well... news

HOT: @ukraine, @russia

bleepingcomputer.com

• Acer fixes UEFI bugs that can be used to disable Secure Boot
• Malicious Android app found powering account creation service
• TikTok ‘Invisible Body’ challenge exploited to push malware
• Cyber Monday deal: Get 50% off Malwarebytes Premium, Privacy VPN
• Meta fined €265M for not protecting Facebook users' data from scrapers
• The Cyber Monday 2022 Security, IT, VPN, & Antivirus Deals
• US bans sales of Huawei, Hikvision, ZTE, and Dahua equipment
• 5.4 million Twitter users' stolen data leaked online — more shared privately
• Windows 11 is getting a VPN status indicator in the taskbar
• Ransomware gang targets Belgian municipality, hits police instead

csirt.cz

• Postřehy z bezpečnosti: pentesteři pozor na nebezpečné PoC
• Postřehy z bezpečnosti: využití dronů k útokům na sítě
• Postřehy z bezpečnosti: 0-day zranitelnost pluginu WPGateway
• Postřehy z bezpečnosti: počítač můžete zničit nevhodným výběrem hudby
• Postřehy z bezpečnosti: zranitelnosti v lokalizačních zařízeních
• Postřehy z bezpečnosti: QNAP NAS je v ohrožení kvůli Nginx
• Závažná zranitelnost Microsoft Office
• Kritická zranitelnost v rozšíření Screencastify pro Chrome
• Postřehy z bezpečnosti: deep fake ve službách podvodných krypto platforem
• QNAP vyzývá uživatele k urychlenému záplatování NAS

darkreading.com

• How the Cloud Changed Digital Forensics Investigations
• Cybersecurity Consolidation Continues, Even as Valuations Stall
• Cyber-Threat Group Targets Critical RCE Vulnerability in 'Bleed You' Campaign
• Global Cyber-Enforcement Op Nets $130M, Says Interpol
• Black Basta Gang Deploys Qakbot Malware in Aggressive Cyber Campaign
• $275M Fine for Meta After Facebook Data Scrape
• KnowBe4 Launches New Mobile Learner App for Cybersecurity Learning
• NanoLock Brings Built-In Meter-Level Cybersecurity to Renesas Customers
• Bring Your Own Key — A Placebo?
• Slippery RansomExx Malware Moves to Rust, Evading VirusTotal
• For Gaming Companies, Cybersecurity Has Become a Major Value Proposition
• How Development Teams Should Respond to Text4Shell

googleprojectzero.blogspot.com

• Mind the Gap
• A Very Powerful Clipboard: Analysis of a Samsung in-the-wild exploit chain
• Gregor Samsa: Exploiting Java's XML Signature Verification
• RC4 Is Still Considered Harmful
• The quantum state of Linux kernel garbage collection CVE-2021-0920 (Part I)
• 2022 0-day In-the-Wild Exploitation…so far
• The curious tale of a fake Carrier.app
• An Autopsy on a Zombie In-the-Wild 0-day
• Release of Technical Report into the AMD Security Processor
• The More You Know, The More You Know You Don’t Know
• CVE-2021-1782, an iOS in-the-wild vulnerability in vouchers
• CVE-2021-30737, @xerub's 2021 iOS ASN.1 Vulnerability

hackread.com

• How to exchange Binance Coin (BNB) cryptocurrency
• How to Craft Rich Data-Driven Infographics with Powered Template
• Meta Fined €265 million in Facebook Data Scraping Case in the EU
• Critical Flaw Exploited to Bypass Fortinet Products and Compromise Orgs
• Hacker Leaks 5.3M Twitter Accounts as Claims of Larger Breach Surface
• What is an Identity Verification Service and How Does it Work?
• Iran’s Fars News Agency website hacked as part of anti-govt protests
• Nearly 500 million WhatsApp User Records Sold Online
• How to Create ISO Files from Discs – 3 Best Ways
• Top 6 Cell Phone Tracker Apps for Parental Control

kratkespravy.sk

• Zo sveta IT bezpečnosti, 10/2022
• Zo sveta IT bezpečnosti, 9/2022
• Zo sveta IT bezpečnosti, 8/2022
• Zo sveta IT bezpečnosti, 7/2022
• Zo sveta IT bezpečnosti, 6/2022
• Zo sveta IT bezpečnosti, 5/2022
• Zo sveta IT bezpečnosti, 4/2022
• Zo sveta IT bezpečnosti, 3/2022
• Zo sveta IT bezpečnosti, 2/2022
• Zo sveta IT bezpečnosti, 1/2022

krebsonsecurity.com

• U.S. Govt. Apps Bundled Russian Code With Ties to Mobile Malware Developer
• Researchers Quietly Cracked Zeppelin Ransomware Keys
• Disneyland Malware Team: It’s a Puny World After All
• Top Zeus Botnet Suspect “Tank” Arrested in Geneva
• Lawsuit Seeks Food Benefits Stolen By Skimmers
• Patch Tuesday, November 2022 Election Edition
• LinkedIn Adds Verified Emails, Profile Creation Dates
• Hacker Charged With Extorting Online Psychotherapy Service
• Accused ‘Raccoon’ Malware Developer Fled Ukraine After Russian Invasion
• Battle with Bots Prompts Mass Purge of Amazon, Apple Employee Accounts on LinkedIn

nakedsecurity.sophos.com

• Chrome fixes 8th zero-day of 2022 – check your version now
• Voice-scamming site “iSpoof” seized, 100s arrested in massive crackdown
• S3 Ep110: Spotlight on cyberthreats – an expert speaks [Audio + Text]
• Multimillion dollar CryptoRom scam sites seized, suspects arrested in US
• How to hack an unpatched Exchange server with rogue PowerShell code
• How social media scammers buy time to steal your 2FA codes
• Black Friday and retail season – watch out for PayPal “money request” scams
• S3 Ep109: How one leaked email password could drain your business [Audio + Transcript]
• Firefox fixes fullscreen fakery flaw – get the update now!
• Log4Shell-like code execution hole in popular Backstage dev tool

nukib.cz

• Stát vstupuje do závěrečné fáze přípravy návrhu zákona o snižování rizik spojených s dodavateli informačních a komunikačních technologií
• Jednotná pravidla kybernetické bezpečnosti subjektů EU jsou opět o něco blíž
• V Praze a Brně se uskutečnil odborný workshop zaměřený na budoucí evropské certifikační schéma EUCC
• Kybernetické incidenty pohledem NÚKIB - říjen 2022
• V Praze proběhla prestižní Prague Cyber Security Conference
• Upozorňujeme na zranitelnosti knihovny OpenSSL ve verzi 3
• Upozorňujeme na zvýšené riziko DDoS útoků
• Upozorňujeme na závažnou zranitelnost Wi-Fi v linuxovém jádru
• Upozorňujeme na kritickou zranitelnost FortiGate CVE-2022-40684 (CVSS 9.6)
• Upozorňujeme na zranitelnost Microsoft Exchange Server CVE-2022-41040 (CVSSv3 6.3) CVE-2022-41082 (CVSSv3 8.8)
• Doporučení k používání protokolu TLP ke sdílení chráněných informací
• Doporučení v oblasti kryptografických prostředků verze 2.0

scmagazine.com

• Microsoft warns zero-day in SolarWinds Serv-U software being exploited by Chinese threat group
• CMS interoperability rule enacted: How providers should tackle API security
• Strata automation tool looks to simplify cloud migration projects
• AWS offers free online training for cloud architects
• Websites repeatedly stalked by fraudulent copycats, say researchers
• New open data project looks to gauge success, failure of ransomware policy
• Microsoft fixes 117 vulnerabilities, four exploited in the wild
• Fashion brand Guess hacked, DarkSide ransomware group the likely culprit
• Major authentication and encryption weaknesses discovered in Schneider Electric, outdated ICS systems
• Report: Cyberattacks drive 185% spike in health care data breaches in 2021

securityaffairs.co

• Tips for Gamifying Your Cybersecurity Awareness Training Program
• Irish data protection commission fines Meta over 2021 data-scraping leak
• A flaw in some Acer laptops can be used to bypass security features
• Experts found a vulnerability in AWS AppSync
• RansomBoggs Ransomware hit several Ukrainian entities, experts attribute it to Russia
• Security Affairs newsletter Round 395
• US FCC bans the import of electronic equipment from Chinese firms
• Data from 5.4M Twitter users obtained from multiple threat actors and combined with data from other breaches
• Devices from Dell, HP, and Lenovo used outdated OpenSSL versions
• Google fixed the eighth actively exploited #Chrome #zeroday this year

securityweek.com

• Cybercriminals Selling Access to Networks Compromised via Recent Fortinet Vulnerability
• Oracle Fusion Middleware Vulnerability Exploited in the Wild
• Census Bureau Chief Defends New Privacy Tool Against Critics
• Virginia County Confirms Personal Information Stolen in Ransomware Attack
• Project Zero Flags 'Patch Gap' Problems on Android
• Irish Regulator Fines Meta 265 Million Euros Over Data Breach
• Hack-for-Hire Group Targets Android Users With Malicious VPN Apps
• Crackdown on African Cybercrime Leads to Arrests, Infrastructure Takedown
• Twitter Data Breach Bigger Than Initially Reported
• Cisco ISE Vulnerabilities Can Be Chained in One-Click Exploit
• Google Patches Eighth Chrome Zero-Day of 2022
• US Bans Huawei, ZTE Telecoms Gear Over Security Risk

thehackernews.com

• Hackers Using Trending TikTok 'Invisible Challenge' to Spread Malware
• 7 Cyber Security Tips for SMBs
• Irish Regulator Fines Facebook $277 Million for Leak of Half a Billion Users' Data
• CISA Warns of Actively Exploited Critical Oracle Fusion Middleware Vulnerability
• Researchers Detail AppSync Cross-Tenant Vulnerability in Amazon Web Services
• The 5 Cornerstones for an Effective Cyber Security Awareness Training
• Over a Dozen New BMC Firmware Flaws Expose OT and IoT Devices to Remote Attacks
• Elon Musk Confirms Twitter 2.0 will Bring End-to-End Encryption to Direct Messages
• All You Need to Know About Emotet in 2022
• U.S. Bans Chinese Telecom Equipment and Surveillance Cameras Over National Security Risk
• Russia-based RansomBoggs Ransomware Targeted Several Ukrainian Organizations
• Update Chrome Browser Now to Patch New Actively Exploited Zero-Day Flaw

threatpost.com

• Student Loan Breach Exposes 2.5M Records
• Watering Hole Attacks Push ScanBox Keylogger
• Tentacles of ‘0ktapus’ Threat Group Victimize 130 Firms
• Ransomware Attacks are on the Rise
• Cybercriminals Are Selling Access to Chinese Surveillance Cameras
• Twitter Whistleblower Complaint: The TL;DR Version
• Firewall Bug Under Active Attack Triggers CISA Warning
• Fake Reservation Links Prey on Weary Travelers
• iPhone Users Urged to Update to Patch 2 Zero-Days
• Google Patches Chrome’s Fifth Zero-Day of the Year

tripwire.com-state-of-security

• VERT Threat Alert: October 2022 Patch Tuesday Analysis
• Turning a Pico into a Human Interface Device (HID)
• The State of Security: Poland
• 4 tips to achieve Data Compliance
• Complying with the Egypt Financial Cybersecurity Framework: What you Should Know
• What to Know about APIs, the “On-Ramps to the Digital World”
• CISA orders federal agencies to catalog their networks, and scan for bugs
• See Yourself in Cyber: 4 Steps to Stay Safe
• Extra, Extra, VERT Reads All About It: Cybersecurity News for the Week of September 26, 2022
• UK Construction: Cybersecurity Experts Defend Joint Ventures
• Foundational Activities for Secure Software Development
• IT admin admits sabotaging ex-employer’s network in bid for higher salary

Toto je souhrn titulků zpravodajských zdrojů, generovaný z jejich RSS/atom kanálů. Zdroje řazeny abecedně.
©opyright a zodpovědnost za obsah nesou autoři jednotlivých zdrojů.
Generováno Tue, 29 Nov 2022 10:16:02 +0100
poznámky a připomínky: klokanek (zavinovačka) eldar (bodka) cz