Американские эксперты предупреждают о возможных угрозах для безопасности и экономики страны.

Аферист обманул тысячи пожилых людей.

Ученые создали оборудование, способное выдержать электромагнитный импульс в 80 кВ/м.

Максим Степченков отметил, что многие SIEM требуют организации полноценного озера данных (Data Lake), работающего по тем же принципам, что и для бизнес-систем.

Запрос этот появляется по мере расширения опыта работы в SIEM, по принципу «аппетит приходит во время еды».

Наиболее интересные сценарии использования SIEM-системНетипичные сценарии использования SIEMНа различного рода форумах всегда вызывают большой интерес нетипичные сценарии использования разного рода инструментов.

Есть также примеры использования аналитических функций SIEM в медицине, но они единичны.

Также спикер спрогнозировал рост интереса к SIEM с открытым кодом (или наиболее дешёвым среди коммерческих), даже со стороны весьм…

Участники дискуссии в рамках пленарной сессии на AM Live Plus обсудили то, как реализовать принципы безопасной разработки с минимумом издержек.

DevSecOps на практикеРуководитель направления безопасной разработки УЦСБ Евгений ТодышевЕвгений Тодышев:— Выработаны два подхода ко внедрению DevSecOps.

Евгений Тодышев назвал наиболее проблемной категорией те 8 %, которые не верят в DevSecOps: их очень трудно убедить в необходимости внедрения.

Как отметил Евгений Тодышев, если такое и имеет место, то только на начальной стадии внедрения и на короткий срок.

Как отметил Евгений Тодышев, компания УЦСБ уже хорошо отработала услуги аутсорсинга функций безопасной разработки.

Система Secret Cloud Enterprise от вендора Secret Technologies позволяет обеспечить защищённый файлообмен с подрядчиками на объектах КИИ.

Для решения задачи по организации защищённого обмена данными между субъектами КИИ и подрядчиками компания Secret Technologies разработала продукт Secret Cloud Enterprise (SCE).

Предоставление доступа к файлам в Secret Cloud EnterpriseВ Secret Cloud Enterprise предусмотрено несколько типов прав доступа: чтение, создание, изменение, администрирование.

Запросы пользователей на загрузку файлов в Secret Cloud EnterpriseИнтерфейс вкладки имеет вид перечня полученных запросов в формате карточек или списка.

Раздел «Доступные мне» в Secret Cloud EnterpriseКаталоги…

Он позволяет в один щелчок мышью проверить защищённость корпоративной электронной почты и в короткие сроки устранить проблемы.

Кроме того, любое обновление систем влечёт за собой изменения в настройках средств защиты почты и, как следствие, неконтролируемое ослабление безопасности.

Функциональные возможности PT KnockinPT Knockin — онлайн-сервис для оценки защищённости корпоративной почты.

Интерфейс настройки проверки в личном кабинетеНа момент написания статьи пользователям бесплатной версии доступны 24 образца ВП из 82 и возможность отправить до 500 писем для проверки.

Коммерческая версия PT Knockin позволит провести более глубокий анализ защищённости корпоративной почты и сделать проверки…

Глаз дракона сверкает при лёгком развороте криптомарки, что придаёт ей дополнительный блеск и таинственность.

В 1845 году они получили хождение в Санкт-Петербурге и на территории Великого княжества Финляндского.

Криптомарки в миреЭкспериментировать с криптомарками начала в мае 2018 года почта Гибралтара.

Благодаря регистрации криптомарки в блокчейне у каждого выпущенного образца появляется признак его уникальности.

Серии криптомарок Почты Австрии (слева направо): 5.1 (Lion), 5.0 (Bear), 4.0 (Bull)Спрос на криптомарки оказался беспрецедентным.

Информация весьма разнообразна:Сведения из банковской системы (Ф. И. О., паспортные данные, физические и электронные адреса, номера телефонов).

Звонки в нетипичное время суток или в выходные дни.

С 25 июля 2024 года в России вступили в силу новые «правила игры» в борьбе с мошенничеством.

Новые правила распространяются как на платёжные карты, так и на переводы через СБП.

Важно продолжать развивать совместные инициативы и технологии, чтобы обеспечить надёжную защиту клиентов и минимизировать риски в будущем.

Разработка и обучение модели — выбор алгоритмов и тренировка модели на подготовленных данных.

Переоценка задачи и метрик модели при необходимости — адаптация к новым требованиям или изменениям в данных.

Их три:«Белый ящик» — полный доступ к модели и её внутренним параметрам.

Наконец, в случае с «серым ящиком», когда злоумышленник, например, частично знает внутреннее устройство модели или код, нужно в первую очередь предупредить утечки информации.

ВыводыОбеспечение безопасности в машинном обучении — это постоянный процесс, требующий внимания на каждом этапе разработки и внедрения моделей.

Мнение атакующихДля Виктора «VeeZy» кибербитва — это и турнир, и интенсив одновременно:«Ты на нём [на Standoff] хочешь выступить как можно лучше.

Так, капитаны команд защитников Максим Шалыгин и Денис Волохов считают Standoff в большей степени образовательной площадкой, нежели соревнованием.

Иван Булавин, руководитель отдела экспертизы промышленных систем управления в Positive TechnologiesИван Булавин, например, видит в Standoff весомый аргумент на собеседовании:«Как сказал Паша, топ-10 в рейтинге пользователей Standoff — это весомая штука.

В некоторых сегментах инфраструктуры вступает в силу механика реагирования: защитники противодействуют атакующим, но не в полную силу, чтобы дать красны…

Учитывая потребности бизнеса, «Лаборатория Касперского» выпустила решение Kaspersky NGFW — межсетевой экран нового поколения (бета-версия).

Интеграционный сценарий № 1 для Kaspersky NGFW и Kaspersky Symphony XDRРисунок 11.

Интеграционный сценарий № 2 для Kaspersky NGFW и Kaspersky Symphony XDRРисунок 12.

Интеграционный сценарий № 3 для Kaspersky NGFW и Kaspersky Symphony XDRИнтеграция с Kaspersky Anti Targeted Attack планируется на 2025 год.

Kaspersky NGFW в экосистеме Kaspersky Symphony XDRСистемные требования и лицензирование Kaspersky NGFWKaspersky NGFW отличается прозрачной моделью лицензирования и отсутствием дополнительных модулей и расширений.

Тем не менее на этапе проектирования систем защиты стоит заранее исключать продукты на основании веских причин для конкретного потребителя, а не предположений умозрительного характера.

Некоторые вендоры продвигают идею неагентского сбора данных, аргументируя это простотой запуска и эксплуатации, и с этим трудно поспорить.

Также стоит учесть, что DCAP-система работает не в вакууме, а в естественной корпоративной среде и является одним из компонентов комплексной защиты.

Больше возможностей у интегрированной системы будет и в плане проверки поведения пользователей (UBA) и выявления аномалий.

Выше упоминалось, что DCAP нужен не только для работы подразделений ИБ, но и для решения ИТ- и даже биз…

Киберпреступники отправляли жертвам специально созданные архивные файлы, чтобы обойти проверки безопасности и внедрить вредоносный код.

Исследователи заключили, что ИБ-специалистам и поставщикам нейросетей нужно уже сейчас продумывать, как интегрировать большие языковые модели в системы защиты, как злоумышленники могут применять LLM и как им в этом помешать.

Глобально внедрение DevSecOps означает принципиально новый подход к безопасности, который получил название «сдвиг влево» (Shift Left).

Источник: APIsecИнтеграция безопасности в ранние этапы SDLC помогает нейтрализовать эти угрозы без лишних затрат, а главное — без риска реальных инцидентов.

Инструменты IAST действуют во время работы при…

Очевидно, что Telegram был клиентом Apple и Google, что позволило, например, компании Statista получить оценку клиентской базы Telegram и динамики её роста.

из приложения Telegram (по странам)Напомним, что Telegram — это коммерческая компания.

Она была создана братьями Дуровыми в 2006 г. В 2007 г. уже названный фонд DST приобрёл 24,99 % её акций.

Известно также, что в 2014 г. Дуров обратился к В. Евтушенкову, руководителю АФК «Система», с просьбой об инвестициях с целью развития Telegram в размере 30 млн долларов.

Собрав эти данные, Financial Times смогла получить оценку финансового состояния Telegram на 2022 г. и дать прогноз до 2024 г.

Мы рассмотрим актуальные (которые обновлялись в течение последнего календарного года) отечественные операционные системы, предназначенные для рабочих станций.

Мы разделили их на три группы: системы для государственных и корпоративных пользователей, ОС для домашних пользователей и СМБ, ОС для опытных пользователей и энтузиастов.

Операционные системы для государственных и корпоративных пользователейТакие ОС предназначены для построения инфраструктур рабочих мест в крупных компаниях и госорганах.

Позиционируется как универсальное решение, пригодное для использования в качестве ОС для серверов, рабочих станций, терминалов, а также встроенных систем.

Достаточный набор ПО в составе системы и в ре…

Создание обращений и заявок в техподдержкуВ ЛК ИБ для пользователей предусмотрен инструмент создания как стандартных заявок в техподдержку, так и запросов на доработку.

Интерфейс «Заявки»Реагирование на инцидентыРабота с инцидентами доступна для пользователей сервиса MDR как в «Личном кабинете ИБ», так и в соответствующем телеграм-боте.

Интерфейс «Инциденты» в ЛК ИБДоступ ко всем подключённым сервисам и продуктамЛК ИБ поддерживает ролевую модель и позволяет задать уровень полномочий пользователя.

Пример оповещения об уязвимостиКак получить доступ в ЛК ИБНа стадии подписания контракта с ГК «Солар» следует указать, кому необходим доступ в ЛК ИБ, к какому сервису или продукту.

Архитектура «Лич…

На прошлой неделе подразделение Mandiant компании Google выпустило отчет , в котором сделана попытка проанализировать реальную эксплуатацию уязвимостей в атаках.

В предыдущем отчете за 2021 и 2022 годы этот показатель составлял 32 дня, а в начале 2021 года — и вовсе 44 дня.

Для этого был проанализирован набор из 41 уязвимости, для которых эксплойт действительно был выложен в общий доступ.

В 2021–2022 годах на них приходилась половина уязвимостей, в 2023 году — только 40%.

Здесь применяется интересный метод обхода средств безопасности: потенциальной жертве предлагают скопировать скрипт и запустить его в оболочке PowerShell.Кстати, аналогичный метод теперь используется и в атаках на macOS.

В 2014 году мной на Хабре был опубликован закон распределения делителей (ЗРД) натурального числа N в НРЧ.

Закон распределения делителей (ЗРД ) числа возник и существует с момента изобретения и использования числовых последовательностей.

Закон распределения делителей натурального числа в натуральном ряде чисел (НРЧ) опубликован в 2014 году на Хабре.

Расширение закона распределения делителей на РЦЧПочему 1-я версия закона распределения делителей составного числа не применима для ряда целых чисел (РЦЧ)?

Введение в криптографию / Ященко, В. В.. — Москва: МЦНМО, 1999.

В человеческой голове значение хеша ужмется до "8f" ну или (в лучшем случае) до 8f-две-семерки.

Ставится простой командой: pipx install pinkhash (ну или pip install pinkhash ), а утилиту можно использовать так же, как и md5sum или sha256sum .

ЯзыкиСпособ кодирования данный в pinkhash называется языком (не путать с человеческими языками и языками программирования).

Небольшой дисклеймер: Не смотря на то, что здесь упоминаются четкие стандарты (RFC1751 и BIP-0039), pinkhash не является инструментом для работы с данными по этим стандартам.

На Pythonfrom pinkhash import PinkHash, PinkHashError import sys try: pink = PinkHash(language_name="bip39", option="en", nwords=3) except PinkHashError as e…

Мы решили использовать GitHub Webhooks напрямую для получения событий, Yandex Cloud Function для их обработки и телеграм-бота для отправки уведомлений в чат (где, собственно, и происходит вся основная активность сообщества).

Телеграм-бот Использовали BotFather для создания бота и настройки его параметров.

Сразу в переменные окружения можем записать токен бота и секрет для вебхука.

Для начала создаем тестовый репозиторий в GitHub, тестового бота в Telegram и группу с топиком для отправки сообщений.

Интеграция с другими сервисами: в будущем можем рассмотреть интеграцию бота с другими инструментами, сервисами и платформами, где будет развиваться наше сообщество.

Эта статья — расширенный туториал того, как установить и настроить свой VPN на VLESS с XTLS-Reality с управлением через GUI интерфейс 3x-UI.

РКН подумает, что наш сервер - это просто сервер Google, a никакой не VPN, и ничего блокировать не будет.

Я хочу настроить сервер с XTLS-Reality, как это сделать максимально правильно?

), но в десятой версии ОС был добавлен встроенный OpenSSH клиент, который работает так же, как в Линукс.

Настройка клиента:Email: аналогично как и с примечанием, наименование для удобства;Flow: выбираем из списка xtls-rprx-vision.

На основе такого благоприятного события я решил перевести анонимную сеть Hidden Lake на алгоритмы постквантовой криптографии и показать с какими особенностями столкнулся при переходе.

Вкратце о Hidden LakeАнонимная сеть Hidden Lake (HL) - это децентрализованная F2F (friend-to-friend) анонимная сеть с теоретической доказуемостью на базе очередей (QB-задача).

Более подробный анализ сети Hidden Lake можно найти в работе:-> Анонимная сеть «Hidden Lake».

Функция шифрованияФункция шифрования E в сети Hidden Lake состоит из двух этапов:1.

Помыслы о переводе сети Hidden Lake на постквантовую криптографию начались - забавно, но за день до финальной стандартизации квантовоустойчивых криптографических…

Некоторые замечали, что после обсуждения в офлайне какого-то специфического предмета они потом видят в Google рекламу на эту тему.Загадочный феномен идёт ещё дальше.

Учёные говорят о феномене Баадера-Майнхофа ( иллюзия частотности ), но широкие массы не слишком верят в такое простое объяснение.Однако недавно теория о работе смартфона в режиме скрытой прослушки получила косвенное подтверждение В открытый доступ попали слайды питчдека (краткой презентации) компании CMG Local Solutions, дочернего подразделения Cox Media Group (CMG).

В частности, компания Cox Media Group была исключена из партнёрской программы Google в рамках процесса проверки.Данные поступают из мобильных приложений, которые з…

Кольцевая подписьВ кольцевой подписи, в отличие от обычной, используются много публичных ключей.

Если для создания подписи использовался один и тот же приватный ключ то и key image будет одним и тем же, даже если используется другое кольцо.

Например, вот еще одно сообщение (используется то же самое кольцо публичных ключей):{"m":"Hi, this is my second message!

В таком случае обвинения в накрутке будут необоснованными потому что это действительно сообщение от какого-то сотрудника.

Так же в том числе если отзыв отрицательный то компании уже будет не отвертеться происками конкурентов!

Прошло не так много времени с событий в не просто так лежавшем МТС.

Были озвучены хоть какие-то рекомендации по итогам?

Прошло не так много времени с событий в не просто так лежавшем СДЭК.

Были озвучены хоть какие-то рекомендации по итогам?

Возможно, к статье будет продолжение в телеграмм канале и на Пикабу.

Сегодня я покажу вам метод, как обойти последнюю версию Windows Defender с помощью Havoc Demons по состоянию на сентябрь 2024 года.

Я буду использовать следующий shellcode-раннер на PowerShell: https://github.com/dievus/PowerShellRunner/blob/main/runner.ps1Теперь я сгенерирую shellcode для agent Havoc, который будет сохранён в файл с расширением .bin.

Теперь мы можем использовать скрипт на Python 2 для конвертации нашего bin-файла в shellcode, который можно вставить в скрипт runner.ps1.

Теперь мы можем скопировать этот shellcode в переменную $buf в скрипте runner.ps1.

Затем я тестирую это с отключенной антивирусной защитой на машине с Windows и убеждаюсь, что это работает.

Chrome продолжает развивать свои механизмы безопасности, и одной из последних технологий, привлекающих внимание, стал протокол Encrypted Client Hello (ECH).

ECH решает эту проблему, шифруя не только содержимое соединения, но и само сообщение Client Hello, которое включает в себя SNI.

Если сервер не поддерживает ECH, браузер может откатиться к стандартному поведению, отправив SNI в открытом виде, как это происходит в настоящее время.

Как включить ECH в ChromeЗайдите в «Настройки» (Settings).

Важно помнить, что для полноценной работы ECH необходимо, чтобы не только браузер, но и сервер поддерживал этот протокол, а также был корректно настроен DNS‑запись с публичным ключом.

Содержание:Настройка конфигурации и создание ролей Ansible для для Debian-хостов Настройка сервера Ansible на Orange PI и спряжение его с мобильным телефономЗачем это нужно?

Если этот вопрос вам интересен, напишите в комментариях, и мы его рассмотрим в дальнейшем.

Это могут быть адреса серверов, имена служб, прокси и, в общем, все, что периодически нужно в наших ролях и что не хотелось бы дублировать.

В нашем примере мы создадим две роли: первая — ufw, которая настроит файрвол, и вторая — fail2ban, которая обеспечит защиту от брутфорс-атак.

Однако важно помнить, что это правило касается задач, запускаемых модулями Ansible, и не относится к командам, выполняемым через модули терминала!

Компания Activision сообщила, что исправила «обход системы обнаружения» в Modern Warfare III и Call of Duty: Warzone, из-за которого игроков банила античит-система Ricochet.

В компании заверили, что проблема «затронула небольшое количество аккаунтов игроков», и все пострадавшие учетные записи уже восстановлены.

Однако, как рассказал zebleer, владелец магазина Phantom Overlay, торгующего читами, проблема была гораздо серьезнее, чем сообщает Activision.

Стоит отметить, что в конце прошлой недели практически аналогичная проблема была устранена и в античите BattlEye.

Эксплоит так же позволял злоумышленникам банить аккаунты других игроков, и затрагивал ряд игр, включая PUBG, Rainbow Six Siege и …

Специалисты Microsoft рассказали о том, что недавно исправленная уязвимость CVE-2024-44133 в macOS может использоваться в атаках рекламного ПО.

Эта проблема позволяет обойти технологию Transparency, Consent, and Control (TCC) и получить доступ к пользовательским данным.

Apple устранила баг в macOS Sequoia 15 в середине сентября текущего года.

Также конфигурация Safari хранится в различных файлах в домашнем каталоге текущего пользователя, который защищен TCC для предотвращения вредоносных модификаций.

При этом уклониться от обнаружения было возможно, попросту запустив Safari в очень маленьком окне.

Справка: сканирование портовСка­ниро­вание пор­тов — стан­дар­тный пер­вый шаг при любой ата­ке.

Он поз­воля­ет ата­кующе­му узнать, какие служ­бы на хос­те при­нима­ют соеди­нение.

На осно­ве этой информа­ции выбира­ется сле­дующий шаг к получе­нию точ­ки вхо­да.

На­ибо­лее извес­тный инс­тру­мент для ска­ниро­вания — это Nmap.

Улуч­шить резуль­таты его работы ты можешь при помощи сле­дующе­го скрип­та:#!/ bin/ bash ports = $( nmap -p- --min-rate = 500 $1 | grep ^[ 0- 9] | cut -d '/ ' -f 1 | tr '\ n' ', ' | sed s/, $/ / ) nmap -p $ports -A $1

Злоумышленники скомпрометировали эксклюзивного партнера компании ESET в Израиле и разослали клиентам фишинговые письма, в которых под видом антивирусного ПО предлагалось установить уничтожающую данные малварь.

И хотя домен eset.co.il содержит контент и логотипы ESET, представители компании пояснили, что домен принадлежит партнеру, и им управляет компания Comsecure — израильский дистрибьютор продуктов ESET.

В письмах хакеры выдавали себя за представителей ESET Advanded Threat Defense Team и предупреждали, что некие правительственные хакеры якобы пытаются атаковать устройство клиента.

Чтобы придать атаке большую легитимность, ссылка на загрузку ESET Unleashed тоже вела в домен eset.co.il.

Вре…

Компания Cisco подтвердила, что была вынуждена отключить свой портал DevHub, так как хакеры сливают в сеть «непубличные» данные.

При этом компания по-прежнему утверждает, что нет никаких доказательств того, что ее системы были скомпрометированы.

В Cisco подчеркивают, что нет никаких признаков того, что была похищена личная информация или финансовые данные, но расследование еще продолжается.

Как теперь сообщает Bleeping Computer, IntelBroker утверждает, что получил доступ к среде для сторонних разработчиков Cisco через «утекший» токен API.

Хакер утверждает, что одновременно с этим потерял доступ к серверу Maven и Docker, связанными с порталом DevHub.

Хотя DDoS и взлом Internet Archive происходили практически одновременно, за этими инцидентами стояли разные злоумышленники.

Как сообщает теперь издание Bleeping Computer, Internet Archive пострадал еще от одной атаки.

В итоге хакер связался с Bleeping Computer через посредника, взял на себя ответственность за атаку и объяснил, как проник в Internet Archive.

По словам злоумышленникам, атака Internet Archive началась с того, что он нашел доступный файл конфигурации GitLab на одном из серверов организации (services-hls.dev.archive.org).

Якобы эти исходники включали дополнительные учетные данные и аутентификационные токены, в том числе от системы управления БД Internet Archive.

Фактически, единственная причина, по которой исследователям не удалось успешно атаковать WeChat, заключается в том, что теперь он защищен еще и MMTLS.

Хотя в конечном итоге, благодаря обертыванию шифротекста в MMTLS, в протоколе WeChat нет фактических уязвимостей, которые можно эксплуатировать прямо сегодня, исследователи пишут, что обнаружили ряд проблем, которые отсутствуют в стандартной, немодифицированной версии TLS.

И в Mars существует функция под названием NewDNS, представляющая собой именно такую систему domain lookup, как описано выше, присутствующую в WeChat.

Исследователи пишут, что Mars широко применяется и в приложениях за пределами WeChat, и это является проблемой, поскольку ко…

Исследователи предупредили, что иранские злоумышленники взламывают организации критической инфраструктуры для сбора учетных данных и сетевой информации, а затем продают эту информацию на хак-форумах другим преступникам.

О том, что иранские хакеры все чаще действуют как брокеры доступов, предупреждают власти США, Канады и Австралии.

По их словам, преступники используют брутфорс для получения доступа к организациям в сферах здравоохранения и общественного здоровья, государственного управления, информационных технологий, машиностроения и энергетики.

Затем они собирают дополнительные учетные данные, повышают привилегии, изучают взломанные системы и сеть, что позволяет продвигаться дальше и нахо…

В мае текущего года северокорейская группировка ScarCruft провела масштабную атаку, в ходе которой использовала 0-day в Internet Explorer для заражения целевых машин RokRAT и кражи данных, предупредили в Национальном центре кибербезопасности Южной Кореи (NCSC) и AhnLab (ASEC).

Уязвимость, которую ScarCruft использовала в атаках, имеет идентификатор CVE-2024-38178 и является type confusion багом в Internet Explorer.

Обнаружив вредоносную кампанию, исследователи проинформировали Microsoft о проблеме, и та выпустила патч для CVE-2024-38178 в августе 2024 года.

Такие рекламные объявления содержали вредоносный iframe, который при рендеринге в Internet Explorer вызывал JavaScript-файл с именем ad…

Теперь они похищают данные из корпоративных сетей, а затем требуют у работодателей выкуп, угрожая в противном случае «слить» информацию в сеть.

Тот факт, что северокорейские ИТ-специалисты тайно устраиваются на удаленную работу в западные компании, обсуждается уже несколько лет.

Secureworks отслеживает группировку, которая организует и координирует фальшивых северокорейских ИТ-специалистов, под названием Nickel Tapestry, а компания Mandiant называет ее UNC5267.

Исследователи пишут, что изучили множество таких случаев и предупреждают, что теперь в схему с фальшивыми удаленными сотрудниками добавилось вымогательство.

Злоумышленники потребовали шестизначный выкуп в криптовалюте, а в обмен обещ…

Специалисты «Лаборатории Касперского» обнаружили волну рассылок с вредоносными вложениями, замаскированными под запросы от потенциальных клиентов или партнеров.

Эта кампания получила название Horns&Hooves («Рога и копыта») и продолжается с весны 2023 года.

Целями хакеров стали как частные пользователи в России, так и предприятия из сферы торговли и услуг.

К примеру, к письмам с запросом цен прилагаются выписки из ЕГРЮЛ, свидетельства о постановке на налоговый учет и карточки компаний.

То есть последствия для компаний могут быть разными, в зависимости от того, в чьи руки в дальнейшем попадет этот доступ: от кражи данных до шифрования и повреждения систем.

Бразильская полиция сообщает, что в рамках операции Data Breach был адресован известный хакер USDoD, стоявший за взломами созданной ФБР организации InfraGard и брокера данных National Public Data.

Также USDoD взломал компанию National Public Data, из-за чего в сеть попали почти 3 млрд записей с личной информацией американцев.

Считается, что National Public Data собирает информацию из открытых источников, чтобы формировать индивидуальные профили на жителей США и других стран.

Как ни странно, в интервью HackRead USDoD подтвердил информацию, собранную специалистами CrowdStrike, и сообщил, что в настоящее время проживает в Бразилии.

Вероятно, эта информация помогла федеральной полиции Бразилии …

СМИ сообщают, что в Международной академии связи (МАС) предложили запретить использование российскими операторами сервиса SpeedTest компания Ookla.

Дело в том, что сервис якобы делится информацией о сетях связи, на которых работает, с иностранными спецслужбами, что повышает риск кибератак.

Документ гласит, что SpeedTest позволяет собирать информацию о сетях связи, которая впоследствии может быть использована для организации кибератак против информационных ресурсов в любой стране.

В Госдуме и ФСБ сообщили, что согласны с предложением об обязательном использовании операторами российских программных продуктов для измерения скорости передачи данных в сетях вместо зарубежного аналога.

Участники …

Как софт, так и модели совер­шенно бес­плат­ны; от тебя пот­ребу­ется толь­ко вре­мя и уси­лия, что­бы разоб­рать­ся в про­цес­се.

СофтПрак­тичес­ки весь софт для генера­тив­ных ИИ бес­пла­тен, дос­тупен в исходных кодах и работа­ет в окне бра­узе­ра с исполь­зовани­ем биб­лиоте­ки gradio.

WebUI Forge: форк AUTOMATIC1111 с более высокой ско­ростью работы и опти­мизи­рован­ным механиз­мом работы с виде­опа­мятью.

Интерфейс в сти­ле блок‑схем — не для всех, одна­ко он же поз­воля­ет сох­ранять и исполь­зовать как свои, так и сто­рон­ние блок‑схе­мы в виде готовых про­ектов.

Модели и архитектуры

The prolific Chinese nation-state actor known as APT41 (aka Brass Typhoon, Earth Baku, Wicked Panda, or Winnti) has been attributed to a sophisticated cyber attack targeting the gambling and gaming industry.

This time we suspect with high confidence that APT41 were after financial gain."

The next-stage is a malicious DLL file named TSVIPSrv.dll that's retrieved over the SMB protocol, following which the payload establishes contact with a hard-coded command-and-control (C2) server.

"If the hardcoded C2 fails, the implant attempts to update its C2 information by scraping GitHub users using the following URL: github[.]com/search?o=desc&q=pointers&s=joined&type=Users&."

The initial contact with…

A pentest checklist for Gray Box testing including user authentication, authorization testing, input testing, file-based attacks, error handling, business logic testing, and discovery and recon.. A pentest checklist for Gray Box testing including user authentication, authorization testing, input testing, file-based attacks, error handling, business logic testing, and discovery and recon.

This is a summary of why pentest checklists are important including an overview of a general pentest checklist.

A complete guide for full-stack security, including BreachLock's compendium of comprehensive pentest checklists across all assets, can be accessed here.

Pentest Checklists Across Your Attack Surfa…

The development comes as Google revealed that of the 138 exploited security vulnerabilities that were disclosed in 2023, 97 of them (70%) were first weaponized as zero-days.

The development comes as Google revealed that of the 138 exploited security vulnerabilities that were disclosed in 2023, 97 of them (70%) were first weaponized as zero-days.

Researchers Outline Early Cascade Injection: Researchers have disclosed a novel-yet-stealthy process injection technique called Early Cascade Injection that makes it possible to evade detection by endpoint security software.

Researchers have disclosed a novel-yet-stealthy process injection technique called Early Cascade Injection that makes it possi…

Cybersecurity researchers have discovered severe cryptographic issues in various end-to-end encrypted (E2EE) cloud storage platforms that could be exploited to leak sensitive data.

"Remarkably, many of our attacks affect multiple providers in the same way, revealing common failure patterns in independent cryptographic designs."

The identified weaknesses are the result of an analysis of five major providers such as Sync, pCloud, Icedrive, Seafile, and Tresorit.

The devised attack techniques hinge on a malicious server that's under an adversary's control, which could then be used to target the service providers' users.

Back in June 2022, ETH Zurich researchers also demonstrated a number of cr…

Unknown threat actors have been observed attempting to exploit a now-patched security flaw in the open-source Roundcube webmail software as part of a phishing attack designed to steal user credentials.

"However, the email client didn't show the attachment.

"By inserting JavaScript code as the value for "href", we can execute it on the Roundcube page whenever a Roundcube client opens a malicious email," Positive Technologies noted.

It also displays a login form in the HTML page displayed to the user in a bid to deceive victims into providing their Roundcube credentials.

"While Roundcube webmail may not be the most widely used email client, it remains a target for hackers due to its prevalent…

In the modern enterprise, data security is often discussed using a complex lexicon of acronyms—DLP, DDR, DSPM, and many others.

- The Payment Card Industry Data Security Standard (PCI DSS) is a security standard established by credit card companies (Visa, mastercard, American Express etc.)

Data Security ToolsBeyond frameworks, there are specific tools that help enforce data security policies and protect sensitive information from threats.

By automating the discovery and classification of sensitive data, DSPM solutions provide continuous visibility into data security risks and help maintain compliance with relevant regulations.

To learn more about how to approach your data security program, …

A nascent threat actor known as Crypt Ghouls has been linked to a set of cyber attacks targeting Russian businesses and government agencies with ransomware with the twin goals of disrupting business operations and financial gain.

"The group under review has a toolkit that includes utilities such as Mimikatz, XenAllPasswordPro, PingCastle, Localtonet, resocks, AnyDesk, PsExec, and others," Kaspersky said.

"As the final payload, the group used the well-known ransomware LockBit 3.0 and Babuk."

Victims of the malicious attacks span government agencies, as well as mining, energy, finance, and retail companies located in Russia.

All of this only makes it more difficult to identify specific malici…

North Korean information technology (IT) workers who obtain employment under false identities in Western companies are not only stealing intellectual property, but are also stepping up by demanding ransoms in order to not leak it, marking a new twist to their financially motivated attacks.

These North Korean workers are typically sent to countries like China and Russia, from where they pose as freelancers looking for potential job opportunities.

"This shift significantly changes the risk profile associated with inadvertently hiring North Korean IT workers," Rafe Pilling, Director of Threat Intelligence at Secureworks CTU, said in a statement.

"The emergence of ransom demands marks a notable…

Keeping your data secure in today's fast-evolving landscape can feel like an impossible challenge.

But there's a game-changing solution: Data Security Posture Management (DSPM).

Like a vigilant security guard, DSPM detects potential risks and helps you fend off attacks before they cause damage.

Ensure Compliance with Ease: Stay ahead of regulatory demands—DSPM makes it simple to follow data security guidelines and avoid costly penalties.

Register now to secure your spot and take the first step towards a stronger, more secure data posture.

Cybersecurity and intelligence agencies from Australia, Canada, and the U.S. have warned about a year-long campaign undertaken by Iranian cyber actors to infiltrate critical infrastructure organizations via brute-force attacks.

The attacks, in some instances, are characterized by using msedge.exe to establish outbound connections to Cobalt Strike command-and-control (C2) infrastructure.

The alert comes weeks after government agencies from the Five Eyes countries published guidance on the common techniques that threat actors use to compromise Active Directory.

"Active Directory is the most widely used authentication and authorization solution in enterprise information technology (IT) network…

Threat actors are leveraging fake Google Meet web pages as part of an ongoing malware campaign dubbed ClickFix to deliver infostealers targeting Windows and macOS systems.

These pages are known to masquerade as popular online services, including Facebook, Google Chrome, PDFSimpli, and reCAPTCHA, and now Google Meet as well as potentially Zoom -meet.google.us-join[.

Sekoia has attributed the cluster impersonating Google Meet to two traffers groups, namely Slavic Nation Empire (aka Slavice Nation Land) and Scamquerteo, which are sub-teams within markopolo and CryptoLove, respectively.

"Both traffers teams [...] use the same ClickFix template that impersonates Google Meet," Sekoia said.

"The r…

Microsoft has disclosed details about a now-patched security flaw in Apple's Transparency, Consent, and Control (TCC) framework in macOS that has likely come under exploitation to get around a user's privacy preferences and access data.

It was addressed by Apple as part of macOS Sequoia 15 by removing the vulnerable code.

Microsoft said the new protections are limited to Apple's Safari browser, and that it's working with other major browser vendors to further explore the benefits of hardening local configuration files.

HM Surf follows Microsoft's discovery of Apple macOS flaws like Shrootless, powerdir, Achilles, and Migraine that could enable malicious actors to sidestep security enforceme…

The Russian threat actor known as RomCom has been linked to a new wave of cyber attacks aimed at Ukrainian government agencies and unknown Polish entities since at least late 2023.

The intrusions are characterized by the use of a variant of the RomCom RAT dubbed SingleCamper (aka SnipBot or RomCom 5.0), said Cisco Talos, which is monitoring the activity cluster under the moniker UAT-5647.

The attack chains start with a spear-phishing message that delivers a downloader -- either coded in C++ (MeltingClaw) or Rust (RustyClaw) -- which serves to deploy the ShadyHammock and DustyHammock backdoors, respectively.

Despite's ShadyHammock additional features, it's believed that it's a predecessor to…

The classic Google Voice scam goes something like this:Setting up a Google Voice account .

The fraudster downloads the Google voice app and links it to a Google account, much like anyone else does..

The fraudster downloads the Google voice app and links it to a Google account, much like anyone else does.

Then they may do one of several things:Sell your Google Voice number and account to other scammersPlace vishing calls designed to scam victims, using your Google Voice accountEmbed your Google Voice number into email phishing or smishing messagesUse the Google Voice voicemail feature to record messages posing as legitimate authorities, in order to further their scamsUse the Google Voice num…

The rest of the software flaws under review were exploited as n-days; i.e., vulnerabilities first exploited after patches are made available (versus zero days, which are abused before patches are released).

The average time to exploit a software flaw has been shrinking considerably over the years – from 63 days in 2018-2019 all the way to only five days last year.

These and other figures in the report underscore a disconcerting trend: threat actors are rapidly getting better at spotting and weaponizing software vulnerabilities, which clearly poses an escalating threat to businesses and individuals alike.

What else did the report find and how does the market for zero-day exploits factor into…

“Hey, wanna chat?” This innocent phrase can take on a sinister meaning when it comes from an adult to a child online and even be the start of a predatory relationship“Hey, wanna chat?” What sounds like a casual and innocent phrase between adults can take a sinister turn when it comes from an adult to a child online – and even be the start of a predatory relationship.

Grooming, where an adult uses psychological tactics to gain a child’s trust in order to manipulate, exploit, or abuse them, is a pervasive problem these days.

It often occurs online, where predators may use social media, gaming platforms, or messaging apps to contact minorsIn this episode of Unlocked 403, Becks sat down with ch…

Although QR codes have been around since the 90s, quishing as a threat really started to appear during the pandemic.

Fraudsters leapt into action, sticking fake QR codes over the real ones.

There have been a number of reports about scammers targeting motorists via malicious QR codes stuck to parking meters.

If you’re uncomfortable scanning a QR code, consider using one of these alternatives to avoid the risk of interacting with a fraudulent code.

News of the latest QR quishing campaign will only increase calls for codes to be banned from public places.

In this blog, we’ll explore cybersecurity internships, scholarships and apprenticeships as three great pathways, especially for young people, to jump-start their careers in this exciting and rewarding field.

For example, ESET currently runs Women in Cybersecurity scholarships for female undergraduates looking to pursue a career in cybersecurity in the UK , US, Canada and Australia.

Some cybersecurity apprenticeships prepare you for industry certifications that validate the training and expertise learned, enhancing employability further down the line.

Job security: Almost all industries require cybersecurity, including health, government, education, law, financial services, and manufacturing…

This week, ESET researchers published the results of their probe into a series of attacks that leveraged bespoke toolsets to compromise air-gapped systems belonging to governmental and diplomatic entities, including those based in Europe.

The toolsets were deployed by a little-known APT group called GoldenJackal and allowed it to penetrate and maintain persistence in targeted systems, gather, process and exfiltrate information of interest from them, as well as provide configurations and commands to other systems.

How exactly were the attacks executed, and what more is there to know about GoldenJackal's tactics, techniques, and procedures?

Find out in the video and make sure to also read the…

The first part focused on Telekopye’s key features, while the second part examined the inner workings of the affiliated scam groups.

Most notably, Telekopye groups have expanded their targeting to popular accommodation booking platforms, such as Booking.com and Airbnb.

Telekopye groups have a business-like operation, with a clear hierarchy, defined roles, internal practices – including admission and mentoring processes for newcomers – fixed working hours, and commission payouts for Telekopye administrators.

Branching out to accommodation booking platformsIn 2024, Telekopye groups have expanded their scamming playbook with schemes targeting users of popular online platforms for hotel and apa…

It’s undeniable that cyber insurance and cybersecurity are intrinsically linked.

This blog is the final of a series looking into cyber insurance and its relevance in this increasingly digital era – see also parts 1, 2, 3, 4, 5 and 6.

In other words, could we see the development of a “cyber-rating”, similar to the credit rating used in finance?

As with credit ratings, everybody could view their cyber rating, and take advice on how to improve it, just as we do with credit ratings today.

Business transformation and hybrid working with AI: How should organizations respond to the growing cyber risk?

Whenever a USB drive is inserted, the unknown component copies itself and the GoldenDealer component to the drive.

Table 1 shows the list of configuration files used by GoldenDealer.

The transport_http module is responsible for communication with the C&C server, and for writing requests and responses to specific directories.

]124 N/A Orange Polska Spolka Akcyjna 2019‑08‑09 Primary C&C server used by GoldenJackal in 2019.

]210 N/A UTANDE 2019‑08‑09 Secondary C&C server used by GoldenJackal in 2019.

Attributing a cyberattack to a specific threat actor is no easy task, as highlighted by new ESET research published this week.

ESET experts recently uncovered a new China-aligned APT group that they named CeranaKeeper and that takes aim at governmental institutions in Thailand, leveraging some tools previously attributed to Mustang Panda.

However, a thorough review of the group's tactics, techniques and procedures (TTPs), code, and infrastructure discrepancies suggests that CeranaKeeper and MustangPanda should be tracked as two separate entities.

How exactly were the attacks executed, and what more is there to know about CeranaKeeper and its relentless hunt for data?

Find out in the video a…

Key points of this blogpost: ESET researchers discovered a new China-aligned threat actor, CeranaKeeper, targeting governmental institutions in Thailand.

CeranaKeeper abuses popular, legitimate cloud and file-sharing services such as Dropbox and OneDrive to implement custom backdoors and extraction tools.

Compromising machines in the same networkThe compromise vectors that CeranaKeeper used in the case we analyzed have yet to be found.

Additionally, CeranaKeeper used the compromised server to store updates for TONESHELL, turning it into an update server.

CeranaKeeper uses cloud and file-sharing services for exfiltration and probably relies on the fact that traffic to these popular services …

One point that caught my interest during the ensuing debate was the suggestion that future incidents of this magnitude could be avoided by some form of automated system recovery.

In my view, the recovery process should be the same in all circumstances, regardless of the third-party software (or spark plugs) involved.

The same scenario could be used for all third-party software that has kernel-mode access.

Having a recovery option built into the OS for all third-party software would be more efficient than relying on each software vendor to develop their own solution.

It would, of course, need consultation and collaboration between OS and third-party software vendors to ensure the mechanism f…

Next year’s Cybersecurity Awareness Month could be void of this topic entirely if all companies storing PII are required to enable MFA on all user accounts by default.

However, this is not to say that it’s acceptable to use weak passwords or reuse passwords across sites.

What I am saying instead is that the emphasis on strong and unique passwords will decrease, as the added layer of MFA will greatly help prevent credential theft.

However, GDPR changed this dynamic, as hefty regulatory fines justify the budget for proper data security measures.

Legislation to the rescueNow imagine Cybersecurity Awareness Month next year without the lecturing about basic security practices such as strong and …

ESET research examines the group's malicious wares as used to spy on targets in Ukraine in the past two yearsThis week, ESET researchers published an extensive analysis of the tools and techniques of Gamaredon, a Russia-aligned threat actor that is currently the most active APT group in Ukraine.

Their research examines the group's malicious wares as used to conduct its cyberespionage activities in 2022 and 2023 and answers questions such as:who were the group's most frequent targets?

what kinds of tactics did the group use and how successful were they?

did the group use tried-and-tested tactics or did it innovate heavily?

Learn more in the video and make sure to read the blogpost and the wh…

These tactics pose a significant challenge to tracking efforts, as they make it harder for systems to automatically detect and block the group’s tools.

The lack of sophistication of Gamaredon tools is compensated by frequent updates and use of regularly changing obfuscation.

Despite the relative simplicity of its tools, Gamaredon’s aggressive approach and persistence make it a significant threat.

For a more detailed analysis and technical breakdown of Gamaredon’s tools and activities, you can access the full ESET Research white paper here.

A comprehensive list of indicators of compromise (IoCs) can be found in our GitHub repository and the Gamaredon white paper.

The ultimate guide to AI security: key AI security risks, vulnerabilities and strategies for protection.

This whitepaper covers the key AI risks being overlooked from LLMs to RAG.

AI security solutions – This chapter goes into detail on each type of AI security measure on the market today.

– This chapter goes into detail on each type of AI security measure on the market today.

Download: Securing GenAI whitepaper

Graylog unveiled significant security advancements to drive smarter, faster, and more cost-efficient security operations.

The company’s latest capabilities include advanced data routing, asset-based risk scoring, and AI-generated investigation reports.

These enhancements, and many others in the Fall 2024 release, help organizations realign their time and financial investment with security objectives, empowering security teams to confidently reduce risk.

With a detailed understanding of the threat landscape at both user and system levels, Graylog enables organizations to make more informed decisions about their security posture and respond more effectively to potential threats.

Exclusive to …

In the last couple of days, Fortinet has released critical security updates for FortiManager, to fix a critical vulnerability that is reportedly being exploited by Chinese threat actors.

The advice apparently includes configuring FortiManager to prevent devices with an unknown serial number (i.e., an unauthorized device) to register/connect to them.

Limiting access to FortiManager installations is also generally a good idea, but implementing the patches once they released is essential.

No CVE, no details (yet)The company has yet to publicly reveal details about or the CVE associated with this vulnerability, though the suggested mitigation might indicate that the issue resides in the “Fortig…

The initial attacksTwo weeks ago, the Internet Archive was made inaccessible by several DDoS attacks claimed by pro-Palestinian hacktivists.

The Wayback Machine – a huge “library” of archived copies of web pages that’s run by the Internet Archive – was made accessible again last week.

Our priority is ensuring the Internet Archive comes online stronger and more secure,” he added.

For one: As far as we know, the threat actor who breached IA didn’t damage the organization’s archives.

The Internet Archive has yet to publicly comment on this new development.

Ataccama ONE v15.3 empowers data teams to monitor, manage, and utilize data to enhance security and compliance and expand their customer value and footprint.

Enhanced data security to facilitate compliance: enterprise data security is critical for regulatory compliance and reputation management.

Monitoring data quality at scale for efficiency and trust in data: Ataccama ONE v15.3 provides accurate and cost-effective processing performance for even the heaviest data processing cases.

: data teams can now run data quality monitoring on the latest increment of large data sets, with slices created based on time range, with monitoring run on a scheduled basis.

Assured data quality: accelerate da…

The idea of “secure AI by design” is becoming more prominent.

Ensuring that AI systems are safe, secure, and trustworthy starts by building AI/ML securely from the ground up.

With an MLSecOps approach, collaboration across security, data science, and operations teams creates resilient AI systems capable of withstanding emerging threats.

What key principles should organizations consider when designing secure AI systems, according to frameworks like NCSC or MITRE?

By updating your build processes to include secure by design, using AI specific security solutions, and upleveling AI security knowledge, organizations can build resilience to evolving AI/ML threats.

A recent Todyl report revealed a 558% increase in BEC (Business Email Compromise), AiTM (Adversary-in-the-Middle), and ATO (Account Takeover) attacks in 2024.

In this Help Net Security video, David Langlands, Chief Security Officer at Todyl, discusses these evolving cyber threats.

Here are the key findings from the report:

The Growing Cybersecurity Skills GapThe cybersecurity landscape is more complex and dangerous than ever before.

Immigration: A Solution to the Cybersecurity ShortageImmigration can help solve the cybersecurity skills shortage in several ways.

Although immigration was highlighted as a crucial element in the policy to mitigate the cybersecurity talent shortage, meaningful immigration reform by Congress is essential for the successful implementation of this strategy.

These experts can help train the next generation of American cybersecurity professionals, ensuring that the U.S. remains at the forefront of global cybersecurity for decades to come.

ConclusionThe cybersecurity skills shortage is …

Cybereason has launched its revolutionary SDR Data Ramp Programme with Observe.

This ensures that customers can experience the full capabilities of Cybereason’s SDR product, which is designed to detect, analyse, and respond to cyber threats with unparalleled accuracy and speed, reducing the need for legacy SIEM platforms.

“The 1TB Free SDR Data Ramp Programme underscores our commitment to empowering organisations with the tools they need to defend against increasingly sophisticated cyber threats.

This multi-layered approach enables security teams to identify and mitigate threats more effectively, reducing the time to detect and respond to incidents.

To learn more about Cybereason’s 1TB Free…

Even seasoned professionals stumble upon common pitfalls that can impact user experience and, consequently, a site’s success.

With expertise from website design company, Full Stack Industries, we will explore common design mistakes and how to avoid them.

This inclusive step means all audiences can experience your site and will also improve your search engine rankings.

Final ThoughtsKeeping these common website design mistakes at bay can significantly elevate your online presence.

By prioritising user experience, accessibility, and clear communication, you’ll create a site that looks great and effectively serves its users.

Encrypting a few devices to test their strategy is a red flag that a more significant ransomware assault is imminent and demands immediate action.

By staying alert to these signs and responding promptly, organisations can better defend against the escalating threat of ransomware attacks.

Poorly Managed Remote Desktop Protocol ConnectionsRemote Desktop Protocol (RDP) connections, if not properly managed, can be an entry point for ransomware attacks.

Sectors Prone to Ransomware AttacksSpecific sectors are particularly vulnerable to ransomware attacks thanks to the critical nature of their operations.

Here are the sectors most commonly targeted:The healthcare sector is a prime target for ranso…

Databarracks’ Data Health Check – an annual survey of 500 UK IT decision makers – found that while more organisations than ever have cyber insurance, the number of claims is down.

66% of those surveyed report having insurance specifically for cyber in 2024, rising from 51% over the past two years.

James Watts, Managing Director at Databarracks, commented:“We have long speculated about the negative effect of cyber insurance policies on ransomware.

The nascent cyber insurance market suddenly became unsustainable.

As our Data Health Check found last year, cyber insurance prices increased significantly and the requirements to obtain cover became stricter.

According to research from Absolute Security, over half (54%) of Chief Information Security Officers (CISOs) feel their security team is unprepared for evolving AI-powered threats.

The findings were uncovered in the Absolute Security United Kingdom CISO Cyber Resilience Report 2024, which surveyed 250 UK CISOs at enterprise organisations to assess the state of cyber resilience, AI, and the cyber threat landscape in the UK.

Almost half (46%) of CISOs believe that AI is more of a threat to their organisation’s cyber resilience than a help, highlighting AI as a potential danger in safeguarding organisations from cyber threats rather than strengthening cyber resilience.

As AI-driven cyber threa…

The report found that threat actors are selling data and source code from major brands on the dark web.

Given the popularity of Amazon, users should be wary of threat actors creating counterfeit websites that ask to submit sensitive information.

Log4j remains a popular vulnerability that threat actors attempt to exploitThree years after its discovery in 2021, Log4j remains one of the most used vulnerabilities leveraged by threat actors.

Inbound traffic is traffic that doesn’t originate from within the network, while WANbound traffic resides within a WAN environment.

“With the Q2 2024 Cato CTRL SASE Threat Report, we are putting the spotlight on a notorious threat actor named IntelBroker.

The National Institute of Standards and Technology (NIST) has officially published its highly anticipated Federal Information Processing Standards (FIPS) for post-quantum cryptography (PQC).

The algorithms announced today represent the first finalized standards from NIST’s PQC standardization project and are now ready for immediate implementation.

Today’s announcement takes place within a larger regulatory framework, including the White House’s National Security Memorandum, NSM-8, which requires the adoption of post-quantum cryptography (PQC).

Today’s quantum computers are small and experimental, but they are rapidly becoming more capable, and it is only a matter of time before cryptographi…

Yet despite the clear and present danger, some businesses continue to deprioritise cyber security, with a concerning 15% failing to invest in cyber security measures.

An overshadowed priorityDespite a shared understanding of cyber threats among security leaders and C-suite, cyber security often gets overlooked.

Alarmingly, a third of security leaders only prioritise cyber security expertise after an attack has happened.

Securing buy-inTo ensure cyber security is prioritised, it is vital to convey to the C-suite the very real implications of not mitigating cyber security risks.

It is time to implement cyber security measures nowBy deprioritising cyber security, businesses are essentially def…

High levels of demand for cyber security expertise also means that it’s one of the best paying roles in tech with a great level of job security.

However, cyber security professionals are in a never-ending arms race with hackers.

On the other side, AI also has the capacity to create an arsenal of new offensive and defensive tools for cyber security experts.

Quantum computingLike AI, Quantum has the capacity to utterly transform how we all live and work.

Ambitious cyber security professionals could become trail blazers in this sector if they start acquiring relevant skills now.

HealthEquity, a leading provider of health savings account (HSA) services, has announced it suffered a data breach recently, resulting in compromised customer protected health information (PHI). It is understood the breach was detected on March 25, 2024, after abnormal activity was flagged from a business partner’s device. Once an investigation was carried out, it was […]

The post HealthEquity Data Breach Compromises Customer Information first appeared on IT Security Guru.

The post HealthEquity Data Breach Compromises Customer Information appeared first on IT Security Guru.

Today, Accenture (NYSE: ACN) and SandboxAQ have announced that they are expanding their partnership to address the critical need for enterprise data encryption that can defend against current data breaches, as well as future AI and quantum threats. Together, Accenture and SandboxAQ are helping organisations secure sensitive data and strengthen encryption across their technology portfolios. […]

The post Accenture and SandboxAQ Expand Cybersecurity Partnership first appeared on IT Security Guru.

The post Accenture and SandboxAQ Expand Cybersecurity Partnership appeared first on IT Security Guru.

New research by Keeper Security has revealed some worrying trends and misunderstandings when it comes to password best practices and overconfidence in cyber knowledge. The research found that, while 85% of respondents believe their passwords are secure, over half admit to sharing their passwords. Additionally, 64% of people feel confident in their cybersecurity knowledge despite […]

The post People Overconfident in Password Habits, Overwhelmed by Too Many Passwords first appeared on IT Security Guru.

The post People Overconfident in Password Habits, Overwhelmed by Too Many Passwords appeared first on IT Security Guru.

Technology is advancing rapidly and tokenized payment cards are a part of its evolution. Gone are the days of keying in long card numbers, expiry dates and CVV codes and hoping for the best. Instead, tokenized cards offer heightened security and improved transaction processes for digital payments. But what are they all about and how […]

The post Secure, Simple, Superior: The Advantages of Tokenized Payment Cards by Wallester first appeared on IT Security Guru.

The post Secure, Simple, Superior: The Advantages of Tokenized Payment Cards by Wallester appeared first on IT Security Guru.

New threat research by Salt-Labs, the research arm of API security company Salt Security, has released new research highlighting critical security flaws within popular web analytics provider Hotjar. The company serves over one million websites, including global brands like Microsoft and Nintendo (according to their website). These vulnerabilities could have potentially allowed an attacker unlimited […]

The post Security Flaws Found in Hotjar, Potentially Affecting Sensitive Data of Millions Utilising Major Global Brands first appeared on IT Security Guru.

The post Security Flaws Found in Hotjar, Potentially Affecting Sensitive Data of Millions Utilising Major Global Brands appeared first on…

About Bruce SchneierI am a public-interest technologist, working at the intersection of security, technology, and people.

I've been writing about security issues on my blog since 2004, and in my monthly newsletter since 1998.

I'm a fellow and lecturer at Harvard's Kennedy School, a board member of EFF, and the Chief of Security Architecture at Inrupt, Inc.

This personal website expresses the opinions of none of those organizations.

About Bruce SchneierI am a public-interest technologist, working at the intersection of security, technology, and people.

I've been writing about security issues on my blog since 2004, and in my monthly newsletter since 1998.

I'm a fellow and lecturer at Harvard's Kennedy School, a board member of EFF, and the Chief of Security Architecture at Inrupt, Inc.

This personal website expresses the opinions of none of those organizations.

About Bruce SchneierI am a public-interest technologist, working at the intersection of security, technology, and people.

I've been writing about security issues on my blog since 2004, and in my monthly newsletter since 1998.

I'm a fellow and lecturer at Harvard's Kennedy School, a board member of EFF, and the Chief of Security Architecture at Inrupt, Inc.

This personal website expresses the opinions of none of those organizations.

The Washington Post has a long and detailed story about the operation that’s well worth reading (alternate version here).

The sales pitch came from a marketing official trusted by Hezbollah with links to Apollo.

Sometime in 2023, she offered Hezbollah a deal on one of the products her firm sold: the rugged and reliable AR924.

Mossad’s pagers, each weighing less than three ounces, included a unique feature: a battery pack that concealed a tiny amount of a powerful explosive, according to the officials familiar with the plot.

Israeli officials believe that Hezbollah did disassemble some of the pagers and may have even X-rayed them.

Upcoming Speaking EngagementsThis is a current list of where and when I am scheduled to speak:I’m speaking at SOSS Fusion 2024 in Atlanta, Georgia, USA.

The event will be held on October 22 and 23, 2024, and my talk is at 9:15 AM ET on October 22, 2024.

The list is maintained on this page.

Posted on October 14, 2024 at 12:49 PM • 0 Comments

It gets installed by exploiting more than 20,000 common misconfigurations, a capability that may make millions of machines connected to the Internet potential targets, researchers from Aqua Security said.

The researchers are calling the malware Perfctl, the name of a malicious component that surreptitiously mines cryptocurrency.

The naming convention is one of the many ways the malware attempts to escape notice of infected users.

Besides using the machine resources to mine cryptocurrency, Perfctl also turns the machine into a profit-making proxy that paying customers use to relay their Internet traffic.

Aqua Security researchers have also observed the malware serving as a backdoor to instal…

About Bruce SchneierI am a public-interest technologist, working at the intersection of security, technology, and people.

I've been writing about security issues on my blog since 2004, and in my monthly newsletter since 1998.

I'm a fellow and lecturer at Harvard's Kennedy School, a board member of EFF, and the Chief of Security Architecture at Inrupt, Inc.

This personal website expresses the opinions of none of those organizations.

More on My AI and Democracy BookIn July, I wrote about my new book project on AI and democracy, to be published by MIT Press in fall 2025.

Feel free to do some mixing and matching: swapping “Will Transform” for “Will Improve” for “Can Transform” for “Can Improve,” for example.

Background: AI and Power30.

Background: AI and Trust31.

The manuscript isn’t due to the publisher until the end of March, and who knows what AI developments will happen between now and then.

IronNet Has Shut DownAfter retiring in 2014 from an uncharacteristically long tenure running the NSA (and US CyberCommand), Keith Alexander founded a cybersecurity company called IronNet.

Whatever ideas he had, they were developed on public time using public resources: he shouldn’t have been able to leave military service with them in his back pocket.

After some crazy VC investments and an IPO with a $3 billion “unicorn” valuation, the company has shut its doors.

IronNet’s rise and fall also raises questions about the judgment of its well-credentialed leaders, a who’s who of the national security establishment.

“I’m honestly ashamed that I was ever an executive at that company,” said Mark B…

Deebot Robot Vacuums Are Using Photos and Audio to Train Their AIAn Australian news agency is reporting that robot vacuum cleaners from the Chinese company Deebot are surreptitiously taking photos and recording audio, and sending that data back to the vendor to train their AIs.

Ecovacs’s privacy policy—available elsewhere in the app—allows for blanket collection of user data for research purposes, including: The 2D or 3D map of the user’s house generated by the deviceVoice recordings from the device’s microphonePhotos or videos recorded by the device’s camera It also states that voice recordings, videos and photos that are deleted via the app may continue to be held and used by Ecovacs.

No …

About Bruce SchneierI am a public-interest technologist, working at the intersection of security, technology, and people.

I've been writing about security issues on my blog since 2004, and in my monthly newsletter since 1998.

I'm a fellow and lecturer at Harvard's Kennedy School, a board member of EFF, and the Chief of Security Architecture at Inrupt, Inc.

This personal website expresses the opinions of none of those organizations.

China Possibly Hacking US “Lawful Access” BackdoorThe Wall Street Journal is reporting that Chinese hackers (Salt Typhoon) penetrated the networks of US broadband providers, and might have accessed the backdoors that the federal government uses to execute court-authorized wiretap requests.

Those backdoors have been mandated by law—CALEA—since 1994.

For years, the security community has pushed back against these backdoors, pointing out that the technical capability cannot differentiate between good guys and bad guys.

And here is one more example of a backdoor access mechanism being targeted by the “wrong” eavesdroppers.

Posted on October 8, 2024 at 7:00 AM • 0 Comments

About Bruce SchneierI am a public-interest technologist, working at the intersection of security, technology, and people.

I've been writing about security issues on my blog since 2004, and in my monthly newsletter since 1998.

I'm a fellow and lecturer at Harvard's Kennedy School, a board member of EFF, and the Chief of Security Architecture at Inrupt, Inc.

This personal website expresses the opinions of none of those organizations.

About Bruce SchneierI am a public-interest technologist, working at the intersection of security, technology, and people.

I've been writing about security issues on my blog since 2004, and in my monthly newsletter since 1998.

I'm a fellow and lecturer at Harvard's Kennedy School, a board member of EFF, and the Chief of Security Architecture at Inrupt, Inc.

This personal website expresses the opinions of none of those organizations.

More recently, USDoD was behind a breach at the consumer data broker National Public Data that led to the leak of Social Security numbers and other personal information for a significant portion of the U.S. population.

According to TV Globo, USDoD is wanted domestically in connection with the theft of data on Brazilian Federal Police officers.

Additional reporting revealed National Public Data had inadvertently published its own passwords on the Internet.

In an interview with KrebsOnSecurity, USDoD acknowledged stealing the NPD data earlier this year, but claimed he was not involved in leaking or selling it.

Toward the end of that interview, USDoD said they were planning to launch a platfor…

The U.S. government on Wednesday announced the arrest and charging of two Sudanese brothers accused of running Anonymous Sudan (a.k.a.

AnonSudan), a cybercrime business known for launching powerful distributed denial-of-service (DDoS) attacks against a range of targets, including dozens of hospitals, news websites and cloud providers.

Active since at least January 2023, AnonSudan has been described in media reports as a “hacktivist” group motivated by ideological causes.

AnonSudan claimed credit for successful DDoS attacks on numerous U.S. companies, causing a multi-day outage for Microsoft’s cloud services in June 2023.

The two men also allegedly extorted some of their victims for money in…

The parents of a 19-year-old Connecticut honors student accused of taking part in a $243 million cryptocurrency heist in August were carjacked a week later — while out house-hunting in a brand new Lamborghini.

But prosecutors in Connecticut said they were targeted “because the co-conspirators believed the victims’ son had access to significant amounts of digital currency.”What made the Miami men so convinced R.C.

One of the usernames leaked during the chat was Veer Chetal.

KrebsOnSecurity sought comment from Veer Chetal, and from his parents — Radhika Chetal and Suchil Chetal.

It is clear that other alleged co-conspirators to the $243 million heist displayed a conspicuous consumption of wea…

Microsoft today released security updates to fix at least 117 security holes in Windows computers and other software, including two vulnerabilities that are already seeing active attacks.

Also, Adobe plugged 52 security holes across a range of products, and Apple has addressed a bug in its new macOS 15 “Sequoia” update that broke many cybersecurity tools.

One of the zero-day flaws — CVE-2024-43573 — stems from a security weakness in MSHTML, the proprietary engine of Microsoft’s Internet Explorer web browser.

Finally, Adobe has released security updates to plug a total of 52 vulnerabilities in a range of software, including Adobe Substance 3D Painter, Commerce, Dimension, Animate, Lightroom,…

Organizations that get relieved of credentials to their cloud environments can quickly find themselves part of a disturbing new trend: Cybercriminals using stolen cloud credentials to operate and resell sexualized AI-powered chat services.

Within minutes, their bait key was scooped up and used to power a service that offers AI-powered sex chats online.

But over the past six months, Ahl said, Bedrock has emerged as one of the top targeted cloud services.

“Bad guy hosts a chat service, and subscribers pay them money,” Ahl said of the business model for commandeering Bedrock access to power sex chat bots.

In June 2024, security experts at Sysdig documented a new attack that leveraged stolen cl…

“Damn my guy actually filed the warrant,” Iza allegedly texted someone after the location warrant was entered.

Iza’s indictment says he also harassed a man identified only as T.W., and refers to T.W.

According to the feds, Iza paid the associate $50,000 to craft the event to his liking, but on the day of the party Iza allegedly told R.C.

balked, Iza allegedly surrounded the man with armed LASD officers, who then extracted the payment by seizing his phone.

The complaint says Iza ran this business with another individual identified only as “T.H.,” and that at some point T.H.

Joker’s Stash also was unique because it claimed to sell only payment cards that its own hackers had stolen directly from merchants.

At the time, card shops typically resold payment cards that were stolen and supplied by many third-party hackers of unknown reliability or reputation.

BRIANS CLUBIn late 2015, a major competitor to Joker’s Stash emerged using UAPS for its back-end payments: BriansClub.

Experts say most of those ATM inflows to Cryptex are bitcoin ATM cash deposits from customers of carding websites like BriansClub and Jokers Stash.

Treasury’s Financial Crimes Enforcement Network (FinCEN) levied sanctions today against PM2BTC under a powerful new “Section 9714” authority include…

This is the story of a couple who recently lost more than $50,000 to an ongoing timeshare scam that spans at least two dozen phony escrow, title and realty firms.

Mrs. Dimitruk even sent them a $5,000 wire to pay off her remaining balance on the timeshare they thought they were selling.

The FBI warns the timeshare fraud schemes have been linked to the Jalisco New Generation drug cartel in Mexico.

But after acknowledging it could help prevent harm to other would-be victims, Mr. Dimitruk said he would consider it.

If you are the victim of a timeshare scam like this, please consider filing a report with the FBI’s Internet Crime Complaint Center (IC3), at ic3.gov.

Many GitHub users this week received a novel phishing email warning of critical security holes in their code.

While it’s unlikely that many programmers fell for this scam, it’s notable because less targeted versions of it are likely to be far more successful against the average Windows user.

A reader named Chris shared an email he received this week that spoofed GitHub’s security team and warned: “Hey there!

Step 3 — pressing the “Enter” key — causes Windows to launch a PowerShell command, and then fetch and execute a malicious file from github-scanner[.

Still, it wouldn’t hurt to share this article with the Windows users in your life who fit the less-savvy profile.

Scammers are flooding Facebook with groups that purport to offer video streaming of funeral services for the recently deceased.

George said their friend’s funeral service page on Facebook included a link to the supposed live-streamed service at livestreamnow[.

]com, which displays links to multiple funeral service streaming groups on Facebook.

for a town social event this summer called Plympton Night Out was quickly made into two different Facebook groups that informed visitors they could stream the festivities at either espnstreamlive[.

The “browser history” folder from the admin of Apkdownloadweb shows Khondokar recently left a comment on the Facebook page of Mohammod Mehedi Hasan, and Kh…

Top Com members are constantly sniping over who pulled off the most impressive heists, or who has accumulated the biggest pile of stolen virtual currencies.

Some of the largest such known groups include CVLT, Court, Kaskar, Leak Society, 7997, 8884, 2992, 6996, 555, Slit Town, 545, 404, NMK, 303, and H3ll.

“The abuse perpetrated by members of com groups is extreme,” Wired’s Ali Winston wrote.

Beige group members also have claimed credit for a breach at the domain registrar GoDaddy.

Prosecutors allege Kalana Limkin, 18, of Hilo, Hawaii, admitted he was an associate of CVLT and 764, and that he was the founder of a splinter harm group called Cultist.

Microsoft Corp. today released updates to fix at least 79 security vulnerabilities in its Windows operating systems and related software, including multiple flaws that are already showing up in active attacks.

Microsoft also corrected a critical bug that has caused some Windows 10 PCs to remain dangerously unpatched against actively exploited vulnerabilities for several months this year.

Those include Windows 10 systems that installed the monthly security update for Windows released in March 2024, or other updates released until August 2024.

“To correct this issue, users need to apply both the September 2024 Servicing Stack Update and the September 2024 Windows Security Updates,” Narang sai…

The missive threatens to release the video to all of your contacts unless you pay a Bitcoin ransom.

In this case, the ransom demand is just shy of $2,000, payable by scanning a QR code embedded in the email.

Following a salutation that includes the recipient’s full name, the start of the message reads, “Is visiting [recipient’s street address] a more convenient way to contact if you don’t take action.

Nice location btw.” Below that is the photo of the recipient’s street address.

Previous innovations in sextortion customization involved sending emails that included at least one password they had previously used at an account online that was tied to their email address.

]agency, a once popular online service that helped attackers intercept the one-time passcodes (OTPs) that many websites require as a second authentication factor in addition to passwords.

Launched in November 2019, OTP Agency was a service for intercepting one-time passwords needed to log in to various websites.

KrebsOnSecurity profiled OTP Agency in a February 2021 story about arrests tied to another phishing-related service based in the U.K.

Within hours of that publication, OTP Agency shuttered its website and announced it was closing up shop and purging its user database.

NCA investigators said more than 12,500 people were targeted by OTP Agency users during the 18 month the service was…

“We have you in our records as not registered to vote,” the unbidden SMS advised.

WDIV even interviewed a seventh-grader from Canada who said he also got the SMS saying he wasn’t registered to vote.

Another version of this SMS campaign told recipients to check their voter status at a site called votewin.org, which DomainTools says was registered July 9, 2024.

The same voter registration query form advertised in the SMS messages is available if one clicks the “check your registration status” link on voteamerica.org.

Cleaver said her office had received several inquiries about the messages, which violate a key tenet of election outreach: Never tell the recipient what their voter status may be.

This website is using a security service to protect itself from online attacks.

The action you just performed triggered the security solution.

There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data.

You can email the site owner to let them know you were blocked.

Please include what you were doing when this page came up and the Cloudflare Ray ID found at the bottom of this page.

All this and more is discussed in the latest edition of the “Smashing Security” podcast by cybersecurity veterans Graham Cluley and Carole Theriault.

Smashing Security listeners get $1000 off!

Support the show:You can help the podcast by telling your friends and colleagues about “Smashing Security”, and leaving us a review on Apple Podcasts or Podchaser.

Follow us:Follow the show on Twitter at @SmashinSecurity, or on the Smashing Security subreddit, or visit our website for more episodes.

Follow Graham Cluley on Twitter, Mastodon, or Threads to read more of the exclusive content we post.

This website is using a security service to protect itself from online attacks.

The action you just performed triggered the security solution.

There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data.

You can email the site owner to let them know you were blocked.

Please include what you were doing when this page came up and the Cloudflare Ray ID found at the bottom of this page.

In episode 20 of “The AI Fix”, Mark asks an AI to make a very important decision, the Nobel academy finds a bandwagon, Graham gets a new nickname, a pair of robots prove that AI can’t do humour, and our hosts find out why emotional support insects haven’t taken off.

Graham introduces Mark to Optimus, the robot that can’t be trusted to fold a t-shirt, and Mark introduces Graham to an AI Fix super fan.

All this and much more is discussed in the latest edition of “The AI Fix” podcast by Graham Cluley and Mark Stockley.

Hosts:Graham Cluley – @gcluleyMark Stockley – @markstockleyEpisode links:Support the show:You can help the podcast by telling your friends and colleagues about “The AI Fix”, and…

This website is using a security service to protect itself from online attacks.

The action you just performed triggered the security solution.

There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data.

You can email the site owner to let them know you were blocked.

Please include what you were doing when this page came up and the Cloudflare Ray ID found at the bottom of this page.

All this and more is discussed in the latest edition of the “Smashing Security” podcast by cybersecurity veterans Graham Cluley and Carole Theriault.

Smashing Security listeners get $1000 off!

Support the show:You can help the podcast by telling your friends and colleagues about “Smashing Security”, and leaving us a review on Apple Podcasts or Podchaser.

Follow us:Follow the show on Twitter at @SmashinSecurity, or on the Smashing Security subreddit, or visit our website for more episodes.

Follow Graham Cluley on Twitter, Mastodon, or Threads to read more of the exclusive content we post.

In episode 19 of “The AI Fix” podcast, Graham and Mark discover some AI podcast hosts having an existential crisis, a robot dog climbs another step towards world domination, Mark makes a gift for anyone working in tech support, and William Shatner chews through Lucy in the Sky with Diamonds.

All this and much more is discussed in the latest edition of “The AI Fix” podcast by Graham Cluley and Mark Stockley.

Hosts:Graham Cluley – @gcluleyMark Stockley – @markstockleyEpisode links:Support the show:You can help the podcast by telling your friends and colleagues about “The AI Fix”, and leaving us a review on Apple Podcasts or Podchaser.

Follow us:Follow the show on Twitter at @TheAIFix, subscri…

This website is using a security service to protect itself from online attacks.

The action you just performed triggered the security solution.

There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data.

You can email the site owner to let them know you were blocked.

Please include what you were doing when this page came up and the Cloudflare Ray ID found at the bottom of this page.

The UK's Sellafield nuclear waste processing and storage site has been fined £332,500 by regulators after its IT systems were found to have been left vulnerable to hackers and unauthorised access for years.

The Office for Nuclear Regulation (ONR) described the Sellafield site as "one of Europe's largest industrial complexes, managing more radioactive waste in one place than any other nuclear facility in the world."

These included a failure by Sellafield to ensure there was adequate protection of sensitive nuclear information on its network.

“We take cyber security extremely seriously at Sellafield, as reflected in our guilty pleas," said Sellafield spokesperson Matt Legg.

“We’ve already mad…

This website is using a security service to protect itself from online attacks.

The action you just performed triggered the security solution.

There are several actions that could trigger this block including submitting a certain word or phrase, a SQL command or malformed data.

You can email the site owner to let them know you were blocked.

Please include what you were doing when this page came up and the Cloudflare Ray ID found at the bottom of this page.

All this and more is discussed in the latest edition of the award-winning “Smashing Security” podcast by computer security veterans Graham Cluley and Carole Theriault.

Smashing Security listeners get $1000 off!

Support the show:You can help the podcast by telling your friends and colleagues about “Smashing Security”, and leaving us a review on Apple Podcasts or Podchaser.

Follow us:Follow the show on Twitter at @SmashinSecurity, or on the Smashing Security subreddit, or visit our website for more episodes.

Follow Graham Cluley on Twitter, Mastodon, or Threads to read more of the exclusive content we post.

Mark discovers what Darth Vader really said on Cloud City, Graham rummages through ChatGPT’s false memories, and our hosts find out why AIs need an inner critic.

All this and much more is discussed in the latest edition of “The AI Fix” podcast by Graham Cluley and Mark Stockley.

Hosts:Graham Cluley – @gcluleyMark Stockley – @markstockleyEpisode links:Support the show:You can help the podcast by telling your friends and colleagues about “The AI Fix”, and leaving us a review on Apple Podcasts or Podchaser.

Follow us:Follow the show on Twitter at @TheAIFix, subscribe for free in your favourite podcast app such as Apple Podcasts or Spotify, or visit our website for more information.

Follow Grah…

39-year-old Robert Westbrook is said to have used genealogy websites to gather personal information about company executives, which he then used to break into their email accounts and steal confidential corporate data.

This insider information, it is alleged, was then used by Westbrook to generate over $3 million by making profitable trades on the stock market before it became known to the general public.

Despite Westbrook's efforts to conceal his identity through the use of VPNs, anonymous email accounts, and cryptocurrency payments, his alleged scheme was ultimately uncovered by experts at the SEC.

According to reports, Westbrook is also said to have subscribed to at least five CAPTCHA-so…

The chair of the United States Foreign Relations Committee was targeted by a sophisticated deepfake operation which impersonated a top Ukrainian official in what was an apparent attempt at election interference.

The office of Ben Cardin, the Democratic Senator for Maryland, reportedly received an email on Thursday September 19 from someone claiming to be former Ukrainian Foreign Affairs Minister Dmytro Kuleba, requesting a Zoom call.

According to Punchbowl News, which first reported the news, Senator Cardin and his staff were faced with bizarre questions such as "Do you support long-range missiles into Russian territory?

The security office warning sent to senior Senate staff underlined tha…

If you believed some of the news headlines in the UK on Thursday, you would think that something much more serious had happened.

Yes, it is true that the public Wi-Fi systems at 19 UK railways stations was hacked this week.

The hackers could have made a bogus login page and attempted to steal personal identifiable information and passwords.

The hackers could have attempted to dupe travellers into believing they had won a lottery or promoted a cryptocurrency scam.

The hackers could even have displayed a fake payment page and attempted to grift a few pounds from commuters.

Обучив ИИ на примерах фишинговых писем, вредоносных файлов и опасного поведения приложений, можно добиться приемлемого уровня обнаружения похожих угроз.

Обученный таким образом алгоритм не эффективен против принципиально новых атак, которые он «не видел» раньше.

Обучив ИИ на примерах фишинговых писем, вредоносных файлов и опасного поведения приложений, можно добиться приемлемого уровня обнаружения угроз.

Обученный таким образом алгоритм не эффективен против принципиально новых атак, которые он «не видел» раньше.

Примеры: поиск несанкционированного использования учетных записей из необычных подсетей, детектирование аномального обращения к файловым серверам и их сканирования, поиск атак с исп…

Мы уже рассказывали, почему в приложениях для фитнеса перед началом использования обязательно нужно настроить конфиденциальность и приватность ваших персональных данных.

В остальных беговых приложениях настройки приватности не так многочисленны, как в Strava, — и по умолчанию они установлены в более жесткие значения (по крайней мере, для новых пользователей, регистрирующихся сейчас).

В приложении крупнейшего производителя спортивной одежды и обуви — Nike Run Club (версии для Android и iOS) — настройки приватности спрятаны так, что может быть не вполне очевидно, как до них добраться.

Для этого зайдите в пункт Не продавать и не передавать мои персональные данные и переведите переключатель ряд…

В ней злоумышленник упоминает, что если жертва не свяжется с атакующим для оплаты молчания, он придет обговорить этот вопрос лично.

«С вами сделали дипфейк»Эта относительно новая версия мошенничества неплохо работает на тех, кто уверен, что компрометирующих видео с ним не существует.

«Вас посадят в тюрьму»Разновидностью sextortion можно считать и мошеннические письма, в которых получателя обвиняют в хранении детского порно.

Мошенники отправляют однотипные письма миллионами и ничего не делают — и не могут сделать!

Исключением является ситуация, когда вы лично знаете отправителя или прямо к письму приложены настоящие компрометирующие снимки и видео.

Как устроены фишинговые атаки с письмами якобы от DocusignАтака начинается с электронного письма, обычно оформленного в стилистике Docusign.

Настоящие письма от Docusign не имеют вложений и содержат кнопку Review document прямо в теле письма.

Настоящие письма от Docusign не имеют вложений и содержат кнопку Review document прямо в теле письма.

Вся необходимая Docusign информация содержится в уникальной ссылке, которую сервис присылает в письме, поэтому от рядового подписанта Docusign не требует проходить аутентификацию.

Как защититься от фишингаЧтобы защитить вашу организацию от фишинговых писем, рассылаемых как от имени Docusign, так и от других популярных сервисов, полезно принять следующи…

Strava (версии для Android и iOS) — вероятно, самое популярное приложение для отслеживания тренировок по бегу, велоспорту и просто пеших прогулок.

Но это можно исправить — благо, в Strava есть довольно много настроек приватности.

Учтите, что настройки приватности в Strava не ретроактивны.

Зайдите в пункт Использование агрегированных данных и передвиньте в выключенное положение переключатель рядом с Вносить данные о тренировках в наборы обезличенных агрегированных данных.

И не забудьте подписаться на наш блог, чтобы не пропустить другие инструкции и полезные статьи и всегда быть на полкруга впереди мошенников.

Приложения для фитнеса в силу своей природы имеют доступ к большому количеству персональных данных, особенно те, которые отслеживают разнообразные активности на свежем воздухе, в первую очередь — бег.

И не стоит думать, что уж вы-то точно не заинтересуете мошенников настолько, чтобы устраивать сложную атаку.

Так что к выбору приложения для трекинга бега и настройке его конфиденциальности стоит подойти максимально осознанно — и в этом вам помогут наши советы.

Как и в случае с любыми другими приложениями, стоит воспользоваться возможностями операционной системы вашего смартфона для минимизации слежки за вами.

Настройки приватности популярных беговых приложенийМы отобрали наиболее популярные б…

Но иногда бывает и иначе: вам приходит сообщение с кодом двухфакторной аутентификации от некоего сервиса… вот только аккаунта в этом сервисе у вас нет и никогда не было.

Вернее, вам не о чем волноваться, если вы не собираетесь заводить аккаунт в данном сервисе.

Чего делать НЕ стоитТеперь о том, чего делать категорически не следует: ни в коем случае не пытайтесь использовать приходящие вам одноразовые коды для входа в не принадлежащий вам аккаунт.

Поэтому самая правильная реакция на SMS с одноразовым кодом для входа в аккаунт, который вам не принадлежит, — попросту игнорировать сообщение.

И ни в коем случае не пытаться войти в чужой аккаунт, чтобы не обрести на свою голову ненужные приключен…

Зачем вообще нужны стандартыЕсли вы хорошо понимаете основные принципы стандартизации в электронике, то можете пропустить этот раздел и перейти к следующему.

Но в конкретной стране в рамках местных законов могут запретить продажу, например, электротехники, не соответствующей местным или международным стандартам.

Также стандарты описывают обязательные меры безопасности и порядок их реализации — как в физических аспектах устройств, так и в программных.

Этот документ отвечает на вопрос о том, как доказать, что IoT-устройство безопасно, а не просто положиться на заявления производителя.

Среди них будут простые и эффективные меры, например безопасные настройки по умолчанию и продолжительный, зар…

По решению компании Google наши приложения для защиты устройств на базе Android в настоящее время недоступны в официальном магазине приложений Google Play.

Это решение Google основано на недавнем запрете правительства США на распространение и продажу продуктов «Лаборатории Касперского» в Соединенных Штатах после 29 сентября 2024 года.

Что будет с уже установленными из Google Play приложениями?

Все наши приложения, установленные из Google Play на Android-устройства, продолжат нормально работать.

На официальной странице нашей технической поддержки есть подробная статья с актуальными ссылками на все магазины приложений, в которых мы представлены, и на прямое скачивание APK-файлов, плюс инструк…

Как устроен ввод информации в Apple visionOSСперва немного поговорим о том, как вообще устроен ввод информации в visionOS — операционной системе, на базе которой работает Apple Vision Pro.

Одной из наиболее впечатляющих инноваций гарнитуры смешанной реальности Apple стало чрезвычайно эффективное использование окулографии, то есть отслеживания движения глаз пользователя.

Вторая важная особенность AR-гарнитуры Apple — в способе реализации видеозвонков с участием пользователя Vision Pro.

Поэтому в Apple придумали чрезвычайно оригинальную технологию, в которой используется так называемая виртуальная камера.

На основе 3D-скана лица пользователя Vision Pro создает его цифровой аватар (в Apple наз…

Попробуем разобраться, почему так происходит и как школам правильно защищать свои компьютеры.

Образовательные учреждения быстро цифровизируются и, как следствие, все больше зависят от ИТ-инфраструктуры — как непосредственно в учебном процессе, так и в административной работе.

Образовательные учреждения быстро цифровизируются и, как следствие, все больше зависят от ИТ-инфраструктуры — как непосредственно в учебном процессе, так и в административной работе.

В образовательных учреждениях наблюдается серьезная нехватка бюджетов, а также квалифицированных ИТ-специалистов — и в особенности в сфере информационной безопасности.

Как правильно защитить школу от кибератакКак правильно подойти к вопрос…

Одна из ведущих организаций, занимающихся сертификацией специалистов в области ИБ, — ISC2 — публикует ежегодные отчеты о состоянии дел с трудовыми ресурсами в кибербезопасности.

Кибербезопасность в высшем образованииЧтобы получить ответ на этот вопрос, мы провели масштабное исследование, в ходе которого опросили более 1000 профессионалов в сфере ИТ и кибербезопасности из 29 стран мира.

Основная проблема формального образования в сфере кибербезопасности состоит в том, что оно категорически не успевает за теми изменениями, которые происходят в реальном мире.

Решение проблемы дефицита кадров в ИБРазумеется, проблема недостатка кадров в сфере кибербезопасности слишком масштабна, чтобы для нее с…

Поэтому для информации, которая важна лично вам, нужно организовывать запасное хранилище и защищать его от шифровальщиков и шпионского ПО.

Как следует обдумайте, что в цифровом мире для вас важно и ценно — и где оно хранится.

Просто скачать файлы себе на дискПрямолинейный и простой способ для фотографий, офисных документов и других файлов, хранящихся онлайн и легко открывающихся на компьютере.

Почитайте помощь и изучите настройки, чтобы узнать, как и в каком формате экспортируются данные.

В некоторых странах и регионах право пользователя скачать свои данные и перенести их в другой сервис (data portability) закреплено законодательно: в их числе Евросоюз, Индия и Бразилия, штат Калифорния в С…

В случае атаки RAMBO вредоносное программное обеспечение инициирует запись данных в оперативную память.

Осталось выбрать наиболее подходящую частоту и на ней уже передавать данные, используя один из доступных методов кодирования.

Поэтому в данной работе Мордехай Гури рассматривает ситуацию, когда эксфильтрация данных происходит ночью: компьютер (и монитор) работают, но в помещении никого нет.

Атака PIXHELL выглядит менее надежной, но и защититься от такой атаки сложно, разве что принудительно наполнять помещение случайным шумом, делая атаку невозможной.

Но, как и в других подобных случаях, крайне важным является предотвращение запуска нежелательного ПО.

Built-in security: QUIC integrates Transport Layer Security (TLS) to provide encrypted connections by default, improving both privacy and security.

Reimagining Zero Trust: Powering a secure, in-office experience, for an anywhere workplaceZero Trust Access by Cisco is available easily via our User Protection Suite licensing, which includes Cisco Secure Access.

With the industry-leading technologies outlined in this blog post and an identity-first approach, Cisco Zero Trust Access (and Cisco Secure Access) provides an easy-to-manage and deploy SSE platform.

Discover more about Cisco Zero Trust Access, and how it can transform your security approach, by registering for an upcoming workshop or …

After a rigorous evaluation of 10 firewall solution vendors, Cisco was named a Leader in The Forrester Wave™: Enterprise Firewall Solutions, Q4 2024 report.

Reading the report, Forrester noted the following in Cisco’s vendor profile that we are particularly proud of.

Cisco: The only Enterprise Firewall Solutions leader to also be named a leader in The Forrester Wave™: Microsegmentation Solutions, Q3 2024While we are incredibly excited to be named a Leader in Enterprise Firewall Solutions, we are equally ecstatic about what we feel this says about how we are addressing segmentation holistically.

Or, learn more about Cisco’s firewall and other security solutions.

Cisco Security Social Channel…

Enter Gatekeeper — a powerful tool designed to manage and implement policies across your EKS clusters, making cross-functional collaboration secure and efficient.

Policy as Code: With Gatekeeper, policies are managed as code, making them version-controlled and auditable.

Using Kubernetes namespaces and Gatekeeper policies, each BU can operate independently within its environment, all while sharing the same EKS infrastructure.

Restricted Access : Gatekeeper policies restrict access between namespaces.

Gatekeeper Policy Enforcement: Gatekeeper policies enforce access control and ensure that operations are restricted to the appropriate namespace.

These days, email security is more critical than ever.

Cisco’s innovative approach to email securityAt Cisco, we continue to innovate in the field of email security by leveraging Machine Learning (ML) and Deep Learning (DL) models.

Email security faces the additional challenge of scale, processing millions of images, URLs, files, QR codes and other objects.

You can see these suspicious images and other signals flagged in Email Threat Defense by starting a free trial today.

Ask a Question, Comment Below, and Stay Connected with Cisco Security on social!

Cisco Secure Endpoint Visionary StatusWe are pleased to announce that Cisco has been named a Visionary in the 2024 Gartner Magic Quadrant for Endpoint Protection Platforms.

Secure Endpoint integrates with Cisco XDR for correlation of telemetry across multiple Cisco + 3rd-party sources — network, cloud, endpoint, email, identity and applications.

Network Behavior Analysis: Secure Endpoint provides endpoint activity data to Cisco Secure Network Analytics, enhancing the ability to detect and respond to anomalous network behavior.

Secure Endpoint provides endpoint activity data to Cisco Secure Network Analytics, enhancing the ability to detect and respond to anomalous network behavior.

Cisco Se…

At Cisco, we have been helping government agencies of all sizes address their unique security and compliance challenge for decades.

Our commitment to delivering modernized securityThe Cisco Security Cloud aims to deliver an open, integrated security platform for multi-cloud environments, and Cisco is committed to helping customers meet stringent federal requirements while enhancing security, reducing risks and speeding up deployment.

The following three Cisco Security products have met or are undergoing the FedRAMP authorization process:Cisco Umbrella for GovernmentMost recently, Cisco Umbrella for Government has achieved the Federal Risk and Authorization Management Program FedRAMP Moderat…

It grants the ability to version-control and continuously integrate, ensuringthat security updates are just as agile as software updates.

It grants the ability to version-control and continuously integrate, ensuringthat security updates are just as agile as software updates.

Regular Audits: Periodic security audits assure continuous security and adherence to recent governmental regulations such as GDPR and HIPAA.

Periodic security audits assure continuous security and adherence to recent governmental regulations such as GDPR and HIPAA.

DevOps Security Integration Roadmap: This illustrates the path from initial implementation to advanced security leadership within DevOps practices.

We are excited to announce the launch of the Cisco AI Security Portal.

What’s inside the AI Security Portal?

AI Security Reference ArchitecturesAccess detailed reference architectures from Robust Intelligence that provide blueprints for building secure AI systems.

Defining Artificial Intelligence Security VulnerabilitiesGain a deeper understanding of the definition of AI Security Vulnerabilities.

Get started todayWe invite you to explore the AI Security Portal and take advantage of the resources available.

In parallel, the National Security Agency (NSA) issued the Commercial National Security Algorithm version two (CNSA 2.0), which requires companies and government agencies working with National Security Systems (NSS) to implement accepted quantum-safe encryption by 2030.

Protecting Yourself Today and TomorrowSecurity professionals feel confident that the NIST PQC and CNSA 2.0 algorithms will deliver quantum-safe encryption.

Using existing encryption and key management technologies, enterprises can realize quantum-safe encryption today without waiting for implementations using the NIST or CNSA 2.0 algorithms.

There are three methods for accomplishing this goal today:Manually pre-provisioned k…

It is equally important to manage software updates in our personal lives and homes.

Installing software updates are important for several reasons.

New Features: Software updates can also bring new features and functionality.

Regularly Check for Updates: If you prefer not to enable automatic updates, make it a habit to regularly check for updates.

To wrap up, regularly installing software updates is a simple yet important step in maintaining the security, performance, and functionality of your personal devices.

Today, we wanted to share some exciting improvements related to open-source security that our development teams are now able to leverage.

Corona also provides validation of applicable security posture characteristics within released Cisco software through forensic analysis of software components and associated risks.

This new data source is provided by Tidelift, a company that partners directly with open-source maintainers to implement and validate industry-leading secure software development practices.

Cisco developers can quickly review recommended versions of packages in application languages such as Java, JavaScript and Python.

Our developers also have a more comprehensive view of risk,…

In cybersecurity, endpoint telemetry refers to data collected by monitoring activities on endpoint devices, such as computers and servers.

Endpoint telemetry also serves as a crucial data source for XDR, enhancing its ability to detect, analyze and respond to security threats across multiple environments.

Capturing telemetry using Cisco Secure EndpointCisco Secure Endpoint is an Endpoint Detection and Response (EDR) tool that collects and records a wide range of endpoint telemetry.

Device trajectory telemetryCisco Secure Endpoint (CSE) captures two types of telemetry under Device Trajectory view: Activity Telemetry and Behavioral Telemetry.

ConclusionThe exploration of Cisco Secure Endpoint…

But it’s not, thanks to password reuse (also called password recycling), and passwords created with common words, phrases and patterns.

Essentially, if you can find the word in a dictionary, it likely isn’t going to make a good password.

In fact, attempting to guess a 12-character truly random password can take 54 days or so on SHA1, even longer on SHA3.

At the end of the day, a password manager means no more password recycling, and no more easily guessed words or phrases.

For now, if your password manager offers to enable this option of defense (most do), you should take advantage and enable it.

The Black Hat Network Operations Center (NOC) provides a high-security, high-availability network in one of the most demanding environments in the world: the Black Hat event.

We appreciate alphaMountain.ai, Pulsedive and Recorded Future donating full licenses to the Black Hat USA 2024 NOC.

Compare this to Black Hat 2024, just a few months later, where the total number has jumped to 194.

The deployment was further improved and streamlined at Black Hat London and Black Hat Asia.

Mobile device management at Black Hat: The role of Meraki Systems ManagerBy: Dalton RossThe Black Hat cybersecurity event in Las Vegas is renowned for its cutting-edge technology and seamless attendee experience.

After a rigorous evaluation of 11 microsegmentation vendors, Cisco was named a Leader in The Forrester Wave™: Microsegementation Solutions, Q3 2024 report.

This approach provides complete visibility, faster detection and mitigation of security threats, without a patchwork of security products.

Secure Workload segments customers’ applications and networks agentlessly with Cisco Secure Firewall and cloud firewalls.

Cisco continues to innovate in microsegmentation through its world-class solution, acquisitions and technology investments.

Below are the innovations and acquisitions Cisco has made since the last Microsegmentation Wave in 2022:Secure Firewall integration, enabling firewall policy …

The most important part that usually requires TCC camera access is:Figure 3.

Note how TCC access for Camera is not permitted, as well as Safari-specific controls do not automatically allow Camera access:Figure 5.

Google Chrome first asking TCC access to the microphone via a “true” TCC popup that works at the app level.

ReferencesJonathan Bar OrMicrosoft Threat IntelligenceLearn moreFor the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog: https://aka.ms/threatintelblog.

To hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape, listen to the Microsoft Threa…

Specifically:Russian threat actors appear to have outsourced some of their cyberespionage operations to criminal groups, especially operations targeting Ukraine.

Iranian nation-state actors used ransomware in a cyber-enabled influence operation, marketing stolen Israeli dating website data.

We believe these domains are examples both of cybercriminal activity driven by profit and of reconnaissance by nation-state threat actors in pursuit of political goals.

Financially motivated cybercrime and fraud remain a persistent threatWhile nation-state attacks continue to be a concern, so are financially motivated cyberattacks.

However, those norms so far lack meaningful consequence for their violati…

This blog explains Kerberoasting risks and provides recommended actions administrators can take now to help prevent successful Kerberoasting cyberattacks.

Once the cyberthreat actor has credentials to the service account, they potentially gain more privileges within the environment.

Services that run as AD machine accounts instead of as standalone service accounts are better protected against compromise using Kerberoasting.

Delegated Managed Service Accounts (dMSA) are the newest iteration of managed service accounts available on Windows Server 2025.

Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

According to data from Microsoft Threat Intelligence, the education sector is the third-most targeted industry, with the United States seeing the greatest cyberthreat activity.

A new security curriculumDue to education budget and talent constraints and the inherent openness of its environment, solving education security is more than a technology problem.

He’s worked on securing everything from federal, state, and local agencies to commercial enterprises, but today he focuses on the education sector.

The dynamics at play inside the education sector include academic institutions, financial services, critical infrastructure like hospitals and transportation, and partnerships with government ag…

Microsoft has observed campaigns misusing legitimate file hosting services increasingly use defense evasion tactics involving files with restricted access and view-only restrictions.

After compromising the trusted vendor, the threat actor hosts a file on the vendor’s file hosting service, which is then shared with a target organization.

In scenarios involving SharePoint or OneDrive, the file is shared from the user’s context, with the compromised user’s email address as the sender.

Identity compromiseWhen the targeted user accesses the shared file, the user is prompted to verify their identity by providing their email address:Figure 2.

To hear stories and insights from the Microsoft Threat …

In order to prove the solution’s business benefits, Microsoft commissioned Forrester Consulting to conduct a Total Economic Impact™ (TEI) study.

Learn moreTo learn more about the business value of Microsoft Defender for Cloud, explore the Total Economic Impact™ Of Microsoft Defender for Cloud study for further analysis and findings, as well as the perspectives of Defender for Cloud users interviewed in the study.

Also, register for the webinar featuring Forrester on top cloud security trends, key considerations, and quantifying the business value of CNAPP.

Learn more about Microsoft Cloud Security Solutions.

To learn more about Microsoft Security solutions, visit our website.

As Cybersecurity Awareness Month marks its 21st year, it’s clear that this year stands out.

Empower everyone to be a cybersecurity champion Help educate everyone in your organization with cybersecurity awareness resources and training curated by the security experts at Microsoft.

The Be Cybersmart Kit is a great starting point, and it’s just one of the many resources Microsoft has put together on its Cybersecurity Awareness site.

And for students pursuing the field of cybersecurity, the Microsoft Cybersecurity Scholarship Program and many more educational opportunities are here to help.

“CISA is excited to lead the federal government’s efforts to reduce online risk during this 21st Cybersec…

Microsoft Entra Connect Sync is a component of Microsoft Entra Connect that synchronizes identity data between on-premises environments and Microsoft Entra ID.

Microsoft recently implemented a change in Microsoft Entra ID that restricts permissions on the Directory Synchronization Accounts (DSA) role in Microsoft Entra Connect Sync and Microsoft Entra Cloud Sync and helps prevent abuse.

This backdoor enables an attacker to sign in as any user of the Microsoft Entra ID tenant in hand if the Microsoft Entra ID user property ImmutableId is known or set by the attackers.

Mitigation and protection guidanceMicrosoft recently implemented a change in Microsoft Entra ID that restricts permissions on…

We are excited to announce that Gartner has named Microsoft a Leader in the 2024 Gartner® Magic Quadrant™ for Endpoint Protection Platforms for the fifth consecutive time.

Recognizing that sophisticated cyberthreats go beyond the endpoint, Microsoft offers Microsoft Defender Experts for XDR.

Learn moreIf you’re not yet taking advantage of Microsoft’s leading endpoint security solution, visit Microsoft Defender for Endpoint and start a free trial today to evaluate our leading endpoint protection platform.

Gartner, Magic Quadrant for Endpoint Protection Platforms, Evgeny Mirolyubov, Franz Hinner, Deepak Mishra, Satarupa Patnaik, Chris Silva, September 23, 2024.

Gartner research publications c…

This week, teams across Microsoft Fabric and Microsoft Purview are gathered in Stockholm, Sweden, for the inaugural European Microsoft Fabric Community Conference.

CluedIn brings native master data management and Data Quality functionality to Microsoft Fabric, Microsoft Purview, and the Azure stack.

brings native master data management and Data Quality functionality to Microsoft Fabric, Microsoft Purview, and the Azure stack.

Semarchy combines master data management, data intelligence, and data integration into a singular application in any environment.

combines master data management, data intelligence, and data integration into a singular application in any environment.

Building on those, today we’re announcing two new capabilities:Evaluation s in Azure AI Studio to support proactive risk assessments.

capability in Microsoft Azure AI Content Safety’s Groundedness detection feature that helps fix hallucination issues in real time before users see them.

Protected Material Detection for Code is now in preview in Azure AI Content Safety to help detect pre-existing content and code.

Muse Chat uses content-filtering models in Azure AI Content Safety to ensure responsible use of the software.

Related:CommitmentsCapabilitiesTags: AI, Azure AI Content Safety, Azure AI Studio, Azure Confidential Computing, Azure OpenAI Service, Copilot, GitHub, Microsoft 365, Micros…

In May 2024, we expanded the initiative to focus on six key security pillars, incorporating industry feedback and our own insights.

Since the initiative began, we’ve dedicated the equivalent of 34,000 full-time engineers to SFI—making it the largest cybersecurity engineering effort in history.

To ensure accountability and transparency at the highest levels, Microsoft’s senior leadership team reviews SFI progress weekly and updates are provided to Microsoft’s Board of Directors quarterly.

SFI Progress Report Discover the key updates and milestones from the first SFI Progress Report.

Read the report​​Learn moreTo learn more about Microsoft Security solutions and Microsoft’s Secure Future Init…

Register nowMicrosoft Security at Microsoft Ignite: An expanded experienceWe’re excited to welcome back security leaders and other security professionals to Microsoft Ignite.

The Microsoft Ignite Security Forum is for businesses of all sizes to hear from Microsoft security experts on threat intelligence insights, learnings, and trends in security.

Register for Microsoft Ignite today and add on the Microsoft Ignite Security Forum.

Date Topic Description Monday, November 18, 2024 Microsoft Ignite Security Forum Join us one day early at Microsoft Ignite for a security-only program, designed for decision makers from businesses of all sizes.

Register now for Microsoft Ignite 2024You won’t want t…

End-to-end security focuses on fully securing your entire digital estate pre- and post-breach, with management, mitigation, and assessment capabilities.

End-to-end security is a comprehensive and proactive approach to protecting your environment that is grounded in a Zero Trust security strategy.

ING consolidated a fragmented, complicated mix of security tools into an end-to-end security approach for better protection of their private, public, and multicloud environments.

And end-to-end security paves the way for security assessments of your resources and other benefits of continuous posture management.

It’s been a leap in our security maturity level.”Explore how adopting end-to-end securit…

The FudModule rootkit described in this blog has now been tied to Citrine Sleet as shared tooling with Diamond Sleet.

Exploiting CVE-2024-7971The observed zero-day exploit attack by Citrine Sleet used the typical stages seen in browser exploit chains.

Strengthen Microsoft Defender Antivirus configurationTurn on cloud-delivered protection in Microsoft Defender Antivirus, or the equivalent for your antivirus product, to help cover rapidly evolving attacker tools and techniques.

For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog: https://aka.ms/threatintelblog.

To hear stories and insights from the Microsoft Threa…

Our internal analysis estimates that 75% of CVEs used in zero-day exploits are memory safety vulnerabilities.

Our Secure by Design commitment emphasizes integrating security considerations, including robust memory safety practices, throughout the entire software development lifecycle.

This post builds upon our previously reported Perspective on Memory Safety, and introduces our strategic approach to memory safety.

By open-sourcing these tools, we've empowered developers worldwide to reduce the likelihood of memory safety vulnerabilities in C and C++ codebases.

Migration to Memory-Safe Languages (MSLs)The first pillar of our strategy is centered on further increasing the adoption of memory-s…

Situations like Janine’s highlighted the need for a comprehensive solution to phone theft that exceeded existing tools on any platform.

These advanced theft protection features are now available to users around the world through Android 15 and a Google Play Services update (Android 10+ devices).

These theft protection features are just one example of how Android is working to provide real-world protection for everyone.

You can turn on the new Android theft features by clicking here on a supported Android device.

Learn more about our theft protection features by visiting our help center.

If only the whole tree of Chrome UI controls were exposed, somehow, such that we could enumerate and interact with each UI control automatically.

We need to amortize that cost over thousands of test cases by running a batch of them within each browser invocation.

Yet this is tricky, since Chrome UI controls are deeply nested and often anonymous.

This approach has proven to be about 80% as quick as the original ordinal-based mutator, while providing stable test cases.

If you’d like to follow along, keep an eye on our coverage dashboard as it expands to cover UI code.

Most smartphones use cellular baseband processors with tight performance constraints, making security hardening difficult.

The Cellular BasebandThe cellular baseband within a smartphone is responsible for managing the device's connectivity to cellular networks.

The firmware within the cellular baseband, similar to any software, is susceptible to bugs and errors.

For example, 0-day exploits in the cellular baseband are being used to deploy the Predator malware in smartphones.

Pixel's proactive approach to security demonstrates a commitment to protecting its users across the entire software stack.

The Chrome Security Team is constantly striving to make it safer to browse the web.

We invest in mechanisms to make classes of security bugs impossible, mitigations that make it more difficult to exploit a security bug, and sandboxing to reduce the capability exposed by an isolated security issue.

Historically the Chrome Security Team has made major investments and driven the web to be safer.

In the longer-term the Chrome Security Team advocates for operating system improvements like less-capable lightweight processes, less-privileged GPU and NPU containers, improved application isolation, and support for hardware-based isolation, memory safety and flow control enforcement.

Good Bugs and Ba…

Memory safety vulnerabilities remain a pervasive threat to software security.

We’ll also share updated data on how the percentage of memory safety vulnerabilities in Android dropped from 76% to 24% over 6 years as development shifted to memory safe languages.

This decision was driven by the increasing cost and complexity of managing memory safety vulnerabilities.

We first reported this decline in 2022, and we continue to see the total number of memory safety vulnerabilities dropping3.

As the number of memory safety vulnerabilities have dropped, the overall security risk has dropped along with it.

Arm Product Security and GPU TeamsArm has a central product security team that sets the policy and practice across the company.

Working together to secure Android devicesGoogle’s Android Security teams and Arm have been working together for a long time.

So “application ⇒ kernel ⇒ firmware ⇒ kernel” is a known attack flow in this area.

The Arm Product Security Team is actively involved in security-focused industry communities and collaborates closely with its ecosystem partners.

The Android Red Team and Arm continue to work together to proactively raise the bar on GPU security.

We previously posted about experimenting with a hybrid post-quantum key exchange, and enabling it for 100% of Chrome Desktop clients.

The hybrid key exchange used both the pre-quantum X25519 algorithm, and the new post-quantum algorithm Kyber.

As a result, the codepoint in TLS for hybrid post-quantum key exchange is changing from 0x6399 for Kyber768+X25519, to 0x11EC for ML-KEM768+X25519.

Post-quantum cryptography is too big to be able to offer two post-quantum key share predictions at the same time.

Longer term, we hope to avoid the chicken-and-egg problem for post-quantum key share predictions through our emerging IETF draft for key share prediction.

The Android team has discussed Rust for bare-metal firmware previously, and has developed training specifically for this domain.

The shim serves as a wrapper around the Rust library API, bridging the existing C API and the Rust API.

Choosing a Pre-Existing Crate (Rust Library)Picking the right open-source crate (Rust library) to replace the chosen component is crucial.

[no_std]#[cfg(feature = "std")] extern crate std; extern crate alloc;Then, iteratively fix all occurring compiler errors as follows:Move any use directives from std to either core or alloc.

Memory Safety for Firmware, TodayUsing the process outlined in this blog post, You can begin to introduce Rust into large legacy firmware…

As a pioneer in responsible AI and cutting-edge privacy technologies like Private Compute Core and federated learning, we made sure our approach to the assistant experience with Gemini on Android is aligned with our existing Secure AI framework, AI Principles and Privacy Principles.

From privacy on-device when handling sensitive data to the world’s best cloud infrastructure, here are six key ways we keep your information private and protected.

For some AI features, like Summarize in Recorder on Pixel, that benefit from additional data privacy or processing efficiency, we utilize on-device AI.

It can be thought of as extending the user’s device and its security boundaries into our cloud infr…

The National Institute of Standards and Technology (NIST) just released three finalized standards for post-quantum cryptography (PQC) covering public key encapsulation and two forms of digital signatures.

Here's a brief overview of what PQC is, how Google is using PQC, and how other organizations can adopt these new standards.

Practical large-scale quantum computers are still years away, but computer scientists have known for decades that a cryptographically relevant quantum computer (CRQC) could break existing forms of asymmetric key cryptography.

Google began testing PQC in Chrome in 2016 and has been using PQC to protect internal communications since 2022.

As we make progress on our own …

In particular, there is increasingly more evidence of the exploitation of weaknesses in cellular communication standards leveraging cell-site simulators to inject SMS phishing messages directly into smartphones.

The method is straightforward and replicates known techniques to trick mobile devices to an attacker-controlled 2G network.

Spreading SMS phishing messages commonly yields a small return as it is very difficult to get these messages to fly undetected by sophisticated anti-spam filters.

Android has built-in spam protection that helps to identify and block spam SMS messages.

We are constantly working to improve our security features and protect users from phishing, fraud, and other th…

Cybercriminals using cookie theft infostealer malware continue to pose a risk to the safety and security of our users.

We already have a number of initiatives in this area including Chrome’s download protection using Safe Browsing, Device Bound Session Credentials, and Google’s account-based threat detection to flag the use of stolen cookies.

Today, we’re announcing another layer of protection to make Windows users safer from this type of malware.

On Windows, Chrome uses the Data Protection API (DPAPI) which protects the data at rest from other users on the system or cold boot attacks.

In Chrome 127 we are introducing a new protection on Windows that improves on the DPAPI by providing Appli…

Last year, we introduced a redesign of the Chrome downloads experience on desktop to make it easier for users to interact with recent downloads.

Adding context and consistency to download warningsThe redesigned Chrome downloads experience gives us the opportunity to provide even more context when Chrome protects a user from a potentially malicious file.

Our legacy, space-constrained warning vs. our redesigned oneWe also made download warnings more understandable by introducing a two-tier download warning taxonomy based on AI-powered malware verdicts from Google Safe Browsing.

The Chrome Security team works closely with Safe Browsing, Google's Threat Analysis Group, and security researchers …

The Chrome Security Team prioritizes the security and privacy of Chrome’s users, and we are unwilling to compromise on these values.

The Chrome Root Program Policy states that CA certificates included in the Chrome Root Store must provide value to Chrome end users that exceeds the risk of their continued inclusion.

Apple policies prevent the Chrome Certificate Verifier and corresponding Chrome Root Store from being used on Chrome for iOS.

Website operators can determine if they are affected by this issue by using the Chrome Certificate Viewer.

Beginning in Chrome 127, enterprises can override Chrome Root Store constraints like those described for Entrust in this blog post by installing the …