Information

24 Feb

Watch on Demand: Attack Surface Management Summit

Information, News

As security teams look to foundational strategies to protect corporate assets, the reduction of attack surface throughout the organization has taken center stage. All sessions from SecurityWeek’s 2023 Attack Surface Management Summit are now available to watch on demand. If you missed any sessions, you can watch them now in the virtual conference center: Fireside Chat With Jason Chan, Former Netflix Security Chief What Our 2022 Data Reveals About the Most Pressing Exposures on Your Attack…

Read More
24 Feb

A Year of Conflict: Cybersecurity Industry Assesses Impact of Russia-Ukraine War

Information, News

Marking the first anniversary of Russia’s war against Ukraine, several cybersecurity companies have published reports summarizing the impact of various types of cyber operations, just as the United States has issued a fresh warning for the West.  In the weeks before and immediately after Russia launched its war against Ukraine on February 24, 2022, Russia appeared to intensify its attacks in cyberspace, with distributed denial-of-service (DDoS) attacks, disruptive wiper malware, and misinformation campaigns.  While everyone…

Read More
24 Feb

11 Countries Take Part in Military Cyberwarfare Exercise

Information, News

The biggest military cyberwarfare exercise in Western Europe took place recently in Estonia. A total of 34 teams from 11 countries took part in a live-fire cyber battle.  Countries such as the US, UK, Japan, India, Italy, Estonia, Ukraine, Ghana, Kenya and Oman were represented by 750 experts at the Defence Cyber Marvel 2 (DCM2) exercise. Many of them participated remotely.  The seven-day event, led by the British Army, tested the response of participants to…

Read More
24 Feb

WinorDLL64: A backdoor from the vast Lazarus arsenal?

Information

The targeted region, and overlap in behavior and code, suggest the tool is used by the infamous North Korea-aligned APT group ESET researchers have discovered one of the payloads of the Wslink downloader that we uncovered back in 2021. We named this payload WinorDLL64 based on its filename WinorDLL64.dll. Wslink, which had the filename WinorLoaderDLL64.dll, is a loader for Windows binaries that, unlike other such loaders, runs as a server and executes received modules in…

Read More
24 Feb

S3 Ep123: Crypto company compromise kerfuffle [Audio + Text]

Information, Malware

by Paul Ducklin LEARNING FROM OTHERS The first search warrant for computer storage. GoDaddy breach. Twitter surprise. Coinbase kerfuffle. The hidden cost of success. Click-and-drag on the soundwaves below to skip to any point. You can also listen directly on Soundcloud. With Doug Aamoth and Paul Ducklin Intro and outro music by Edith Mudge. You can listen to us on Soundcloud, Apple Podcasts, Google Podcasts, Spotify, Stitcher and anywhere that good podcasts are found. Or…

Read More
23 Feb

Stealthy Mac Malware Delivered via Pirated Apps

Information, News

Legitimate Mac software applications are being trojanized with malware and uploaded to Pirate Bay. From here, software pirates are downloading the apps and unknowingly infecting themselves. One example involves a stealthy implementation of XMRig cryptojacking malware; but the process could be used for other malware. XMRig on Macs is not new. Trend Micro analyzed a sample in February 2022: “We suspected that the Mach-O sample arrived packaged in a DMG (an Apple image format used…

Read More
23 Feb

ESET SMB Digital Security Sentiment Report: The damaging effects of a breach

Information

SMBs need to not only reduce their odds of being hit by an attack, but also implement processes that they can follow if their defenses are breached The prevalence of cyberattacks continues to rise, with our telemetry showing a 13% increase in cyberthreat detections in 2022 year-on-year. While the news tends to feature breaches involving major companies, it would be wrong to assume that only large enterprises are targeted by cybercriminals. Although these incidents grab…

Read More
23 Feb

Writing like a boss with ChatGPT and how to get better at spotting phishing scams

Information

It’s never been easier to write a convincing message that can trick you into handing over your money or personal data ChatGPT has been taking the world by storm, having reached 100 million users only two months after launching. However, media stories about the tool’s uncanny ability to write human-sounding text mask a potentially darker reality. In the wrong hands, the powerful chatbot (now also built into the Bing search engine) and technologies like it could…

Read More
23 Feb

NPM JavaScript packages abused to create scambait links in bulk

Information

by Paul Ducklin Johnathan Swift is probably most famous for his novel Gulliver’s Travels, during which the narrator, Lemuel Gulliver, encounters a socio-political schism in Liiliputian society caused by unending arguments over whether you should open a boiled egg at the big end or the little end. This satirical observation has flowed diretly into modern computer science, with CPUs that represent integers with the least significant bytes at the lowest memory addresses called little-endian (that’s…

Read More
22 Feb

Intel Paid Out Over $4.1 Million via Bug Bounty Program Since 2017

Information, News

Intel has paid out more than $4.1 million through its bug bounty program since its creation in 2017, according to a product security report published by the chip giant on Wednesday. Between 2018 and 2021, Intel paid out, on average, $800,000 through its bug bounty program each year for vulnerabilities discovered in the company’s products. In 2022, it awarded $935,000.  Intel says a total of 243 vulnerabilities were reported in 2022, roughly the same as…

Read More