CyberSecurity Updates

31 May

Gigabyte firmware component can be abused as a backdoor

Data Breaches, Malware, Social Engineering

Researchers warn that the UEFI firmware in many motherboards made by PC hardware manufacturer Gigabyte injects executable code inside the Windows kernel in an unsafe way that can be abused by attackers to compromise systems. Sophisticated APT groups are abusing similar implementations in the wild. “While our ongoing investigation has not confirmed exploitation by a specific threat actor, an active widespread backdoor that is difficult to remove poses a supply chain risk for organizations with…

Read More
31 May

Tricks of the trade: How a cybercrime ring operated a multi‑level fraud scheme

Information

A peek under the hood of a cybercrime operation and what you can do to avoid being an easy target for similar ploys They hacked into corporate emails, stole money from people and businesses, and tricked others into transferring the loot. Nigerian nationals Solomon Ekunke Okpe and Johnson Uke Obogo ran a sophisticated fraud scheme that caused up to US$1 million in losses to victims. A US court recently sentenced the duo to four years and…

Read More
31 May

Serious Security: Verification is vital – examining an OAUTH login bug

Information

by Paul Ducklin Researchers at web coding security company SALT just published a fascinating description of how they found an authentication bug dubbed CVE-2023-28131 in a popular online app-buildin toolkit known as Expo. The good news is that Expo responded really quickly to SALT’s bug report, coming up with a fix within just a few hours of SALT’s responsible disclosure. Fortunately, the fix didn’t rely on customers downloading anything, because the patch was implemented inside…

Read More
31 May

Inactive, unmaintained Salesforce sites vulnerable to threat actors

Data Breaches, Malware, Social Engineering

Improperly deactivated and unmaintained Salesforce sites are vulnerable to threat actors who can gain access to sensitive business data and personally identifiable information (PII) by simply changing the host header. That’s according to new research from Varonis Threat Labs, which explores the threats posed by Salesforce “ghost sites” that are no longer needed, set aside, but not deactivated. These sites are typically not maintained or tested against vulnerabilities, while admins fail to update security measures…

Read More
31 May

Breaking Enterprise Silos and Improving Protection

Information, News

As networks become atomized, the need for specialization comes into play. Infrastructure is spread across legacy, on-premises, hybrid, multi-cloud, and edge environments. Organizations have security operations center (SOC), network, cloud operations, and in some cases operational technology (OT) teams all tasked with keeping the business up and running and secure. And each team consists of subject matter experts with specialized levels of knowledge and specific tools that they use. When capabilities, nomenclature, constructs, and available…

Read More
31 May

Trellix, Netskope announce new Amazon Security Lake support to enhance threat detection, remediation

Data Breaches, Malware, Social Engineering

Cybersecurity vendors Trellix and Netskope have announced new support for Amazon Security Lake from AWS, which became generally available on May 30. Trellix customers can now integrate their security data lake into the Trellix XDR security operations platform to enhance detection and response capabilities for their AWS environments. Meanwhile, Netskope customers can export logs from the Netskope Intelligent Security Service Edge (SSE) platform to Amazon Security Lake to improve visibility and threat remediation. AWS launched…

Read More
31 May

Barracuda patches zero-day vulnerability exploited since October

Data Breaches, Malware, Social Engineering

Barracuda has patched a zero-day vulnerability that had been exploited since October to backdoor customers’ Email Security Gateway (ESG) appliances with custom malware and steal data, the company said on Tuesday.  “On May 19, 2023, Barracuda Networks identified a remote command injection vulnerability (CVE-2023-2868) present in the Barracuda Email Security Gateway (appliance form factor only) versions 5.1.3.001-9.2.0.006,” the company said, adding that the vulnerability stemmed from incomplete input validation of user-supplied .tar files as it…

Read More
31 May

What is federated Identity? How it works and its importance to enterprise security

Data Breaches, Malware, Social Engineering

At the very heart of enterprise security is the tension between convenience and safety. The business longs for the ease of users, in competition with the demands of security. Authentication is a main theater for this tension, directly impacting the onboarding and login experience. Federated identity is at the forefront in addressing this tension, affording a good user experience without sacrificing security. Federated identity management (FIM) makes it possible to share a single digital identity…

Read More
31 May

Data of more than 470,000 hacking site members leaked

Attacks, Data Breaches

More than 470,000 members of dark web hacking site RaidForums have had their data leaked by Exposed, another hacking forum. Members of the forums would put the various data stolen during data breaches on the site, where it could be purchased by other members for use in other malicious activities, including phishing and social engineering campaigns and even identity theft. In April 2022, the site shut down after its infrastructure and website were seized during…

Read More
31 May

Phishing remained the top identity abuser in 2022: IDSA report

Data Breaches, Malware, Social Engineering

Phishing was the most common type of identity-related incident in 2022, according to a study by Identity Defined Security Alliance (IDSA), a nonprofit identity and security intelligence firm. The study, commissioned through Dimensional Research, also revealed that the top phishes among the incidents included email phishing, spear phishing, and vishing/smishing incidents. “With a spike in digital identities comes an increase in cyberattacks targeting them. By far the most significant reason behind this was employees unknowingly…

Read More