News

Gmail users in the US can now run scans to find out whether their Gmail ID appears on the dark web, Google announced today at Google I/O, its annual developer conference. The feature was initially announced in March, when the internet giant released it for Google One users only. It allows users to run scans and receive a report informing them whether their information, including name, address, email address, phone number, and Social Security number,…

Read More

Microsoft on Tuesday announced patches for 40 newly documented vulnerabilities in its products, including two zero-day flaws. One of the zero-days, CVE-2023-29336, is described as an elevation of privilege bug in the Win32k driver. Successful exploitation could allow an attacker to gain System privileges. Microsoft has shared no information on the attacks exploiting this vulnerability, but such issues are typically combined with code execution flaws to spread malware, according to Trend Micro’s Zero Day Initiative…

Read More

Google last week announced the general availability of ‘rules_oci’, an open source Bazel plugin for building container images. Bazel improves supply chain trust by using dependencies’ integrity hashes. Google uses this build and test tool for creating Distroless base images for Docker. Distroless images too are meant to improve supply chain security, as they are minimal base images that include only what is necessary for applications to run. “Using minimal base images reduces the burden…

Read More

The French Senate’s website was offline on Friday after pro-Russian hackers claimed to have taken it down, in just the latest such cyberattack since Russia invaded Ukraine last year. “Access to the site has been disrupted since this morning,” the upper house of Parliament said on Twitter shortly before midday, saying a team was busy fixing the problem. A group calling itself NoName on Telegram claimed responsibility, saying it had acted because “France is working…

Read More

Researchers at French offensive hacking shop Synacktiv have demonstrated a pair of successful exploit chains against Tesla’s newest electric car to take top billing at the annual Pwn2Own software exploitation contest. Pwn2Own organizers confirmed the successful hacks exploited flaws in the Tesla-Gateway and Tesla-Infotainment sub-systems to “fully compromise” a new Tesla Model 3 vehicle. The first Tesla hack, described as a TOCTOU (time-of-check to time-of-use) race condition, earned the hackers a $100,000 cash prize and…

Read More

The Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA) this week announced new guidance for identity and access management (IAM) administrators. A framework for the management of digital identities, IAM covers the business processes, policies, and technologies that ensure user access to data. The basis for proper IAM involves inventorying, auditing, and tracking user identities and access, which represent daunting but necessary operations, especially with state-sponsored groups successfully exploiting vulnerabilities in…

Read More

Looking to grab a slice of the lucrative enterprise AppSec market, Backslash Security emerged from stealth Wednesday with $8 million in seed-stage capital and new technology to identify and mitigate “toxic code flows” in cloud-native applications.  The Israeli startup said the financing was provided by StageOne Ventures, First Rays Venture Partners, D. E. Shaw & Co.  A roster of prominent security practitioners and entrepreneurs also joined the round.  Based in Tel Aviv, Backslash is building…

Read More

Security startup 443ID, which previously focused on bringing open source intelligence (OSINT) to access management, is now refocusing its solution to tackle account fraud detection and prevention, and has changed its name to Verosint to better describe its new focus. It is launching what is technically version 2 of 443ID’s IAM platform, but is effectively version 1 of Verosint’s account fraud solution. “The previous product was focused on measuring the likelihood of risk to enable…

Read More

Cryptocurrency ATM manufacturer General Bytes over the weekend disclosed a security incident that resulted in the theft of millions of dollars’ worth of funds. The attackers, the company says, exploited a vulnerability in the master service interface that Bitcoin ATMs use to upload videos, which allowed them to upload a JavaScript script and execute it with batm user privileges. “The attacker scanned the Digital Ocean cloud hosting IP address space and identified running CAS services…

Read More

Chinese technology giant Huawei has replaced thousands of product components banned by the United States with homegrown versions, its founder has said, according to a transcript of a recent speech released by a Shanghai university. A leading supplier of telecom gear, smartphones and other advanced equipment, Huawei has been repeatedly targeted by Washington in recent years over cybersecurity and espionage concerns. The administration of former president Donald Trump effectively barred American companies from doing business…

Read More