IT Security News Daily Summary 2024-08-09

• Intel has news – good, bad and ugly – about Raptor Lake bug patch. Here’s what to know

• How to ask Google to remove deepfake porn results from Google Search

• 6 VPN Security Best Practices for Secure Connection

• Australian Enterprises Coming 4th in 2024 Global Survey of Generative AI Usage

• Ecovacs home robots can be hacked to spy on their owners, researchers say

• USENIX Security ’23 – Cheesecloth: Zero-Knowledge Proofs of Real World Vulnerabilities

• ATM Software Flaws Left Piles of Cash for Anyone Who Knew to Look

• Friday Squid Blogging: SQUID Is a New Computational Tool for Analyzing Genomic AI

• Raptor Lake microcode limits Intel chips to a mere 1.55 volts to prevent CPU destruction

• Flaws in Ubiquitous ATM Software Could Have Let Attackers Take Over Cash Machines

• Microsoft Reveals Four OpenVPN Flaws Leading to Potential RCE and LPE

• 5 Types of IVR Testing Tools and When To Use Each

• Louvre and Top French Museums Fall Victim to Ransomware Attack, Including Olympic Sites

• Five zero-days impacts EoL Cisco Small Business IP Phones. Replace them with newer models asap!

• HPE Infuses AI Into Network Detection and Response Platform

• Have you used Cash App in the last 6 years? You might be eligible for $2,500

• How a cybersecurity researcher befriended, then doxed, the leader of LockBit ransomware gang

• Aqua Security Researchers Disclose Series of AWS Flaws

• Security company ADT announces security breach of customer data

• Microsoft Update Alert: 70% Of Windows Users Are Now At Risk

• #BHUSA: CISA Encourages Organizations to Adopt a ‘Secure by Demand’ Strategy

• Ransomware attack leads to death and Cow and Calf

• The Role of Microsegmentation in Kubernetes Environments

• Federal Watchdog Calls on EPA to Formulate Comprehensive Cybersecurity Plan for Water Systems

• Reddit CEO Hints At Subreddit Paywalls

• Evolving threat landscape influencing cyber insurance market

• MDR vs MSSP: Key Differences and Full Guide

• 0.0.0.0 Day Vulnerability: An 18-Year-Old Flaw Actively Exploited by Threat Actors

• Understanding escalating cyber threats

• Content Detection Technologies in Data Loss Prevention (DLP) Products

• Partnership in Action: Creating Connection through Community Impact

• Ransomware Attack on OneBlood Disrupts Florida Blood Supply Chain, Urgent Call for Donations

• New Ransomware Threat: Hunters International Deploys SharpRhino RAT

• Cryptojacking Attacks Soar 409% in India Amid a Global Shift in Cybersecurity Tactics

• New Flaws in Sonos Smart Speakers Allow Hackers to Eavesdrop on Users

• Ransomware Recovery: Steps to Take After an Attack

• StormBamboo Compromises ISP, Spreads Malware

• Applications are open: ENISA Cybersecurity Support Action Programme tender procedure

• Threat Actors Exploiting Windows Systems To Deploy Multiple Malwares

• How MSSPs Can Navigate the Regulatory Landscape: Ensuring Compliance

• People-Search Site Removal Services Largely Ineffective

• ADT Breached: Customer Data Leaked on a Hacking Forum

• How to Weaponize Microsoft Copilot for Cyberattackers

• Pro-Iran groups lay groundwork for ‘chaos and violence’ as US election meddling intensifies

• In Other News: KnowBe4 Product Flaws, SEC Ends MOVEit Probe, SOCRadar Responds to Hacking Claims

• Cybersecurity Insights with Contrast CISO David Lindner | 8/9/24

• North Korean Kimusky Group Attacking University Professors

• Iranian Hackers Targeting 2024 US Election Campaigns

• Confusion Attacks Vulnerability In Apache HTTP Server Allow Attackers To Gain Root Access Remotely

• 0.0.0.0 Day – 18 Yr Old Vulnerability Allow Attackers to Bypass All Browser Security

• Cisco Networking Academy honors International Day of the World’s Indigenous People

• US Offers $10 Million for Information on Iranian Hackers Behind CyberAv3ngers Water Utility Attacks

• Automated vs Manual: Web Penetration Testing

• Dell Begins Fresh Round Of Job Losses, Amid AI Move – Report

• New APT Actor240524 Weaponizing Official Documents To Deliver Malware

• Leaked MDM Credentials Exposes Commonly Laptops And Smartphones For Hacking

• ‘Sinkclose’ Flaw in Hundreds of Millions of AMD Chips Allows Deep, Virtually Unfixable Infections

• Transparency in Cybersecurity: The Importance of Accurate Vulnerability Disclosures

• Critical 1Password flaws may allow hackers to snatch your passwords (CVE-2024-42219, CVE-2024-42218)

• Critical Jenkins Vulnerabilities Expose Servers To RCE Attack

• Number of Incidents Affecting GitHub, Bitbucket, GitLab, and Jira Continues to Rise

• Warnings Issued Over Cisco Device Hacking, Unpatched Vulnerabilities

• Elon Musk Shares Fake News Of UK Rioters Being Deported To Falklands

• How Hackers Extracted the ‘Keys to the Kingdom’ to Clone HID Keycards

• Consumer Reports Study Finds Data Removal Services are Often Ineffective

• New Ransomware Groups Emerge Despite Crackdowns

• #BHUSA: CoSAI, Combating AI Risks Through Industry Collaboration

• CISA Warns of Cisco Smart Install Feature Actively Exploited by Hackers

• Ransomware Review: First Half of 2024

• Not SOCRadar – 282,478,425 breached accounts

• Russia’s Kursk Region Suffers ‘Massive’ DDoS Attack Amid Ukraine Offensive

• Ransomware Drill Targets Healthcare in Operation 911

• Entrust distrust: How to move to a new Certificate Authority

• OpenAI Leadership Split Over In-House AI Watermarking Technology

• RustScan: Open-Source Port Scanner

• August 2024 Patch Tuesday forecast: Looking for a calm August release

• “0.0.0.0-Day” vulnerability affects Chrome, Safari and Firefox

• Cybersecurity Headlines: Chameleon malware reappears, Rhysida hospital attack, Blacksuit’s $500m tally

• OpenWrt Dominates, but Vulnerabilities Persist in OT/IoT Router Firmware

• Vulnerability Allowed Eavesdropping via Sonos Smart Speakers

• PowerDMARC Integrates with SecLytics for Predictive Threat Intelligence Analysis

• Threat Actors Favor Rclone, WinSCP and cURL as Data Exfiltration Tools

• Windows Zero-day Flaw Let Hackers Downgrade Fully Updated Systems To Old Vulnerabilities

• GhostWrite Vulnerability Let Hackers Read And Write Any Part Of The Computer’s Memory

• DISPOSSESSOR And RADAR Ransomware Emerging With RaaS Model

• Hackers Exploit iOS Settings to Trigger Fake iOS Updates on Hijacked Devices

• DOJ Charges Nashville Man for Helping North Koreans Get U.S. Tech Jobs

• MongoDB Vulnerabilities Let Attackers Escalate Privileges

• Russian cyber spies stole data and emails from UK government systems

• CISA adds Apache OFBiz and Android kernel bugs to its Known Exploited Vulnerabilities catalog

• Next-Gen Vehicle Technologies Present New Challenges for Cybersecurity Professionals

• One of the largest data breaches in history? Cyber Security Today for Friday, August 9th, 2024

• Security vulnerability in IT infrastructure of Ransomware gang saves six victimized companies

• Key Cloud Security Tools for 2024: A Comprehensive Overview

• Authorities Dismantled North Korean Remote IT Worker Laptop Farm

• CISA Warns of Hackers Exploiting Legacy Cisco Smart Install Feature

• Proxmox Backup by NAKIVO: Powerful VM Data Protection

• The Olympic Games have been protected from cyber-attacks so far

• It’s 2024 and we’re just getting round to stopping browsers insecurely accessing 0.0.0.0

• Passwordless Prescription: The Cure for Healthcare Cybersecurity

• Vectra AI Expands XDR Platform

• Overcoming the 5 Biggest Challenges to Implementing Just-in-Time, Just Enough Privilege

• NIS2: A catalyst for cybersecurity innovation or just another box-ticking exercise?

• How Situational Awareness Enhances the Security of Your Facility

• Malware-as-a-Service and Ransomware-as-a-Service lower barriers for cybercriminals

• A Dive into Earth Baku’s Latest Campaign

• Shorter TLS certificate lifespans expected to complicate management efforts

• Improving Apache httpd Protections Proactively with Orange Tsai of DEVCORE

• New infosec products of the week: August 9, 2024

• Where internal audit teams are spending most of their time

• ISC Stormcast For Friday, August 9th, 2024 https://isc.sans.edu/podcastdetail/9090, (Fri, Aug 9th)

• Black Hat USA 2024: How cyber insurance is shaping cybersecurity strategies

• Hello? Are you talking on a Cisco SPA300 or SPA500 IP phone? Now’s the time to junk ’em

• Chained for attack: OpenVPN vulnerabilities discovered leading to RCE and LPE

• Computer Crash Reports Are an Untapped Hacker Gold Mine

• Delta: CrowdStrike’s offer to help in Falcon meltdown was too little, too late

• Security bugs in ransomware leak sites helped save six companies from paying hefty ransoms

• How to maximize the value of AI: Q&A with Cisco experts

• Sustainability 101: How Hybrid Work Can Advance Sustainability in the Workforce

• IT Security News Daily Summary 2024-08-08

• Stolen data from scraping service National Public Data leaked online

• Tricky Web Timing Attacks Are Getting Easier to Use—and Abuse

• Weak “Guardrails” on Police Face Recognition Use Make Things Worse

• Reintroducing the EFA

• US ‘laptop farm’ man accused of outsourcing his IT jobs to North Korea to fund weapons programs

• Humans are Top Factor in Cloud Security: CSA Study

• US ‘laptop farm’ man accused of outsourcing his IT jobs to North Koreans to raise funds for weapons

• Top 10 Valimail Alternatives and Competitors in 2024

• Top 10 DMARC Solutions in 2024

• HYPR and Microsoft Partner on Entra FIDO2 Provisioning APIs

• Introducing Secretless Identity and Access for Serverless with AWS Lambda

• USENIX Security ’23 – TAP: Transparent and Privacy-Preserving Data Services

• How to Offer Secure IVR Banking and Authenticate Callers

• How to Become a Cybersecurity Engineer

• Education Sector Common Breaches and Cyber Threats

• Black Hat and DEF CON Roundup 2024: AWS Patched a Vulnerability Affecting Six Cloud Services

• 0.0.0.0 Day flaw allows malicious websites to bypass security in major browsers

• #BHUSA: CISA Director Confident in US Election Security

• Wiz researchers hacked into leading AI infrastructure providers

• Zenity CTO on dangers of Microsoft Copilot prompt injections

• CrowdStrike Class Action Lawsuit for Massive Software Outage

• Microsoft’s AI Can Be Turned Into an Automated Phishing Machine

• The Guide to Zero Trust Data Detection & Response (DDR)

• The Need For A Vulnerability Operations Center (VOC) in Modern Cybersecurity

• The top stories coming out of the Black Hat cybersecurity conference

• Black Hat USA 2024: Chip Flaw ‘GhostWrite’ Steals Data from CPU Memory

• CrowdStrike Dismisses Claims of Exploitability in Falcon Sensor Bug

• How to Perform a Cloud Security Assessment: Checklist & Guide

• Salt Security Extends Scope of API Security Platform

• MCA to Strike Off 400 Chinese Companies for Fraud in India

• How Microsoft and NIST are collaborating to advance the Zero Trust Implementation

• UK To Investigate Amazon’s $4 Billion Investment In Anthropic

• LG unleashes South Korea’s first open-source AI, challenging global tech giants

• Over $40 Million Recovered and Arrests Made Within Days After Firm Discovers Business Email Compromise Scam

• Fake FIM: The Cybersecurity Lie That Could Cost You

• UK Watchdog Clears HPE’s Acquisition Of Juniper

• What is the Coalition for Secure AI (CoSAI)?

• EFF and 12 Organizations Tell Bumble: Don’t Sell User Data Without Opt-In Consent

• Cybercriminals Impersonate Law Enforcement in New ‘Digital Detention’ Scam

• Hackers Steal 6 Terabytes Data, Sells on Dark Web

• University Professors Targeted by North Korean Cyber Espionage Group

• Wordfence Intelligence Weekly WordPress Vulnerability Report (July 29, 2024 to August 4, 2024)

• Meet the ransomware gang that demands $500 million

• Anthropic offers $15,000 bounties to hackers in push for AI safety

• The Critical Role of Data Center Technology in Transforming the Manufacturing Industry

• Google Discontinues Chromecast Portfolio

• Black Hat USA 2024: AWS ‘Bucket Monopoly’ Flaw Led to Account Takeover

• I tested 7 AI content detectors – they’re getting dramatically better at identifying plagiarism

• The Windows 10 clock is ticking: 5 ways to save your old PC in 2025 (most are free)

• Hackers Spreading Malicious Python Packages Through Popular Developer Q&A Platform

• Keytronic Lost Over $17 Million Due to a Ransomware Attack

• USPS Text Scammers Duped His Wife, So He Hacked Their Operation

• Home security giant ADT says it was hacked

• Critical Progress WhatsUp Gold RCE Flaw Now Under Active Exploitation

• Stolen Credentials Have Turned SaaS Apps Into Attackers’ Playgrounds

• #BHUSA: Ransomware Drill Targets Healthcare in Operation 911

• Dorsett Controls InfoScan

• How East Carolina University Uses LoRaWAN to Drive Regional Innovation

• 0.0.0.0 Day: 18-Year-Old Browser Vulnerability Impacts MacOS and Linux Devices

• Alibaba’s T-Head C910 RISC-V Chips Found Vulnerable to GhostWrite Attack

• Using 1Password on Mac? Patch up if you don’t want your Vaults raided

• Ransomware Attack Costs loanDepot Almost $27 Million

• SEC Investigation into Progress MOVEit Hack Ends Without Charges

• Security researcher discovered attack to downgrade Windows permanently

• What Is a Whaling Attack (Whale Phishing) + How Can You Prevent It?

• Tesla Issues Recall For 1.6 Million Cars In China

• STAC6451 Hacker Hijacking Microsoft SQL Servers to Compromise Organizations

• NIS2 Compliance Unveiled: Operational Managers’ Roadmap to Actionable Security Measures

• Cloud Storage From Microsoft, Google Used in Malware Attacks

• US Offering $10 Million Reward for Iranian ICS Hackers

• Operational Technology (OT) Security a Top Priority for CIOs

• Phishing Attack Exploits Google, WhatsApp to Steal Data

• Infinity Global Services and Cysurance Launch a Comprehensive Insurability Assessment Program

• NIS2 Directive in the EU: An imminent deadline, insufficient preparation

• PureHVNC Deployed via Python Multi-stage Loader

• FBI and CISA Uncover Updated TTPs and Activity of the BlackSuit Ransomware Group

• US elections have never been more secure, says CISA chief

• Web-Connected Industrial Control Systems Vulnerable to Attack

• Massive Data Breach Exposes Personal Information of 2.9 Billion People Worldwide

• Microsoft 365 anti-phishing alert “erased” with one simple trick

• Balancing the Scales: Addressing Privacy, Security, and Biases in AI based on the White House Blueprint for an AI Bill of Rights

• Intel Sued By Shareholders After Dividend Suspension, Stock Price Crash

• Thousands of Exposed Industrial Control Systems in US, UK Threaten Water Supplies

• Our Latest Product Updates

• Ronin Network Hacked, $12 Million Returned by “White Hat” Hackers

• Dude, Where’s My Documentation?

• BIND Vulnerabilities: Urgent Security Updates Released

• Automated Security Validation: One (Very Important) Part of a Complete CTEM Framework

• North Korea Kimsuky Launch Phishing Attacks on Universities

• As use of IoT devices grows, so do the associated security risks

• Proton Pass password manager adds identity data, biometric authentication

• One year later: The Flipper Zero is still cool. Here are 7 useful things you can do

• Watch How a Hacker’s Infrared Laser Can Spy on Your Laptop’s Keystrokes

• ISC Stormcast For Thursday, August 8th, 2024 https://isc.sans.edu/podcastdetail/9088, (Thu, Aug 8th)

• Can AI detectors save us from ChatGPT? I tried 7 online tools to find out

• Researcher Discovers Downgrade Attack Abusing Windows Update Process

• Report: Tech misconceptions plague the IT world

• Menlo Zero Trust Access enhancements boost enterprise browsing security

• New Phishing Scam Uses Google Drawings and WhatsApp Shortened Links

• Windows Downgrade Attack Risks Exposing Patched Systems to Old Vulnerabilities

• YouTube Hit By Thousands Of Outages In Russia

• Record Breaking DDoS Attack 419 TB of Malicious Traffic Within 24-Hours

• Mule-as-a-Service Infrastructure Exposed

• Benefits of Adopting Zero-Trust Security

• Get a Lifetime of 1TB Cloud Storage for Only $70 With FolderFort

• SEC Ends Probe Into MOVEit Attacks Impacting 95 Million People

• AWS Patches Vulnerabilities Potentially Allowing Account Takeovers

• Should Deny By Default Be the Cornerstone of Zero Trust?

• Roundcube Flaws Allow Easy Email Account Compromise (CVE-2024-42009, CVE-2024-42008)

• Securonix and Cribl partner to enhance threat detection with advanced data integration

• “Perfect” Windows downgrade attack turns fixed vulnerabilities into zero-days

• BlackSuit/Royal Ransomware Group Has Demanded $500m

• Cybersecurity Headlines: McLaren hospitals disrupted, CrowdStrike improves processes, Ronin Network hacked

• Microsoft 365 Anti-Phishing Feature can be Bypassed with CSS

• Endor Labs launches Upgrade Impact Analysis and Magic Patches for SCA market

• FBI and CISA update a joint advisory on the BlackSuit Ransomware group

• Entrust faces years of groveling to regain browsers’ trust, say rival chiefs

• 7 Best Cyber Risk Management Platforms of 2024

• AI Remediation by ArmorCode reduces DevSecOps friction and accelerates security fixes

• Ethical Hackers Steal and Return $12m to Ronin Network

• AppViewX and Utimaco team up to enhance cloud security with new lifecycle management solutions

• Unlock the Future of Cybersecurity: Exclusive, Next Era AI Insights and Cutting-Edge Training at SANS Network Security 2024

• Optimizing AWS GuardDuty for Enhanced Security Monitoring

• Photos: Black Hat USA 2024 Arsenal

• Critical Cisco Small Business IP Phone Flaws Exposes Users to Remote Attacks

• MFA: Multi-Factor Annoyance? Why MFA’s Days Are Numbered.

• Tor Browser 13.5.2 Released: What’s New!

• Cloud Data Storage Raises New Security Issues

• Photos: Black Hat USA 2024 Startup City

• Provisional £6m Fine Imposed on Software Provider Following NHS Ransomware Attack

• Police Recover Over USD 40 Million from International Email Scam

• RAD Security Combines AI With Behavioral Analytics to Improve Cybersecurity

• SSHamble: Open-source security testing of SSH services

• Critical Security Flaw in WhatsUp Gold Under Active Attack – Patch Now

• FBI and CISA Warn of BlackSuit Ransomware That Demands Up to $500 Million

• The three pillars of the next generation in data security: PostgreSQL, zero trust and web3

• Rhysida Ransomware group claims to have breached Bayhealth Hospital in Delaware

• Ransomware Attack Targets Grand Palais, Paris

• INC Ransomware targets McLaren Health Care Hospitals

• New APT Group Actor240524: A Closer Look at Its Cyber Tactics Against Azerbaijan and Israel

• Traceeshark: Open-source plugin for Wireshark

• Why tech-savvy leadership is key to cyber insurance readiness

• AI security 2024: Key insights for staying ahead of threats

• How network segmentation can strengthen visibility in OT networks

• Securing against GenAI weaponization

• Download: CIS Critical Security Controls v8.1

• Ransomware operators continue to innovate

• Cloud storage lockers from Microsoft and Google used to store and spread state-sponsored malware

• New APK Scam: Protect Your Bank Account from Fraudsters

• Samsung boosts bug bug bounty to a cool million for cracks of the Knox Vault subsystem

Generated on 2024-08-09 23:55:10.906632