SecurityWeek

When using cyber threat intelligence to track cyber criminal activity and impact, it’s clear that the bad guys follow the path of least resistance and most profit. This is why I wrote about cyber threats not generally being as complex as they’re made out to be.

Google informed bug bounty hunters on Thursday that it has made some changes to its Vulnerability Rewards Program (VRP), including offering more money for certain types of flaws.

Bug bounty platform provider HackerOne announced on Thursday that open source projects can benefit from its Professional services at no cost if they can meet certain conditions.

Google announced this week that it will expand Safe Browsing on macOS in an effort to protect Chrome users against unwanted ad injections and unauthorized settings changes.

A researcher managed to bypass Google’s ReCaptcha v2 and has decided to make the discovery public after Google failed to patch it for several months.

Windows 10 Creators Update, the platform iteration expected to arrive next month, will provide users with improved control over software updates and privacy settings, Microsoft says.

For the next two months, developers who report vulnerabilities as part of Microsoft’s Online Services bounty program will receive doubled rewards for their work, the company announced.

Financial institutions have long been an attractive target for threat actors due to the information they hold, their role as part of critical national infrastructure and their often global presence.  It’s natural to think that their adversaries are all financially motivated, but many are not. In 2016 we saw drivers like hacktivism, ideological differences and intelligence gathering also motivating attacks.

The New York State Department of Financial Services (DFS) 'first-in-the-nation' cybersecurity regulation for the financial services industry is, as of 1 March 2017, operational . One of the most highly regulated industries is now even more regulated in New York.

Researchers at Trustwave have identified a backdoor in GSM gateways manufactured by Hong Kong-based voice over IP (VoIP) solutions provider DBL Technology.

Cloudflare informed customers on Wednesday that it has found no evidence of the recently discovered memory leak being exploited for malicious purposes before it was patched.

It only took the developers of the Slack team collaboration tool five hours to patch a critical vulnerability that could have been exploited to steal a user’s private token and gain access to their account.

The recently disclosed security incident involving forged cookies affected 32 million user accounts, Yahoo said in its annual filing to the U.S. Securities and Exchange Commission (SEC).

Recent analysis has found 132 Android applications in the official Google Play app store that have been infected with tiny hidden IFrames linking to malicious domains, Palo Alto Networks researchers warn.

New Dridex 4 Banking Malware With AtomBombing Code Injection is Expected to be Used Against U.S. Banks 

HPE-owned network access solutions provider Aruba has patched XML external entity (XXE) and cross-site scripting (XSS) vulnerabilities in its AirWave network management platform.The vulnerabilities were reported to Aruba by Pichaya Morimoto of SEC Consult and independently by two other researchers. Both weaknesses affect AirWave’s VisualRF component.

An update released by Siemens for its RUGGEDCOM network management system (NMS) patches a couple of cross-site request forgery (CSRF) and cross-site scripting (XSS) vulnerabilities.Used in various sectors worldwide, the RUGGEDCOM NMS allows organizations to monitor, configure and maintain their RUGGEDCOM mission-critical networks.

Security Leaders Must Speak the Language of the Audience They Are Trying to Communicate With