IT Security News Daily Summary 2024-10-24

• How the ransomware attack at Change Healthcare went down: A timeline

• UnitedHealth says Change Healthcare data breach affects over 100 million people in America

• Pwn2Own Ireland 2024 Day 2: participants demonstrated an exploit against Samsung Galaxy S24

• Apple will pay security researchers up to $1 million to hack its private AI cloud

• White House Memo Puts the Focus of AI on National Security

• Apple Cuts Orders iPhone 16, Says Analyst

• Meta just beat Google and Apple in the race to put powerful AI on phones

• Apple Opens Private Cloud Compute for Public Security Inspection

• Emergency patch: Cisco fixes bug under exploit in brute-force attacks

• Lazarus Group Exploits Chrome 0-Day for Crypto with Fake NFT Game

• Development Features Enabled in Prodcution, (Thu, Oct 24th)

• Cisco Partner Summit 2024: Know Before You Go

• Confidential Containers with IBM Secure Execution for Linux

• Secure design principles in the age of artificial intelligence

• Strengthen DevSecOps with Red Hat Trusted Software Supply Chain

• How to Upskill and Fill Cybersecurity Skill Gaps on Your Team With Custom Learning Paths

• Beyond the Resume: Effective Techniques for Qualifying Top Cybersecurity Talent

• Modernizing Data Security: Imperva and IBM Z in Action

• Cybersecurity teams being excluded from AI implementation discussions, ISACA study shows

• Keeper Security Introduces New Updates to KeeperFill Browser Extension

• Evolving Email Threats and How to Protect Against Them

• The Rise of Cyberattacks on Critical Infrastructure: Are You Prepared?

• The Entrust Distrust Deadline is Closing In. Are you Prepared?

• DEF CON 32 – AppSec Village – Securing Frontends at Scale;Paving our Way to Post XSS World

• Randall Munroe’s XKCD ‘RNAWorld’

• Blackwire Labs AI Cybersecurity Platform Incorporates Blockchain to Validate Data

• New Qilin.B Ransomware Variant Emerges with Improved Encryption and Evasion Tactics

• LinkedIn Fined €310m By Irish Data Protection Commission

• Cisco fixed tens of vulnerabilities, including an actively exploited one

• Nvidia Patches High-Severity Flaws in Windows, Linux Graphics Drivers

• Security Risks Discovered in Popular End-to-End Encrypted Cloud Storage Platforms

• Lounge Scam at Bengaluru Airport Costs Woman ₹ 87,000

• Infostealer-Injecting Plugins infect Thousands of WordPress Sites

• How Ignoring These Wi-Fi Settings Can Leave You Vulnerable to Hackers

• Amazon identified internet domains abused by APT29

• Fake IT Workers: How HYPR Stopped a Fraudulent Hire

• DMARC MSP Case Study: CloudTech24 Simplies Domain Security Management for Clients with PowerDMARC

• WhatsApp offers new contact management for data security

• CMA Begins Probe Into Alphabet Partnership With Anthropic

• From Uptime to Outcome: New Paths for Managed Services Success

• Lazarus Group Exploits Google Chrome Flaw in New Campaign

• Wordfence Intelligence Weekly WordPress Vulnerability Report (October 14, 2024 to October 20, 2024)

• The Most Secure Payment Solutions in the USA: Zelle, MoneyGram, CashApp, and Venmo

• NotLockBit: Ransomware Discovery Serves As Wake-Up Call For Mac Users

• 2024 Report: Insider Threat

• Accelerating Connection Handshakes in Trusted Network Environments

• Penn State Settles for $1.25M Over Cybersecurity Violations

• TSMC Stops Supplying Customer, After Discovery Of Restricted Chip

• 3 proven use cases for AI in preventative cybersecurity

• Deep Sea Electronics DSE855

• VIMESA VHF/FM Transmitter Blue Plus

• iniNet Solutions SpiderControl SCADA PC HMI Editor

• CISA Releases Four Industrial Control Systems Advisories

• AWS Cloud Development Kit Vulnerability Exposes Users to Potential Account Takeover Risks

• Exploring digital sovereignty: learning opportunities at re:Invent 2024

• Get it Done Faster with AI Copilot for Harmony SASE

• Pinterest tracks users without consent, alleges complaint

• North Korean Hackers Exploited Chrome Zero-Day for Cryptocurrency Theft

• White House Issues AI National Security Memo

• Misconfigured UN Database Exposes 228GB of Gender Violence Victims’ Data

• The 3 Questions at the Core of Every Cybersecurity Compliance Mandate

• ‘Deceptive Delight’ Jailbreak Tricks Gen-AI by Embedding Unsafe Topics in Benign Narratives

• SEC Fines Four Tech Firms for Downplaying SolarWinds Impacts

• Strengthening Critical Infrastructure Defense: Shifting to an Exposure Management Mindset

• Cisco Issues Urgent Fix for ASA and FTD Software Vulnerability Under Active Attack

• What is the difference between a data leak and a data breach?

• Hook’d: How HookBot Malware Impersonates Known Brands to Steal Customer Data

• The best travel VPNs of 2024: Expert tested and reviewed

• What Is PCI Compliance? A Simple Guide for Businesses

• FortiJump flaw CVE-2024-47575 has been exploited in zero-day attacks since June 2024

• Phishing for Votes in the Upcoming US Election

• Bitwarden’s FOSS halo slips as new SDK requirement locks down freedoms

• New Fortinet Zero-Day Exploited for Months Before Patch

• Why Phishing-Resistant MFA Is No Longer Optional: The Hidden Risks of Legacy MFA

• How to use the Private Space feature in Android 15 – and secure your sensitive data

• Equipment to include in a computer forensic toolkit

• Top Court Sides With Intel Over EU Antitrust Fine

• Ransomware’s ripple effect felt across ERs as patient care suffers

• Penn State Settles for $1.25M Over Failure to Comply With DoD, NASA Cybersecurity Requirements

• Fortinet Confirms Exploitation of Critical FortiManager Zero-Day Vulnerability

• GitLab Patches HTML Injection Flaw Leads to XSS Attacks

• 16-31 July 2024 Cyber Attacks Timeline

• The UK Must Act: Alaa Abd El-Fattah Still Imprisoned 25 Days After Release Date

• New Scoring System Helps Secure the Open Source AI Model Supply Chain

• Exploring the Transformative Potential of AI in Cybersecurity

• Lazarus Group Exploits Google Chrome Vulnerability to Control Infected Devices

• UK Government Introduces New Data Governance Legislation

• Talos IR trends Q3 2024: Identity-based operations loom large

• Perplexity Boss Surprised After New Corp Sues

• Get Advanced Ad Blocking and Superior Data Privacy Tools for Just $11

• Cybersecurity Teams Largely Ignored in AI Policy Development

• Understanding the Initial Stages of Web Shell and VPN Threats: An MXDR Analysis

• Technologist Bruce Schneier on security, society and why we need ‘public AI’ models

• Meet ZachXBT, the Masked Vigilante Tracking Down Billions in Crypto Scams and Thefts

• NotLockBit Ransomware Targets Both Windows and MacOS

• Cisco Patches Vulnerability Exploited in Large-Scale Brute-Force Campaign

• Majority of SaaS Applications, AI Tools Unmanaged

• Fortinet FortiManager flaw exploited in zero-day attacks (CVE-2024-47575)

• Xerox Printers Vulnerable to Remote Code Execution Attacks

• Samsung Galaxy S24 Hacked at Pwn2Own Ireland 2024

• Blending Traditional and Emerging Cybersecurity Practices for a Holistic Approach

• Nucleus Security unveils POAM Process Automation for federal agencies

• F5 BIG-IP Next for Kubernetes reduces the complexity of AI deployments

• Fortinet Warns of Critical Vulnerability in FortiManager Under Active Exploitation

• Guarding Digital Assets By Understanding Third-Party Access Risks

• UK Government Urges Organizations to Get Cyber Essentials Certified

• Cisco ASA Devices Vulnerable to SSH Remote Command Injection Flaw

• CISA data rules, Fortinet zero-day, UK Cyber Essentials

• Ransomware hackers using cloud service platforms as their playgrounds

• Google Patches Multiple Chrome Security Vulnerabilities

• Voice-enabled AI agents can automate everything, even your phone scams

• SEC Fines Four Companies $7 Million for Misleading Cybersecurity Disclosures: Cyber Security Today for Thursday, October 23, 2024

• U.S. CISA adds Fortinet FortiManager flaw to its Known Exploited Vulnerabilities catalog

• Cybersecurity Awareness Month 2024: Wrapping Up with Actionable Insights to Secure Our World

• WhatsApp Debuts New Features for Contact Management with Enhanced Privacy Protections

• The Lazarus APT Strikes Again: New Zero-Day Exploit Targets Investors through DeFi Games

• China’s top messaging app WeChat banned from Hong Kong government computers

• Enhancing national security: The four pillars of the National Framework for Action

• What’s more important when hiring for cybersecurity roles?

• Anthropic’s latest Claude model can interact with computers – what could go wrong?

• Facing the uncertainty of cyber insurance claims

• How to enable Safe Browsing in Google Chrome on Android

• AI and deepfakes fuel phishing scams, making detection harder

• Perfctl malware strikes again as crypto-crooks target Docker Remote API servers

• 2024-10-17 – Two days of server scans and probes and web traffic

• 2024-10-23 – Redline Stealer infection

• ISC Stormcast For Thursday, October 24th, 2024 https://isc.sans.edu/podcastdetail/9194, (Thu, Oct 24th)

• Hackers Leak 180,000 Esport North Africa User Records a Day Before Tournament Begins

• Investigating FortiManager Zero-Day Exploitation (CVE-2024-47575)

• Samsung phone users under attack, Google warns

• Deep web horror stories from the dark side of the internet

• Penn State pays DoJ $1.25M to settle cybersecurity compliance case

• CVE-2024-47575: Frequently Asked Questions About FortiJump Zero-Day in FortiManager and FortiManager Cloud

• Warning! FortiManager critical vulnerability under active attack

• Comic Agilé – Mikkel Noe-Nygaard, Luxshan Ratnaravi – #310 – The Day After PI Planning

• DEF CON 32 – AppSec Village – Speed Bumps and Speed HacksP: Adventures in Car Mfg Security

• IT Security News Daily Summary 2024-10-23

• Deceptive Google Meet Invites Lure Users Into Malware Scams

• ‘Satanic’ data thief claims to have slipped into 350M Hot Topic shoppers info

• Microsoft Threat Intelligence healthcare ransomware report highlights need for collective industry action

• Critical Flaw in Open Policy Agent Exposed NTLM Credentials, Patch Released

• OpenAI scientist Noam Brown stuns TED AI Conference: ’20 seconds of thinking worth 100,000x more data’

• Microsoft SharePoint RCE flaw exploits in the wild – you’ve had 3 months to patch

• Fortinet Confirms Zero-Day Exploit Targeting FortiManager Systems

• CISA Adds One Known Exploited Vulnerability to Catalog

• Are Automatic License Plate Scanners Constitutional?

• Apple ‘Sharply Cuts’ Production For Vision Pro Headset – Report

• How Federal Agencies Are Achieving Zero Trust With Automation

• Digital Echo Chambers and Erosion of Trust – Key Threats to the US Elections

• Google SynthID Adding Invisible Watermarks to AI-Generated Content

• WeChat’s Updated Encryption System Prone to Threats for its Users

• New Grandoreiro Banking Malware Variants Emerge with Advanced Tactics to Evade Detection

• Congratulations to the Top MSRC 2024 Q3 Security Researchers!

• Wiz hopes to hit $1B in ARR in 2025 before an IPO, after turning down Google’s $23B

• TA866 Group Linked to New WarmCookie Malware in Espionage Campaign

• Google Messages adds nudity blur option, plus other new security upgrades

• The best VPN for streaming in 2024: Expert tested and reviewed

• After concerns of handing Facebook taxpayer info, four companies found to have improperly shared data

• Unveiling Hidden Connections: JA4 Client Fingerprinting on VirusTotal

• Hong Kong Bans WhatsApp, Google Drive On Government Devices

• Threat Actors Are Exploiting Vulnerabilities Faster Than Ever

• Microsoft Warns Foreign Disinformation Is Hitting the US Election From All Directions

• CISA Proposes Stronger Security Requirements to Protect Sensitive Data

• API Vulnerabilities Jump 21% in Third Quarter

• Everybody Loves Bash Scripts. Including Attackers., (Wed, Oct 23rd)

• Deceptive Delight: Jailbreak LLMs Through Camouflage and Distraction

• Trick or Treat? Your Infrastructure Might Be Haunted by Zombie and Shadow APIs

• DdoS Attack on Russian Foreign Ministry during BRICS summit

• Unmasking Prometei: A Deep Dive Into Our MXDR Findings

• Ofcom Finds Online Posts Were Clearly Connected To UK Riots

• ARM Cancels Qualcomm Chip Design Licence – Report

• Nigerian Court Orders Release Of Binance Executive

• Millions of iOS and Android Users at Risk as Popular Apps Expose Cloud Keys

• Attackers Use Encoded JavaScript to Deliver Malware

• Threat Actors Allegedly Selling Database of 1,000 NHS Email Accounts

• Grayscale Investments Data Breach Exposes 693K User Records Reportedly Affected

• AI hallucinations can pose a risk to your cybersecurity

• Engaging with Security Researchers: Embracing a “See Something, Say Something” Culture

• Defending Against Ransom DDoS Attacks

• CIS Control 16 Application Software Security

• Is a VPN Really Worth It in 2024?

• The Global Surveillance Free-for-All in Mobile Ad Data

• Nigeria Drops Charges Against Tigran Gambaryan, Jailed Binance Exec and Former IRS Agent

• How Cisco is Using Apple Vision Pro to Create the Next Evolution of Spatial Collaboration

• Crooks are targeting Docker API servers to deploy SRBMiner

• U.S. CISA adds Microsoft SharePoint flaw to its Known Exploited Vulnerabilities catalog

• The Crypto Game of Lazarus APT: Investors vs. Zero-days

• Democratising Cybersecurity

• ShadyShader: Crashing Apple Devices with a Single Click

• Modernizing Data Security: Imperva and IBM zSystems in Action

• Securing E-commerce

• LinkedIn bots and spear phishers target job seekers

• Reality Defender Banks $33M to Tackle AI-Generated Deepfakes

• Bolstering CTEM with AI and Purple Team Security

• Keep your secrets secret: 5 core tips — and a call to action on modernizing

• IBM Addresses AI, Quantum Security Risks with New Platform

• FortiJump: Yet Another Critical Fortinet 0-Day RCE

• The Impact of Google’s Manifest V3 on Chrome Extensions

• Old Redbox Kiosks Hacked to Expose Customers’ Private Details

• Cofense improves visibility of dangerous email-based threats

• Ransomware Gangs Use LockBit’s Fame to Intimidate Victims in Latest Attacks

• Think You’re Secure? 49% of Enterprises Underestimate SaaS Risks

• Researchers Reveal ‘Deceptive Delight’ Method to Jailbreak AI Models

• CISA Warns of Active Exploitation of Microsoft SharePoint Vulnerability (CVE-2024-38094)

• Permiso State of Identity Security 2024: A Shake-up in Identity Security Is Looming Large

• Internet Archive Secures Zendesk Account, Works Toward Full-Service Restoration

• 70% of Leaders See Cyber Knowledge Gap in Employees

• Former British PM Cameron Calls for Tech Engagement with China Despite Cyber Threats

• Embargo Ransomware Gang Deploys Customized Defense Evasion Tools

• New Malware WarmCookie Targets Users with Malicious Links

• Everybody Loves Bash Scripts. Including Attackers., (Wed, Oct 23rd)

• Deceptive Delight: Jailbreak LLMs Through Camouflage and Distraction

• Trick or Treat? Your Infrastructure Might Be Haunted by Zombie and Shadow APIs

• DdoS Attack on Russian Foreign Ministry during BRICS summit

• Unmasking Prometei: A Deep Dive Into Our MXDR Findings

• Ofcom Finds Online Posts Were Clearly Connected To UK Riots

• ARM Cancels Qualcomm Chip Design Licence – Report

• Nigerian Court Orders Release Of Binance Executive

• Millions of iOS and Android Users at Risk as Popular Apps Expose Cloud Keys

• Attackers Use Encoded JavaScript to Deliver Malware

• Threat Actors Allegedly Selling Database of 1,000 NHS Email Accounts

• Grayscale Investments Data Breach Exposes 693K User Records Reportedly Affected

• AI hallucinations can pose a risk to your cybersecurity

• Engaging with Security Researchers: Embracing a “See Something, Say Something” Culture

• Defending Against Ransom DDoS Attacks

• CIS Control 16 Application Software Security

• Is a VPN Really Worth It in 2024?

• The Global Surveillance Free-for-All in Mobile Ad Data

• Nigeria Drops Charges Against Tigran Gambaryan, Jailed Binance Exec and Former IRS Agent

• How Cisco is Using Apple Vision Pro to Create the Next Evolution of Spatial Collaboration

• Crooks are targeting Docker API servers to deploy SRBMiner

• U.S. CISA adds Microsoft SharePoint flaw to its Known Exploited Vulnerabilities catalog

• The Crypto Game of Lazarus APT: Investors vs. Zero-days

• Democratising Cybersecurity

• ShadyShader: Crashing Apple Devices with a Single Click

• Modernizing Data Security: Imperva and IBM zSystems in Action

• Securing E-commerce

• LinkedIn bots and spear phishers target job seekers

• Reality Defender Banks $33M to Tackle AI-Generated Deepfakes

• Bolstering CTEM with AI and Purple Team Security

• Keep your secrets secret: 5 core tips — and a call to action on modernizing

• IBM Addresses AI, Quantum Security Risks with New Platform

• FortiJump: Yet Another Critical Fortinet 0-Day RCE

• The Impact of Google’s Manifest V3 on Chrome Extensions

• Old Redbox Kiosks Hacked to Expose Customers’ Private Details

• Cofense improves visibility of dangerous email-based threats

• Ransomware Gangs Use LockBit’s Fame to Intimidate Victims in Latest Attacks

• Think You’re Secure? 49% of Enterprises Underestimate SaaS Risks

• Researchers Reveal ‘Deceptive Delight’ Method to Jailbreak AI Models

• CISA Warns of Active Exploitation of Microsoft SharePoint Vulnerability (CVE-2024-38094)

• Permiso State of Identity Security 2024: A Shake-up in Identity Security Is Looming Large

• US Government Pledges to Cyber Threat Sharing Via TLP Protocol

• Internet Archive Secures Zendesk Account, Works Toward Full-Service Restoration

• 70% of Leaders See Cyber Knowledge Gap in Employees

• Former British PM Cameron Calls for Tech Engagement with China Despite Cyber Threats

• Embargo Ransomware Gang Deploys Customized Defense Evasion Tools

• Highlighting TA866/Asylum Ambuscade Activity Since 2021

• Threat Spotlight: WarmCookie/BadSpace

• Complex controls: Addressing PCI DSS by 2025

• Why DSPM is Essential for Achieving Data Privacy in 2024

• ESET HOME Security enhancements strengthen protection against AI-driven threats

• UK Government Weighs Review of Computer Misuse Act to Combat Cybercrime

• Building a Cyber Resilience Framework for Credit Unions

• BT Switches On First Self-Powered Cell Tower

• Dutch Police Infiltrate Telegram Groups, Arrest 4 for Illegal Data Trading

• AI is Revolutionizing Cybersecurity — But Not in the Ways You Might Think

• Mallox Ransomware Vulnerability Lets Victims Decrypt Files

• SEC fined 4 companies for misleading disclosures about the impact of the SolarWinds attack

• Election Security: Here’s What We Should Really Be Worried About

• Western Digital Fined Over $310 Million for Patent Infringement

• AI Data Breach Reveals Trust Issues with Personal Information

• Reality Defender secures $33 million to enhance AI detection capabilities

• Cohesity Gaia brings the power of generative AI to enterprise data

• Stream.Security raises $30 million to boost cloud security

• White Hat Hackers Earn $500,000 on First Day of Pwn2Own Ireland 2024

• US Energy Sector Vulnerable to Supply Chain Attacks

• Red Hat NetworkManager Flaw Allows Hackers to Gain Root Access

• SolarWinds disclosure fines, Zendesk helps Internet Archive, Samsung zero-day

• Grandoreiro, the global trojan with grandiose goals

• Can Offline Data Storage Curb Ransomware Attacks?

• Tor Browser 14.0 Released With New Android Circuit Options

• CISA Proposes New Security Measures to Safeguard Sensitive Data from Adversary States

• Britain online users should be aware of this Online Job Scam

• Five Ways to Improve Your Security Posture, Fast

• Effective strategies for measuring and testing cyber resilience

• Argus: Open-source information gathering toolkit

• Evolving cloud threats: Insights and recommendations

• Cybersecurity jobs available right now: October 23, 2024

• Showcasing our Industry-First BDR Solution in Singapore

• Most women in IT work overtime to advance in their careers

• ISC Stormcast For Wednesday, October 23rd, 2024 https://isc.sans.edu/podcastdetail/9192, (Wed, Oct 23rd)

• Millions of Android and iOS users at risk from hardcoded creds in popular apps

Generated on 2024-10-24 23:55:04.753158