CyberSecure Specialist

21 Aug

ASD’s ACSC, CISA, FBI, and NSA, with the support of International Partners Release Best Practices for Event Logging and Threat Detection

Attacks, Insights, Malware

Today, the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), CISA, FBI, NSA, and international partners are releasing Best Practices for Event Logging and Threat Detection. This guide will assist organizations in defining a baseline for event logging to mitigate malicious cyber threats. The increased prevalence of malicious actors employing living off the land (LOTL) techniques, such as living off the land binaries (LOLBins) and fileless malware, highlights the importance of implementing and maintaining…

Read More
20 Aug

Implementation Challenges in Privacy-Preserving Federated Learning

Insights

In this post, we talk with Dr. Xiaowei Huang and Dr. Yi Dong (University of Liverpool), Dr. Mat Weldon (United Kingdom (UK) Office of National Statistics (ONS)), and Dr. Michael Fenton (Trūata) who were winners in the UK-US Privacy-Enhancing Technologies (PETs) Prize Challenges. We discuss implementation challenges of privacy-preserving federated learning (PPFL) – specifically, the areas of threat modeling and real world deployments. Threat Modeling In research on privacy-preserving federated learning (PPFL), the protections of…

Read More
19 Aug

National Public Data Published Its Own Passwords

Data Breaches, Information, Insights

New details are emerging about a breach at National Public Data (NPD), a consumer data broker that recently spilled hundreds of millions of Americans’ Social Security Numbers, addresses, and phone numbers online. KrebsOnSecurity has learned that another NPD data broker which shares access to the same consumer records inadvertently published the passwords to its back-end database in a file that was freely available from its homepage until today. In April, a cybercriminal named USDoD began…

Read More
17 Aug

How a BEC scam cost a company $60 Million – Week in security with Tony Anscombe

Information

Video Business email compromise (BEC) has once again proven to be a costly issue, with a company losing $60 million in a wire transfer fraud scheme 16 Aug 2024 A Luxembourg-based chemicals and manufacturing company has recently suffered one of the largest-ever business email compromise (BEC) attacks. According to a filing to the U.S. Securities and Exchanges Commission (SEC), an employee was tricked into making multiple wire transfers to cybercriminals, losing the company $60 million. …

Read More
15 Aug

NationalPublicData.com Hack Exposes a Nation’s Data

Data Breaches, Information, Insights

A great many readers this month reported receiving alerts that their Social Security Number, name, address and other personal information were exposed in a breach at a little-known but aptly-named consumer data broker called NationalPublicData.com. This post examines what we know about a breach that has exposed hundreds of millions of consumer records. We’ll also take a closer look at the data broker that got hacked — a background check company founded by an actor…

Read More
15 Aug

CISA Releases Eleven Industrial Control Systems Advisories

Attacks, Insights, Malware

CISA released eleven Industrial Control Systems (ICS) advisories on August 15, 2024. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-228-01 Siemens SCALANCE M-800, RUGGEDCOM RM1224 ICSA-24-228-02 Siemens INTRALOG WMS ICSA-24-228-03 Siemens Teamcenter Visualization and JT2Go ICSA-24-228-04 Siemens SINEC Traffic Analyzer ICSA-24-228-05 Siemens LOGO! V8.3 BM Devices ICSA-24-228-06 Siemens SINEC NMS ICSA-24-228-07 Siemens Location Intelligence ICSA-24-228-08 Siemens COMOS ICSA-24-228-09 Siemens NX ICSA-24-228-10 AVEVA Historian Web Server ICSA-24-228-11 PTC Kepware…

Read More
14 Aug

Why scammers want your phone number

Information

Scams Your phone number is more than just a way to contact you – scammers can use it to target you with malicious messages and even exploit it to gain access to your bank account or steal corporate data Márk Szabó 13 Aug 2024  •  , 5 min. read Last month, we looked at how scammers can gain access to your phone number and how data breaches and phishing campaigns could make obtaining it easy.…

Read More
13 Aug

Top 6 Craigslist scams: Don’t fall for these tricks

Information

Scams Here’s how to spot and dodge scams when searching for stuff on the classified ads website that offers almost everything under the sun Phil Muncaster 12 Aug 2024  •  , 5 min. read People have been buying and selling items on Craigslist for nearly three decades. As a platform for digital classified ads, its utility is still second to none for many people. But its simplicity (and anonymity) can also create risks that are,…

Read More
13 Aug

The great location leak: Privacy risks in dating apps

Information

Privacy What if your favorite dating, social media or gaming app revealed your exact coordinates to someone you’d rather keep at a distance? Tony Anscombe 12 Aug 2024  •  , 3 min. read In today’s digital age, geolocation features in many apps offer undeniable convenience. Just before writing this blog, I needed to locate some materials for a DIY project, and using the ‘click and collect’ feature I immediately established the closest store that has…

Read More
13 Aug

Six 0-Days Lead Microsoft’s August 2024 Patch Push

Information, Insights

Microsoft today released updates to fix at least 90 security vulnerabilities in Windows and related software, including a whopping six zero-day flaws that are already being actively exploited by attackers. Image: Shutterstock. This month’s bundle of update joy from Redmond includes patches for security holes in Office, .NET, Visual Studio, Azure, Co-Pilot, Microsoft Dynamics, Teams, Secure Boot, and of course Windows itself. Of the six zero-day weaknesses Microsoft addressed this month, half are local privilege…

Read More