SecurityWeek

An easy-to-exploit local privilege escalation vulnerability has been found and patched in Rapid7’s InsightIDR intruder analytics solution, a researcher revealed on Monday.

As a threat researcher, I’ve advised security teams of organizations big and small, across both public and private sectors. So after a decade in DFIR, people often ask me about the craziest or most interesting things I’ve seen on client networks. I have quite a few interesting stories under my belt, from state and local governments, to start ups, and large enterprises. I’m excited to share a few of these ‘Tales from the SOC’ with the larger cybersecurity community.

Apple announced on Monday at its 2019 Worldwide Developers Conference (WWDC) a new authentication system that should provide better privacy protections compared to similar products from Facebook and Google.

A top Australian university with close ties to the country's government and security services on Tuesday said it had been the victim of a vast hack by a "sophisticated operator" who gained access to 19 years of sensitive data.

As organizations become more and more digitally connected, concerns about secure access seem to loom larger than ever. With more users connecting to more resources, how can organizations ensure people requesting access are who they say they are? 

The Open Technology Institute (OTI) has responded to GCHQ/NCSC's article on 'Principles for a More Informed Exceptional Access Debate' with an 'Open Letter to GCHQ on the Threats Posed by the Ghost Proposal'.

A data breach at billing collections service provider American Medical Collection Agency (AMCA) could impact many of the company’s customers. One victim is medical testing firm Quest Diagnostics and roughly 12 million of its patients.

The authors of the GandCrab ransomware have reportedly announced on underground forums that they are closing their operation after claiming that they have earned over $150 million a year. 

A group of researchers has devised a new proof-of-concept attack that targets the touchscreen of Near-Field Communication (NFC)-enabled mobile devices such as smartphones and allows remote control of the devices. 

Luxembourg-based laboratory testing services giant Eurofins Scientific on Monday revealed that some of its IT systems have been infected with a piece of ransomware.

Several vulnerabilities have been found and patched in the Kace K1000 systems management appliance from Quest.

Hackers can use synthetic clicks to bypass many of the privacy and security features implemented last year by Apple in its macOS operating system, a researcher has revealed.

Unpatched vulnerabilities found in the rkt container runtime can be exploited by an attacker to escape the container and gain root access to the host. 

Google this week announced a new policy that aims at eliminating the use of deceptive installation tactics among Chrome browser extensions. 

Security researchers from ESET have analyzed several PowerShell scripts used by the Russia-linked Turla threat group in recent attacks. 

Microsoft has reminded users to patch the Windows vulnerability tracked as BlueKeep and CVE-2019-0708 due to the high risk of exploitation.

2.3 billion files are currently exposed and accessible through misconfigured network-attached storage (NAS) devices, FTP and rsync servers, and Amazon S3 buckets to anyone on the internet. That's 750 million more than 12 months ago, and despite Amazon's largely successful attempts to limit the exposure of its S3 buckets.

Ireland's supreme court on Friday dismissed a bid by Facebook to block a landmark data security case from progressing to the European Court of Justice.

Fort Lee, New Jersey-based cloud data protection company OwnBackup on Thursday announced that it raised $23.25 million in a Series C funding round.

Amazon on Wednesday added the ability to tell its Alexa digital assistant to forget what it has heard in a move that could assuage concerns about Echo devices remembering conversations.The command "Alexa, delete everything I said today" will get the virtual aide to do just that, the internet colossus said in an online post.