Parse notes
U-Haul has reported a cyberattack where 67,000 customers in the United States and Canada had their personal data compromised, including names, dates of birth, and driver's license numbers. No financial information was taken. The attack targeted the U-Haul Dealer and Team Members system used for reservations and customer records.
A serious vulnerability (CVE-2024-23204) in Apple Shortcuts allows attackers to access sensitive data without user permission. Attackers exploiting the vulnerability can access and transmit sensitive data, posing a risk to user privacy and security. Apple has addressed the issue with updates to iOS and macOS. It is urging users to install the patches promptly to safeguard their information.
Prescription orders in the US are being delayed as pharmacies are experiencing a "nation-state" cyber attack. The attack is believed to coming from a foreign government. It is targeting major pharmacy chains, including Walgreens, Rite Aid, and CVS Health. The attack has disrupted the pharmacies' prescription-filling systems, causing delays across the country.
This list covers the top cybersecurity trends that Gartner sees coming in 2024. 2024 will be the year that gen AI-driven security products finally emerge. 2025 will see those tools delivering real risk-management outcomes.
AWS Nitro Enclaves are a Trusted Execution Environment that is offered for running sensitive workloads by AWS. It is somewhat lacking in documentation. This post offers a look at what Nitro Enclaves are and how images and attestation work. The post also includes a TL;DR checklist at the top.
Truffle Security performed a scraping project to generate a list of Amazon Account IDs that are used by Thinkst to generate AWS canaries. The Truffle Security team identified about a half dozen Account IDs which can be used to identify if an AWS Key ID is a canary token. The capability has been added to the open-source TruffleHog tool.
Sponsored
Last chance to join the webinar this Wednesday, February 28! SINGLE PANE OF GLASS (SPOG) has long been derided as vendor-speak. But is it actually useful in describing the way enterprises manage vulnerabilities in sprawling IT environments [11]? Join Scott Kuffer, Founder of Nucleus Security, and Peter Wolski, Head of Cyber and
and effective vulnerability management programs. Register here, free
A compiled checklist of 300+ tips for protecting digital security and privacy in 2024.
VAmPI is a vulnerable API made with Flask. It includes vulnerabilities from the OWASP top 10 vulnerabilities for APIs. VAmPI was created to evaluate the efficiency of tools used to detect security issues in APIs.
The Living Off the Pipeline project is an inventory of how development tools commonly run in CI/CD pipelines can be leveraged to achieve code execution by running on untrusted code changes or via workflow injection.
An M&M vending machine at a university was secretly using facial recognition-enabled collecting data without consent. The machines could estimate age/gender. The university has confirmed that it will disable the tech and that it plans to remove the machines, though the timeline is unclear.
Redis servers are under attack by new malware that deploys rootkits and cryptominers. The attackers are disabling Redis protections and loopback policies to open doors for the Migo malware payload and fetching XMRig miners from GitHub.
The FTC has ordered Avast to pay $16.5 million and banned it from selling users’ web browsing data or licensing it for advertising purposes. Avast collected a staggering amount of personal data amounting to more than 8 petabytes between the years of 2014 to 2020 while marketing its products as protecting users from browser tracking.
An AI threat security diagram and guide from OWASP around AI security threats.
Reddit and Google have reached a deal to allow Google to scrape Reddit posts to train AI models. Google will also provide Reddit with tools to improve its internal search.
Crooks stole almost $10 million from Jeff "Jihoz" Zirlin, co-founder of the video game Axie Infinity, and the Ronin Network.