Collection of the resources and links I have found insightful and shared during week #46 of 2022. Goodbye passwords? 1Password says it will soon support passkeys Password manager 1Password is launching passkey functionality in 2023 and in the meantime has setup a demo for users to test the new passwordless experience. Passkeys use the WebAuthn standard created by the…

Collection of the {cyber,info}security resources and links I have found insightful and shared during week #03 of 2023. Exploits released for two Samsung Galaxy App Store vulnerabilities Two vulnerabilities in the Galaxy App Store, Samsung’s official repository for its devices, could enable attackers to install any app in the Galaxy Store without the user’s knowledge or to direct victims…

Collection of the {cyber,info}security resources and links I have found insightful and shared during week #02 of 2023. Fortinet: Govt networks targeted with now-patched SSL-VPN zero-day Fortinet says unknown attackers exploited a FortiOS SSL-VPN zero-day vulnerability patched last month in attacks against government organizations and government-related targets. ”The discovered Windows sample attributed to the attacker displayed artifacts of…

Collection of the {cyber,info}security resources and links I have found insightful and shared during week #01 of 2023. Slack’s private GitHub code repositories stolen over holidays Slack suffered a security incident over the holidays affecting some of its private GitHub code repositories. The immensely popular Salesforce-owned IM app is used by an estimated 18 million users at workplaces…

Collection of the {cyber,info}security resources and links I have found insightful and shared during week #52 of 2022. Ukraine shuts down fraudulent call center claiming 18,000 victims A group of imposters operating out of a Ukrainian call center defrauded thousands of victims while pretending to be IT security employees at their banks. They contacted the victims, claimed that their…

Collection of the {cyber,info}security resources and links I have found insightful and shared during week #51 of 2022. Eufy camera security breach admission leaves many questions unanswered Early December, Paul Moore, a security researcher, revealed a frightening security situation with Eufy home security products including camera-equipped doorbells. In the thread and accompanying videos, Moore shows proof that Eufy cameras…

Collection of the resources and links I have found insightful and shared during week #50 of 2022. Google introduces end-to-end encryption for Gmail on the web Once enabled, Gmail client-side encryption will ensure that any sensitive data delivered as part of the email’s body and attachments can not be decrypted by Google servers. Gmail E2EE beta is currently available…

Collection of the resources and links I have found insightful and shared during week #49 of 2022. {JS-ON: Security-OFF}: Abusing JSON-Based SQL to Bypass WAF Team82 at Claroty has developed a generic bypass of industry-leading web application firewalls (WAF). The attack technique involves appending JSON syntax to SQL injection payloads that a WAF is unable to parse. The…

Collection of the resources and links I have found insightful and shared during week #48 of 2022. New Zealand admits it has direct access to Facebook takedown portal where it can flag content for censorship New Zealand’s government has officially admitted that it has partner access to Facebook’s controversial content takedown portal. This portal is designed specifically for government agencies to flag content to Facebook for censorship.

Collection of the resources and links I have found insightful and shared during week #47 of 2022. 5.4 million Twitter users’ stolen data leaked online — more shared privately Over 5.4 million Twitter user records containing non-public information stolen using an API vulnerability fixed in January have been shared for free on a hacker forum. The data consists of scraped public information…

Collection of the resources and links I have found insightful and shared during week #45 of 2022. FTX Faces Potential Hack, Sees Mysterious Outflows Totaling More than $600M More than $600 million in crypto left bankrupt crypto company FTX’s wallets late Friday, with little clear explanation as to why. Soon afterwards, FTX stated in its official Telegram channel that it had…

Collection of the resources and links I have found insightful and shared during week #44 of 2022. Password security still an issue despite rising cybersecurity education While nearly 9 in 10 respondents (89%) know that using the same password or a variation is a risk, only 12% said they use different passwords for different accounts and 62% said they…

Collection of the resources and links I have found insightful and shared during week #41 of 2022. New Chinese Malware Attack Framework Targets Windows, macOS, and Linux Systems A previously undocumented command-and-control (C2) framework dubbed Alchimist is likely being used in the wild to target Windows, macOS, and Linux systems. Written in GoLang, Alchimist is complemented by a beacon implant called…

Collection of the resources and links I have found insightful and shared during week #42 of 2022. Gartner research finds no single tool protects app security There is no one ring to rule them all ⬇️ Overcoming the challenges of securing devops and software supply chains from malicious, unpredictable attacks with new technologies dominates Gartner’s latest Hype Cycle for…

Collection of the resources and links I have found insightful and shared during week #40 of 2022. Hacker steals $566 million worth of crypto from Binance Bridge Hackers have reportedly stolen 2 million Binance Coins (BNB), worth $566 million, from the Binance Bridge. Details are scant at the moment, but the attack appears to have started at 2:30 PM EST…

Collection of the resources and links I have found insightful and shared during week #39 of 2022. Microsoft confirms new Exchange zero-days are used in attacks 🚨 Microsoft has confirmed that two recently reported zero-day vulnerabilities in Microsoft Exchange Server 2013, 2016, and 2019 are being exploited in the wild. “The first vulnerability, identified as CVE-2022–41040, is a Server-Side…

Collection of the resources and links I have found insightful and shared during week #38 of 2022. AttachMe: critical OCI vulnerability allows unauthorized access to customer cloud storage volumes Before it was patched, AttachMe could have allowed attackers to access and modify any other users’ OCI storage volumes without authorization, thereby violating cloud isolation. Upon disclosure, the vulnerability was fixed within hours…

Collection of the resources and links I have found insightful and shared during week #37 of 2022. Telos Corporation to Help Enterprises Operationalize Cybersecurity Compliance and Regulatory Risks with IBM Security Great announcement on the collaboration between Telos Corporation and IBM Security as part of IBM’s Active Governance Services (AGS) that allows enterprises to operationalize and automate activities and solve challenges in #cybersecurity compliance…

Collection of the resources and links I have found insightful and shared during week #36 of 2022. Amberoon Lucre AML: Now At Home On IBM Cloud for Financial Services Some great news! Amberoon Inc. Lucre AML now available on IBM Cloud for Financial Services. Amberoon Lucre AML: Now At Home On IBM Cloud for Financial Services Lucre is a modernized AML offering that leverages advances in artificial intelligence, data engineering and security to…www.amberoon.com

Collection of the resources and links I have found insightful and shared during week #35 of 2022. FBI’s team to investigate massive cyberattack in Montenegro A rapid deployment team of FBI cyber experts is heading to Montenegro to investigate a massive, coordinated attack on the tiny Balkan nation’s government and its services, the country’s Ministry of Internal Affairs…