Tag: software
-
Researchers Uncover Backdoor in Solana’s Popular Web3.js npm Library
Cybersecurity researchers are alerting to a software supply chain attack targeting the popular @solana/web3.js npm library that involved pushing two malicious versions capable of harvesting users’ private keys with an aim to drain their cryptocurrency wallets.The attack has been detected in versions 1.95.6 and 1.95.7. Both these versions are no longer available for download from…
-
Jetzt patchen! Exploit für kritische Lücke in Whatsup Gold in Umlauf
Die Monitoring-Software Whatsup Gold ist verwundbar. Sicherheitsforscher sind nun auf einen Exploit für Schadcode-Attacken gestoßen. Ein Patch ist verfügbar. First seen on heise.de Jump to article: www.heise.de/news/Jetzt-patchen-Exploit-fuer-kritische-Luecke-in-Whatsup-Gold-in-Umlauf-10187538.html
-
Hackers Use Corrupted ZIPs and Office Docs to Evade Antivirus and Email Defenses
Cybersecurity researchers have called attention to a novel phishing campaign that leverages corrupted Microsoft Office documents and ZIP archives as a way to bypass email defenses.”The ongoing attack evades #antivirus software, prevents uploads to sandboxes, and bypasses Outlook’s spam filters, allowing the malicious emails to reach your inbox,” ANY.RUN said in a series of posts…
-
BlackBerry Highlights Rising Software Supply Chain Risks in Malaysia
Tags: access, ai, attack, breach, ceo, ciso, communications, compliance, cyber, cyberattack, cybersecurity, data, detection, espionage, finance, framework, government, infrastructure, intelligence, international, Internet, iot, malware, mobile, monitoring, phishing, ransomware, regulation, resilience, risk, skills, software, strategy, supply-chain, threat, tool, training, vulnerabilityIn 2024, BlackBerry unveiled new proprietary research, underscoring the vulnerability of software supply chains in Malaysia and around the world.According to the study, 79% of Malaysian organizations reported cyberattacks or vulnerabilities in their software supply chains during the past 12 months, slightly exceeding the global average of 76%. Alarmingly, 81% of respondents revealed they had…
-
Ransomware attacks on critical sectors ramped up in November
Supply chain software vendor Blue Yonder and energy management giant Schneider Electric SE experienced some of the most notable ransomware incidents in November. First seen on techtarget.com Jump to article: www.techtarget.com/searchsecurity/news/366616601/Ransomware-attacks-on-critical-sectors-ramped-up-in-November
-
First-ever Linux UEFI bootkit turns out to be student project
Tags: antivirus, attack, authentication, awareness, computer, conference, cybersecurity, firmware, linux, malicious, malware, microsoft, risk, software, technology, threat, training, update, windowsBootkitty, a recently discovered boot-level UEFI rootkit for Linux, was evidently created by students participating in a cybersecurity training program at the South Korean Information Technology Research Institute (KITRI).The bootkit, found and analyzed by researchers from antivirus vendor ESET last week, showed signs of being a proof of concept rather than production-ready malware. Nevertheless, the…
-
Perfect 10 directory traversal vuln hits SailPoint’s IAM solution
20-year-old info disclosure class bug still pervades security software First seen on theregister.com Jump to article: www.theregister.com/2024/12/03/sailpoint_identityiq_vulnerability/
-
First-ever Linux UEFI bootkit turns out to be research project
Tags: antivirus, attack, authentication, awareness, computer, conference, cybersecurity, firmware, linux, malicious, malware, microsoft, risk, software, technology, threat, training, update, windowsBootkitty, a recently discovered boot-level UEFI rootkit for Linux, was evidently created by students participating in a cybersecurity training program at the South Korean Information Technology Research Institute (KITRI).The bootkit, found and analyzed by researchers from antivirus vendor ESET last week, showed signs of being a proof of concept rather than production-ready malware. Nevertheless, the…
-
16 Zero-Days Uncovered in Fuji Electric Monitoring Software
Flaws in Fuji’s Tellus and V-Server Software Pose Risks to Critical Infrastructure. Security researchers have uncovered 16 zero-day vulnerabilities in Japanese equipment manufacturer Fuji Electric’s Tellus and V-Server remote monitoring software that enable attackers to execute malicious code in devices commonly used by utilities and other critical infrastructure providers. First seen on govinfosecurity.com Jump to…
-
Decade-Old Cisco Vulnerability Under Active Exploit
Cisco encourages users to update to an unaffected version of its Adaptive Security Appliance (ASA) software since there are no workarounds for the 2014 vulnerability. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/decade-old-cisco-vulnerability-exploit
-
ESicherheit made in Germany jetzt bei Sysob verfügbar
Sysob kooperiert mit NoSpamProxy, dem Experten für einfachen und umfassenden Schutz von E-Mail-Infrastrukturen. Der neue Herstellerpartner bietet ein mehrfach ausgezeichnetes E-Mail-Security-Gateway, welches als erstes Software-Produkt weltweit das BSI-Zertifikat nach der Beschleunigten Sicherheitszertifizierung (BSZ) erhalten hat. Anpassbar auf den individuellen Schutzbedarf von Unternehmen ist die Gateway-Lösung entweder als komplette Suite oder flexibel in den vier Modulen…
-
SmokeLoader picks up ancient MS Office bugs to pack fresh credential stealer
Threat actors are using a well-known modular malware loader, SmokeLoader, to exploit known Microsoft Office vulnerabilities and steal sensitive browser credentials.The loader which runs a framework to deploy multiple malware modules, was observed by Fortinet’s FortiGuard Labs in attacks targeting manufacturing, healthcare, and IT companies in Taiwan.”SmokeLoader, known for its ability to deliver other malicious…
-
CIO POV: Building trust in cyberspace
Tags: access, ai, attack, best-practice, business, cio, cisa, cloud, cyber, data, deep-fake, encryption, framework, GDPR, group, identity, infrastructure, intelligence, Internet, mfa, mitre, nist, privacy, regulation, resilience, risk, service, software, strategy, technology, threat, tool, update, windowsTrust lies at the heart of every relationship, transaction, and encounter. Yet in cyberspace”, where we work, live, learn, and play”, trust can become elusive.Since the dawn of the internet nearly 50 years ago, we’ve witnessed incredible digital transformations paired with increasingly formidable threats. Knowing who and what to trust has become so difficult that…
-
Novel phishing campaign uses corrupted Word documents to evade security
A novel phishing attack abuses Microsoft’s Word file recovery feature by sending corrupted Word documents as email attachments, allowing them to bypass security software due to their damaged state but still be recoverable by the application. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/novel-phishing-campaign-uses-corrupted-word-documents-to-evade-security/
-
Retail outages drag into second week after Blue Yonder ransomware attack
A ransomware attack on supply chain software giant Blue Yonder continues to cause disruption to the company’s customers, almost two weeks after the outage first began. In a brief update to its cybersecurity incident page on Sunday, Arizona-based Blue Yonder said it is making “good progress” in its recovery from the attack, which hit its…
-
2nd December Threat Intelligence Report
Supply chain software provider Blue Yonder was hit by a ransomware attack, disrupting services for clients like Starbucks and UK grocery chains Morrisons and Sainsbury’s. The incident affected operations such as employee […] First seen on research.checkpoint.com Jump to article: research.checkpoint.com/2024/2nd-december-threat-intelligence-report/
-
Novel phising campaign uses corrupted Word documents to evade security
A novel phishing attack abuses Microsoft’s Word file recovery feature by sending corrupted Word documents as email attachments, allowing them to bypass security software due to their damaged state but still be recoverable by the application. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/novel-phising-campaign-uses-corrupted-word-documents-to-evade-security/
-
Apple Safari JavaScriptCore Remote Code Execution Flaw Exploited in the Wild
Tags: apple, cve, cyber, exploit, flaw, macOS, remote-code-execution, software, threat, vulnerabilityA critical vulnerability identified as CVE-2024-44308 has been actively exploited in the wild, affecting multiple versions of Apple Safari across iOS, visionOS, and macOS platforms. This flaw, located within WebKit’s DFG JIT compiler, poses a significant threat by allowing remote code execution (RCE). Affected Software and Versions Here’s a table summarizing the affected software and…
-
Inside the 2024 CWE Top 25: Trends, surprises, and persistent challenges
In this Help Net Security interview, Alec Summers, Project Leader for the CVE Program at MITRE, shares his insights on the 2024 CWE top 25 most dangerous software weaknesses. … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/12/02/alec-summers-mitre-cwe-top-25-2024/
-
Bedrohungsakteure nehmen KI/Machine-Learning-Modelle und Software-Lieferketten ins Visier
Die Bedeutung der Software-Lieferkette wird in diesem Jahr weiter zunehmen und parallel wird auch die Bedrohungslage an Komplexität und Intensität gew… First seen on infopoint-security.de Jump to article: www.infopoint-security.de/bedrohungsakteure-nehmen-ki-machine-learning-modelle-und-software-lieferketten-ins-visier/a36652/
-
Axians gibt Tipps für NISkonforme Cybersecurity im Gesundheitswesen
Um Unternehmen und Institutionen im Gesundheitsbereich erfolgreich gegen Cyberangriffe abzusichern, braucht es mehr als in Hardware und Software zu in… First seen on infopoint-security.de Jump to article: www.infopoint-security.de/axians-gibt-tipps-fuer-nis-2-konforme-cybersecurity-im-gesundheitswesen/a36789/
-
JFrog Software Supply Chain Report zeigt, dass viele kritische CVSS-Scores irreführend sind
74 Prozent der Bewertungen von Schwachstellen mit hohen oder kritischen CVSS-Scores sind irreführend trotzdem verbringen 60 Prozent der Sicherheits- … First seen on infopoint-security.de Jump to article: www.infopoint-security.de/jfrog-software-supply-chain-report-zeigt-dass-viele-kritische-cvss-scores-irrefuehrend-sind/a36964/
-
Logpoint kommentiert XZ Utils Sicherheitslücke in der SoftwareChain
Insgesamt unterstreicht der Vorfall die Notwendigkeit einer verstärkten Aufmerksamkeit für die Sicherheitsaspekte von Open-Source-Software und die Bed… First seen on infopoint-security.de Jump to article: www.infopoint-security.de/logpoint-kommentiert-xz-utils-sicherheitsluecke-in-der-software-supply-chain/a37025/
-
Kostenloser Service von Qualys unterstützt Unternehmen bei den britischen NCSC-Richtlinien
Das NCSC hat vor kurzem einen Leitfaden herausgegeben, in dem empfohlen wird, Schwachstellen bei Diensten und Software, die mit dem Internet verbunden… First seen on infopoint-security.de Jump to article: www.infopoint-security.de/kostenloser-service-von-qualys-unterstuetzt-unternehmen-bei-den-britischen-ncsc-richtlinien/a37132/
-
JFrog fördert sichere KI-Entwicklung mit Integration von Databricks MLflow
Die neue JFrog Artifactory-Integration bietet Entwicklern und Data Scientists eine Open Source Software-Lösung, um die Entwicklung von ML-Modellen zu … First seen on infopoint-security.de Jump to article: www.infopoint-security.de/jfrog-foerdert-sichere-ki-entwicklung-mit-integration-von-databricks-mlflow/a37220/
-
T-Systems und Aurora Labs bieten OTA-Software-Updates der nächsten Generation an
Für den Betrieb von Elektrofahrzeugen und Software-definierten Fahrzeugen wird es immer wichtiger, jede elektronische Steuereinheit (ECU), einschließl… First seen on infopoint-security.de Jump to article: www.infopoint-security.de/t-systems-und-aurora-labs-bieten-ota-software-updates-der-naechsten-generation-an/a37505/
-
JFrog integriert GitHub und optimiert sicheres Software Supply Chain Management
Im Rahmen einer fortlaufenden Initiative wollen beide Unternehmen eine Roadmap für kontinuierliche Verbesserungen aufstellen, um sicherzustellen, dass… First seen on infopoint-security.de Jump to article: www.infopoint-security.de/jfrog-integriert-github-und-optimiert-sicheres-software-supply-chain-management/a37534/
-
Neue Theia IDE unterstützt moderne und flexible Software-Entwicklung
Tags: softwareDie Eclipse-Community hat die Entwicklung der Theia IDE konsequent auf die Anforderungen heutiger Entwickler ausgerichtet und integriert neueste Webte… First seen on infopoint-security.de Jump to article: www.infopoint-security.de/neue-theia-ide-unterstuetzt-moderne-und-flexible-software-entwicklung/a37765/
-
Diskrepanzen zwischen Führungskräfte und Entwickler können die Sicherheit gefährden
Sicherheitsverletzungen in der Software-Lieferkette nehmen deutlich zu, wie die jüngsten IDC-Umfragedaten zeigen, die einen erstaunlichen Anstieg solc… First seen on infopoint-security.de Jump to article: www.infopoint-security.de/diskrepanzen-zwischen-fuehrungskraefte-und-entwickler-koennen-die-sicherheit-gefaehrden/a37848/