CyberSecurity Updates

13 Dec

Silent but deadly: The rise of zero-click attacks

Information

Mobile Security A security compromise so stealthy that it doesn’t even require your interaction? Yes, zero-click attacks require no action from you – but this doesn’t mean you’re left vulnerable. Márk Szabó 11 Dec 2023  •  , 3 min. read In a world of instant communication and accelerated by the ever-spreading notion that if you are not connected or available, you might be the odd one out, messaging has, in many ways, become a crucial…

Read More
13 Dec

Black Hat Europe 2023: Should we regulate AI?

Information

We Live Progress ChatGPT would probably say “Definitely not!”, but will we learn any lessons from the rush to regulate IoT in the past? Tony Anscombe 11 Dec 2023  •  , 3 min. read The accelerated pace in the advancement of technology is challenging for any of us to keep up with, especially for public sector policymakers who traditionally follow rather than lead. Last week, the Black Hat Europe conference held in London, provided an…

Read More
12 Dec

Microsoft Patch Tuesday, December 2023 Edition

Information, Insights

The final Patch Tuesday of 2023 is upon us, with Microsoft Corp. today releasing fixes for a relatively small number of security holes in its Windows operating systems and other software. Even more unusual, there are no known “zero-day” threats targeting any of the vulnerabilities in December’s patch batch. Still, four of the updates pushed out today address “critical” vulnerabilities that Microsoft says can be exploited by malware or malcontents to seize complete control over…

Read More
12 Dec

A Note on progress…NIST’s Digital Identity Guidelines.

Insights

In August 2023 the Digital Identity Guidelines team hosted a two-day workshop to provide a public update on the status of revision 4. As part of that session, we committed to providing further information on the status of each volume going forward. In fulfillment of this commitment, we wanted to offer a quick update on where we stand. Our goal remains to have the next version of each volume out by the Spring of 2024.…

Read More
12 Dec

CISA Releases SCuBA Google Workspace Secure Configuration Baselines for Public Comment

Attacks, Insights, Malware

Today, CISA released the draft Secure Cloud Business Applications (SCuBA) Google Workspace (GWS) Secure Configuration Baselines and the associated assessment tool ScubaGoggles for public comment. The draft baselines offer minimum viable security configurations for nine GWS services: Groups for Business, Google Calendar, Google Common Controls, Google Classroom, Google Meet, Gmail, Google Chat, Google Drive and Docs, and Google Sites. The ScubaGoggles tool assesses GWS tenants’ compliance against the baselines.    Federal agencies and other organizations are invited…

Read More
12 Dec

The Apache Software Foundation Updates Struts 2

Attacks, Insights, Malware

The Apache Software Foundation has released security updates to address a vulnerability (CVE-2023-50164) in Struts 2. A remote attacker could exploit this vulnerability to take control of an affected system. Users and administrators are encouraged to review the Apache Security Bulletin and upgrade to Struts 2.5.33 or Struts 6.3.0.2 or greater.

Read More
10 Dec

Black Hat Europe 2023: The past could return to haunt you

Information

Critical Infrastructure Legacy protocols in the healthcare industry present dangers that can make hospitals extremely vulnerable to cyberattacks. Tony Anscombe 08 Dec 2023  •  , 3 min. read The healthcare industry will, I am sure, remain a significant target for cybercriminals due to the huge potential it provides them to monetize their efforts through ransomware demands or by abusing the exfiltrated data of patients. Operational disruption and sensitive data, such as medical records, combined with…

Read More
10 Dec

Surge in deceptive loan apps – Week in security with Tony Anscombe

Information

Video ESET Research reveals details about a growth in the number of deceptive loan apps on Android, their origins and modus operandi 08 Dec 2023 This week, ESET researchers have taken a look at a steep increase in deceptive loan apps for Android. According to ESET Research, there has been a large growth of these apps across unofficial third-party app stores, Google Play, and websites since the beginning of 2023. These apps request various sensitive…

Read More
08 Dec

Atlassian Releases Security Advisories for Multiple Products

Attacks, Insights, Malware

Atlassian has released security updates to address vulnerabilities affecting multiple Atlassian products. A cyber threat actor could exploit one of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the following advisories and apply the necessary updates or mitigations. CVE-2023-22522 – RCE Vulnerability In Confluence Data Center and Confluence Server CVE-2023-22524 – RCE Vulnerability in Atlassian Companion App for MacOS CVE-2023-22523 – RCE Vulnerability in Assets Discovery CVE-2022-1471 –…

Read More