SecurityWeek

UK's National Audit Office Says Online Fraud Needs to be Treated More Seriously by Government

A bug in Linux’s systemd init system causes root permissions to be given to services associated with invalid usernames, and while this could pose a security risk, exploitation is not an easy task.

Google has notified some employees that their personal information may have been compromised as a result of the data breach suffered by travel technology firm Sabre.

In the wake of global malicious attacks such as WannaCry and NotPetya, Microsoft this week announced a new feature meant to keep users’ data safe from ransomware and other type of malware.

A free tool that can scan networks to discover computers that are vulnerable to the NSA-linked EternalBlue exploit is now available.

The details of several vulnerabilities affecting Schneider Electric’s U.motion Builder software have been disclosed before the vendor released any patches.

Internet radio service 8tracks this week informed users of a database hack, prompting them to reset their passwords to prevent account compromise.

Human rights group Liberty was today granted permission by the UK High Court to challenge part of the UK government's mass surveillance Investigatory Powers Act (IPA). The IPA, nicknamed the Snoopers' Charter, became UK law in November 2016 and came into force at the end of December.

A wiper malware disguised as ransomware wreaked havoc this week, infecting the systems of numerous organizations across more than 60 countries.

Cisco has warned users that devices running the company’s IOS or IOS XE software are affected by several high severity vulnerabilities that can be exploited for remote code execution and denial-of-service (DoS) attacks.

The developers of the BIND and Knot DNS software have released updates to patch a potentially serious vulnerability that can be exploited to bypass authentication mechanisms.

Pro-ISIS hacking group Team System DZ is continuing its website defacement campaign. Over last weekend several websites in Ohio and Maryland were forced to shut down after messages threatening President Trump and supporting Islamic State were posted on the sites.

There is a pressing need for technical assurance standards for industrial control systems (ICS). This is the conclusion and recommendation of a new paper from CREST (a leading UK accreditation body), and is supported by the UK National Cyber Security Centre (NCSC).

An analysis conducted using Mozilla’s Observatory tool has showed that modern security technologies are increasingly used by Alexa top 1 million websites.

As employees spend more time outside the office in the summer months, risk increases. Most of us bring our work, and the devices that we use to access it, with us wherever we go, including on our vacations. Keeping up with work so that we’re not buried when we return is a real temptation, although not the healthiest way to decompress. 

Microsoft has released an update for Azure Active Directory (AD) Connect to address an “important” vulnerability that can be exploited to hijack the accounts of privileged users.

In my last article I discussed how defenders need to borrow a page from bad actors with regard to embracing automation. There’s another lesson we can learn from how cyber criminals operate – sharing information to boost success. 

Never confuse a marketecture from an architecture. Marketecture is how to simplify a company’s technology to represent what a product can do. 

NotPetya/GoldenEye Malware Overwrites Master Boot Record 

An update released earlier this month by Kaspersky Lab for its Anti-Virus for Linux File Server product addresses several potentially serious vulnerabilities discovered by researchers at Core Security.