IT Security News Daily Summary 2024-08-14

• Microsoft Discovers Critical OpenVPN Vulnerabilities

• USENIX Security ’23 – Are You Spying on Me? Large-Scale Analysis on IoT Data Exposure through Companion Apps

• CrowdStrike’s Recovery Efforts in Focus After Global IT Outage

• Top Data Strategies to Better Protect Your Information from Hackers

• CBA’s x15ventures Set to Lead in Fintech AI Innovation

• Bringing Our Portfolio Together

• Safeguarding Democracy in the Digital Age: Insights from Day 1 at Black Hat 2024 and Las Vegas Officials

• Lessons learned from CrowdStrike’s automation errors

• Trump campaign hack-and-leak appears like a rerun of 2016. This time, media outlets are responding differently

• In These Five Social Media Speech Cases, Supreme Court Set Foundational Rules for the Future

• Microsoft Patched 6 Actively Exploited Zero-Day Flaws

• Google Pixel 9 is first Android phone to get satellite SOS messaging

• Russian cyber snoops linked to massive credential-stealing campaign

• Five Gartner Reports. Four Categories. What Does OX Security Do Anyway?

• Spotify To Add EU Pricing Info To iOS App

• Your Gym Locker May Be Hackable

• China-linked APT Earth Baku targets Europe, the Middle East, and Africa

• Texas sues GM for selling driver data to analytics, insurance companies

• Black Basta-Linked Attackers Target Users with SystemBC Malware

• August Patch Pileup: Microsoft’s Zero-Day Doozy Dump

• SolarWinds addressed a critical RCE in all Web Help Desk versions

• Enzo Biochem ordered to cough up $4.5 million over lousy security that led to ransomware disaster

• How to centrally manage secrets with AWS Secrets Manager

• California Permits Passenger Testing For Chinese Robotaxi Firm WeRide

• Texas Sues GM for Collecting Driving Data without Consent

• EFF Presses Federal Circuit To Make Patent Case Filings Public

• Talos discovers 11 vulnerabilities between Microsoft, Adobe software disclosed on Patch Tuesday

• PRODUCT REVIEW: TREND VISION ONE CLOUD SECURITY

• Upcoming Speaking Engagements

• Publishers Spotlight: Endace

• Cyber Attack Sparks Phishing Scam Across Greater Manchester

• Bluesky Signups Surge In UK After Musk Clash With British Government

• The best VPN for streaming in 2024: Expert tested and reviewed

• Tesserent Offers Mental Health Tips for Australian CISOs

• GitHub Copilot Autofix tackles vulnerabilities with AI

• Xapo Bank Aims To Boost Bitcoin Safety With Tech And Bunkers

• New Phishing Attack Uses Sophisticated Infostealer Malware

• Akamai Guardicore Platform: Microsegmentation Just Got a Whole Lot Better

• India’s Bharti Global To Acquire 24.5 Percent Of BT

• Ransomware Kingpin Who Called Himself “J P Morgan” Extradited to the United States

• Adobe Releases Security Updates for Multiple Products

• Texas firm says it lost $60M in a bank wire transfer scam

• 2.7 billion Leaked Data Records Expose Personal Information of US People

• Unconfirmed Hack of 2.9 Billion Records at National Public Data Sparks Media Frenzy Amid Lawsuits

• How Audit Procedures and Internal Controls Improve Your Compliance Posture

• GPS Spoofing Incidents Spike 400%: Here’s What You Should Know

• Manufacturing Firm Loses $60m in BEC Scam

• The Evolution of Secure Access: The Shift from VPNs to Zero Trust Network Access

• Creating Effective Exceptions in Java Code [Video]

• Research Uncovers New Microsoft Outlook Vulnerability

• Watch Out For The ‘0.0.0.0 Day’ Zero-Day Flaw Affecting Web Browsers

• CIRCIA feedback update: Critical infrastructure providers weigh in on NPRM

• Have you ever used Cash App? You might be eligible for a $2,500 settlement payout

• Palo Alto Networks execs apologize for ‘hostesses’ dressed as lamps at Black Hat booth

• Dark Web Revealed: The Hidden Internet’s Role in Cybercrime and Digital Privacy

• Cloud Security Report Highlights Misconfiguration and IAM as Top Threats

• CISA’s Shields Up and Shields Ready Programs: A Proactive Approach to Cybersecurity for Critical Infrastructure

• Enabling Cyber Resiliency with NIST, Cisco Security, and Splunk

• New Threat Report from Cato Networks Uncovers Threat Actor Selling Data and Source Code from Major Brands

• Prolific Malvertising Scammer Arrested and Extradited to US to Face Charges

• Update: New Windows SmartScreen Bypass Exploited as Zero-Day Since March

• Unit 42 Attack Surface Threat Research: Over 23% of Internet-Connected Exposures Involve Critical IT and Security Infrastructure

• X accused of unlawfully using personal data of 60 million+ users to train its AI

• We’re making it easier for you to protect your identity

• Server-Side Template Injection: A Critical Vulnerability Threatening Web Applications

• Defense in Diversity: A Strategy for Robust Cybersecurity

• Strobes Integrates with Azure Repos: Enhancing Code Security

• DigiCert Acquires Vercara to Extend Cybersecurity Services

• ClearSale introduces three solutions to protect businesses from fraud

• AI risks are everywhere – and now MIT is adding them all to one database

• ‘SinkClose’ AMD CPU vulnerability explained: How dangerous is it really?

• White House Post-Quantum Announcement: What It Means for Cybersecurity

• Microsoft Patched SmartScreen Zero-Day Without Announcing

• Secure Data Sharing Company Kiteworks Raises $456 Million

• How to Augment Your Password Security with EASM

• Belarusian-Ukrainian Hacker Extradited to U.S. for Ransomware and Cybercrime Charges

• Understanding AI Bias and Security with NetSPI

• Face Check With Microsoft Entra Verified ID Is Now Generally Available, Microsoft

• Earth Baku Using Customized Tools To Maintain Persistence And Steal Data

• Iranian APT42 Actors Conducting World Wide Surveillance Operations

• BYOVDLL – A New Exploit That Is Bypassing LSASS Protection

• EastWind campaign: new CloudSorcerer attacks on government organizations in Russia

• Intel Sells Stake In British Chip Designer ARM

• Hackers Exploited by GraphQL Vulnerabilities to Compromise Organizations

• Vulnerability Recap 8/13/24 – Old Vulnerabilities Unexpectedly Emerge

• Seamless Secure Work on a Plane

• How CIOs, CTOs, and CISOs View Cyber Risks Differently

• Phishing Campaign Poses as Ukraine’s Security Service to Spread ANONVNC Malware

• Microsoft August Patch Tuesday Fixed 10 Zero-Day Vulnerabilities

• Proton has a plan to boost your online privacy. And your friend can benefit, too

• Want to Win a Bike Race? Hack Your Rival’s Wireless Shifters

• Improved vulnerability reporting on Quay.io

• test post for author

• Critical Vulnerability Found in Microsoft’s AI Healthcare Chatbot

• DoJ Considers Google Breakup After Landmark Monopoly Ruling

• iProov: 70% of organizations will be greatly impacted by gen AI deepfakes

• Kiteworks captures $456M at a $1B+ valuation to help secure sensitive data

• Microsoft Discloses 10 Zero-Day Bugs in Patch Tuesday Update

• Biden Administration Pledges $11 Million to Open Source Security Initiative

• Feds Seize Radar/Dispossessor Ransomware Gang Servers in US and Europe

• Chipmaker Patch Tuesday: Intel, AMD Address Over 110 Vulnerabilities

• NIST Releases Post Quantum Cryptography Standards

• Putting Threat Modeling Into Practice: A Guide for Business Leaders

• Cyber-Attack Spreads Phishing Scam Across Greater Manchester Areas

• 0-Click Outlook RCE Vulnerability Triggered When Email is Clicked – Technical Analysis

• The AMD SinkClose security hole is dangerous. Here’s how to protect your systems

• Report: 35% of Exposed API Keys Still Active, Posing Major Security Risks

• Critical SAP Flaw Allows Remote Attackers to Bypass Authentication

• Cybercriminal Duo Attracts FBI Notice by Spending Big & Living Large

• Is Lenovo a blind spot in US anti-China security measures?

• How LLMs are Revolutionizing Data Loss Prevention

• Cybersecurity News: FBI shutters Radar, NIST post-quantum standards, 2.7B record leaked

• Dark Web Marketplace Admins Busted Following Luxury Life

• Kootenai Health data breach impacted 464,000 patients

• NCSC Calls on UK Firms to Join Mass Cyber-Deception Initiative

• Updates and Evolution of the NIST Cybersecurity Framework: What’s New?

• Train for Entry-Level or Advanced IT Positions for Just $50

• Manufacturer Orion SA says scammers conned it out of $60M

• DeathGrip: Emergence of a new Ransomware-as-a-Service

• ICS Patch Tuesday: Advisories Released by Siemens, Schneider, Rockwell, Aveva

• Will GitOps Solve Configuration Security Issues?

• 2.7 Billion Data Records Leaked Including Social Security Numbers

• Microsoft Fixes Nine Zero-Days on Patch Tuesday

• Multiple Malware Dropped Through MSI Package, (Wed, Aug 14th)

• Clickbait PDFs, An Entry point For Multiple Web Based Attacks

• Microsoft Patch Tuesday security updates for August 2024 addressed six actively exploited bugs

• GraphQL Vulnerabilities and Common Attacks: Seen in the Wild

• Ivanti Neurons for Patch Management enhancements automate patching process

• Hackers Toolkit Unveiled, Comprehensive Tools For Various Cyber Attacks

• Exploiting pfsense Flaw for Remote Code Execution

• New Banshee MacOS Stealer Attacking Users to Steal Keychain Data

• DDoS Attacks Surge 46% in First Half of 2024, Gcore Report Reveals

• Indian telcos to cut off scammy, spammy, telemarketers for two whole years

• Elon Musk’s claim of DDoS attack greeted with skepticism: Cyber Security Today for Wednesday, August 14th, 2024

• Zoom Fixes Critical Vulnerabilities Allowing Privilege Escalation

• Malware Loaders Dominate Cybersecurity Threats in 2024

• Mobile security settings useful to block thieves in extracting data and money

• Can Hackers Track Down a User Based on Google Maps Usage?

• When Disinformation Floods the Internet, Preserving Truth Requires Proper Equipment

• China-Backed Earth Baku Expands Cyber Attacks to Europe, Middle East, and Africa

• Critical Flaw in Ivanti Virtual Traffic Manager Could Allow Rogue Admin Access

• Microsoft Issues Patches for 90 Flaws, Including 10 Critical Zero-Day Exploits

• Email Breach Report 2024: The Most Vulnerable Names and Providers Exposed

• IntelOwl: Open-source threat intelligence management

• Delta vs. CrowdStrike: The duties vendors owe to customers – or do they?

• NIST Debuts First Set of Finalized Post-Quantum Encryption Standards

• Cybersecurity jobs available right now: August 14, 2024

• Current attacks, targets, and other threat landscape trends

• What We Know About Suspected Iranian Cyber Intrusion in the US Presidential Race

• NIST releases finalized post-quantum encryption standards

• A Letter From Our CEO

• ISC Stormcast For Wednesday, August 14th, 2024 https://isc.sans.edu/podcastdetail/9096, (Wed, Aug 14th)

• NIST finalizes trio of post-quantum encryption standards

• Patch Tuesday brings 90 new Microsoft CVEs, six already under exploit

• Transform Your MSP’s Financial Future

• VERT Threat Alert: August 2024 Patch Tuesday Analysis

• Chris Leong – 27,096 breached accounts

• Why Badge’s device independent MFA is core to the future of identity security

• Six 0-Days Lead Microsoft’s August 2024 Patch Push

• IT Security News Daily Summary 2024-08-13

• LDLC – 1,266,026 breached accounts

• Cloud infrastructure entitlement management in AWS

• Back to school: Managing your high schooler’s digital milestones

• Six ransomware gangs behind over 50% of 2024 attacks

• FBI Disrupts Operations of the Dispossessor Ransomware Group

• Microsoft fixes 6 zero-days under active attack

• Microsoft August 2024 Patch Tuesday, (Tue, Aug 13th)

• 16 Women in Cybersecurity Who Are Reshaping the Industry [2024]

• What the Delta-Crowdstrike lawsuit may mean for IT contracts

• Microsoft Warns of Six Windows Zero-Days Being Actively Exploited

• Gartner® Insights: Navigating the Evolving API Protection Market and Taking Action

• Talos discovers Microsoft kernel mode driver vulnerabilities that could lead to SYSTEM privileges; Seven other critical issues disclosed

• Law enforcement disrupts Radar/Dispossessor ransomware group

• A PoC exploit code is available for critical Ivanti vTM bug

• National Public Data (unverified) – 133,957,569 breached accounts

• Vulnerability Recap 8/12/24 – Old Vulnerabilities Unexpectedly Emerge

• Ewon Cosy+ Industrial Devices Vulnerable to Serious Security Exploits

• StickmanCyber Report: A Look Inside Australia’s Cybersecurity Skills Crisis

• Rockwell Automation ControlLogix, GuardLogix 5580, CompactLogix, Compact GuardLogix 5380

• Rockwell Automation FactoryTalk View Site Edition

• Rockwell Automation GuardLogix/ControlLogix 5580 Controller

• CISA Adds Six Known Exploited Vulnerabilities to Catalog

• US accuses man of being ‘elite’ ransomware pioneer they’ve hunted for years

• Adobe Calls Attention to Massive Batch of Code Execution Flaws

• WTH? DPRK WFH Ransomware Redux: 3rd Person Charged

• SIEM vs. SOAR vs. XDR: Evaluate the key differences

• The UN General Assembly and the Fight Against the Cybercrime Treaty

• Check Point Research Warns Every Day is a School Day for Cyber Criminals with the Education Sector as the Top Target in 2024

• US appeals court rules geofence warrants are unconstitutional

• Biden-Harris Campaign, Trump Operative Stone Also Target of Hackers

• Rhysida Ransomware Takes Responsibility for Bayhealth Hospital Breach

• Malwarebytes awarded Parent Tested Parent Approved Seal of Approval

• Digital Apartheid in Gaza: Big Tech Must Reveal Their Roles in Tech Used in Human Rights Abuses

• Australian gold producer targeted by ransomware gang

• What Does It Take to Manage an On-Premise vs Cloud Data Security Product?

• Rockwell Automation AADvance Standalone OPC-DA Server

• Rockwell Automation ControlLogix, GuardLogix 5580, CompactLogix, and Compact GuardLogix 5380

• Rockwell Automation Micro850/870

• Rockwell Automation Pavilion8

• AVEVA SuiteLink Server

• Lead with simplicity: A guide for strengthening security in logistics

• US Unseals Charges Against Three Eastern Europeans Over Ransomware, Malvertising

• Gold Mining Firm in Australia Reports Ransomware Breach

• EDR Importance: Why Is EDR Important? (With Use Cases)

• Feds bust minor league Radar/Dispossessor ransomware gang

• Sleeping With the Phishes

• USENIX Security ’23 – Formal Analysis of SPDM: Security Protocol and Data Model Version 1.2

• NIST Formalizes World’s First Post-Quantum Cryptography Standards

• Hacktivism’s Role in Political Conflict: The Renewed Campaign of #OpVenezuela

• Check Point Research Warns Every Day is a School Day for Cybercriminals with the Education Sector as the Top Target in 2024

• New Post Quantum Cryptography Standards Poised to Revolutionize Cybersecurity

• Massive Data Breach in Columbus Over 3TB Files Leaked by Rhysida Ransomware Group

• East Valley Institute of Technology Data Breach Exposes Over 200,000 Records

• Cost of a data breach 2024: Financial industry

• National Public Data Breach: 2.7bn Records Leaked on Dark Web

• Guardio Critical Security Alerts monitors and analyzes scam activities

• Suspected head of Reveton, Ransom Cartel RaaS groups arrested

• Researchers Uncover Vulnerabilities in AI-Powered Azure Health Bot Service

• GhostWrite: New T-Head CPU Bugs Expose Devices to Unrestricted Attacks

• The great location leak: Privacy risks in dating apps

• Reframing the ZTNA vs. SASE Debate

• Cequence Storms Black Hat with API Security Testing for Generative AI Applications

• Cato Network Reports Spike in Attempts to Exploit Log4j Vulnerabilities

• Scammers dupe chemical company into wiring $60 million

• Phishing Campaign Compromises 100+ Ukrainian Government Computers

• Twitter’s AI Ambitions Face GDPR Backlash: Nine New Complaints Filed

• Preparation Is Not Optional: 10 Incident Response Readiness Considerations for Any Organization

• Stellar strengthens security for remote teams

• Prolific Belarusian Cybercriminal Arrested in Spain

• Help Desks Under Siege: Bolstering Cyber Defenses

• CryptoScam Strikes Misusing Trump & Musk Interview

• McAfee vs Kaspersky (2024): Which Solution Is Best for Your Team?

• Urgent Call for EPA Cyber Strategy to Safeguard Water Infrastructure

• A refresher on Talos’ open-source tools and the importance of the open-source community

• Hackers Leak 1.4 Billion Tencent User Accounts Online

• APT trends report Q2 2024

• Misconfigurations and IAM Weaknesses Top Cloud Security Concerns

• Post-Quantum Cryptography Standards Officially Announced by NIST – a History and Explanation

• Italy Demands Cybersecurity Safeguards from Dongfeng for New Auto Plant Investment

• What Happens When Your House Burns Down Right Before a Meeting?

• How to Prepare for SOC 2 and ISO 27001 Audit? Tips for Jira Admins

• Why Hardsec Matters: From Protecting Critical Services to Enhancing Resilience

• Data theft forum admins busted after flashing their cash in a life of luxury

• On the Voynich Manuscript

• New Dark Skippy Attack Let Hackers Steal Secret Keys From Signing Devices

• Orion SA says scammers conned company out of $60 million

• Three Reasons to Take a New Cyber-Resilient Approach to Data Protection

• Australian gold mining company hit with ransomware

• Fake X Content Warnings on Ukraine War, Earthquakes Used as Clickbait

• Scout Suite: Open-Source Cloud Security Auditing Tool

• Who uses LLM prompt injection attacks IRL? Mostly unscrupulous job seekers, jokesters and trolls

• Ransomware Hits Australian Gold Mining Firm Evolution Mining

• ArtiPACKED: Hacking Giants Through a Race Condition in GitHub Actions Artifacts

• Volocopter Tests eVTOL ‘Air Taxi’ At Versailles

• Polish Billionaire, Wife To Sue Meta Over Misinformation

• Privacy Group Files GDPR Complaints Over X AI Data Plans

• Trump Returns To X For Live Interview

• FBI Investigates After Trump Campaign Hacked By Iranians

• Kicking cyber security down the road can come back to bite you

• Britain and France to Discuss Misuse of Commercial Cyber Intrusion Tools

• The Crucial Role of Firewall Rule Histories

• Why Are Fortune 500 Companies Swiping Right on 3-Person Startups?

• Authorities Seized Dispossessor Ransomware Servers

• Understanding Social Engineering Tactics: 8 Attacks to Watch Out For

• What is the Critical Pathway to Insider Risk (CPIR)?

• FBI Shuts Down Dispossessor Ransomware Group’s Servers Across U.S., U.K., and Germany

• Cybersecurity News: U.S. “laptop farm” shut down, Ukranian computers compromised, Trump campaign hacked

• CERT-UA warns of a phishing campaign targeting government entities

• NIS2: A Catalyst for Cybersecurity Innovation or Just Another Box-Ticking Exercise?

• South Korea Warns Pyongyang Has Stolen Spy Plane Details

• DeathGrip Ransomware Expanding Services Using RaaS Service

• Unmasking the Overlap Between Golddigger and Gigabud Android Malware

• Radar/Dispossessor Ransomware Operation Disrupted by Authorities

• Black Hat Fireside Chat: Here’s how ‘Active ASPM’ is helping to triage and remediate coding flaws

• International investigation shuts down Radar/Dispossessor ransomware group

• FBI Leads Effort to Dismantle Radar/Dispossessor Ransomware

• In search of the foolproof AI watermark

• US DoJ dismantled remote IT worker fraud schemes run by North Korea

• Government says to add cybersecurity to your back-to-school list

• Understanding Defense in Depth in IT Security

• PostgreSQL Vulnerability Allows Hackers To Execute Arbitrary SQL Functions

• This new fully encrypted messenger app is serious about privacy

• PostgreSQL Vulnerability Hackers Execute Arbitrary SQL Functions

• Email Security Risk Remains Alarmingly High

• Publishers Spotlight: DigitalXForce

• ‘Digital arrest’ scams are big in India and may be spreading

• Ukraine Warns of New Phishing Campaign Targeting Government Computers

• Donald Trump interview with Elon Musk disrupted by DDoS Cyber Attack

• Browser backdoors: Securing the new frontline of shadow IT

• Six Reasons Healthcare Organizations Need Robust Cybersecurity

• How CIOs, CTOs, and CISOs view cyber risks differently

• Key metrics for monitoring and improving ZTNA implementations

• AMD won’t patch Sinkclose security bug on older Zen CPUs

• 35% of exposed API keys still active, posing major security risks

• ISC Stormcast For Tuesday, August 13th, 2024 https://isc.sans.edu/podcastdetail/9094, (Tue, Aug 13th)

• FBI Says It Is Investigating After Trump Campaign Said Sensitive Documents Were Hacked by Iran

• Risk & Repeat: Recapping Black Hat USA 2024

Generated on 2024-08-14 23:55:11.206050