Cybersecurity News


Proxyware Services Open Orgs to Abuse – Report

Proxyware Services Open Orgs to Abuse – Report Services that let consumers resell their bandwidth for money are ripe for abuse, researchers warn.
31 August 2021

Flaw in the Quebec vaccine passport: analysis

ESET's cybersecurity expert Marc-Étienne Léveillé analyses in-depth the Quebec's vaccine proof apps VaxiCode and VaxiCode Verif.

The post Flaw in the Quebec vaccine passport: analysis appeared first on WeLiveSecurity

31 August 2021

Faille dans la preuve vaccinale Québécoise : analyse

Les chercheurs d’ESET expliquent les détails d’une faille découverte dans VaxiCode Vérif, l’application mobile permettant la vérification des preuves vaccinales québécoise

The post Faille dans la preuve vaccinale Québécoise : analyse appeared first on WeLiveSecurity

31 August 2021

Back-to-Basics: Think Before You Click

 

As small and medium businesses begin to re-open following the pandemic, it’s important to do so securely in order to protect customer’s payment card data. Too often, data breaches happen as a result of vulnerabilities that are entirely preventable. The PCI Security Standards Council (PCI SSC) has developed a set of payment protection resources for small businesses. In this 8-part back-to-basics series, we highlight payment security basics for protecting against payment data theft. Today’s blog focuses on thinking before you click.

31 August 2021

Don’t use single‑factor authentication, warns CISA

The federal agency urges organizations to ditch the bad practice and instead use multi-factor authentication methods

The post Don’t use single‑factor authentication, warns CISA appeared first on WeLiveSecurity

31 August 2021

WooCommerce Pricing Plugin Allows Malicious Code-Injection

WooCommerce Pricing Plugin Allows Malicious Code-Injection The popular Dynamic Pricing and Discounts plugin from Envato can be exploited by unauthenticated attackers.
31 August 2021

QNAP Is Latest to Get Dinged by OpenSSL Bugs Fallout

QNAP Is Latest to Get Dinged by OpenSSL Bugs Fallout The NAS maker issued two security advisories about the RCE and DoS flaws, adding to a flurry of advisories from the vast array of companies whose products use OpenSSL.
31 August 2021

Top 3 APIs Vulnerabilities: Why Apps are Owned by Cyberattackers

Top 3 APIs Vulnerabilities: Why Apps are Owned by Cyberattackers Jason Kent, hacker-in-residence at Cequence, talks about how cybercriminals target apps and how to thwart them.
31 August 2021

Cyberattackers are now quietly selling off their victim's internet bandwidth

Proxyware is yet another way for criminals to generate revenue from their victims.
31 August 2021

Initial Access Broker use, stolen account sales spike in cloud service cyberattacks

Current trends also include the abuse of Docker images.
31 August 2021

LockFile Ransomware Uses Never-Before Seen Encryption to Avoid Detection

LockFile Ransomware Uses Never-Before Seen Encryption to Avoid Detection Researchers from Sophos discovered the emerging threat in July, which exploits the ProxyShell vulnerabilities in Microsoft Exchange servers to attack systems.
31 August 2021

Vaccine passports: Is your personal data in safe hands?

Vaccination passports may facilitate the return to normalcy, but there are also concerns about what kinds of personal data they collect and how well they protect it. Here’s what you should know.

The post Vaccine passports: Is your personal data in safe hands? appeared first on WeLiveSecurity

31 August 2021

HPE Warns Sudo Bug Gives Attackers Root Privileges to Aruba Platform

HPE Warns Sudo Bug Gives Attackers Root Privileges to Aruba Platform HPE joins Apple in warning customers of a high-severity Sudo vulnerability.
30 August 2021

Army Testing Facial Recognition in Child-Care Centers

Army Testing Facial Recognition in Child-Care Centers Army looking for AI to layer over daycare CCTV to boost ‘family quality of life.’
30 August 2021

The Underground Economy: Recon, Weaponization & Delivery for Account Takeovers

The Underground Economy: Recon, Weaponization & Delivery for Account Takeovers In part one of a two-part series, Akamai's director of security technology and strategy, Tony Lauro, lays out what orgs need to know to defend against account takeover attacks.
30 August 2021

Microsoft Exchange ‘ProxyToken’ Bug Allows Email Snooping

Microsoft Exchange ‘ProxyToken’ Bug Allows Email Snooping The bug (CVE-2021-33766) is an information-disclosure issue that could reveal victims' personal information, sensitive company data and more.
30 August 2021

LockBit Gang to Publish 103GB of Bangkok Air Customer Data

LockBit Gang to Publish 103GB of Bangkok Air Customer Data The airline announced the breach on Thursday, and the ransomware gang started a countdown clock the next day.
30 August 2021

T-Mobile’s Security Is ‘Awful,’ Says Purported Thief

T-Mobile’s Security Is ‘Awful,’ Says Purported Thief John Binns, claiming to be behind the massive T-Mobile theft of >50m customer records, dissed the security measures of the US's No. 2 wireless biggest carrier. T-Mobile is "humbled," it said, announcing new partnerships with security heavyweights on Friday.
28 August 2021

Parallels Offers ‘Inconvenient’ Fix for High-Severity Bug

Parallels Offers ‘Inconvenient’ Fix for High-Severity Bug Firm offers guidance on how to mitigate a five-months-old privilege escalation bug impacting Parallels Desktop 16 for Mac and all previous versions.
27 August 2021

Experts: WH Cybersecurity Summit Should Be Followed by Regulation, Enforcement

Experts: WH Cybersecurity Summit Should Be Followed by Regulation, Enforcement Amazon, Google, Microsoft etc. making major commitments to shore up nation’s cyber-defenses just won't be enough, researchers say.
27 August 2021