A vulnerability that can be exploited to determine if a user is connected to a VPN and hijack active TCP connections in a VPN tunnel has been found to affect various Linux and Unix operating systems. The vulnerability, tracked as CVE-2019-14899, was discovered recently by a team of researchers from the University of New Mexico. They privately reported their findings to the developers of the affected operating systems some time…
A Lamborghini-driving Moscow hacker who called his operation Evil Corp and has ties to the FSB Russian intelligence service was indicted by US authorities Thursday for the cybertheft of tens of millions of dollars. An indictment unsealed in Pittsburgh named Maksim Yakubets and his Evil Corp partner Igor Turashev as the main figures in a group which inserted malware on computers in dozens of countries to steal more than $100…
Microsoft this week issued guidance regarding Windows Hello for Business (WHfB) public keys that persist even after the devices they are tied to are removed from Active Directory. These WHfB public keys, the tech company explains, are written to the on-premises Active Directory after the user sets up WHfB. Tied to the user and the device added to Azure AD, these keys are considered orphaned when the device is removed….
Chinese tech giant Huawei is asking a U.S. federal court to throw out a rule that bars rural phone carriers from using government money to purchase its equipment on security grounds. The lawsuit announced Thursday is Huawei Technologies Ltd.’s second legal challenge this year to Trump administration efforts to reduce its already minimal U.S. market presence. The company is scrambling to preserve its global sales of smartphones and network gear…
Competing in today’s digital marketplace requires that organizations be cyber-savvy. End users and customers need organizations to understand things like web application development, digital shopping and other online transactions, the effective use of social media, and using digital tools to get and keep customers. And with all of this digital transformation taking place, cybercriminals are relying on organizations to implement security as an afterthought, which often results in new security…
Cisco Talos this week released a new tool designed to make it easier to create complex applications that have lengthy dependency chains. Called Mussels, the cross-platform, general-purpose dependency build automation tool allows software developers to easily download, build, and assemble app dependencies. The tool’s creator is Micah Snyder, a Cisco Talos researcher and developer at ClamAV, Cisco’s cross-platform and open source antivirus toolkit. The tool was initially developed with a…
Moxa Urges Users to Replace Discontinued Industrial AP Filled With Security Holes More than a dozen serious vulnerabilities have been found in an industrial wireless access point (AP) made by Taiwan-based industrial networking and automation solutions provider Moxa, but the vendor only addressed the flaws several months after exploits were made public. Researcher Samuel Huntley discovered in early 2018 that Moxa’s AWK-3121 series industrial AP/bridge/client product was affected by a…
Amazon Web Services (AWS) has expanded its portfolio with three new services and capabilities meant to help organizations build and operate securely in the cloud. With the new Amazon Detective, customers can increase efficiency when investigating incidents across workloads. Currently available in preview, the service leverages machine learning, statistical analysis, and graph theory. Once enabled in the AWS Management Console, Amazon Detective taps into data from AWS CloudTrail and Amazon…
A hacker was able to access private customer reports on HackerOne after one of the platform’s security analysts inadvertently shared a session cookie. The incident occurred last week during an online exchange about a bug bounty report that the hacker submitted to HackerOne. Specifically, the HackerOne Security Analyst copied a cURL command from a browser console and sent it to the hacker without removing sensitive information from it. This resulted…
Globalization and business transformation have created an incredibly complex worldwide supply chain for almost all manufacturers. Hardware ostensibly manufactured in the U.S. will inevitably include components manufactured in many different locations around the world — including nations that are in other circumstances described as ‘adversary states’. The potential for interference in the supply chain, by foreign governments or criminal gangs, exists. An example of this threat was seen in the…