📊 2023 OpenText Cybersecurity Threat Report
News, Announcements, Tech Discussions
A previously unknown compression side channel in GPUs can expose images thought to be private. DAN GOODIN - 9/26/2023 GPUs from all six of the major suppliers are vulnerable to a newly discovered attack that allows malicious websites to read the usernames, passwords, and other sensitive visual data displayed by other websites, researchers have demonstrated in a paper published Tuesday.The cross-origin attack allows a malicious website from one domain—say, example.com—to effectively read the pixels displayed by a website from example.org, or another different domain. Attackers can then reconstruct them in a way that allows them to view the words or images displayed by the latter site. This leakage violates a critical security principle that forms one of the most fundamental security boundaries safeguarding the Internet. Known as the same origin policy, it mandates that content hosted on one website domain be isolated from all other website domains. >> Full Article <<
September 26, 2023 By Bill Toulas A new APT hacking group named 'AtlasCross' targets organizations with phishing lures impersonating the American Red Cross to deliver backdoor malware.Cybersecurity firm NSFocus identified two previously undocumented trojans, DangerAds and AtlasAgent, associated with attacks by the new APT group.NSFocus reports that the AtlasCross hackers are sophisticated and evasive, preventing the researchers from determining their origin."After an in-depth study of the attack process, NSFOCUS Security Labs found that this APT attacker is quite different from known attacker characteristics in terms of execution flow, attack technology stack, attack tools, implementation details, attack objectives, behavior tendency and other main attribution indicators," explains NSFocus."The technical level and cautious attitude shown by this attacker during this activity are also worthy of attention." >> Full Article <<
September 25, 2023 By Bill Toulas The Better Outcomes Registry & Network (BORN), a healthcare organization funded by the government of Ontario, has announced that it is among the victims of Clop ransomware's MOVEit hacking spree.BORN is a perinatal and child registry that collects, interprets, shares and protects critical data about pregnancy, birth and childhood in the province of Ontario.MOVEit attacks leveraged a zero-day vulnerability (CVE-2023-34362) in the Progress MOVEit Transfer software to compromise and steal data from thousands of organizations worldwide.BORN first became aware of the security breach on May 31 and posted a public notice on its site while simultaneously notifying the relevant authorities (Privacy Commissioner of Ontario). >> Full Article <<
September 26, 2023 By Sergiu Gatlan Google has assigned a new CVE ID (CVE-2023-5129) to a libwebp security vulnerability exploited as a zero-day in attacks and patched two weeks ago.The company initially disclosed the flaw as a Chrome weakness, tracked as CVE-2023-4863, rather than assigning it to the open-source libwebp library used to encode and decode images in WebP format.This zero-day bug was jointly reported by Apple Security Engineering and Architecture (SEAR) and the Citizen Lab at The University of Toronto's Munk School on Wednesday, September 6, and fixed by Google less than a week later....New maximum severity CVEHowever, it has now assigned another CVE ID, CVE-2023-5129, marking it as a critical issue in libwebp with a maximum 10/10 severity rating. This change has significant implications for other projects using the libwebp open-source library.Now officially recognized as a libwebp flaw, it involves a heap buffer overflow in WebP, impacting Google Chrome versions precedin
CISO churn is a hidden cybersecurity threat. Major security initiatives or implementations can take longer than the residency of a single CISO, and constant churn can leave cracks or gaps in security. September 26, 2023 By Kevin Townsend The average tenure of a Chief Information Security Officer said to sit between 18 to 24 months. This is barely enough time to get feet under the table, never mind a meaningful seat at the table. Two questions arise: why is there such volatile churn in this space; and how does it affect enterprise cybersecurity?Reasons for CISO churn Cause #1: the scapegoat effectThe potential for CISOs to be used as scapegoats for security incidents is widely accepted and potentially growing. It can simply be internal: ‘We got breached under your watch, so we’ll blame you and let you go.’ But it can equally be a complex external issue ultimately caused by a lack of legal clarity in the Computer Fraud and Misuse Act (CFAA), a lack of clarity on bounty hunting and secur
My Yahoo account is being deleted but I would like to preserve participation in old Community threads.Per the following thread the method is to request a change. A PM was sent to Ssherjj, the moderator who helped at that time but it seems she may no longer be active. I tried via support at Webroot but they can’t help with this request.https://community.webroot.com/community-101-2/re-registering-on-community-320246My current, soon to be old, email address is If someone can help I would be happy to provide the new email address via email or private message. Thank you for even reading!
Recently, we shared the results of a new survey on phishing knowledge and click habits of 7,000 workers in the U.S., U.K., Australia/New Zealand, Germany, France, Italy and Japan. In it, we focused a fair bit on COVID-19 and its effects on people and their online habits with the increase in WFH, as well as on cybercriminal tactics themselves. We then worked with Dr. Prashanth Rajivan, assistant professor at the University of Washington and expert in human behavior and technology, to get his take on the survey results. Below are snippets from our interview with Dr. Rajivan, where we asked him about some of the nitty-gritty in the report and what he thinks the numbers mean. Thanks for taking the time to share additional information with our Community. I’d like to dive right in by examining some the numbers around the mass shift to working from home. In the survey, 54% of workers worldwide said they had increased the amount of time they spend working from home due to the COVID-19 pande
by: Paul Horowitz One way to test out MacOS Sonoma beta but without installing it directly on a Mac is to install the Sonoma beta into a virtual machine instead. There are several different ways to do this, but for this particular article we will show you how you can setup and install MacOS Sonoma beta in a virtual machine by using the free UTM software.To use this particular method of running Sonoma in a VM, you’ll want an Apple Silicon Mac with at least 60GB of disk space available and 16GB RAM, and you’ll then use the Sonoma beta IPSW file provided by Apple to install Sonoma into a VM using the free UTM app. It may sound complex, but it’s actually pretty easy, as you’ll see as we walk you through the steps. ⇨⇨ Full Article ⇦⇦
Hello Webroot Community,As Webroot users, we all know the importance of online security, especially in today's digital landscape. Webroot provides us with powerful tools to protect our devices and data, but there are also best practices and tips that can further enhance our security.I'm curious to hear from fellow Webroot users: What are your go-to strategies for maximizing your online security? Are there specific settings, features, or habits you rely on to keep your devices safe from threats? Do you have any recommendations for securing different types of devices or networks?For instance, I find that [mention your own security tip or practice, e.g., regularly updating my software, using strong and unique passwords with a password manager, or enabling two-factor authentication] has made a significant difference in my online security.Let's share our collective knowledge and experiences to help others make the most out of their Webroot protection. Your insights could be invaluable in cr
Another sign that a new version of Windows is on the way!Jun 14, 2021, 9:06am EDT Microsoft is ending support for Windows 10 on October 14th, 2025. It will mark just over 10 years since the operating system was first introduced. Microsoft revealed the retirement date for Windows 10 in an updated support life cycle page for the OS. Thurrott reports that this is the first time Microsoft has ever described the end of support for Windows 10.It’s not clear exactly when the support document was updated, but Thurrott reports it only previous documented “when specific Windows 10 versions would leave support,” and not the entire OS. It could be another hint that a new version of Windows is on the way.Microsoft keeps dropping Windows 11 hintsMicrosoft has been dropping lots of hints that it’s ready to launch Windows 11. The software maker is holding a special Windows event to reveal the “next generation” of the OS next week. The event starts at 11AM ET, and the event invite includes a window tha
September 22, 2023 By Brian Krebs The password manager service LastPass is now forcing some of its users to pick longer master passwords. LastPass says the changes are needed to ensure all customers are protected by their latest security improvements. But critics say the move is little more than a public relations stunt that will do nothing to help countless early adopters whose password vaults were exposed in a 2022 breach at LastPass.LastPass sent this notification to users earlier this week. LastPass told customers this week they would be forced to update their master password if it was less than 12 characters. LastPass officially instituted this change back in 2018, but some undisclosed number of the company’s earlier customers were never required to increase the length of their master passwords.This is significant because in November 2022, LastPass disclosed a breach in which hackers stole password vaults containing both encrypted and plaintext data for more than 25 million users.
by: Jamie CuevasStaying safe online with your Apple devices is an ongoing effort, and it’s important to keep yourself vigilant and informed about potential threats and risks. While the Mac, iPhone, and iPad, are generally much more secure than their competitor counterparts, that doesn’t mean you should be completely oblivious to risks to your personal information, logins, privacy, and general security.We’re going to walk through six important tips to remember for when you’re online with your Mac, iPhone, or iPad, to help to insure your and your devices safety. ⇨⇨ Full Article ⇦⇦
September 25, 2023 By Helga Labus US educational nonprofit organization National Student Clearinghouse (NSC) has revealed that the breach of its MOVEit server ended up affecting almost 900 colleges and universities, and resulted in the theft of personal information of their students.The National Student Clearinghouse MOVEit breach noticeNSC provides educational reporting, data exchange, verification, and research services to around 3,600 North American colleges and universities and 22,000 high schools.NSC has filed a breach notification letter with the California Attorney General’s Office on behalf of the affected schools.The notification letter informed affected students – whose total number has not been disclosed – about the security breach resulting from a cyberattack that exploited a vulnerability in the MOVEit managed file transfer solution. >> Full Article <<
September 25, 2023 By Bill Toulas Security researchers discovered a new campaign that distributes a new version of the Xenomorph malware to Android users in the United States, Canada, Spain, Italy, Portugal, and Belgium.Analysts at cybersecurity company ThreatFabric have been tracking Xenomorph activity since February 2022 and note that the new campaign launched in mid-August.The latest version of Xenomorph is targeting users of cryptocurrency wallets and various U.S. financial institutions. >> Full Article <<
Early days but we will soon find out if this is genuine.Ransomed.vc claims to have access to some 6,000 files from the tech giant September 25, 2023 By Levi Winslow There’s a new gang on the dark web that claims it’s breached all of Sony’s systems in a ransomware attack.According to a September 25 article from Australian cybersecurity publication Cyber Security Connect, the PlayStation maker was cracked open by Ransomed.vc, a new outfit of hackers that’s only been operating since September—though the publication suggests the gang has connections to previous dark web forums and groups. Cyber Security Connect reports that the hack allegedly unearthed screenshots of Sony’s internal log-in page, an internal PowerPoint presentation outlining test bench details, several Java files, and a document tree of the entire leak housing 6,000 files. >> Full Article <<
September 25, 2023 By Pierluigi Paganini Experts warn of a critical vulnerability in the TeamCity CI/CD server that can be exploited to take over a vulnerable server.JetBrains TeamCity is a popular and highly extensible Continuous Integration (CI) and Continuous Delivery (CD) server developed by JetBrains, a software development company known for its developer tools. TeamCity is designed to automate various aspects of the software development process, including building, testing, and deploying applications, while providing a wide range of features and integrations to support collaborative development.Sonar’s Vulnerability Research Team discovered a critical security vulnerability, tracked as CVE-2023-42793 (CVSS score of 9.8), in TeamCity. >> Full Article <<
A stealthy APT known as Gelsemium has been observed targeting a government entity in Southeast Asia for persistence and intelligence collection. September 25, 2023 By Ionut Arghire A stealthy advanced persistent threat (APT) actor known as Gelsemium has been observed targeting a government entity in Southeast Asia to establish persistence and collect intelligence, cybersecurity firm Palo Alto Networks reveals.As part of the observed activity, spanning over a period of six months in late 2022 and into 2023, the threat actor deployed a variety of web shells to support lateral movement and malware delivery, along with backdoors, a Cobalt Strike beacon, and various other tools.Palo Alto Networks did not make any claims regarding attribution, but noted that others linked Gelsemium to China in the past. >> Full Article <<
September 25, 2023 : 09:23 AM Mixin Network, an open-source, peer-to-peer transactional network for digital assets, has announced today on Twitter that deposits and withdrawals are suspended effective immediately due to a $200 million hack the platform suffered on Saturday.The incident occurred on September 23 early in the morning, Hong Kong time, and the attack reportedly targeted the database of Mixin’s cloud service provider.Due to the substantial amount lost in the hack, the situation has seriously troubled the platform's users.Mixin has stated that they would take action to address the problems caused by the loss of assets but any solutions would be announced at a later time.Mixin’s founder, Feng Xiaodong, will give more explanations about the incident via a public address scheduled for later today.Blockchain trackers like PeckShield and Lookonchain have identified roughly $141 million of the stolen assets, analyzed as $93.5M in ETH, $23.5M in DAI (swapped from USDT), and $23.3M i
