Information

In Other News: AI Regulation, Layoffs, US Aerospace Attacks, Post-Quantum Encryption

SecurityWeek is publishing a weekly cybersecurity roundup that provides a concise compilation of noteworthy stories that might have slipped under the radar. We provide a valuable summary of stories that may not warrant an entire article, but are nonetheless crucial for a comprehensive understanding of the cybersecurity landscape. Each week, we will curate and present a collection of noteworthy developments, ranging from the latest vulnerability discoveries and emerging attack techniques to significant policy changes and…

Read More

Blackpoint Raises $190 Million to Help MSPs Combat Cyber Threats

Cybersecurity company Blackpoint Cyber this week announced that it has raised $190 million in a growth funding round led by Bain Capital Tech Opportunities. Accel also participated in Blackpoint’s third investment round, which has brought the total raised by the company to just over $200 million. Founded in 2014, Blackpoint provides an advanced security suite via managed service providers (MSPs), helping them keep customers safe. According to Blackpoint, its Managed Detection and Response (MDR) technology…

Read More

Google Introduces SAIF, a Framework for Secure AI Development and Use

The Google SAIF (Secure AI Framework) is designed to provide a security framework or ecosystem for the development, use and protection of AI systems. All new technologies bring new opportunities, threats, and risks. As business concentrates on harnessing opportunities, threats and risks can be overlooked. With AI, this could be disastrous for business, business customers, and people in general. SAIF offers six core elements to ensure maximum security in AI. Expand strong security foundations to…

Read More

Barracuda Urges Replacing — Not Patching — Its Email Security Gateways

It’s not often that a zero-day vulnerability causes a network security vendor to urge customers to physically remove and decommission an entire line of affected hardware — as opposed to just applying software updates. But experts say that is exactly what transpired this week with Barracuda Networks, as the company struggled to combat a sprawling malware threat which appears to have undermined its email security appliances in such a fundamental way that they can no…

Read More

Hear no evil: Ultrasound attacks on voice assistants

How  your voice assistant could do the bidding of a hacker – without you ever hearing a thing Regular WeLiveSecurity readers won’t be stunned to read that cyberattacks and their methods keep evolving as bad actors continue to enhance their repertoire. It’s also become a common refrain that as security vulnerabilities are found and patched (alas, sometimes after being exploited), malicious actors find new chinks in the software armor. Sometimes, however, it is not “just”…

Read More

Firefox 114 is out: No 0-days, but one fascinating “teachable moment” bug

by Paul Ducklin Firefox’s latest major update is out, following Mozilla’s usual every-fourth-Tuesday release cycle. The list of security fixes this month (like full moons, there are sometimes two Firefox releases in a calendar month, but most months only have one) is splendidly short, and there aren’t any critical bugs or zero-days in the list. But there’s a fascinating bug that acts as a reminder that it’s hard to write responsive, user-friendly browser code that’s…

Read More

S3 Ep138: I like to MOVEit, MOVEit

by Paul Ducklin BACKDOORS, EXPLOITS, AND LITTLE BOBBY TABLES No audio player below? Listen directly on Soundcloud. With Doug Aamoth and Paul Ducklin. Intro and outro music by Edith Mudge. You can listen to us on Soundcloud, Apple Podcasts, Google Podcasts, Spotify, Stitcher and anywhere that good podcasts are found. Or just drop the URL of our RSS feed into your favourite podcatcher. READ THE TRANSCRIPT DOUG.  Backdoors, exploits, and the triumphant return of Little Bobby…

Read More

Consolidate Vendors and Products for Better Security

Organizations everywhere are evolving in new ways, whether it’s embracing remote work or developing new digital business initiatives. Although these changes can be crucial to business growth and employee retention, they often expand the attack surface, which leads to greater day-to-day operational complexity for Security Operations Center (SOC) teams. At the same time the attack surface is increasing, threats are also on the upswing. Cyberattacks are becoming more sophisticated and organizations of all sizes across…

Read More

VMware Plugs Critical Flaws in Network Monitoring Product

Virtualization technology giant VMware on Wednesday shipped urgent patches to cover security defects in the Aria Operations for Networks product, warning that the flaws expose business to remote code execution attacks. VMware released an advisory documenting three critical-severity vulnerabilities haunting the network and application monitoring tool and called special attention to a command injection issue (CVE-2023-20887) that carries a CVSSv3 base score of 9.8/10. “A malicious actor with network access to VMware Aria Operations for…

Read More

Service Rents Email Addresses for Account Signups

One of the most expensive aspects of any cybercriminal operation is the time and effort it takes to constantly create large numbers of new throwaway email accounts. Now a new service offers to help dramatically cut costs associated with large-scale spam and account creation campaigns, by paying people to sell their email account credentials and letting customers temporarily rent access to a vast pool of established accounts at major providers. The service in question —…

Read More