Information

17 Feb

New Protections for Food Benefits Stolen by Skimmers

Information, Insights

Millions of Americans receiving food assistance benefits just earned a new right that they can’t yet enforce: The right to be reimbursed if funds on their Electronic Benefit Transfer (EBT) cards are stolen by card skimming devices secretly installed at cash machines and grocery store checkout lanes. On December 29, 2022, President Biden signed into law the Consolidated Appropriations Act of 2023, which — for the first time ever — includes provisions for the replacement…

Read More
17 Feb

Newly Disclosed Vulnerability Exposes EOL Arris Routers to Attacks

Information, News

Malwarebytes warns of a remote code execution vulnerability impacting several Arris routers, for which proof-of-concept (PoC) exploit code has been released. Tracked as CVE-2022-45701, the bug exists because the router firmware does not properly neutralize special characters in requests, which allowed security researcher Yerodin Richards to perform shell script command injection. The impacted models have reached end-of-life (EOL) and are no longer supported by CommScope (the company that acquired Arris), meaning that they are unlikely…

Read More
17 Feb

‘Frebniis’ Malware Hijacks Microsoft IIS Function to Deploy Backdoor

Information, News

A recently identified malware family is abusing Microsoft Internet Information Services (IIS) to deploy a backdoor and monitor all HTTP traffic to the infected system, Symantec reports. Dubbed Frebniis, the malware injects code into a DLL that an IIS feature called Failed Request Event Buffering (FREB) uses when troubleshooting failed requests. FREB collects data about the tracked requests, including HTTP headers with cookies, originating IP address and port, and more. As part of the observed…

Read More
16 Feb

ChatGPT, will you be my Valentine?

Information

Spoiler alert: it turned me down. But that’s far from the only thing I learned while playing around with the bot that the world has fallen in love with so badly. When it was unleashed into an astonished world on November 30th 2022, ChatGPT became the fastest-growing web app ever, reaching a million users in the first five days before going on to clock 100 million monthly active users in January of this year. In so doing,…

Read More
16 Feb

10 signs that scammers have you in their sights

Information

Don’t be their next victim – here’s a handy round-up of some the most common signs that should set your alarm bells ringing We all spend so much of our time online these days. It’s estimated that the average adult spends the best part of seven hours per day glued to their screens. When we’re finished with work, we’re hitting up our apps to watch TV, do our online banking, play games, socialize with friends…

Read More
16 Feb

S3 Ep122: Stop calling every breach “sophisticated”! [Audio + Text]

Information

by Paul Ducklin CAN WE STOP WITH THE “SOPHISTICATED” ALREADY? The birth of ENIAC. A “sophisticated attack” (someone got phished). A cryptographic hack enabled by a security warning. Valentine’s Day Patch Tuesday. Apple closes spyware-sized 0-day hole. Click-and-drag on the soundwaves below to skip to any point. You can also listen directly on Soundcloud. With Doug Aamoth and Paul Ducklin Intro and outro music by Edith Mudge. You can listen to us on Soundcloud, Apple…

Read More
16 Feb

Published XIoT Vulnerabilities Trend Down, but Vigilance Must Remain High: Report

Information, News

Published XIoT vulnerabilities are trending down and have been since 2021. At the same time, the percentage of vulnerabilities published by the device manufacturer rather than third-party researchers is trending up. The clear implication is device manufacturers are taking greater responsibility for the security of their own devices. The reason is probably twofold: government pressure and commercial reality. The introduction of SBOM’s has focused manufacturers’ attention on the software make-up of their devices, while the…

Read More
15 Feb

PE Firm Francisco Partners to Take Sumo Logic Private in $1.7B Deal

Information, News

Cloud monitoring, log management and SIEM solutions provider Sumo Logic is set to become a private company after it has entered into a definitive agreement to be acquired by affiliates of private equity firm Francisco Partners for $1.7 billion. Francisco Partners is prepared to pay $12.05 per share in cash. The law firm Kahn Swick & Foti has announced that it’s investigating the deal to determine if the price is adequate. Sumo Logic offers cloud-native…

Read More
14 Feb

Confident cybersecurity means fewer headaches for SMBs

Information

Small and medium-sized businesses have good reason to be concerned about the loss of data and financial impacts While tech advancements have enabled small and medium businesses (SMBs) to grow their business and allowed them to evolve their operational models, cybersecurity risks and threats can cancel any progress that has been made so far. Underlying these is another serious obstacle: SMBs lacking confidence in managing cybersecurity. The lack of confidence manifests as a strong belief…

Read More
14 Feb

Apple fixes zero-day spyware implant bug – patch now!

Information

by Paul Ducklin Apple has just released updates for all supported Macs, and for any mobile devices running the very latest versions of their respective operating systems. In version number terms: iPhones and iPads on version 16 go to iOS 16.3.1 and iPadOS 16.3.1 respectively (see HT213635). Apple Watches on version 9 go to watchOS 9.3.1 (no bulletin). Macs running Ventura (version 13) go to macOS 13.2.1 (see HT213633). Macs running Big Sur (version 11)…

Read More