CyberSecure Specialist

02 May

CISA and FBI Release Secure by Design Alert to Urge Manufacturers to Eliminate Directory Traversal Vulnerabilities

Attacks, Insights, Malware

Today, CISA and the Federal Bureau of Investigation (FBI) released a joint Secure by Design Alert, Eliminating Directory Traversal Vulnerabilities in Software. This Alert was crafted in response to recent well-publicized threat actor campaigns that exploited directory traversal vulnerabilities in software (e.g., CVE-2024-1708, CVE-2024-20345) to compromise users of the software—impacting critical infrastructure sectors, including the Healthcare and Public Health Sector. Additionally, this Alert highlights the prevalence, and continued threat actor exploitation of, directory traversal defects. Currently,…

Read More
02 May

Protecting Model Updates in Privacy-Preserving Federated Learning: Part Two

Insights

The problem  The previous post in our series discussed techniques for providing input privacy in PPFL systems where data is horizontally partitioned. This blog will focus on techniques for providing input privacy when data is vertically partitioned.  As described in our third post, vertical partitioning is where the training data is divided across parties such that each party holds different columns of the data. In contrast to horizontally partitioned data, training a model on vertically partitioned data is…

Read More
01 May

MDR: Unlocking the power of enterprise-grade security for businesses of all sizes

Information

In this day and age, technology and business are inextricably linked. Digital transformation has ushered in unparalleled opportunities for organizations that act with agility in response to the blistering pace of change and look for ways to harness the potential of technology to advance their business. However, the growing reliance on digital systems, coupled with their interconnectedness and convergence, has also introduced new challenges, particularly an evolving and increasingly complex cybersecurity landscape. Recent history has…

Read More
01 May

CERT/CC Reports R Programming Language Vulnerability

Attacks, Insights, Malware

CERT Coordination Center (CERT/CC) has released information on a vulnerability in R programming language implementations (CVE-2024-27322). A cyber threat actor could exploit this vulnerability to take control of an affected system. Users and administrators are encouraged to review the following advisories and apply the necessary updates: CERT/CC VU#23819 Hidden Layer Blog: R-Bitrary Code Execution–Vulnerability in R’s Deserialization Comprehensive R Archive Network

Read More
01 May

CISA and Partners Release Fact Sheet on Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity

Attacks, Insights, Malware

Today, CISA, in collaboration with U.S. and international partners, published a joint fact sheet, Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity. This fact sheet provides information and mitigations associated with cyber operations conducted by pro-Russia hacktivists who seek to compromise industrial control systems (ICS) and small-scale operational technology (OT) systems in North American and European critical infrastructure sectors, including Water and Wastewater Systems, Dams, Energy, and Food and Agriculture Sectors. The pro-Russia hacktivist activity…

Read More
01 May

Take A Tour! NIST Cybersecurity Framework 2.0: Small Business Quick Start Guide

Insights

Credit: NIST The U.S. Small Business Administration is celebrating National Small Business Week from April 28 – May 4, 2024. This week recognizes and celebrates the small business community’s significant contributions to the nation. Organizations across the country participate by hosting in-person and virtual events, recognizing small business leaders and change-makers, and highlighting resources that help the small business community more easily and efficiently start and scale their businesses.  To add to the festivities, this NIST…

Read More
30 Apr

Why space exploration is important for Earth and its future: Q&A with David Eicher

Information

With Starmus Earth: The Future of Our Home Planet around the corner, we sat down with David Eicher, the Astronomy Magazine editor-in-chief and one of the event’s speakers, to hear his thoughts on a diverse range of subjects – from the most pressing challenges facing our home planet to the mysteries of the universe and the possibility of life beyond Earth. WeLiveSecurity: Did you observe the solar eclipse that occurred recently? What was it like for…

Read More
30 Apr

Man Who Mass-Extorted Psychotherapy Patients Gets Six Years

Information, Insights

A 26-year-old Finnish man was sentenced to more than six years in prison today after being convicted of hacking into an online psychotherapy clinic, leaking tens of thousands of patient therapy records, and attempting to extort the clinic and patients. On October 21, 2020, the Vastaamo Psychotherapy Center in Finland became the target of blackmail when a tormentor identified as “ransom_man” demanded payment of 40 bitcoins (~450,000 euros at the time) in return for a…

Read More
29 Apr

FCC Fines Major U.S. Wireless Carriers for Selling Customer Location Data

Information, Insights

The U.S. Federal Communications Commission (FCC) today levied fines totaling nearly $200 million against the four major carriers — including AT&T, Sprint, T-Mobile and Verizon — for illegally sharing access to customers’ location information without consent. The fines mark the culmination of a more than four-year investigation into the actions of the major carriers. In February 2020, the FCC put all four wireless providers on notice that their practices of sharing access to customer location…

Read More
27 Apr

Major phishing-as-a-service platform disrupted – Week in security with Tony Anscombe

Information

Video The investigation uncovered at least 40,000 phishing domains that were linked to LabHost and tricked victims into handing over their sensitive details 26 Apr 2024 One of the world’s largest phishing-as-a-service (Phaas) platforms known as LabHost has been disrupted in a global law enforcement operation, Europol has announced. Authorities from no fewer than 19 countries joined the year-long operation led by the UK’s London Metropolitan Police, and arrested 37 suspects, including those allegedly linked…

Read More