The Register-Security News.

"Ivanti commits to secure-by-design overhaul after vulnerability nightmare."

Views expressed in this cybersecurity, cyber crime update are those of the reporters and correspondents.  Accessed on 05 April 2024, 0215 UTC.

Content and Source:  https://feedly.com/i/subscription/feed%2Fhttp%3A%2F%2Fwww.theregister.co.uk%2Fsecurity%2Fheadlines.atom/The Register-Security News.

Please scroll down to read your selections.  Thanks for joining us today.

Russ Roberts (https://www.hawaiicybersecurityjournal.net).

The Register – Security

84K followers34 articles per week#security#tech

27

MOST POPULAR

Ivanti commits to secure-by-design overhaul after vulnerability nightmare

Resource Hijacking (Enterprise T1496)

•

by Connor Jones / 11h

CEO addresses whirlwind start to 2024 and how it plans to prevent a repeat Ivanti has committed to adopting a secure-by-design approach to security as it gears up for an organizational overhaul in response to the multiple vulnerabilities in Connect Secure exploited earlier this year.…

Feds probe alleged classified US govt data theft and leak

State Department investigates alleged data theft

•

by Jessica Lyons / 7h

State Dept keeps schtum 'for security reasons' Updated Uncle Sam is investigating claims that some miscreant stole and leaked classified information from the Pentagon and other national security agencies.…

World's second-largest eyeglass lens-maker blinded by infosec incident

Hoya halts production after cyberattack

•

by Simon Sharwood / 25min

Also makes components for chips, displays, and hard disks, and has spent four days groping for a fix If ever there was an incident that brings the need for good infosec into sharp focus, this is the one: Japan's Hoya – a maker of eyeglass and contact lenses, plus kit used to make semiconductor manufacturing, flat panel displays, and hard disk drives – has halted some production and sales activity

TODAY

Ransomware gang did steal residents' confidential data, UK city council admits

by Connor Jones / 15h

INC Ransom emerges as a growing threat as some ex-LockBit/ALPHV affiliates get new gigs Leicester City Council is finally admitting its "cyber incident" was carried out by a ransomware gang and that data was stolen, hours after the criminals forced its hand.…

YESTERDAY

When AI attacks

by David Gordon / 17h

Watch this webinar for a hair raising journey into the darkest depths of GenAI enabled cyber crime Sponsored Post Artificial intelligence (AI) offers enormous commercial potential but also substantial risks to data security if it is harnessed by cyber criminals intent on stealing or corrupting sensitive information for their own gain.…

Nearly 1M medical records feared stolen from City of Hope cancer centers

by Jessica Lyons / 1d

Is there no cure for this cyber-plague? Nearly one million individuals' personal details, financial account information, and medical records may well have been stolen from City of Hope systems in the United States.…

Cyberattack hits Omni Hotels systems, taking out bookings, payments, door locks

50by Jessica Lyons / 1d

As WhatsApp, Facebook Messenger, other Meta bits plus Apple stuff fall offline today Updated Omni Hotels & Resorts' computer systems have been offline since Friday due to what the American luxury hospitality chain called a "disruption."…

Security pioneer Ross Anderson dies at 67

Professor Ross Anderson passes away

•

by Connor Jones / 1d

A man with a list of accolades long enough for several lifetimes, friends remember his brilliance Obituary Venerable computer scientist and information security expert Ross Anderson has died at the age of 67.…

Google bakes new cookie strategy that will leave crooks with a bad taste

Chrome fights cookie theft with DBSC

•

by Dan Robinson / 1d

Device Bound Session Credentials said to render cookie theft useless Google reckons that cookie theft is a problem for users, and is seeking to address it with a mechanism to tie authentication data to a specific device, rendering any stolen cookies useless.…

APR 2, 2024

Meet clickjacking's slicker cousin, 'gesture jacking,' aka 'cross window forgery'

by Thomas Claburn / 1d

Web devs advised to do their part to limit UI redress attacks Web browsers still struggle to prevent clickjacking, an attack technique first noted in 2008 that repurposes web page interface elements to deceive visitors.…

Microsoft slammed for lax security that led to China's cyber-raid on Exchange Online

Microsoft criticized for lax security

•

by Simon Sharwood / 1d

CISA calls for 'fundamental, security-focused reforms' to happen ASAP, delaying work on other software A review of the June 2023 attack on Microsoft's Exchange Online hosted email service – which saw accounts used by senior US officials compromised by a China-linked group called "Storm-0558" – has found that the incident would have been preventable save for Microsoft's lax infosec culture and sub

Feds finally decide to do something about years-old SS7 spy holes in phone networks

2 TTPs

•

64by Jessica Lyons / 2d

•

FCC investigates telecom network vulnerabilities

And Diameter, too, for good measure The FCC appears to finally be stepping up efforts to secure decades-old flaws in American telephone networks that are allegedly being used by foreign governments and surveillance outfits to remotely spy on and monitor wireless devices.…

OWASP server blunder exposes decade of resumes

OWASP discloses wiki misconfiguration data breach

•

22by Jessica Lyons / 2d

Irony alerts: Open Web Application Security Project Foundation suffers lapse A misconfigured MediaWiki web server allowed digital snoops to access members' resumes containing their personal details at the Open Web Application Security Project (OWASP) Foundation.…

Pandabuy confirms crooks nabbed data on 1.3M punters

PandaBuy data leak affects 1.3M users

•

by Connor Jones / 2d

Nothing says 'sorry' like 10 percent off shipping for a month Ecommerce platform Pandabuy has apologized after two cybercriminals were spotted hawking personal data belonging to 1.3 million of its customers.…

Microsoft warns deepfake election subversion is disturbingly easy

25by Jessica Lyons / 2d

Simple stuff like slapping on a logo fools more folks and travels further As hundreds of millions of voters around the globe prepare to elect their leaders this year, there's no question that trolls will try to sway the outcomes using AI, according to Clint Watts, general manager of Microsoft's Threat Analysis Center.…

Rubrik files to go public following alliance with Microsoft

Rubrik, Microsoft-backed cloud data security,

•

by Lindsay Clark / 2d

Cloud cyber resilience model could raise $700M despite $278M losses Cloud security provider Rubrik has filed for an IPO on the New York Stock Exchange following a flurry of similar flotations.…

Polish officials may face criminal charges in Pegasus spyware probe

Poland investigates previous government's Pegasus

•

31by Jessica Lyons / 2d

Victims of the powerful surveillance tool will soon find out the truth Former Polish government officials may face criminal charges following an investigation into their use of the notorious spyware Pegasus to surveil political opponents and others.…

INC Ransom claims to be behind 'cyber incident' at UK city council

Leicester City Council services restored

•

by Connor Jones / 2d

This follows attack on NHS services in Scotland last week The cyber skids at INC Ransom are claiming responsbility for the ongoing cybersecurity incident at Leicester City Council, according to a post caught by eagle-eyed infosec watchers.…