FreshRSS

🔒
❌ Secure Planet Training Courses Updated For 2019 - Click Here
There are new available articles, click to refresh the page.
Before yesterdaySecurity

Test Post 2 03-11

Where does it come from?

Contrary to popular belief, Lorem Ipsum is not simply random text. It has roots in a piece of classical Latin literature from 45 BC, making it over 2000 years old. Richard McClintock, a Latin professor at Hampden-Sydney College in Virginia, looked up one of the more obscure Latin words, consectetur, from a Lorem Ipsum passage, and going through the cites of the word in classical literature, discovered the undoubtable source. Lorem Ipsum comes from sections 1.10.32 and 1.10.33 of “de Finibus Bonorum et Malorum” (The Extremes of Good and Evil) by Cicero, written in 45 BC. This book is a treatise on the theory of ethics, very popular during the Renaissance. The first line of Lorem Ipsum, “Lorem ipsum dolor sit amet..”, comes from a line in section 1.10.32.

The standard chunk of Lorem Ipsum used since the 1500s is reproduced below for those interested. Sections 1.10.32 and 1.10.33 from “de Finibus Bonorum et Malorum” by Cicero are also reproduced in their exact original form, accompanied by English versions from the 1914 translation by H. Rackham.

Where can I get some?

There are many variations of passages of Lorem Ipsum available, but the majority have suffered alteration in some form, by injected humour, or randomised words which don’t look even slightly believable. If you are going to use a passage of Lorem Ipsum, you need to be sure there isn’t anything embarrassing hidden in the middle of text. All the Lorem Ipsum generators on the Internet tend to repeat predefined chunks as necessary, making this the first true generator on the Internet. It uses a dictionary of over 200 Latin words, combined with a handful of model sentence structures, to generate Lorem Ipsum which looks reasonable. The generated Lorem Ipsum is therefore always free from repetition, injected humour, or non-characteristic words etc.

The post Test Post 2 03-11 appeared first on McAfee Blog.

Test post delete 2 – 03-11

Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..

Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..

Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..

Test heading one..

Test heading two..

Test heading three…

The post Test post delete 2 – 03-11 appeared first on McAfee Blog.

Test Post 1 03-11

What is Lorem Ipsum?

Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry’s standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. It was popularised in the 1960s with the release of Letraset sheets containing Lorem Ipsum passages, and more recently with desktop publishing software like Aldus PageMaker including versions of Lorem Ipsum.

Why do we use it?

It is a long established fact that a reader will be distracted by the readable content of a page when looking at its layout. The point of using Lorem Ipsum is that it has a more-or-less normal distribution of letters, as opposed to using ‘Content here, content here’, making it look like readable English. Many desktop publishing packages and web page editors now use Lorem Ipsum as their default model text, and a search for ‘lorem ipsum’ will uncover many web sites still in their infancy. Various versions have evolved over the years, sometimes by accident, sometimes on purpose (injected humour and the like).

The post Test Post 1 03-11 appeared first on McAfee Blog.

Test post delete – 03-11

Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..

Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..

Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..Lorem ipsum..

The post Test post delete – 03-11 appeared first on McAfee Blog.

New TikTok Privacy Policy Confirms Chinese Staff Can Access European Users' Data

Popular short-form video-sharing service TikTok is revising its privacy policy for European users to make it explicitly clear that user data can be accessed by some employees from across the world, including China. The ByteDance-owned platform, which currently stores European user data in the U.S. and Singapore, said the revision is part of its ongoing data governance efforts to limit employee

Former Apple worker pleads guilty to $17m mail and wire fraud charges

Nefarious schemes included harvesting motherboard components and selling them back to Apple

A one-time Apple employee working as a buyer within the iGiant's supply chain department has pleaded guilty to mail and wire fraud charges spanning multiple years, ultimately costing the company $17 million.…

The OpenSSL security update story – how can you tell what needs fixing?

How to Hack! Finding OpenSSL library files and accurately identifying their version numbers...

ossl-code-1200

US Treasury thwarts DDoS attack from Russian Killnet group

Yet another pathetic 'stunt' from pro-Kremlin criminals

The US Treasury Department has thwarted a distributed denial of service (DDoS) attack that officials attributed to Russian hacktivist group Killnet.…

Employee Volunteers Enrich Communities From the Farm to the Theatre and Beyond

Cisconians delight in contributing to their communities in a variety of ways including at the local theatre, farm and library. Cisco’s paid Time2Give benefit encourages team members to volunteer at the places where their passions thrive.

How should you decide where to get involved? Customer Success Program Manager Kate Pydyn advises: “Find something that speaks to your passion while giving back. There are so many opportunities that involve being outdoors, crafting, teaching skills you’ve developed, telling stories or providing comfort.”

With ten paid days a year to give, these Cisconians demonstrate that building relationships with people, the arts and the earth can increase fulfillment, connection and community.

Harvesting good will

Urban farming is an issue very close to the heart of Petra Hammerl, a senior enterprise customer success manager who works on Duo Security. Hammerl frequently volunteers at Farm City Detroit, part of Detroit Blight Busters. Using Time2Give, Hammerl has shared the experience by “bringing a crew of awesome co-workers which has been amazing and a lot of fun,” she said.

Petra Hammerl, Kate Pydyn and Emily Gennrich give their time at Farm City Detroit

“It felt great to take action! There are so many problems in the world, and I often feel powerless to make a difference. What I did was small, but with all of the volunteers together, the work that was done makes a real difference in the lives of my neighbors.” – Kate Pydyn

Pydyn and Emily Gennrich, a manager of operations for security customer success at Cisco Secure, joined in on the fun by contributing to multiple facets of gardening from weeding to harvesting food. “It felt great to take action! There are so many problems in the world, and I often feel powerless to make a difference. What I did was small, but with all of the volunteers together, the work that was done makes a real difference in the lives of my neighbors,” Pydyn said.

Community connections at the library

Senior Communications Manager, Brand Strategy & Design at Cisco Secure Chrysta Cherrie spent her Time2Give as a sighted assistant at the VISIONS vendor fair, hosted at the Ann Arbor District Library Downtown. “I was really happy to take some time to volunteer at the VISIONS vendor fair for people who are blind, visually impaired or physically disabled,” Cherrie said.

Learning how to be a sighted assistant was “a reminder that we can do more when we can rely on each other. Taking the time to better understand how someone makes their way through life gives you a chance to build empathy,” Cherrie said. She escorted attendees around the event where exhibitors offered products and services like electronic readers, leader dogs and transportation. There were also talks throughout the day and Cherrie helped attendees navigate between the presentation and vendor areas.

Meeting attendees of the VISIONS vendor fair and experiencing how meaningful the event is also moved Cherrie. The fair “brings out folks throughout southeast Michigan, so there’s a good chance that the person you’re assisting will run into some friends, and getting to see people connect like that can’t help but make you feel good,” Cherrie said.

Lights up on employee volunteers

Jenny Callans, a senior design researcher who works on Duo Security, serves as the chair of the Friends of the Detroit Film Theatre’s Auxiliary, a part of the Detroit Institute of Arts. “We support the mission of the Friends of the Detroit Film Theatre to make great niche films accessible to audiences,” she said. To do that, the organization is responsible for building a community of film fans and overseeing how donations are spent.

Volunteer

For Callans, the most meaningful part of using Time2Give to support the FDFT and the DIA is sharing her love of film with others. Time2Give supports her duties as FDFT chair, and gives her a sense of connection when she’s visiting the DFT to take in a movie. “Sitting in a theatre next to my young adult son, but surrounded by strangers watching a film that is unusual or unexpected but which moves me and challenges me to think is the best part hands-down,” Callans said.

Employee volunteer program multiplies impact

From supporting youth to volunteering at community hubs, Time2Give “is a fantastic opportunity to have a long-lasting, meaningful relationship with your community by volunteering as a board or committee member! Having a long-term presence with an org is amazingly impactful, for you and for the organization,” Callans said.

Time2Give is one of Cherrie’s favorite things about working at Cisco. She says, “Take advantage of the opportunity! Time2Give is a great way to give back to your community and the people and causes that you care about.”

Stay tuned for more posts celebrating the community engagement Time2Give fosters and check out our open roles to join in on giving back.


We’d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with Cisco Secure on social!

Cisco Secure Social Channels

Instagram
Facebook
Twitter
LinkedIn

The Rise of Rust, the ‘Viral’ Secure Programming Language That’s Taking Over Tech

Rust makes it impossible to introduce some of the most common security vulnerabilities. And its adoption can’t come soon enough.

Ransomware cost US banks $1.2 billion last year

Up 188% on 2020 but could be because financial institutions were encouraged to report incidents

Banks in the US paid out nearly $1.2 billion in 2021 as a result of ransomware attacks, a marked rise over the year before though it may simply be due to more financial institutions being asked to report incidents.…

Multiple Vulnerabilities Reported in Checkmk IT Infrastructure Monitoring Software

Multiple vulnerabilities have been disclosed in Checkmk IT Infrastructure monitoring software that could be chained together by an unauthenticated, remote attacker to fully take over affected servers.  "These vulnerabilities can be chained together by an unauthenticated, remote attacker to gain code execution on the server running Checkmk version 2.1.0p10 and lower," SonarSource researcher

IoT devices can undermine your security. Here are four ways to boost your defences

IoT is an increasingly common part of critical networks and cyber attackers know it. Here's how to avoid becoming a victim of their tactics.

These Android Apps with a Million Play Store Installations Redirect Users to Malicious Sites

A set of four Android apps released by the same developer has been discovered directing victims to malicious websites as part of an adware and information-stealing campaign. The apps, published by a developer named Mobile apps Group and currently available on the Play Store, have been collectively downloaded over one million times. According to Malwarebytes, the websites are designed to generate

Inside Raccoon Stealer V2

Raccoon Stealer is back on the news again. US officials arrested Mark Sokolovsky, one of the malware actors behind this program. In July 2022, after several months of the shutdown, a Raccoon Stealer V2 went viral. Last week, the Department of Justice's press release stated that the malware collected 50 million credentials. This article will give a quick guide to the latest info stealer's version

The Most Vulnerable Place on the Internet

Underwater cables keep the internet online. When they congregate in one place, things get tricky.

Experts Warn of SandStrike Android Spyware Infecting Devices via Malicious VPN App

A previously undocumented Android spyware campaign has been found striking Persian-speaking individuals by masquerading as a seemingly harmless VPN application. Russian cybersecurity firm Kaspersky is tracking the campaign under the moniker SandStrike. It has not been attributed to any particular threat group. "SandStrike is distributed as a means to access resources about the Bahá'í religion 

Still Using Passwords? Get Started with Phishing-Resistant, Passwordless Authentication Now!

Going beyond the hype, passwordless authentication is now a reality. Cisco Duo’s passwordless authentication is now generally available across all Duo Editions.

“Cisco Duo simplifies the passwordless journey for organizations that want to implement phishing-resistant authentication and adopt a zero trust security strategy.”
—Jack Poller, Senior Analyst, ESG

We received tremendous participation and feedback during our public preview, and we are now excited to bring this capability to our customers and prospects.

“Over the last few years, we have increased our password complexities and required 2FA wherever possible.  With this approach, employees had more password lock outs, password fatigue, and forgetting their longer passwords due to password rotations.  With Duo Passwordless, we are excited to introduce this feature to our employees to keep our password complexities in place and leverage different Biometric options whether that is using their mobile device, Windows Hello, or a provided FIDO security key. 

The Duo Push for passwordless authentication feature is simple and easy and introduces a more pleasant experience overall.  Using Duo’s device insight and application policies, we are able to leverage and verify the security of the mobile devices before the device is allowed to be used.  To top it off, Duo is connected to our SIEM and our InfoSec team is able to review detailed logs and setup alerts to be able to keep everything secure.”
—Vice President of IT, Banking and Financial Services Customer

As with any new technology, getting to a completely passwordless state will be a journey for many organizations. We see customers typically starting their passwordless journey with web-based applications that support modern authentication. To that effect, Duo’s passwordless authentication is enabled through Duo Single Sign-On (SSO) for federated applications. Customers can choose to integrate their existing SAML Identity provider such as Microsoft (ADFS, Azure), Okta or Ping Identity; or choose to use Duo SSO (Available across all Duo editions).

“Password management is a challenging proposition for many enterprises, especially in light of BYOD and ever increasing sophistication of phishing schemes. Cisco aims to simplify the process with its Duo passwordless authentication that offers out-of-box integrations with popular single sign-on solutions.”
—Will Townsend, Vice President & Principal Analyst, Networking & Security, Moor Insights & Strategy

Duo’s Passwordless Architecture

Duo Passwordless Architecture

Duo offers a flexible choice of passwordless authentication options to meet the needs of businesses and their use cases. This includes:

  1. FIDO2-compliant, phishing-resistant authentication using
    • Platform authenticators – TouchID, FaceID, Windows Hello, Android biometrics
    • Roaming authenticators – security keys (e.g. Yubico, Feitian)
  2. Strong authentication using Duo Mobile authenticator application

No matter which authentication option you choose, it is secure and inherently multi-factor authentication. We are eliminating the need for the weak knowledge factor (something you know – passwords) which are shared during authentication and can be easily compromised. Instead, we are relying on stronger factors, which are the inherence factor (something you are – biometrics) and possession factor (something you have – a registered device). A user completes this authentication in a single gesture without having to remember a complex string of characters. This significantly improves the user experience and mitigates the risk of stolen credentials and man-in-the-middle (MiTM) attacks.

Phishing resistant passwordless authentication with FIDO2

Passwordless authentication using FIDO2

FIDO2 authentication is regarded as phishing-resistant authentication because it:

  1. Removes passwords or shared secrets from the login workflow. Attackers cannot intercept passwords or use stolen credentials available on the dark web.
  2. Creates a strong binding between the browser session and the device being used. Login is allowed only from the device authenticating to an application.
  3. Ensures that the credential (public/private key) exchange can only happen between the device and the registered service provider. This prevents login to fake or phishing websites.

Using Duo with FIDO2 authenticators enables organizations to enforce phishing-resistant MFA in their environment. It also complies with the Office of Management and Budget (OMB) guidance issued earlier this year in a memo titled “Moving the U.S. Government Towards Zero Trust Cybersecurity Principles”. The memo specifically requires agencies to use phishing-resistant authentication method.

We understand that getting the IT infrastructure ready to support FIDO2 can be expensive and is typically a long-term project for organizations. In addition, deploying and managing 3rd party security keys creates IT overhead that some organizations are not able to undertake immediately.

Alternatively, using Duo Push for passwordless authentication is an easy, cost effective to get started on a passwordless journey for many organizations, without compromising on security.

Strong passwordless authentication using Duo Mobile

We have incorporated security into the login workflow to bind the browser session and the device being used. So, organizations get the same benefits of eliminating use of stolen credentials and mitigation of phishing attacks. To learn more about passwordless authentication with Duo Push, check out our post: Available Now! Passwordless Authentication Is Just a Tap Away.

 

 

Beyond passwordless: Thinking about Zero Trust Access and continuous verification

passwordless authentication

In addition to going passwordless, many organizations are looking to implement zero trust access in their IT environment. This environment typically is a mix of modern and legacy applications, meaning passwordless cannot be universally adopted. At least not until all applications can support modern authentication.

Additionally, organizations need to support a broad range of use cases to allow access from both managed and unmanaged (personal or 3rd party contractor) devices. And IT security teams need visibility into these devices and the ability to enforce compliance to meet the organization’s security policies such as ensuring that the operating system (OS) and web browser versions are up to date. The importance of verifying device posture at the time of authentication is emphasized in the guidance provided by OMB’s zero trust memorandum – “authorization systems should work to incorporate at least one device-level signal alongside identity information about the authenticated user.”

Duo can help organizations adopt a zero trust security model by enforcing strong user authentication across the board either through passwordless authentication where applicable or thought password + MFA where necessary, while providing a consistent user experience. Further, with capabilities such as device trust and granular adaptive policies, and with our vision for Continuous Trusted Access, organizations get a trusted security partner they can rely on for implementing zero trust access in their environment.

To learn more, check out the eBook – Passwordless: The Future of Authentication, which outlines a 5-step path to get started. And watch the passwordless product demo in this on-demand webinar .

Many of our customers have already begun their passwordless journey.  If you are looking to get started as well, sign-up for a free trial and reach out to our amazing representatives.

 


We’d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with Cisco Secure on social!

Cisco Secure Social Channels

Instagram
Facebook
Twitter
LinkedIn

Ritz cracker giant settles bust-up with insurer over $100m+ NotPetya cleanup

Deal could 'upend the entire cyber-insurance ecosystem and make it almost impossible to get meaningful cyber coverage'

Mondelez International has settled its lawsuit against Zurich American Insurance Company, which it brought because the insurer refused to cover the snack giant's $100-million-plus cleanup bill following the 2017 NotPetya outbreak.…

Dropbox Breach: Hackers Unauthorizedly Accessed 130 GitHub Source Code Repositories

File hosting service Dropbox on Tuesday disclosed that it was the victim of a phishing campaign that allowed unidentified threat actors to gain unauthorized access to 130 of its source code repositories on GitHub. "These repositories included our own copies of third-party libraries slightly modified for use by Dropbox, internal prototypes, and some tools and configuration files used by the

The spy who rented to me? Throwing the spotlight on hidden cameras in Airbnbs

Do you find reports of spy cams found in vacation rentals unsettling? Try these tips for spotting hidden cameras to put your worries to rest.

The post The spy who rented to me? Throwing the spotlight on hidden cameras in Airbnbs appeared first on WeLiveSecurity

Dropbox admits 130 of its private GitHub repos were copied after phishing attack

Personal info and data safe, stolen code not critical, apparently

Dropbox has said it was successfully phished, resulting in someone copying 130 of its private GitHub code repositories and swiping some of its secret API credentials.…

OpenSSL dodges a security bullet

The critical security vulnerability turned out to be two serious vulnerabilities. Still, they need patching ASAP.

OpenSSL downgrades horror bug after week of panic, hype

Relax, there's more chance of Babbage coming back to life to hack your system than this flaw being exploited

OpenSSL today issued a fix for a critical-turned-high-severity vulnerability that project maintainers warned about last week. …

OpenSSL patches are out – CRITICAL bug downgraded to HIGH, but patch anyway!

That bated-breath OpenSSL update is out! It's no longer rated CRITICAL, but we advise you to patch ASAP anyway. Here's why...

OpenSSL Releases Patch for 2 New High-Severity Vulnerabilities

The OpenSSL project has rolled out fixes to contain two high-severity flaws in its widely used cryptography library that could result in a denial-of-service (DoS) and remote code execution. The issues, tracked as CVE-2022-3602 and CVE-2022-3786, have been described as buffer overrun vulnerabilities that can be triggered during X.509 certificate verification by supplying a specially-crafted email

Researchers Disclose Details of Critical 'CosMiss' RCE Flaw Affecting Azure Cosmos DB

Microsoft on Tuesday said it addressed an authentication bypass vulnerability in Jupyter Notebooks for Azure Cosmos DB that enabled full read and write access. The tech giant said the problem was introduced on August 12, 2022, and rectified worldwide on October 6, 2022, two days after responsible disclosure from Orca Security, which dubbed the flaw CosMiss. "In short, if an attacker had

Chinese Hackers Using New Stealthy Infection Chain to Deploy LODEINFO Malware

The Chinese state-sponsored threat actor known as Stone Panda has been observed employing a new stealthy infection chain in its attacks aimed at Japanese entities. Targets include media, diplomatic, governmental and public sector organizations and think-tanks in Japan, according to twin reports published by Kaspersky. Stone Panda, also called APT10, Bronze Riverside, Cicada, and Potassium, is a

Ransomware: Not enough victims are reporting attacks, and that's a problem for everyone

The true impact of ransomware is unclear because some victims aren't disclosing that they've been attacked.

Ransomware is a global problem and getting worse, says US

US government looks at ways of limiting the impact of ransomware across the world.

Government by Gmail catches up with UK minister... who is reappointed anyway

Home Secretary 'nominally in charge' of nation's security apologizes for breach of tech protocols

The UK's Home Secretary – the minister in charge of policing and internal security – has been forced to apologize for breaching IT security protocols in government.…

SHA-3 code execution bug patched in PHP – check your version!

As everyone waits for news of a bug in OpenSSL, here's a reminder that other cryptographic code in your life may also need patching!

Black Friday and Cyber Monday Scams: Beware of the Pitfalls

By: McAfee

With the shopping bonanzas of Black Friday and Cyber Monday comes a flurry of deals and offers, some of which are too good to be true. Unfortunately, the latter instances often become scams run by fraudsters seeking to take advantage of the shopping frenzy. In this article, we will discuss some of the most notorious Black Friday and Cyber Monday scams that you should keep an eye out for.

Understanding the Scams

Scammers are skilled manipulators who know how to twist human emotions to their advantage. They create a sense of urgency, fear, or stress, which are heightened during the holiday season rush. As people scramble to get the best deals and hard-to-get items, they often let their guard down, making them easy targets for these fraudsters. Knowing how to identify these scams is the first step to safeguarding yourself from becoming a victim.

Top Online Shopping Scams to Avoid

Whether you’re a seasoned online shopper or just getting started, this guide will help you identify the top online shopping scams today and stay one step ahead to enjoy a safer, more secure shopping experience:

1. The Fake Order Scam

As everyone is hurrying to grab the best deals during the holiday season, keeping track of all the orders can be challenging. Scammers leverage this situation, sending fake order confirmations via email or text. These seemingly legit confirmations often contain malware or phishing links that the scammers use to steal your identity. The best strategy is to track your orders directly from the seller’s website or platform.

2. The Phony Tracking Number Scam

Similar to the fake order scam, fraudsters send fake package tracking notifications as an email attachment or link. Actual retailers will never send tracking numbers via an attachment. Scammers use these tactics to infect your device with malware or direct you to phishing sites. As always, visit the seller’s site to get accurate tracking information for your order.

3. The Bogus Website Scam

Scammers are skilled at creating fake email addresses and URLs that resemble those of legitimate companies. These phishing emails often lead to scam sites that capture your login credentials and payment information. Avoid clicking on email links; it’s safer to type the URL manually and search for deals.

Dig Deeper: 7 Ways to Tell If It’s a Fake

4. The Hot Deal Scam

Scarcity is a prime tool for scammers. They create fake websites offering popular items that are generally hard to find. These scams can result in you paying for a product you’ll never receive and the scammer possessing your payment details. The Better Business Bureau provides useful reviews to help verify the legitimacy of a product or seller.

5. The Fake Charity Scam

During the holiday season, there’s a surge in charity donations, and scammers know this trend. They set up bogus charities and employ high-pressure tactics to get you to donate. Be wary of organizations that accept payment only through gift cards, wire transfers, or cryptocurrency. The U.S. Federal Trade Commission (FTC) offers resources to ensure your donations reach legitimate charities.

Avoiding Scams on Black Friday and Cyber Monday

Amidst the whirlwind of savings and special offers, there’s a lurking concern that every savvy shopper should be aware of – scams. Protecting yourself from potential scams during these shopping bonanzas is paramount. Several strategies are available to help you stay one step ahead of potential scammers and ensure a safe and successful shopping experience during Black Friday and Cyber Monday. Here are strategies you can follow:

Stick with known, legitimate retailers online

One of the simplest ways to avoid scammers is to shop from familiar and reputable online retailers. If you’re unsure about a retailer, the U.S. Better Business Bureau provides listings to help you research their reputation.

Look for the lock icon in your browser when you shop

Secure websites start with “https,” with the extra “s” standing for “secure.” You’ll often see a padlock icon in the address bar of your browser. If you don’t see these security indicators, avoid purchasing on that website.

McAfee Pro Tip: When you’re visiting a website, it’s important to keep your radar up for a few essential clues that tell you whether it’s safe or not. Sure, we’ve talked about the ‘https’ thing in the web address, but there are other giveaways, too, like phony icons and symbols, how well the website’s put together, how fast it loads, and a bunch of other stuff. Want to know more about how to check out if a website’s the real deal or not? Check how to tell whether a website is safe.

6. The False Discount Scam

In this scam, fraudsters lure victims with advertisements offering significant discounts on popular products. These advertisements usually contain a link redirecting you to a fraudulent website where your personal and financial information gets stolen. Always cross-check the offered prices with those on the manufacturer’s or well-known retailers’ websites. Also, check if the seller provides complete contact information. A lack of information or a recently registered website should raise a red flag.

7. The Social Media Gift Exchange Scam

During the holiday season, a gift exchange scam often resurfaces on social media. The concept is simple: you buy a gift worth a certain amount, typically $10, and supposedly receive several gifts in return. However, the only person who benefits is the scammer who initiated the scheme. This type of scam is not only deceptive but also illegal. If you encounter such a scheme on social media, report it immediately.

Dig Deeper: 6 Tips for Protecting Your Social Media Accounts

8. The Fraudulent Gift Card Scam

Scammers love gift cards! They use emails or text messages to trick you into thinking you’ve received a gift card from a friend or family member. These messages often contain links that, when clicked, install malware on your device or steal your personal information. Always verify the source before clicking on any links. And remember, if a deal sounds too good to be true, it probably is.

9. The Non-existent E-tailer Scam

Beware of new e-commerce sites offering popular items at massive discounts. Scammers often create fake e-commerce sites that vanish after collecting money from their victims. Always research the seller’s reputation before making a purchase. If you can’t find any reviews or feedback about the seller, it’s better to avoid the risk.

Dig Deeper: 8 Ways to Know If Online Stores Are Safe and Legit

10. The Smishing Scam

Smishing is a scam where fraudsters send text messages posing as reputable companies to trick individuals into revealing personal information. During the holiday season, these messages often link to a supposed deal or gift. However, the link usually leads to a fraudulent website designed to steal your data. Treat unsolicited print messages with caution, and never click on suspicious links.

Final Thoughts

While the holiday season brings joy and excitement, it also increases online shopping scams. Scammers use a variety of tactics, including fake order confirmations, phony tracking numbers, bogus websites, and nonexistent e-tailers, to trick their victims. To protect yourself, always verify the source before clicking on any links, research sellers before purchasing, and avoid deals that seem too good to be true. By being vigilant and taking precautions, you can safely navigate through the holiday shopping frenzy and prevent yourself from falling victim to these Black Friday and Cyber Monday scams. And, of course, don’t forget to equip your devices with security solutions further to improve your security, privacy, and finances.

The post Black Friday and Cyber Monday Scams: Beware of the Pitfalls appeared first on McAfee Blog.

Last Years Open Source - Tomorrow's Vulnerabilities

Linus Torvalds, the creator of Linux and Git, has his own law in software development, and it goes like this: "given enough eyeballs, all bugs are shallow." This phrase puts the finger on the very principle of open source: the more, the merrier - if the code is easily available for anyone and everyone to fix bugs, it's pretty safe. But is it? Or is the saying "all bugs are shallow" only true for

Partner Summit 2022: Let’s Own the Opportunity to Build a World of Secure, Resilient Organizations

It’s Partner Summit week and, for me, it’s an important reminder that no one company, not even Cisco, can do it alone. Our partners provide diverse perspectives, expertise, and solutions offerings. Each partner plays a key part in delivering the outcomes and experiences our customers need, want, and expect. So, when we say, “Let’s Own It”, it’s a rally cry for Cisco and our partners alike to do our parts to seize the massive opportunity that we have in front of us and turn it into mutual success.

Together, I know we can achieve amazing things. Foremost on my mind right now is both the opportunity and necessity to empower customers with security resilience. Resilience means customers can protect the integrity of every aspect of their business so that they can withstand unpredictable threats or changes and emerge stronger. It’s about providing controlled, trusted access to applications and services, at any time, from any place.

Resilience can also help customers deal with issues the moment they arise. If changes are needed, they will have the visibility to determine priorities, thanks to actionable intelligence and insight in the face of some major security realities that they are dealing with every day.

One, businesses are more interconnected, meaning that a breach on anyone in the value chain has dramatic ripple effects on the others.

Two, security attacks are becoming more personalized. Individuals remain one of the easiest targets for cybercriminals and their attacks are becoming more sophisticated and customized for the individual.

Three, hybrid work is here to stay. People around the world will continue to work from anywhere, on managed and unmanaged devices, over secured and unsecured networks, to applications spread across multiple clouds and data centers.

Innovating to win: Summary of Partner Summit announcements

Our vision for enabling a more resilient organization is the Cisco Security Cloud. It’s an open, integrated security platform that will protect the integrity of entire IT ecosystems by safeguarding users, devices and applications across public clouds and private data centers, without public cloud lock-in. Delivering on the Security Cloud is part of our long-term product strategy; but the innovations we are announcing at Partner Summit this week are foundational elements that execute on this vision.

Specifically, we are announcing new solutions and technologies across our portfolio in Secure Connectivity, Network Security, and Zero Trust. I encourage all partners to drill down on each announcement in the accompanying blogs and news announcements. But here are the highlights of the announcements.

Secure Access by Duo

Helping increase resistance to phishing attacks and improve user experience through frictionless access using Duo Passwordless, which is now generally available with support for Duo Mobile as a passwordless authenticator.

Secure Firewall 3100 Series

Expanding the Cisco Secure Firewall 3100 series, the first firewall purpose-built for hybrid work, with the Secure Firewall 3105, ideal for branch office and similar use cases focused on performance at a competitive price point.

Secure Connectivity Enhancements

Strengthening Umbrella’s data loss prevention (DLP) capabilities by adding API-based enforcement and unified reporting to protect sensitive data, e.g., intellectual property and financial and healthcare information. This complements Umbrella’s current inline-DLP functionality and collectively forms multi-mode DLP.

Cloud Application Security

New Secure Workload capabilities delivering policy-as-code workload security for cloud-native and public-cloud application development. Common use cases for policy-as-code include access control to infrastructure and simplifying enterprise compliance and controls.

Our partner enablement commitments

Our strategy and our innovation roadmap are all designed to set you up, our partners, for long-term success. In addition, we are committed to several partner enablement programs to help you deliver more value to customers and to help you become more profitable. Examples include:

  • Simplifying how you do business with Cisco: We are taking active steps to simplify the ease of doing business with Cisco Secure in ways that accelerate your velocity and scaling our growth through the channel. We are continuing to invest in our partners’ programs, offers, and expanding our routes to market so that our partners can be more profitable with Cisco Secure.
  • Compelling offers and promotions: Recent examples include “One Year on Us” that we expanded to include the complete SaaS and recurring software subscription portfolio. Specifically, partners can offer customers preferential pricing with 1-year free with a 3-year subscription purchase.
  • Investment in awareness: We want customers to ask for Cisco Secure by name, so we are aggressively investing in brand awareness. This includes a new secure the enterprise campaign “if it’s connected, it’s protected” designed to strengthen Cisco’s market perception as a world-class security solutions provider. We are also planning to back this up by investing more than $50 million in paid digital marketing specifically for security over the next year.

How you can own this week

Partner Summit is for you. So, my call-to-action is for you to maximize the value you get out of this week by attending as many of the informative, high-impact security sessions many teams worked hard to create. I am really looking forward to meeting as many of you as possible – on the expo floor, at the sessions, or in our 1-on-1 meetings.

Security has never been more critical and the need for resiliency is a requirement for virtually every business. The time for us to own it and innovate to win this future together has never been better.


We’d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with Cisco Secure on social!

Cisco Secure Social Channels

Instagram
Facebook
Twitter
LinkedIn

Critical RCE Vulnerability Reported in ConnectWise Server Backup Solution

IT service management software platform ConnectWise has released Software patches for a critical security vulnerability in Recover and R1Soft Server Backup Manager (SBM). The issue, characterized as a "neutralization of Special Elements in Output Used by a Downstream Component," could be abused to result in the execution of remote code or disclosure of sensitive information. ConnectWise's

When Your Neighbor Turns You In

Authoritarian societies depend on people ratting each other out for activities that were recently legal—and it's already happening in the US.

Kioxia warns of potential cost of US chip policy over China

Nice NAND industry you have there, would be a shame if something happened to it

Attempts to reorganize supply chains to cut out China and foil its attempts to build a high-tech chip industry will be costly and may simply cause the Middle Kingdom to redouble its efforts, says memory maker Kioxia.…

❌