Parse notes
Sponsored
The shocking reality of critical vulnerabilities in publicly-exposed containers. Kubernetes (K8s) has transformed the way applications are deployed and managed in the cloud-native landscape. Based on scans of over 200,000 cloud accounts, the Wiz Security Research team [5] exposes how many clusters are at risk, and what it means for your cloud defense.
Kentucky healthcare organization Norton Healthcare is informing about 2.5 million individuals that their personal information was compromised in a ransomware data extortion hack earlier this year. The organization said that it did not pay the ransom demands as the hackers leaked 4.7 TB of data. This included contact information, dates of birth, Social Security numbers, health and insurance information, and medical identification numbers.
Forescout Vedere Labs has identified a total of 21 new vulnerabilities affecting Sierra Wireless Airlink cellular routers and their dependencies. Of these vulnerabilities, 1 is rated critical and 9 are rated as high. Over 86,000 internet-facing devices were discovered by the researchers, with less than 10% being fully patched. This article includes mitigation and patching instructions.
A group of researchers from Singapore discovered a series of 14 vulnerabilities that impact a total of 710 5G smartphone models from Android, Apple, routers, and USB modems. The 5Ghoul attacks range from temporary service disruption to network downgrade and can be executed without any secret knowledge of the victim, such as SIM card details. The flaws involve impersonating a legitimate 5G base station with proof-of-concept exploits available.
This guidance is focused on people and processes, so organizations can effectively respond during critical incidents. The guide explains how to structure the human elements of incident responses with best practices to help navigate the crucial hours after breach detection and help security teams and leaders steer an investigation when plunged into an incident.
This post is part 2 of a blog series by Datadog focusing on Kubernetes security fundamentals. It details the attack surface of the Kubernetes API in both managed and unmanaged clusters. The post provides guidance on how to reduce the network exposure of these API endpoints and how to encrypt communication.
The Trend Micro Managed XDR team discusses how the aspnet_compiler.exe, a legitimate Microsoft Process, is used to inject the AsyncRAT payload. The investigation revealed different tactics employed by the attackers, including phishing campaigns, code injection, and the use of dynamic DNS servers as well as the ability to evade detection by Antivirus software.
Sponsored
Next week: Join cybersecurity experts from MANDIANT, GOOGLE, and NUCLEUS as they uncover how to effectively leverage Vulnerability Threat Intelligence (VTI) [12] to prioritize threats and shape strategies for risk acceptance. Throughout the discussion, they will discuss how to use Vulnerability Threat Intelligence to gauge the true impact of vulnerabilities, shift from patch prioritization to an informed strategy, and preemptively tackle zero-day vulnerabilities and other imminent cyber threats.
BBOT (Bighuge BLS OSINT Tool) is a modular, recursive OSINT framework that can execute the entire OSINT workflow in a single command.
A free and open vulnerabilities database and the packages they impact. It also includes the tools to aggregate and correlate these vulnerabilities.
Amazon Inspector has launched a set of open source plugins and an API to enable container scanning at build time directly from a CI/CD plugin. Inspector has also launched a new capability to enable agent-less continuous monitoring of EC2 instances. It added a new feature that utilizes generative AI to provide assisted code remediation for Lambda functions.
Cisco Talos has discovered a new campaign by the Lazarus Group called "Operation Blacksmith." The campaign involves the use of three new malware families written in DLang, including two remote access trojans (RATs) that use Telegram for command and control. The malware families discovered in Operation Blacksmith demonstrate a shift in Lazarus Group's tactics and the use of DLang as a programming language.
An ex-employee from First Republic Bank allegedly deployed malware, broke services, and damaged the cloud environment after getting fired for watching pornography on his work laptop. He also impersonated a colleague who got the promotion he wanted. According to the bank, the total damage exceeded $220,000.
Log4J took the world by storm when it was first disclosed as being actively exploited in December 2021. A report from Veracode shows that roughly 38% of Log4J applications are still using vulnerable versions of the library.
FBI has issued a clarification to SEC-required data breach disclosure requirements, allowing for a 30 to 60-day delay in cases of national emergency, but not exceeding 120 days without an exemptive order from the SEC.
This playbook was developed to help vCISOs in their journey, covering vCISO goals, pitfalls to avoid, 5 phases (research, understand, prioritize, execute, and report), and the key activities for each phase.
AWS Secrets Manager recently announced a 99.99% availability SLA. In the event that AWS fails to meet this SLA in a given billing period, users will be eligible for a credit.