CyberSecurity Updates

03 Jan

Netgear WiFi Routers Receive Update For Critical Vulnerability

Attacks, Malware

Users of the above Netgear devices should update their firmware as soon as possible. Netgear support documentation provides update instructions for affected users: 1. Visit NETGEAR Support: https://www.netgear.com/support/2. Start typing your model number in the search box, then select your model from the drop-down menu as soon as it appears.3. If you do not see a drop-down menu, make sure that you entered your model number correctly, or select a product category to browse for…

Read More
03 Jan

Researcher Says Google Paid $100k Bug Bounty for Smart Speaker Vulnerabilities

Information, News

Security researcher Matt Kunze says Google paid him a $107,500 bug bounty reward for responsibly reporting vulnerabilities in the Google Home Mini smart speaker. The issues, the researcher says, could have been exploited by an attacker within wireless proximity to create a rogue account on the device and then perform various actions. According to Kunze, the attacker could use the account to send remote commands to the device, over the internet, to access the microphone,…

Read More
03 Jan

PyTorch suffers supply chain attack via dependency confusion

Data Breaches, Malware, Social Engineering

Users who deployed the nightly builds of PyTorch between Christmas and New Year’s Eve likely received a rogue package as part of the installation that siphoned off sensitive data from their systems. The incident was the result of an attack called dependency confusion that continues to impact package managers and development environments if hardening steps are not taken. “If you installed PyTorch nightly on Linux via pip between December 25, 2022, and December 30, 2022,…

Read More
03 Jan

LockBit apologizes for ransomware attack on hospital, offers decryptor

Data Breaches, Malware, Social Engineering

LockBit, a prominent ransomware-as-a-service (RaaS) operation, has apologized for an attack on the Toronto-based Hospital for Sick Children, also known as SickKids, and offered a free decryptor.  SickKids, a major pediatric teaching hospital, announced on December 19 that it had called a Code Grey system failure, as it was responding to a cybersecurity incident that was affecting several network systems at the hospital. The incident impacted some internal clinical and corporate systems, as well as…

Read More
02 Jan

Ransomware ecosystem becoming more diverse for 2023

Data Breaches, Malware, Social Engineering

The ransomware ecosystem has changed significantly in 2022, with attackers shifting from large groups that dominated the landscape toward smaller ransomware-as-a-service (RaaS) operations in search of more flexibility and drawing less attention from law enforcement. This democratization of ransomware is bad news for organizations because it also brought in a diversification of tactics, techniques, and procedures (TTPs), more indicators of compromise (IOCs) to track, and potentially more hurdles to jump through when trying to negotiate…

Read More
01 Jan

PyTorch: Machine Learning toolkit pwned from Christmas to New Year

Information, Malware

by Paul Ducklin PyTorch is one of the most popular and widely-used machine learning toolkits out there. (We’re not going to be drawn on where it sits on the artifical intelligence leaderboard – as with many widely-used open source tools in a competitive field, the answer seems to depend on whom you ask, and which toolkit they happen to use themselves.) Originally developed and released as an open-source project by Facebook, now Meta, the software…

Read More
30 Dec

Cybersecurity trends and challenges to look out for in 2023

Information

What are some of the key cybersecurity trends and themes that organizations should have on their radars in 2023? As another eventful year comes to a close, it’s time not only to take stock of and reflect on the defining moments of 2022, but especially to look ahead to the challenges that are likely to persist or emerge in the new year. The increasing geopolitical complexity, upheaval and uncertainty, along with high economic volatility and…

Read More
30 Dec

Naked Security 33 1/3 – Cybersecurity predictions for 2023 and beyond

Information

by Paul Ducklin It’s the last regular working weekday of 2022 (in the UK and the US, at least), in the unsurprisingly relaxed and vacationistic gap between Christmas and New Year… …so you were probably expecting us to come up either with a Coolest Stories Of The Year In Review listicle, or with a What You Simply Must Know About Next Year (Based On The Coolest Stories Of The Year) thinly-disguised-as-not-a-listicle listicle. After all, even…

Read More
30 Dec

CISA Says Two Old JasperReports Vulnerabilities Exploited in Attacks

Information, News

The US Cybersecurity and Infrastructure Security Agency (CISA) has added two JasperReports flaws to its Known Exploited Vulnerabilities Catalog. Tibco’s JasperReports Library is advertised as the world’s most popular open source reporting engine. The JasperReports Server software is designed to enable non-technical users to create reports, dashboards, and visualizations. CISA has learned that two JasperReports vulnerabilities discovered in 2018 have been exploited in attacks. One of them is CVE-2018-18809, a critical directory traversal issue in…

Read More
30 Dec

US Congress funds cybersecurity initiatives in FY2023 spending bill

Data Breaches, Malware, Social Engineering

On December 23, the House and Senate Appropriations Committee agreed to a $1.7 trillion omnibus spending bill that funds government operations through the fiscal year 2023. On December 29, President Biden signed it. The 4,155-page bill reflects an already agreed-upon $858 billion for defense spending and an additional $800 billion for non-defense spending, including several prominent cybersecurity items. US Senator Chris Murphy (D-CT), chair of the Subcommittee on Homeland Security, said, “This bill is a…

Read More