CyberSecure Specialist

24 Jan

ServiceNow to detect open source security vulnerabilities with Snyk integration

Data Breaches, Malware, Social Engineering

ServiceNow Vulnerability Response users will now have access to Snyk Open Source, a software composition analysis (SCA) platform designed to help developers find, prioritize, and fix security vulnerabilities and license issues in open source dependencies. Snyk Open Source is backed by the Israeli-US company’s own security intelligence that relies on a combination of public sources, data from the developer community, proprietary expert research, machine learning, and human-in-the-loop AI.  ServiceNow Vulnerability Response is part of ServiceNow Security Operations…

Read More
24 Jan

Hybrid play: Leveling the playing field in online video gaming and beyond

Information

Does VALORANT’s approach to cheating signal a turning point in how we deal with the continued hacks afflicting our hybrid world of work and play? First social apps, now gaming? The growth of cloud-powered apps like Telegram and Teams has created mega communities out of their users. Many of these apps have opened the door to personal self-expression and the types of risk-taking notorious on social media platforms. Oversharing, connecting with strangers, clickbait, and phishing…

Read More
24 Jan

Serious Security: How dEliBeRaTe tYpOs might imProVe DNS security

Information

by Paul Ducklin Over the years, we’ve written and spoken on Naked Security many times about the thorny problem of DNS hijacking. DNS, as you probably know, is short for domain name system, and you’ll often hear it described as the internet’s “telephone directory” or “gazetteer”. If you’re not familiar with the word gazeteer, it refers to the index at the back of an atlas where you look up, say, Monrovia, Liberia in a convenient…

Read More
24 Jan

Apple patches are out – old iPhones get an old zero-day fix at last!

Information

by Paul Ducklin Last year, on the last day of August 2022, we wrote with mild astonishment, and perhaps even a tiny touch of excitement, about an unexpected but rather important update for iPhones stuck back on iOS 12. As we remarked at the time, we’d already decided that iOS 12 had slipped (or perhaps been quietly pushed) off Apple’s radar, and would never be updated again, give that the previous update had been a…

Read More
24 Jan

Skyhawk launches platform to provide threat detection and response across multi-cloud environments

Data Breaches, Malware, Social Engineering

Cloud threat detection vendor Skyhawk Security has released a platform designed to address alert fatigue that provides cloud detection and response (CDR) across multi-cloud environments, the company said Tuesday in a statement. The company says the Synthesis platform is being released on a “freemium” basis—the base version is available at no cost, but supplement features can be purchased. Skyhawk claims the platform improves upon products focused on identifying numerous static cloud security misconfigurations by employing…

Read More
24 Jan

How passkeys are changing authentication

Data Breaches, Malware, Social Engineering

Passwords are a central aspect of security infrastructure and practice, but they are also a principal weakness involved in 81% of all hacking breaches. Inherent useability problems make passwords difficult for users to manage safely. These security and useability shortcomings have driven the search for alternative approaches known generally as passwordless authentication. Passkeys are a kind of passwordless authentication that is seeing increasing focus and adoption. They are set to become a key part of…

Read More
24 Jan

Australia fronts International Counter Ransomware Taskforce

Data Breaches, Malware, Social Engineering

The International Counter Ransomware Taskforce (ICRTF), envisioned by the International Counter Ransomware Initiative (CRI), kicked off its operations on Monday with Australia as its inaugural chair and coordinator. The CRI was first brought together in October 2021 with a virtual meeting of 30 countries, facilitated by the US White House National Security Council. In November 2022, a second meeting took place where the following was established by the 37 participating member: Hold ransomware actors accountable for…

Read More
23 Jan

Nvidia targets insider attacks with digital fingerprinting technology

Data Breaches, Malware, Social Engineering

Nvidia today announced that a digital lab playground for its latest security offering is now available, letting users try out an AI-powered system designed to monitor individual user accounts for potentially hazardous behavior. The idea, according to the company, is to leverage the large amounts of data that many organizations compile anyway about login and data access events on their systems, and use that to train an AI that watches for user accounts to diverge…

Read More
23 Jan

Attackers exploiting critical flaw in many Zoho ManageEngine products

Data Breaches, Malware, Social Engineering

Users of on-premises deployments of Zoho ManageEngine products should make sure they have patches applied for a critical remote code execution vulnerability that attackers have now started exploiting in the wild. Technical details about the flaw along with a proof-of-concept exploit was released late last week, which will allow more attackers to add this exploit to their arsenal. “The vulnerability is easy to exploit and a good candidate for attackers to ‘spray and pray’ across…

Read More
23 Jan

Apple Patches WebKit Code Execution in iPhones, MacBooks

Information, News

Apple’s product security response team on Monday rolled out patches to cover numerous serious security vulnerabilities affecting users of its flagship iOS and macOS platforms. The most serious of the documented vulnerabilities affect WebKit and can expose both iOS and macOS devices to code execution attacks via booby-trapped web content, Apple warned in multiple advisories. On the mobile side, Apple pushed out iOS and iPadOS 16.3 with fixes for more than a dozen documented security…

Read More