The distribution of malware to random targets through a trusted piece of software crosses a new line, and one that that open source community is clearly not comfortable with as a form of hacktivism.
Providing authentication services to tens of thousands of companies and government agencies, Okta is a supply chain vendor that could cause a cascade of security breaches if compromised.
When attackers are able to insert themselves into the engineering environment via CI/CD security failings, this gives them a direct line to the production environment. This is often an area of security that receives an inadequate level of attention.
Russian hackers are attacking MFA configuration weaknesses, something that is often set by default, and following up with a PrintNightmare attack to take over Windows systems.
Civilian federal agencies and companies in the critical infrastructure space may be looking at a three-day cyber incident reporting window should recent cybersecurity legislation make it through the House.
Samsung phones produced between 2017 and 2021 have a severe encryption flaw that can open up the entire device to an attacker without much effort.
Attacker exploited Wormhole network’s unique status as a “bridge” between the Solona blockchain and a variety of other DeFi projects. A signature verification vulnerability allowed them to make this connection.
The pattern of the cyber attacks fit Russia’s general intentions and past actions, but seemed restrained. The banks and government websites were ultimately only inconvenienced for a few hours.
Credential stuffing has grown year-over-year, particularly during the Covid-19 pandemic. Every new data breach that leaks compromised accounts to the dark web provides these campaigns with that much more fuel.
What exactly does the FTC expect companies to do to steer clear of legal action? Thus far it has not laid out specific requirements, but has called for “reasonable steps” to include following the CISA published guidance on Log4J.