FreshRSS

πŸ”’
❌ Secure Planet Training Courses Updated For 2019 - Click Here
There are new available articles, click to refresh the page.
Before yesterdaySecurity

Warning: Samsung Devices Under Attack! New Security Flaw Exposed

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned of active exploitation of a medium-severity flaw affecting Samsung devices. The issue, tracked asΒ CVE-2023-21492Β (CVSS score: 4.4), impacts select Samsung devices running Android versions 11, 12, and 13. The South Korean electronics giant described the issue as an information disclosure flaw that could be exploited by a

The real cost of a free lunch – Week in security with Tony Anscombe

By: Editor

Don't download software from non-reputable websites and sketchy links – you might be in for more than you bargained for

The post The real cost of a free lunch – Week in security with Tony Anscombe appeared first on WeLiveSecurity

Teen in court after '$600K swiped from DraftKings gamblers'

Bet he didn't expect these computer hacking charges

An 18-year-old Wisconsin man has been charged with allegedly playing a central role in the theft of $600,000 from DraftKings customer accounts.…

Moderator Applications Open

Hello /r/netsec,

I am excited to announce that we are opening up applications for new moderators to join the existing moderation team. As our community continues to expand, we want to ensure that we maintain the quality and integrity of the content shared here.

If you are passionate about information security and have a strong desire to help maintain and foster community, we encourage you to apply!

Preferred qualifications:

  1. A history of posting links and/or comments to /r/netsec, demonstrating your active participation in the community.
  2. At least 3 years of academic or professional experience in information security.
  3. Not involved with the marketing team of any major vendor, to ensure unbiased moderation.
  4. Have read and agree with the /r/netsec posting guidelines.

Application Process:

To apply, please submit the following information via ModMail:

  1. Briefly describe your experience in information security, including any relevant certifications or qualifications.
  2. Explain your history of posting and participating in the /r/netsec community.
  3. Confirm that you are not involved with the marketing team of any major vendor.
  4. Describe why you want to become a moderator for /r/netsec and how you can contribute to maintaining and enhancing the quality of our community.

Applying shouldn't feel like a chore; ~1 paragraph per question is more than enough.

We'll review your application and /r/netsec posting history before deciding.

New moderator selections will be announced on May 31st.

submitted by /u/sanitybit
[link] [comments]

Russian IT guy sent to labor camp for DDoSing Kremlin websites

Pro-Ukraine techie gets hard time

A Russian IT worker accused of participating in pro-Ukraine denial of service attacks against Russian government websites has been sentenced to three years in a penal colony and ordered to pay 800,000 rubles (about $10,000). …

How You, or Anyone, Can Dodge Montana’s TikTok Ban

Montana’s TikTok ban will be impossible to enforce. But it could encourage copycat crackdowns against the social media app.

Don't get scammed by fake ChatGPT apps: Here's what to look out for

ChatGPT is a wildly popular AI chatbot and scammers are happy to try to take advantage of that -- and you.

Privacy Sandbox Initiative: Google to Phase Out Third-Party Cookies Starting 2024

Google has announced plans to officially flip the switch on its twice-delayedΒ Privacy SandboxΒ initiatives as it slowly works its way to deprecate support for third-party cookies in Chrome browser. To that end, the search and advertising giant said it intends to phase out third-party cookies for 1% of Chrome users globally in the first quarter of 2024. "This will support developers in conducting

Dr. Active Directory vs. Mr. Exposed Attack Surface: Who'll Win This Fight?

Active Directory (AD) is among the oldest pieces of software still used in the production environment and can be found in most organizations today. This is despite the fact that its historical security gaps have never been amended. For example, because of its inability to apply any security measures beyond checking for a password and username match, AD (as well the resources it manages) is

Developer Alert: NPM Packages for Node.js Hiding Dangerous TurkoRat Malware

Two malicious packages discovered in the npm package repository have been found to conceal an open source information stealer malware calledΒ TurkoRat. The packages – named nodejs-encrypt-agent and nodejs-cookie-proxy-agent – were collectively downloaded approximately 1,200 times and were available for more than two months before they were identified and taken down. ReversingLabs, which broke

A Mysterious Group Has Ties to 15 Years of Ukraine-Russia Hacks

Kaspersky researchers have uncovered clues that further illuminate the hackers’ activities, which appear to have begun far earlier than originally believed.

UK's GDPR replacement could wipe out oversight of live facial recognition

Question not whether UK police should use facial recog, but how, says surveillance chief

Biometrics and surveillance camera commissioner Professor Fraser Sampson has warned that independent oversight of facial recognition is at risk just as the policing minister plans to "embed" it into the force.…

Searching for AI Tools? Watch Out for Rogue Sites Distributing RedLine Malware

Malicious Google Search ads for generative AI services like OpenAI ChatGPT and Midjourney are being used to direct users to sketchy websites as part of a BATLOADER campaign designed to deliverΒ RedLine StealerΒ malware. "Both AI services are extremely popular but lack first-party standalone apps (i.e., users interface with ChatGPT via their web interface while Midjourney uses Discord)," eSentire

WebKit Under Attack: Apple Issues Emergency Patches for 3 New Zero-Day Vulnerabilities

Apple on ThursdayΒ rolled out security updatesΒ to iOS, iPadOS, macOS, tvOS, watchOS, and the Safari web browser to address dozens of flaws, including three new zero-days that it said are being actively exploited in the wild. The three security shortcomings are listed below - CVE-2023-32409Β - A WebKit flaw that could be exploited by a malicious actor to break out of the Web Content sandbox. It

Apple warns of three WebKit vulns under active exploitation, dozens more CVEs across its range

High school student and Amnesty International named among bug-finders

Apple has issued a bushel of security updates and warned that three of the flaws it's fixed are under active attack.…

Apple’s secret is out: 3 zero-days fixed, so be sure to patch now!

All Apple users have zero-days that need patching, though some have more zero-days than others.

Cisco squashes critical bugs in small biz switches

You'll want to patch these as proof-of-concept exploit code is out there already

Cisco rolled out patches for four critical security vulnerabilities in several of its network switches for small businesses that can be exploited to remotely hijack the equipment.…

Steer Clear of Rip-offs: Top Tips for Safer Online Shopping

By: McAfee

Everyone loves a great deal when they shop online. Until they discover it’s a rip-off.Β 

Social media ads for vintage wear. Website ads for home entertainment gear. Search ads for handbags. Some of these ads aren’t what they seem. Instead of leading you to deals on a trustworthy ecommerce site, the ads take you to a bogus page designed to steal your money and personal info.Β 

Unfortunately, it happens. And one global report estimated that online shoppers lost $41 billion to fraud in 2022. How do scammers pull it off? With the same tools that legitimate businesses use.Β Β 

Let’s look at how they do it and how you can steer clear of their tricks.Β 

Organized cybercrime in your cartΒ 

Many of today’s scammers work in organized fashion. They oversee large cybercrime operations that run much like a business. They employ web designers, coders, marketing teams, and customer call centers that mimic a genuine online retailer. Which makes sense. The more they can look and act like the real thing, the more likely they can lure victims into their online stores.Β 

Smaller bands of scammers get in on this action as well. Just as a small business can easily create an online store with any number of off-the-shelf services and solutions, so can a couple of scammers.Β 

In this way, scammers large and small can readily create a professional-looking website, create effective ads to drive traffic to it, and collect financial information from there.Β Β 

Yet, some scammers don’t steal financial information outright. They might indeed ship you the goods, but they won’t be the goods you ordered. They’re counterfeit. And it might be part of a large-scale operation that exploits child workers.Β Β 

Whether they’re out to steal your money or sell you knockoff goods, online shopping scams tend to ramp up around gift-giving seasons. They’ll bait shoppers with hard-to-find items, tout steep discounts on other popular items, and otherwise play into the rush of holiday gift buying. Yet they crop up year-round as well. Really, any time you shop is a time to be on the lookout for them.Β Β 

Top tips for safer shopping onlineΒ 

1. Stick with known, legitimate retailers online.Β 

This is a great piece of advice to start with. Directly typing in the correct address for online stores and retailers is a prime way to avoid scammers online. In the case of retailers that you don’t know much about, the U.S. Better Business Bureau (BBB) asks shoppers to do their research. Ensure that the retailer has a good reputation. The BBB makes that easier with a listing of retailers you can search by typing in their name.Β Β 

Also in the U.S., you can visit the website of your state’s Secretary of State. There you can search for the business in question, learn when it was founded, if it’s still active, or if it exists at all. For businesses based in a state other than your own, you can visit that state’s Secretary of State website for information. For a state-by-state list of Secretaries of State, you can visit the Secretary of State Corporate Search page here.Β 

For a listing of businesses with international locations, organizations like S&P Global Ratings and the Dun and Bradstreet Corporation can provide background information.Β 

2. Research new sellers for their history and reviews.Β 

Never heard of that retailer before? See when they launched their website. A relatively new site might be a sign that it’s part of a scam.Β 

A quick visit to the ICANN (Internet Corporation for Assigned Names and Numbers) website can show you certain background information for any website you type in. Given how quickly and easily scammers can register and launch a website, this kind of information can help you sniff out a scam.Β Β Β 

Of course, it might also indicate a new business that’s entirely legitimate, so a little more digging is called for. That’s where reviews come in. Aside from the resources listed above, a simple web search of β€œ[company name] reviews” or β€œ[company name] scam” can help you find out if the retailer is legit.Β 

3. Look for the lock icon in your browser when you shop.Β 

Secure websites begin their addresses with β€œhttps,” not just β€œhttp.” That extra β€œs” stands for β€œsecure,” which means that it uses a secure protocol for transmitting sensitive info like passwords, credit card numbers, and the like over the internet. It often appears as a little padlock icon in the address bar of your browser, so double-check for that. If you don’t see that it’s secure, it’s best to avoid making purchases on that website.Β 

4. Pay with a credit card instead of your debit card.Β 

Credit cards offer fraud protections that debit cards don’t. Another key difference: when fraud occurs with a debit card, you fight to get your money backβ€”it’s gone straight out of your account. With a credit card, the issuer fights to get their money back. They’re the ones who take the financial hit.Β 

Additionally, in the U.S., the Fair Credit Billing Act offers the public protection against fraudulent charges on credit cards. The act gives citizens the power to dispute charges over $50 for goods and services that were never delivered or otherwise billed incorrectly. Note that many credit card companies have their own policies that improve upon the Fair Credit Billing Act as well. However, debit cards aren’t afforded the same protection under the Act. Avoid using a debit card while shopping online and use your credit card instead.Β 

5. Use two-factor authentication on your accounts.Β 

Two-factor authentication is an extra layer of defense on top of your username and password. It adds a one-time-use code to access your login procedure, typically sent to your smartphone by text or call. Together, that makes it tougher for a crook to hack your account. If any of your accounts support two-factor authentication, the few extra seconds it takes to set up is more than worth the big boost in protection you’ll get.Β 

6. Use a VPN if you’re shopping on public Wi-Fi.Β 

Public Wi-Fi in coffee shops and other public locations can expose your private surfing to prying eyes because those networks are open to all. A virtual private network (VPN) encrypts your browsing, shopping, and other internet traffic. That makes it secure from bad actors who try to intercept your data on public Wi-Fi, which can include your passwords and credit card numbers.Β 

7. Protect your devices for shopping.Β 

A complete suite of online protection software like McAfee+ can offer layers of extra security while you shop. It includes web browser protection that can block malicious and questionable links that might lead you down the road to malware or a phishing scamβ€” along with a password manager that can create and securely store strong, unique passwords.Β 

Avoiding shopping rip-offs on social mediaΒ 

Social media has made it easier for sellers large and small to reach customers online. It’s made it easier for scammers to reach victims too.Β 

If you’re on social media, you’ve certainly seen your share of ads. Some are from companies and retailers you know and trust. Yet more are from names you’ve likely never heard of. They might be legitimate businesses, yet they might be fronts for a convincing-looking scam.Β 

These ads end up on social media the same way ads from legitimate businesses do, by way of social media ad platforms. Social media companies created these platforms so advertisers can reach millions of individual users based upon their age group, hobbies and interests, past purchases, and so on.Β Β 

For example, a scammer might target younger shoppers with an interest in retro fashion. From there, the scammer can narrow that down to target people who live in metropolitan areas who like 1980s memorabilia. The scammers then create an ad that takes that audience to a phony website loaded with bogus t-shirts, coats, and bags.Β 

All of it costs relatively little. A small ad budget of a few hundred dollars can give scammers exposure to millions of potential victims.Β 

The best way to avoid getting stung by these sites is to do your homework. Seek out the company’s track record. Look for reviews. And if you’re unsure, take a pass. Don’t shop with that company.Β 

Buyer be wary … 

Shopping scams can look and feel rather sophisticated today. With a host of low-cost and easy-to-use tools for publishing and advertising online, scammers of all sizes can create bogus shopping experiences that look convincing.Β 

So buyers be wary. Before you click or tap on that ad, do some research. Determine if the company is legitimate, if it’s had complaints waged against it, and how those complaints were resolved. And always use your credit card. It offers the best consumer protections you have in the event you do end up getting scammed.Β Β 

The post Steer Clear of Rip-offs: Top Tips for Safer Online Shopping appeared first on McAfee Blog.

How to Stop Google From Deleting Your Inactive Account

Your inactive profiles, like Gmail or Docs, could turn into digital dust later this year. A few clicks can save them.

Microsoft decides it will be the one to choose which secure login method you use

Certificate-based authentication comes first and phones last

Microsoft wants to take the decision of which multi-factor authentication (MFA) method to use out of the users' hands and into its own.…

Top 5 search engines for internet‑connected devices and services

A roundup of some of the handiest tools that security professionals can use to search for and monitor devices that are accessible from the internet

The post Top 5 search engines for internet‑connected devices and services appeared first on WeLiveSecurity

S3 Ep135: Sysadmin by day, extortionist by night

Laugh (sufficiently), learn (efficiently), and then let us know what you think in our comments (anonymously, if you wish)...

This Cybercrime Syndicate Pre-Infected Over 8.9 Million Android Phones Worldwide

A cybercrime enterprise known asΒ Lemon GroupΒ is leveraging millions of pre-infected Android smartphones worldwide to carry out their malicious operations, posing significant supply chain risks. "The infection turns these devices into mobile proxies, tools for stealing and selling SMS messages, social media and online messaging accounts and monetization via advertisements and click fraud,"

How to password-protect a file in Apple Pages (and when you might want to)

If you work with documents in Apple Pages that contain sensitive information, you might want to consider locking those documents behind a password.

Zero Trust + Deception: Join This Webinar to Learn How to Outsmart Attackers!

Cybersecurity is constantly evolving, but complexity can give hostile actors an advantage. To stay ahead of current and future attacks, it's essential to simplify and reframe your defenses. Zscaler Deception is a state-of-the-art next-generation deception technology seamlessly integrated with the Zscaler Zero Trust Exchange. It creates a hostile environment for attackers and enables you to track

How to Reduce Exposure on the Manufacturing Attack Surface

Digitalization initiatives are connecting once-isolated Operational Technology (OT) environments with their Information Technology (IT) counterparts. This digital transformation of the factory floor has accelerated the connection of machinery to digital systems and data. Computer systems for managing and monitoring digital systems and data have been added to the hardware and software used for

Escalating China-Taiwan Tensions Fuel Alarming Surge in Cyber Attacks

TheΒ risingΒ geopolitical tensionsΒ between China and Taiwan in recent months have sparked a noticeable uptick in cyber attacks on the East Asian island country. "From malicious emails and URLs to malware, the strain between China's claim of Taiwan as part of its territory and Taiwan's maintained independence has evolved into a worrying surge in attacks," the Trellix Advanced Research CenterΒ saidΒ 

8220 Gang Exploiting Oracle WebLogic Flaw to Hijack Servers and Mine Cryptocurrency

The notorious cryptojacking group tracked asΒ 8220 GangΒ has been spotted weaponizing a six-year-old security flaw in Oracle WebLogic servers to ensnare vulnerable instances into a botnet and distribute cryptocurrency mining malware. The flaw in question isΒ CVE-2017-3506Β (CVSS score: 7.4), which, when successfully exploited, could allow an unauthenticated attacker to execute arbitrary commands

Darknet Carding Kingpin Pleads Guilty: Sold Financial Info of Tens of Thousands

A U.S. national has pleaded guilty in a Missouri court to operating a darknet carding site and selling financial information belonging to tens of thousands of victims in the country. Michael D. Mihalo, aka Dale Michael Mihalo Jr. and ggmccloud1, has been accused of setting up a carding site called Skynet Market that specialized in the trafficking of credit and debit card data. Mihalo and his

Apple Thwarts $2 Billion in App Store Fraud, Rejects 1.7 Million App Submissions

Apple has announced that it prevented over $2 billion in potentially fraudulent transactions and rejected roughly 1.7 million app submissions for privacy and security violations in 2022. The computing giant said it terminated 428,000 developer accounts for potential fraudulent activity, blocked 105,000 fake developer account creations, and deactivated 282 million bogus customer accounts. It

Critical Flaws in Cisco Small Business Switches Could Allow Remote Attacks

Cisco has released updates to address a set of nine security flaws in its Small Business Series Switches that could be exploited by an unauthenticated, remote attacker to run arbitrary code or cause a denial-of-service (DoS) condition. "These vulnerabilities are due to improper validation of requests that are sent to the web interface," CiscoΒ said, crediting an unnamed external researcher for

Meet β€œAI”, your new colleague: could it expose your company’s secrets?

Before rushing to embrace the LLM-powered hire, make sure your organization has safeguards in place to avoid putting its business and customer data at risk

The post Meet β€œAI”, your new colleague: could it expose your company’s secrets? appeared first on WeLiveSecurity

Six million patients' data feared stolen from PharMerica

Cue the inevitable class action lawsuit

PharMerica, one of the largest pharmacy service providers in the US, has revealed its IT systems were breached – and it's feared the intruders stole personal and healthcare data belonging to more than 5.8 million past customers…

'Strictly limit' remote desktop – unless you like catching BianLian ransomware

Do it or don't. We're not cops. But the FBI are, and they have this to say

The FBI and friends have warned organizations to "strictly limit the use of RDP and other remote desktop services" to avoid BianLian infections and the ransomware gang's extortion attempts that follow the data encryption.…

The US Post Office Is Spying on the Mail. Senators Want to Stop It

The USPS carries out warrantless surveillance on thousands of parcels every year. Lawmakers want it to endβ€”right now.

These ransomware victims are paying more to recover data

While the number of businesses reporting attacks this past year remained flat, a Sophos report makes one thing clear: There is a cheaper alternative every business should know.

How to deny websites access to your location in Safari (and why you should)

If you value your privacy, you may want to prevent certain websites from accessing your location data. Here's why and how to do it.
❌