy: Building a Robust Policy in 2024

• RaaS Group Targets Corporate Networks with SharpRhino RAT

• Windows Update Flaws Allow Undetectable Downgrade Attacks

• Tenable Adds Ability to Prioritize Vulnerabilities by Threat Level

• What Is Encryption and How Does It Work?

• Critical Solar Power Grid Vulnerabilities Risk Global Blackouts

• How You Can Avoid a CrowdStrike Fiasco

• CISA Adds Two Known Exploited Vulnerabilities to Catalog

• Microsoft 365 Phishing Alert Can Be Hidden with CSS

• Fortinet acquires Next DLP

• Musk Hits Out At UK Justice System, Amid War Of Words

• Data Breaches Are Costing Australian Organisations, IBM Report Reveals

• Black Hat and DEF CON Roundup 2024: What to Expect From This Week’s Security Events

• Hackers could spy on cellphone users by abusing 5G baseband flaws, researchers say

• New and Emerging Cybersecurity Threats and Attacker Tactics

• Report: Email Attacks Skyrocket 293%

• Fighting AI fire with AI fire

• Researcher Sounds Alarm on Windows Update Flaws Allowing Undetectable Downgrade Attacks

• USENIX Security ’23 – Squirrel: A Scalable Secure Two-Party Computation Framework for Training Gradient Boosting Decision Tree

• Hackers are Employing Real Estate Fraud to Target North Dakota Citizens

• Hackers Breach ISP to Poison Software Updates With Malware

• Akamai Blocked 419 TB of Malicious Traffic in a 24-Hour DDoS Attack

• Examine a captured packet using Wireshark

• European IT Professionals Want Training on AI, Poll Finds

• Roundcube Webmail Flaws Allow Hackers to Steal Emails and Passwords

• New Linux Kernel Exploit Technique ‘SLUBStick’ Discovered by Researchers

• CISA Releases Guide to Enhance Software Security Evaluations

• Attack Vectors at a Glance

• The Best MSSP Software You Should Consider Looking At in 2024

• Federal Watchdog Urges EPA to Develop Comprehensive Cyber Strategy to Protect Water Systems

• Sysdig Adds Ability to Correlate Identities to Cloud Computing Breaches

• This Caller Does Not Exist: Using AI to Conduct Vishing Attacks

• #BHUSA: The Board Needs to Understand AI Deployment Risks

• Phishing Attacks Can Bypass Microsoft 365 Email Safety Warnings

• How CIRCIA is changing crisis communication

• Expert Insight: Cyber Security Resilience Act: A game-changer for industry standards

• Women in CyberSecurity (WiCyS) Announces 5th Annual Security Training Scholarship

• NHS Software Supplier Advanced Faces $7.6 Million Fine Over Ransomware Attack Failings

• Network perimeter security protections for generative AI

• Unlock the Power of GenAI with Check Point Software Technologies

• Black Hat Roundup 2024: What to Expect From This Week’s Security Events

• Small CSS tweaks can help nasty emails slip through Outlook’s anti-phishing net

• Rubrik Allies With Mandiant to Increase Cyber Resiliency Capability

• Google Ads Glitch Exposes Sensitive Competitor Data, Causes Reporting Disruption

• #BHUSA: DARPA’s AI Cyber Challenge Heats Up as Healthcare Sector Watches

• How NetSPI Built a Proactive Security Platform

• What is Captcha?

• Threat Actors Announced Doubleface Ransomware, Claims Fully Undetectable

• Ransomware Swells Despite Collective Push to Curb Attacks

• Scamnetic Emerges From Stealth With AI-Based Scam Detection Solution

• CrowdStrike engages external experts, details causes of massive outage

• AWS Launches Mithra To Detect Malicious Domains Across Systems

• Researchers Proposed MME Framework To Enhance API Sequence-Based Malware Detection

• Cyber Training Organization Pledges $15 Million in Education Programs

• The Art of Possible: Redefining Cybersecurity in the Age of Data as the New Perimeter

• Microsoft, CrowdStrike Hit Back At Delta’s Compensation Bid

• Microsoft 365 Vulnerability Let Hackers Bypass Anti-phishing Feature

• Cisco ISE 3.4 – Here and Now!

• Abnormal Security Raises $250M on $5.1B Valuation to Enhance AI-Driven Cyber Protection

• North Korean Hackers Leverage Malicious NPM Packages for Initial Access

• Police take just 2 days to recover $40M stolen in business email scam

• Hunters International RaaS Group Points SharpRhino at IT Workers

• Problems with Georgia’s Voter Registration Portal

• Chameleon Malware Now Targeting Employees Masquerading as a CRM app

• Cyberattack On Mobile Guardian MDM Wiped Connected Devices

• Apple Tightens macOS Gatekeeper Controls in macOS Sequoia

• Replacement for Action Fraud, UK’s Cybercrime Reporting Service, Delayed Again Until 2025

• The Role of AI in Cybersecurity Operations

• CrowdStrike Reveals Root Cause of Global System Outages

• New Go-based Backdoor GoGra Targets South Asian Media Organization

• Elon Musk’s X Sues Advertisers Over “Massive Advertiser Boycott”

• Have You Heard About the New PCI 4.0 Section 1.2 Spec? Tripwire Makes Compliance Easy

• Reliable Baseline Management with Fortra’s Tripwire Enterprise

• StormCloud Hacks ISP to Spread Malware Posing as Software Updates

• EQT buys majority share in Swiss cybersecurity biz Acronis

• Ransomware Attack Cost LoanDepot $27 Million

• Join Us 08-23-24 for “Hacking the Future of Pentesting” – Super Cyber Friday

• New Zola Ransomware Using Multiple Tools to Disable Windows Defender

• New Android spyware LianSpy relies on Yandex Cloud to avoid detection

• UK Managers Improve Cyber Knowledge but Staff Lack Training

• Cybersecurity Headlines: Google kernel zero-day, voter portal flaw, ransomware as terrorism

• Microsoft’s Security Efforts Leave Much To Be Desired, Especially For Email Security

• Contrast Security Introduces ADR to Help Organisations Combat Zero Days and Secure Applications from Within

• CISA Adds Microsoft COM for Windows Bug to its Known Exploited Vulnerabilities Catalog

• Veza introduces Access AI to streamline risk management and access control

• ICO Prepares £6m Fine for NHS Supplier Advanced

• What Does the EU AI Act Mean for Cybersecurity?

• Masterclass in CIAM for Insurance: Balancing Security, Experience, and Consent

• Attackers Use Multiple Techniques to Bypass Reputation-Based Security

• Police Shield Communications from Public Scrutiny with Encryption

• Elastic automates SIEM data onboarding with Automatic Import

• Cequence Unified API Protection defends against attacks targeting AI applications

• AppSOC launches new AI security capabilities for enhanced governance and protection

• Roundcube flaws allow easy email account compromise (CVE-2024-42009, CVE-2024-42008)

• Tech Contractor Exposes Data of 4.6 Million US Voters

• UK health services call-handling vendor faces $7.7M fine over 2022 ransomware attack

• Chrome, Firefox Updates Patch Serious Vulnerabilities

• Flashpoint Ignite and Echosec deliver threat intelligence for enhanced protection

• D3 enhances Smart SOAR Platform with Ace AI

• EQT takes a majority stake in cybersecurity firm Acronis at $3.5B+ valuation

• Cymulate AI Copilot validates security against real-time threats

• Contrast Security ADR enables teams to identify vulnerabilities, detect threats, and stop attacks

• XDSpy Hackers Attacking Users to Steal Sensitive Data

• EQT takes a majority stake in cybersecurity firm Acronis at a $3.5B+ valuation

• Chameleon Android Banking Trojan Targets Users Through Fake CRM App

• Britain NHS Software provider to face Ransomware penalty of £ 6 million

• Can a Bitcoin Ban Help Stop Ransomware Attacks

• Chrome Security Update: Patch for Multiple Vulnerabilities

• The C-Suite Conundrum: Are Senior Executives the Achilles’ Heel of Cybersecurity?

• OpenWrt dominates, but vulnerabilities persist in OT/IoT router firmware

• Apple’s New macOS Sequoia Tightens Gatekeeper Controls to Block Unauthorized Software

• SharpRhino malware targets IT admins – Hunters International gang suspected

• Securing Data in the AI Era: Introducing Check Point Harmony Endpoint DLP

• Georgia’s voter portal gets a crash course in client versus backend input validation

• RustScan: Open-source port scanner

• Sports venues must vet their vendors to maintain security

• AWS’ Mithra Neural Network Detects, Ranks Malicious Domains

• Breaking down FCC’s proposal to strengthen BGP security

• Microsoft punches back at Delta Air Lines and its legal threats

• Hackers breached MDM firm Mobile Guardian and wiped thousands of devices

• Number of incidents affecting GitHub, Bitbucket, GitLab, and Jira continues to rise

• Is shadow IT being brought in to organizations by security professionals? Cyber Security Today for Wednesday, August 7th, 2024

• CrowdStrike hires outside security outfits to review troubled Falcon code

• Microsoft Hits Back at Delta After the Airline Said Last Month’s Tech Outage Cost It $500 Million

• ISC Stormcast For Wednesday, August 7th, 2024 https://isc.sans.edu/podcastdetail/9086, (Wed, Aug 7th)

• How AHEAD Enhanced SecOps Efficiency with Low-code Security Automation

• CrowdStrike hires outside security outfits to review Falcon code

• Same Scripts, Different Day: What My DShield Honeypot Taught Me About the Importance of Security Fundamentals [Guest Diary], (Wed, Aug 7th)

• CrowdStrike hires outside security firms to review Falcon code

• UK data watchdog to fine NHS vendor Advanced for security failures prior to LockBit ransomware attack

Generated on 2024-08-08 23:55:12.638158