A Startup With NSA Roots Wants Silently Disarming Cyberattacks on the Wire to Become the Norm

Trinity Cyber takes a new spin on some traditional network-security techniques, but can its approach catch on widely?

The post A Startup With NSA Roots Wants Silently Disarming Cyberattacks on the Wire to Become the Norm appeared first on Malware Devil.

https://malwaredevil.com/2021/05/11/a-startup-with-nsa-roots-wants-silently-disarming-cyberattacks-on-the-wire-to-become-the-norm/?utm_source=rss&utm_medium=rss&utm_campaign=a-startup-with-nsa-roots-wants-silently-disarming-cyberattacks-on-the-wire-to-become-the-norm

BloodHound Enterprise vs. BloodHound Open-Source

As we’re continuing to approach our summer launch, many of you have asked us for a simple breakdown of BloodHound Enterprise vs BloodHound free and open-source (FOSS). There’s quite a lot to detail as the two products are built around two completely different use cases for different target audiences — BloodHound FOSS is designed to identify Attack Paths to exploit, BloodHound Enterprise is designed to continuously and comprehensively manage Attack Path risk. However, we did our best to boil down everything in the table below for clarity.

We also recently did a webinar and live Q&A just covering the differences in data collection if you’re looking for more information on that topic specifically.

Missed our BloodHound Enterprise announcement webinar? You can also sign up to receive updates as we push them here.

BloodHound Enterprise vs. BloodHound Open-Source was originally published in Posts By SpecterOps Team Members on Medium, where people are continuing the conversation by highlighting and responding to this story.

Read More

The post BloodHound Enterprise vs. BloodHound Open-Source appeared first on Malware Devil.

https://malwaredevil.com/2021/05/11/bloodhound-enterprise-vs-bloodhound-open-source/?utm_source=rss&utm_medium=rss&utm_campaign=bloodhound-enterprise-vs-bloodhound-open-source

Webinar: Cybereason vs. DarkSide Ransomware

Colonial Pipeline was recently the victim of a devastating attack that shut down U.S. operations across the East Coast, threatening an already tenuous economic recovery effort. This attack against critical infrastructure by the DarkSide Ransomware gang highlights the urgent need for better ransomware prevention, detection and response.

The post Webinar: Cybereason vs. DarkSide Ransomware appeared first on Security Boulevard.

Read More

The post Webinar: Cybereason vs. DarkSide Ransomware appeared first on Malware Devil.

https://malwaredevil.com/2021/05/11/webinar-cybereason-vs-darkside-ransomware/?utm_source=rss&utm_medium=rss&utm_campaign=webinar-cybereason-vs-darkside-ransomware

Colonial Pipeline attack expected to trigger imminent hardening of cybersecurity rules for federal agencies

The ransomware attack on Colonial Pipeline last week caused the White House to hold emergency meetings to possibly strengthen a planned Executive Order on cybersecurity that could be released in the coming days or weeks, the New York Times reported.

The Executive Order–currently a draft–could place new restrictions on businesses that develop software and sell it to the federal government, such as the requirements to use multi-factor authentication and to access federal databases only when completely necessary. Such a strategy seemed like an appropriate response several months ago, when cybercriminals believed to be working with the Russian government infiltrated nine federal agencies by first hacking into the IT management company SolarWinds.

But the recent attack on Colonial Pipeline reveals that new rules meant only for federal contractors could still leave broad swaths of the American public at risk. Complicating the issue is that, while President Joe Biden has taken a harder stance against Russian cyberaggression than the past administration, the attack on Colonial Pipeline has no confirmed connection to the Russian government.

“I’m going to be meeting with President Putin, and so far there is no evidence based on, from our intelligence people, that Russia is involved, although there’s evidence that the actors’ ransomware is in Russia,” Biden said this week.

According to multiple reports of the planned Executive Order, companies that sell their products to the government could have to implement several new cybersecurity measures.

Such companies would have to use multi-factor authentication and they would have to encrypt data that belongs to federal government clients. The government would also begin using a “zero-trust” model with these contractors, meaning that such contractors would only gain access to federal systems on a “need-to-know” basis. Further, contractors would also have to notify government customers of any cyberbreach, bringing new transparency to the government about ongoing and increasingly frequent cybercrimes.

In speaking with Reuters, a spokeswoman for the National Security Council explained the importance of such a requirement, noting that the SolarWinds attack showed that “the federal government needs to be able to investigate and remediate threats to the services it provides the American people early and quickly.”

She continued: “Simply put, you can’t fix what you don’t know about.”

According to The New York Times, companies that violate these rules would have their products banned from being sold to the federal government. For many companies that count the federal government as their largest client, such a ban could serve as a revenue death knell.

Finally, the Executive Order could create a “cybersecurity incident review board” to investigate major cyberattacks in the US, and the Order could ask victims of cyberattacks to work with the FBI and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency when responding to attacks.

The post Colonial Pipeline attack expected to trigger imminent hardening of cybersecurity rules for federal agencies appeared first on Malware Devil.

https://malwaredevil.com/2021/05/11/colonial-pipeline-attack-expected-to-trigger-imminent-hardening-of-cybersecurity-rules-for-federal-agencies-5/?utm_source=rss&utm_medium=rss&utm_campaign=colonial-pipeline-attack-expected-to-trigger-imminent-hardening-of-cybersecurity-rules-for-federal-agencies-5

Survey and Taxonomy of Adversarial Reconnaissance Techniques

Read More

The post Survey and Taxonomy of Adversarial Reconnaissance Techniques appeared first on Malware Devil.

https://malwaredevil.com/2021/05/11/survey-and-taxonomy-of-adversarial-reconnaissance-techniques/?utm_source=rss&utm_medium=rss&utm_campaign=survey-and-taxonomy-of-adversarial-reconnaissance-techniques

Colonial Pipeline attack expected to trigger imminent hardening of cybersecurity rules for federal agencies

The ransomware attack on Colonial Pipeline last week caused the White House to hold emergency meetings to possibly strengthen a planned Executive Order on cybersecurity that could be released in the coming days or weeks, the New York Times reported.

The Executive Order–currently a draft–could place new restrictions on businesses that develop software and sell it to the federal government, such as the requirements to use multi-factor authentication and to access federal databases only when completely necessary. Such a strategy seemed like an appropriate response several months ago, when cybercriminals believed to be working with the Russian government infiltrated nine federal agencies by first hacking into the IT management company SolarWinds.

But the recent attack on Colonial Pipeline reveals that new rules meant only for federal contractors could still leave broad swaths of the American public at risk. Complicating the issue is that, while President Joe Biden has taken a harder stance against Russian cyberaggression than the past administration, the attack on Colonial Pipeline has no confirmed connection to the Russian government.

“I’m going to be meeting with President Putin, and so far there is no evidence based on, from our intelligence people, that Russia is involved, although there’s evidence that the actors’ ransomware is in Russia,” Biden said this week.

According to multiple reports of the planned Executive Order, companies that sell their products to the government could have to implement several new cybersecurity measures.

Such companies would have to use multi-factor authentication and they would have to encrypt data that belongs to federal government clients. The government would also begin using a “zero-trust” model with these contractors, meaning that such contractors would only gain access to federal systems on a “need-to-know” basis. Further, contractors would also have to notify government customers of any cyberbreach, bringing new transparency to the government about ongoing and increasingly frequent cybercrimes.

In speaking with Reuters, a spokeswoman for the National Security Council explained the importance of such a requirement, noting that the SolarWinds attack showed that “the federal government needs to be able to investigate and remediate threats to the services it provides the American people early and quickly.”

She continued: “Simply put, you can’t fix what you don’t know about.”

According to The New York Times, companies that violate these rules would have their products banned from being sold to the federal government. For many companies that count the federal government as their largest client, such a ban could serve as a revenue death knell.

Finally, the Executive Order could create a “cybersecurity incident review board” to investigate major cyberattacks in the US, and the Order could ask victims of cyberattacks to work with the FBI and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency when responding to attacks.

The post Colonial Pipeline attack expected to trigger imminent hardening of cybersecurity rules for federal agencies appeared first on Malware Devil.

https://malwaredevil.com/2021/05/11/colonial-pipeline-attack-expected-to-trigger-imminent-hardening-of-cybersecurity-rules-for-federal-agencies-4/?utm_source=rss&utm_medium=rss&utm_campaign=colonial-pipeline-attack-expected-to-trigger-imminent-hardening-of-cybersecurity-rules-for-federal-agencies-4

Colonial Pipeline attack expected to trigger imminent hardening of cybersecurity rules for federal agencies

The ransomware attack on Colonial Pipeline last week caused the White House to hold emergency meetings to possibly strengthen a planned Executive Order on cybersecurity that could be released in the coming days or weeks, the New York Times reported.

The Executive Order–currently a draft–could place new restrictions on businesses that develop software and sell it to the federal government, such as the requirements to use multi-factor authentication and to access federal databases only when completely necessary. Such a strategy seemed like an appropriate response several months ago, when cybercriminals believed to be working with the Russian government infiltrated nine federal agencies by first hacking into the IT management company SolarWinds.

But the recent attack on Colonial Pipeline reveals that new rules meant only for federal contractors could still leave broad swaths of the American public at risk. Complicating the issue is that, while President Joe Biden has taken a harder stance against Russian cyberaggression than the past administration, the attack on Colonial Pipeline has no confirmed connection to the Russian government.

“I’m going to be meeting with President Putin, and so far there is no evidence based on, from our intelligence people, that Russia is involved, although there’s evidence that the actors’ ransomware is in Russia,” Biden said this week.

According to multiple reports of the planned Executive Order, companies that sell their products to the government could have to implement several new cybersecurity measures.

Such companies would have to use multi-factor authentication and they would have to encrypt data that belongs to federal government clients. The government would also begin using a “zero-trust” model with these contractors, meaning that such contractors would only gain access to federal systems on a “need-to-know” basis. Further, contractors would also have to notify government customers of any cyberbreach, bringing new transparency to the government about ongoing and increasingly frequent cybercrimes.

In speaking with Reuters, a spokeswoman for the National Security Council explained the importance of such a requirement, noting that the SolarWinds attack showed that “the federal government needs to be able to investigate and remediate threats to the services it provides the American people early and quickly.”

She continued: “Simply put, you can’t fix what you don’t know about.”

According to The New York Times, companies that violate these rules would have their products banned from being sold to the federal government. For many companies that count the federal government as their largest client, such a ban could serve as a revenue death knell.

Finally, the Executive Order could create a “cybersecurity incident review board” to investigate major cyberattacks in the US, and the Order could ask victims of cyberattacks to work with the FBI and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency when responding to attacks.

The post Colonial Pipeline attack expected to trigger imminent hardening of cybersecurity rules for federal agencies appeared first on Malware Devil.

https://malwaredevil.com/2021/05/11/colonial-pipeline-attack-expected-to-trigger-imminent-hardening-of-cybersecurity-rules-for-federal-agencies-3/?utm_source=rss&utm_medium=rss&utm_campaign=colonial-pipeline-attack-expected-to-trigger-imminent-hardening-of-cybersecurity-rules-for-federal-agencies-3

Colonial Pipeline attack expected to trigger imminent hardening of cybersecurity rules for federal agencies

The ransomware attack on Colonial Pipeline last week caused the White House to hold emergency meetings to possibly strengthen a planned Executive Order on cybersecurity that could be released in the coming days or weeks, the New York Times reported.

The Executive Order—currently a draft—could place new restrictions on businesses that develop software and sell it to the federal government, such as the requirements to use multi-factor authentication and to access federal databases only when completely necessary. Such a strategy seemed like an appropriate response several months ago, when cybercriminals believed to be working with the Russian government infiltrated nine federal agencies by first hacking into the IT management company SolarWinds.

But the recent attack on Colonial Pipeline reveals that new rules meant only for federal contractors could still leave broad swaths of the American public at risk. Complicating the issue is that, while President Joe Biden has taken a harder stance against Russian cyberaggression than the past administration, the attack on Colonial Pipeline has no confirmed connection to the Russian government.

“I’m going to be meeting with President Putin, and so far there is no evidence based on, from our intelligence people, that Russia is involved, although there’s evidence that the actors’ ransomware is in Russia,” Biden said this week.

According to multiple reports of the planned Executive Order, companies that sell their products to the government could have to implement several new cybersecurity measures.

Such companies would have to use multi-factor authentication and they would have to encrypt data that belongs to federal government clients. The government would also begin using a “zero-trust” model with these contractors, meaning that such contractors would only gain access to federal systems on a “need-to-know” basis. Further, contractors would also have to notify government customers of any cyberbreach, bringing new transparency to the government about ongoing and increasingly frequent cybercrimes.

In speaking with Reuters, a spokeswoman for the National Security Council explained the importance of such a requirement, noting that the SolarWinds attack showed that “the federal government needs to be able to investigate and remediate threats to the services it provides the American people early and quickly.”

She continued: “Simply put, you can’t fix what you don’t know about.”

According to The New York Times, companies that violate these rules would have their products banned from being sold to the federal government. For many companies that count the federal government as their largest client, such a ban could serve as a revenue death knell.

Finally, the Executive Order could create a “cybersecurity incident review board” to investigate major cyberattacks in the US, and the Order could ask victims of cyberattacks to work with the FBI and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency when responding to attacks.

The post Colonial Pipeline attack expected to trigger imminent hardening of cybersecurity rules for federal agencies appeared first on Malwarebytes Labs.

The post Colonial Pipeline attack expected to trigger imminent hardening of cybersecurity rules for federal agencies appeared first on Malware Devil.

https://malwaredevil.com/2021/05/11/colonial-pipeline-attack-expected-to-trigger-imminent-hardening-of-cybersecurity-rules-for-federal-agencies-2/?utm_source=rss&utm_medium=rss&utm_campaign=colonial-pipeline-attack-expected-to-trigger-imminent-hardening-of-cybersecurity-rules-for-federal-agencies-2

Colonial Pipeline attack expected to trigger imminent hardening of cybersecurity rules for federal agencies

The ransomware attack on Colonial Pipeline last week caused the White House to hold emergency meetings to possibly strengthen a planned Executive Order on cybersecurity that could be released in the coming days or weeks, the New York Times reported.

The Executive Order–currently a draft–could place new restrictions on businesses that develop software and sell it to the federal government, such as the requirements to use multi-factor authentication and to access federal databases only when completely necessary. Such a strategy seemed like an appropriate response several months ago, when cybercriminals believed to be working with the Russian government infiltrated nine federal agencies by first hacking into the IT management company SolarWinds.

But the recent attack on Colonial Pipeline reveals that new rules meant only for federal contractors could still leave broad swaths of the American public at risk. Complicating the issue is that, while President Joe Biden has taken a harder stance against Russian cyberaggression than the past administration, the attack on Colonial Pipeline has no confirmed connection to the Russian government.

“I’m going to be meeting with President Putin, and so far there is no evidence based on, from our intelligence people, that Russia is involved, although there’s evidence that the actors’ ransomware is in Russia,” Biden said this week.

According to multiple reports of the planned Executive Order, companies that sell their products to the government could have to implement several new cybersecurity measures.

Such companies would have to use multi-factor authentication and they would have to encrypt data that belongs to federal government clients. The government would also begin using a “zero-trust” model with these contractors, meaning that such contractors would only gain access to federal systems on a “need-to-know” basis. Further, contractors would also have to notify government customers of any cyberbreach, bringing new transparency to the government about ongoing and increasingly frequent cybercrimes.

In speaking with Reuters, a spokeswoman for the National Security Council explained the importance of such a requirement, noting that the SolarWinds attack showed that “the federal government needs to be able to investigate and remediate threats to the services it provides the American people early and quickly.”

She continued: “Simply put, you can’t fix what you don’t know about.”

According to The New York Times, companies that violate these rules would have their products banned from being sold to the federal government. For many companies that count the federal government as their largest client, such a ban could serve as a revenue death knell.

Finally, the Executive Order could create a “cybersecurity incident review board” to investigate major cyberattacks in the US, and the Order could ask victims of cyberattacks to work with the FBI and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency when responding to attacks.

The post Colonial Pipeline attack expected to trigger imminent hardening of cybersecurity rules for federal agencies appeared first on Malware Devil.

https://malwaredevil.com/2021/05/11/colonial-pipeline-attack-expected-to-trigger-imminent-hardening-of-cybersecurity-rules-for-federal-agencies/?utm_source=rss&utm_medium=rss&utm_campaign=colonial-pipeline-attack-expected-to-trigger-imminent-hardening-of-cybersecurity-rules-for-federal-agencies

Hot Legal Topics in Privacy and Cybersecurity, Part 2 – Erik Weinick – SCW #73

A flurry of legislative and legal activity is re-shaping the way privacy and cybersecurity professionals conduct business. As a result, in addition to actually carrying out their protection responsibilities, professionals charged with protecting private and confidential data must be also be constantly aware of these evolving regulatory and legal obligations.

Segment Resources:
https://www.otterbourg.com/assets/htmldocuments/Protecting%20Privilege%20in%20Cyberspace%20New%20York%20State%20Bar%20Association%20Erik%20Weinick%20March%202021.pdf

Visit https://www.securityweekly.com/scw for all the latest episodes!

Show Notes: https://securityweekly.com/scw73

The post Hot Legal Topics in Privacy and Cybersecurity, Part 2 – Erik Weinick – SCW #73 appeared first on Malware Devil.

https://malwaredevil.com/2021/05/11/hot-legal-topics-in-privacy-and-cybersecurity-part-2-erik-weinick-scw-73/?utm_source=rss&utm_medium=rss&utm_campaign=hot-legal-topics-in-privacy-and-cybersecurity-part-2-erik-weinick-scw-73

VERT Threat Alert: May 2021 Patch Tuesday Analysis

Today’s VERT Alert addresses Microsoft’s May 2021 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-943 on Wednesday, May 12th. In-The-Wild & Disclosed CVEs CVE-2021-31204 Up first in the list this month, we have a vulnerability that impacts .NET and Visual Studio and could allow a successful attacker […]… Read More

The post VERT Threat Alert: May 2021 Patch Tuesday Analysis appeared first on The State of Security.

The post VERT Threat Alert: May 2021 Patch Tuesday Analysis appeared first on Security Boulevard.

Read More

The post VERT Threat Alert: May 2021 Patch Tuesday Analysis appeared first on Malware Devil.

https://malwaredevil.com/2021/05/11/vert-threat-alert-may-2021-patch-tuesday-analysis/?utm_source=rss&utm_medium=rss&utm_campaign=vert-threat-alert-may-2021-patch-tuesday-analysis

Microsoft Patch Tuesday, May 2021 Edition

Microsoft today released fixes to plug at least 55 security holes in its Windows operating systems and other software. Four of these weaknesses can be exploited by malware and malcontents to seize complete, remote control over vulnerable systems without any help from users. On deck this month are patches to quash a wormable flaw, a creepy wireless bug, and yet another reason to call for the death of Microsoft’s Internet Explorer (IE) web browser.

While May brings about half the normal volume of updates from Microsoft, there are some notable weaknesses that deserve prompt attention, particularly from enterprises. By all accounts, the most pressing priority this month is CVE-2021-31166, a Windows 10 and Windows Server flaw which allows an unauthenticated attacker to remotely execute malicious code at the operating system level. With this weakness, an attacker could compromise a host simply by sending it a specially-crafted packet of data.

“That makes this bug wormable, with even Microsoft calling that out in their write-up,” said Dustin Childs, with Trend Micro’s ZDI program. “Before you pass this aside, Windows 10 can also be configured as a web server, so it is impacted as well. Definitely put this on the top of your test-and-deploy list.”

Kevin Breen from Immersive Labs said the fact that this one is just 0.2 points away from a perfect 10 CVSS score should be enough to identify just how important it is to patch.

“For ransomware operators, this kind of vulnerability is a prime target for exploitation,” Breen said. “Wormable exploits should always be a high priority, especially if they are for services that are designed to be public facing. As this specific exploit would not require any form of authentication, it’s even more appealing for attackers, and any organization using HTTP.sys protocol stack should prioritize this patch.”

Breen also called attention to CVE-2021-26419 — a vulnerability in Internet Explorer 11 — to make the case for why IE needs to stand for “Internet Exploder.” To trigger this vulnerability, a user would have to visit a site that is controlled by the attacker, although Microsoft also recognizes that it could be triggered by embedding ActiveX controls in Office Documents.

“IE needs to die – and I’m not the only one that thinks so,” Breen said. “If you are an organization that has to provide IE11 to support legacy applications, consider enforcing a policy on the users that restricts the domains that can be accessed by IE11 to only those legacy applications. All other web browsing should be performed with a supported browser.”

Another curious bug fixed this month is CVE-2020-24587, described as a “Windows Wireless Networking Information Disclosure Vulnerability.” ZDI’s Childs said this one has the potential to be pretty damaging.

“This patch fixes a vulnerability that could allow an attacker to disclose the contents of encrypted wireless packets on an affected system,” he said. “It’s not clear what the range on such an attack would be, but you should assume some proximity is needed. You’ll also note this CVE is from 2020, which could indicate Microsoft has been working on this fix for some time.”

Microsoft also patched four more security holes its Exchange Server corporate email platform, which recently was besieged by attacks on four other zero-day Exchange flaws that resulted in hundreds of thousands of servers worldwide getting hacked. One of the bugs is credited to Orange Tsai of the DEVCORE research team, who was responsible for disclosing the ProxyLogon Exchange Server vulnerability that was patched in an out-of-band release back in March.

Researcher Orange Tsai commenting that nobody guessed the remote zero-day he reported on Jan. 5, 2021 to Microsoft was in Exchange Server.

“While none of these flaws are deemed critical in nature, it is a reminder that researchers and attackers are still looking closely at Exchange Server for additional vulnerabilities, so organizations that have yet to update their systems should do so as soon as possible,” said Satnam Narang, staff research engineer at Tenable.

As always, it’s a good idea for Windows users to get in the habit of updating at least once a month, but for regular users (read: not enterprises) it’s usually safe to wait a few days until after the patches are released, so that Microsoft has time to iron out any kinks in the new armor.

But before you update, please make sure you have backed up your system and/or important files. It’s not uncommon for a Windows update package to hose one’s system or prevent it from booting properly, and some updates have been known to erase or corrupt files.

So do yourself a favor and backup before installing any patches. Windows 10 even has some built-in tools to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.

And if you wish to ensure Windows has been set to pause updating so you can back up your files and/or system before the operating system decides to reboot and install patches on its own schedule, see this guide.

If you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a better-than-even chance other readers have experienced the same and may chime in here with some helpful tips.

Read More

The post Microsoft Patch Tuesday, May 2021 Edition appeared first on Malware Devil.

https://malwaredevil.com/2021/05/11/microsoft-patch-tuesday-may-2021-edition/?utm_source=rss&utm_medium=rss&utm_campaign=microsoft-patch-tuesday-may-2021-edition

Managed Attribution FAQs: Stop Investing Online Without Managed Attribution

Authentic8 answers FAQs about managed attribution and misattrib from online investigators who need to cloak or be anonymous for research.

The post Managed Attribution FAQs: Stop Investing Online Without Managed Attribution appeared first on Security Boulevard.

Read More

The post Managed Attribution FAQs: Stop Investing Online Without Managed Attribution appeared first on Malware Devil.

https://malwaredevil.com/2021/05/11/managed-attribution-faqs-stop-investing-online-without-managed-attribution/?utm_source=rss&utm_medium=rss&utm_campaign=managed-attribution-faqs-stop-investing-online-without-managed-attribution

Android NFC: Type Confusion in nfa_rw_sys_disable

Read More

The post Android NFC: Type Confusion in nfa_rw_sys_disable appeared first on Malware Devil.

https://malwaredevil.com/2021/05/11/android-nfc-type-confusion-in-nfa_rw_sys_disable-2/?utm_source=rss&utm_medium=rss&utm_campaign=android-nfc-type-confusion-in-nfa_rw_sys_disable-2

Wormable Windows Bug Opens Door to DoS, RCE

Microsoft’s May 2021 Patch Tuesday updates include fixes for four critical security vulnerabilities.
Read More

The post Wormable Windows Bug Opens Door to DoS, RCE appeared first on Malware Devil.

https://malwaredevil.com/2021/05/11/wormable-windows-bug-opens-door-to-dos-rce/?utm_source=rss&utm_medium=rss&utm_campaign=wormable-windows-bug-opens-door-to-dos-rce

Microsoft Patch Tuesday May 2021 fixes 55 vulnerabilities, including 3 zero-days

This month’s Patch Tuesday is here and the hustle is on. With most organizations embracing a distributed workforce these days, system administrators are bound to be up to their ears in work for the next two weeks, testing and figuring …

The post Microsoft Patch Tuesday May 2021 fixes 55 vulnerabilities, including 3 zero-days appeared first on ManageEngine Blog.

The post Microsoft Patch Tuesday May 2021 fixes 55 vulnerabilities, including 3 zero-days appeared first on Security Boulevard.

Read More

The post Microsoft Patch Tuesday May 2021 fixes 55 vulnerabilities, including 3 zero-days appeared first on Malware Devil.

https://malwaredevil.com/2021/05/11/microsoft-patch-tuesday-may-2021-fixes-55-vulnerabilities-including-3-zero-days/?utm_source=rss&utm_medium=rss&utm_campaign=microsoft-patch-tuesday-may-2021-fixes-55-vulnerabilities-including-3-zero-days

Elon Musk, Colonial Pipeline, Net Neutrality Redux, & Lemon Duck Botnet – SWN #121

This week in the Security Weekly News: Elon, Jerry Lee Lewis, Colonial Pipeline, Net Neutrality redux, Lemon Duck, Rico, & Jason Wood returns for Expert Commentary!

Time Stamps:

1:20 – Colonial Pipeline’s Ransomware Attack Sparks Emergency Declaration
3:40 – 80% of Net Neutrality Comments to FCC Were Fudged
7:00 – Lemon Duck Cryptojacking Botnet Changes Up Tactics
7:57 – Apple AirTag jailbroken already – hacked in rickroll attack
10:10 – Dell fixes exploitable holes in its own firmware update driver – patch now!
11:58 – Google Patches 19 Vulnerabilities With Chrome 90 Update
12:36 – Four Plead Guilty to RICO Conspiracy Involving Hosting Services for Cybercrime
14:19- Commercial Break & Jason Wood!
23:47 – Twitter scammers impersonate SNL in Elon Musk cryptocurrency scams

Visit https://www.securityweekly.com/swn for all the latest episodes!

Show Notes: https://securityweekly.com/swn121

The post Elon Musk, Colonial Pipeline, Net Neutrality Redux, & Lemon Duck Botnet – SWN #121 appeared first on Malware Devil.

https://malwaredevil.com/2021/05/11/elon-musk-colonial-pipeline-net-neutrality-redux-lemon-duck-botnet-swn-121/?utm_source=rss&utm_medium=rss&utm_campaign=elon-musk-colonial-pipeline-net-neutrality-redux-lemon-duck-botnet-swn-121

The Importance of Code Signing in the Software Supply Chain

How do you know that your code can be trusted? 

In a world where trust is hard to come by, it’s an important question to ask ourselves. How do we know that the applications we’re running, the containers we’re deploying, or code we’re delivering to our customers is genuine? How do we know it hasn’t been tampered with?

It all comes down to code signing.

In this blog, we’ll discuss the importance of code signing, the challenges of implementing it properly, and how Keyfactor Code Assure allows you to centralize and secure code signing without disrupting developer workflows (you can find the full webinar on this topic by clicking “Watch Now” below).

The post The Importance of Code Signing in the Software Supply Chain appeared first on Security Boulevard.

Read More

The post The Importance of Code Signing in the Software Supply Chain appeared first on Malware Devil.

https://malwaredevil.com/2021/05/11/the-importance-of-code-signing-in-the-software-supply-chain/?utm_source=rss&utm_medium=rss&utm_campaign=the-importance-of-code-signing-in-the-software-supply-chain

Hot Legal Topics in Privacy and Cybersecurity, Part 1 – Erik Weinick – SCW #73

A flurry of legislative and legal activity is re-shaping the way privacy and cybersecurity professionals conduct business. As a result, in addition to actually carrying out their protection responsibilities, professionals charged with protecting private and confidential data must be also be constantly aware of these evolving regulatory and legal obligations.

Segment Resources:
https://www.otterbourg.com/assets/htmldocuments/Protecting%20Privilege%20in%20Cyberspace%20New%20York%20State%20Bar%20Association%20Erik%20Weinick%20March%202021.pdf
Visit https://www.securityweekly.com/scw for all the latest episodes!
Show Notes: https://securityweekly.com/scw73

The post Hot Legal Topics in Privacy and Cybersecurity, Part 1 – Erik Weinick – SCW #73 appeared first on Malware Devil.

https://malwaredevil.com/2021/05/11/hot-legal-topics-in-privacy-and-cybersecurity-part-1-erik-weinick-scw-73/?utm_source=rss&utm_medium=rss&utm_campaign=hot-legal-topics-in-privacy-and-cybersecurity-part-1-erik-weinick-scw-73

Android NFC: Type Confusion in nfa_rw_sys_disable

Read More

The post Android NFC: Type Confusion in nfa_rw_sys_disable appeared first on Malware Devil.

https://malwaredevil.com/2021/05/11/android-nfc-type-confusion-in-nfa_rw_sys_disable/?utm_source=rss&utm_medium=rss&utm_campaign=android-nfc-type-confusion-in-nfa_rw_sys_disable