CyberSecure Specialist

09 Jan

Identity Thieves Bypassed Experian Security to View Credit Reports

Data Breaches, Information, Insights

Identity thieves have been exploiting a glaring security weakness in the website of Experian, one of the big three consumer credit reporting bureaus. Normally, Experian requires that those seeking a copy of their credit report successfully answer several multiple choice questions about their financial history. But until the end of 2022, Experian’s website allowed anyone to bypass these questions and go straight to the consumer’s report. All that was needed was the person’s name, address,…

Read More
09 Jan

If governments are banning TikTok, why is it still on your corporate devices?

Data Breaches, Malware, Social Engineering

TikTok, the viral app resident on millions of devices, was recently banned from executive branch devices in the United States, as set out in in the recent Omnibus Bill signed by President Joe Biden. The Omnibus Bill, as detailed in CSO Online’s overview, highlighted that the “legislation required the Office of Management and Budget in consultation with the administrator of general services, the director of CISA, the director of national intelligence, and the secretary of…

Read More
09 Jan

11 top XDR tools and how to evaluate them

Data Breaches, Malware, Social Engineering

Little in the modern IT world lends itself to manual or siloed management, and this is doubly true in the security realm. The scale of modern enterprise computing and modern application stack architecture requires security tools that can bring visibility into the security posture of modern IT components and integrate tightly to bring real-time threat detection, possibly even automating aspects of threat mitigation. This need has given rise to extended detection and response (XDR) tools.…

Read More
06 Jan

Ransomware target list – Week in security with Tony Anscombe

Information

Why schools, hospitals, local governments and other public sector organizations are in a sweet spot for ransomware attacks Why are schools, hospitals and local governments firmly in the crosshairs of cybercriminals and why do public-sector entities fall into a sweet spot for ransomware attacks? What are the latest trends on the ransomware scene? A report released this week looks at publicly disclosed ransomware incidents in the United States in 2022 in order to help organizations…

Read More
06 Jan

RSA crypto cracked? Or perhaps not!

Information

by Paul Ducklin There’s been a bit of a kerfuffle in the technology media over the past few days about whether the venerable public-key cryptosystem known as RSA might soon be crackable. RSA, as you probably know, is short for Rivest-Shamir-Adleman, the three cryptographers who devised what turned into an astonishingly useful and long-lived encryption system by means of which two people can communicate securely… …without meeting up first to agree on a secret encryption…

Read More
06 Jan

SpyNote Android Malware Infections Surge Following Leak of CypherRat Source Code

Attacks, Malware

While no official statement has been released as to how the malware variants are spreading, it can be assumed that these are likely spreading through phishing campaigns and malicious websites. From an enterprise level, the best course of action to take to prevent against this malware would be to educate end users on the best practices to take when browsing the internet, to verify application legitimacy, and to read application reviews prior to installation. Applications…

Read More
06 Jan

Bitdefender Releases Decryptor for MegaCortex Ransomware

Attacks, Malware

MegaCortex was first discovered in 2019 and was observed targeting corporate network with attacks that included adjustable ransom demands based on the companies that were attacked and the amount of data stolen. In October 2021, officials arrested 12 individuals related to thousands of MegaCortex and LockerGoga ransomware attacks. Along with the arrests, authorities discovered the private keys used in attacks, which lead to Bitdefender releasing the decryptor for the LockerGoga ransomware. Bitdefender did not release…

Read More
06 Jan

Rackspace: Customer Email Data Accessed in Ransomware Attack

Attacks, Malware

Since discovering the attack on December 2 and confirming the resulting outage was caused by a ransomware attack, Rackspace has been offering affected customers free licenses to migrate their email from its Hosted Exchange platform to Microsoft 365. The cloud computing provider also provided affected customers with download links to recovered historic mailbox data (containing email messages before December 2) through its customer portal via an automated queue. Rackspace added that its Hosted Exchange environment…

Read More
06 Jan

XDR and the Age-old Problem of Alert Fatigue

Information, News

XDR’s fully loaded value to threat detection, investigation and response will only be realized when it is viewed as an architecture According to 451 Research’s M&A Knowledgebase, cybersecurity M&A activity in 2021 reached an all-time high total deal value of $74.1 billion. Contributing to that growth, extended detection and response (XDR) went from zero to 28 deals in 19 months and is expected to drive continued M&A activity, with good reason. Extending its research into…

Read More
06 Jan

IOTW: Almost 50,000 UK government workers vulnerable to cyber attacks

Attacks, Data Breaches

A large number of UK government ministers and civil servants have been warned that they are vulnerable to hackers after their personal information was posted online and remained visible for months. The personal information for more than 45,000 civil servants was available until March 2020 via the Government Communication Service (GCS) website. The information included names, email addresses, phone numbers and job titles as well as links to social media profiles including Twitter and LinkedIn.…

Read More