📊 2023 OpenText Cybersecurity Threat Report
News, Announcements, Tech Discussions
OpenText Cybersecurity is pleased to announce that Webroot was once again recognized for efficacy in small business endpoint protection by the software testing firm SE Labs for the January - March 2023 time period. This detailed report tested various endpoint security products between January and March 2023 and focused on their ability to handle well-known threats and targeted attacks. These tests are invaluable for helping vendors improve their products and assisting buyers in choosing the best solutions for their needs. SE Labs is known for its commitment to transparency, and this report is no exception. It has gone through the rigorous AMTSO certification process, ensuring that the testing and results are accurate and reliable. In addition to the testing results, the report also debunks five common antivirus myths that often cause misconceptions about endpoint security. These myths include beliefs such as "anti-virus slows your computer" and "updates are no longer necessary." The
September 30, 2023 By Bill Toulas Cloudflare's Firewall and DDoS prevention can be bypassed through a specific attack process that leverages logic flaws in cross-tenant security controls.This bypass could put Cloudflare's customers under a heavy burden, rendering the protection systems of the internet firm less effective.To make matters worse, the only requirement for the attack is for the hackers to create a free Cloudflare account, which is used as part of the attack.However, it should be noted that the attackers must know a targeted web server's IP address to abuse these flaws. >>Full Article<<
Hi FolksAfter several days of searching the internet and failing can anyone identify this tool please.The secateurs are just there for scale, and I can give no more info than what can be seen there, other than the bottom of the green part will move away from the metal spike by about 2cm, sorry.
Last week, officials for Air Canada released a statement regarding a security incident that briefly impacted one of their internal networks and compromised some sensitive employee records. During the investigation, Air Canada staff were able to confirm that neither their flight operations systems nor any customer information were affected by this breach, though the threat actors behind the incident are still unclear.Xenomorph malware campaign targets global financial institutionsOver a year after Xenomorph malware became known, a new campaign has been identified that has focused on US banks and has also expanded its reach to include several European countries as well. It is also believed that the threat actors responsible for Xenomorph have either begun collaborating with other info stealers or that they have started operating as a malware-as-a-service and are bundling with other malware families to increase their impact.3.4 million individuals affected by MOVEit hack on Ontario’s chil
Deceptive videos and images created using generative AI could sway elections, crash stock markets and ruin reputations. Researchers are developing methods to limit their harm. Illustration by Señor Salme This June, in the political battle leading up to the 2024 US presidential primaries, a series of images were released showing Donald Trump embracing one of his former medical advisers, Anthony Fauci. In a few of the shots, Trump is captured awkwardly kissing the face of Fauci, a health official reviled by some US conservatives for promoting masking and vaccines during the COVID-19 pandemic.“It was obvious” that they were fakes, says Hany Farid, a computer scientist at the University of California, Berkeley, and one of many specialists who examined the pictures. On close inspection of three of the photos, Trump’s hair is strangely blurred, the text in the background is nonsensical, the arms and hands are unnaturally placed and the details of Trump’s visible ear are not right. All are h
The NSA is starting an artificial intelligence security center — a crucial mission as AI capabilities are increasingly acquired, developed and integrated into U.S. defense and intelligence systems. September 29, 2023 The National Security Agency is starting an artificial intelligence security center — a crucial mission as AI capabilities are increasingly acquired, developed and integrated into U.S. defense and intelligence systems, the agency’s outgoing director announced Thursday.Army Gen. Paul Nakasone said the center would be incorporated into the NSA’s Cybersecurity Collaboration Center, where it works with private industry and international partners to harden the U.S. defense-industrial base against threats from adversaries led by China and Russia.“We maintain an advantage in AI in the United States today. That AI advantage should not be taken for granted,” Nakasone said at the National Press Club, emphasizing the threat from Beijing in particular.Asked if the U.S. has detected e
These common vulnerabilities and exposures (CVEs) were recently published or revised in the Microsoft Security Update Guide:CVE-2023-1999· Title: Chromium: CVE-2023-1999 Use after free in libwebp· Version: 1.0· Reason for revision: Information published.· Originally released: September 29, 2023· Last updated: September 29, 2023· Aggregate CVE Severity Rating:CVE-2023-36788· Title: .NET Framework Remote Code Execution Vulnerability· Version: 1.1· Reason for revision: In the Security Update table, corrected Article links for Microsoft .NET Framework 3.5 AND 4.8.1 installed on Windows 11 Version 22H2 for x64-based Systems and Windows 11 Version 22H2 for ARM64-based Systems. This is an informational change only.· Originally released: September 12, 2023· Last updated: September 26, 2023· Aggregate CVE Severity Rating: ImportantCVE-2023-36792· Title: Visual Studio Remote Code Execution Vulnerability· Version: 2.1· Reason for revision: In the Security Update table, corrected Article links for
Hackers trying to get access to WormGPT, the ChatGPT alternative with 'no ethical boundaries or limitations,' get scammed themselves. September 29, 2023 By Michael Kan A malicious version of ChatGPT designed to assist cybercriminals has ended up scamming crooks interested in buying access to the service.In July, we wrote about WormGPT, a chatbot built from open-source code that promised to help hackers churn out phishing messages and malware in return for a monthly fee. The news set off concerns that generative AI could lower the bar for computer hacking, thus fueling cybercrime.But in a bit of irony, it looks like the WormGPT brand has become more of a threat to hackers than to the public. Antivirus provider Kaspersky noticed several websites that claim to offer access to WormGPT, but seem designed to scam would-be customers into giving up their funds, without actually getting access to WormGPT. >> Full Article <<
The Israeli company developed highly-targeted, mobile malware that would make any APT jealous. September 29, 2023 By Nate Nelson An Israeli surveillanceware company used the three Apple zero-day vulnerabilities disclosed last week to develop an exploit chain for iPhones, and a Chrome zero-day to exploit Androids — all in a novel attack on Egyptian organizations.According to a recent report from Google's Threat Analysis Group (TAG), the company — which calls itself "Intellexa" — used the special access it gained through the exploit chain to install its signature "Predator" spyware against unnamed targets in Egypt.Predator was first developed by Cytrox, one of a number of spyware developers that have been absorbed under the umbrella of Intellexa in recent years, according to TAG. The company is a known threat: Intellexa had previously deployed Predator against Egyptian citizens back in 2021. >> Full Article <<
September 29, 2023 By Sergiu Gatlan A critical zero-day vulnerability in all versions of Exim mail transfer agent (MTA) software can let unauthenticated attackers gain remote code execution (RCE) on Internet-exposed servers.Found by an anonymous security researcher and disclosed through Trend Micro's Zero Day Initiative (ZDI), the security bug (CVE-2023-42115) is due to an Out-of-bounds Write weakness found in the SMTP service.While this type of issue can lead to software crashes or corruption of data following successful exploitation, it can also be abused by attackers for code or command execution on vulnerable servers."The specific flaw exists within the smtp service, which listens on TCP port 25 by default," a ZDI security advisory published on Wednesday explains. >> Full Article <<
September 29, 2023 By Bill Toulas The North Korean 'Lazarus' hacking group targeted employees of an aerospace company located in Spain with fake job opportunities to hack into the corporate network using a previously unknown 'LightlessCan' backdoor.The hackers utilized their ongoing "Operation Dreamjob" campaign, which entails approaching a target over LinkedIn and engaging in a fake employee recruitment process that, at some point, required the victim to download a file.The employee did so on a company's computer, allowing the North Korean hackers to breach the corporate network to conduct cyber espionage. >> Full Article <<
September 29, 2023 By Pierluigi Paganini The World Baseball Softball Confederation (WBSC) left open a data repository exposing nearly 50,000 files, some of which were highly sensitive, the Cybernews research team has discovered.On June 5th, our researchers discovered a misconfigured Amazon Web Services (AWS) bucket storing nearly 48,000 files.A bucket is a container for storing data within AWS’s cloud storage system. The misconfiguration exposed the repository’s contents.According to our team, the exposed files belonged to the WBSC, the world governing body for baseball, softball, and Baseball5 – a recently introduced sport combining the previous two.The WBSC, headquartered in Switzerland, was established in 2013 and currently has 141 countries as members located in Asia, Africa, the Americas, Europe, and Oceania.Worryingly, among the contents of the misconfigured AWS bucket, which the WBSC closed after being contacted by the team, were copies of 4,600 national passports. >> Ful
September 29, 2023 By Sergiu Gatlan Proof-of-concept exploit code has surfaced on GitHub for a critical authentication bypass vulnerability in Microsoft SharePoint Server, allowing privilege escalation.Tracked as CVE-2023-29357, the security flaw can let unauthenticated attackers gain administrator privileges following successful exploitation in low-complexity attacks that don't require user interaction."An attacker who has gained access to spoofed JWT authentication tokens can use them to execute a network attack which bypasses authentication and allows them to gain access to the privileges of an authenticated user," Microsoft explained in June when it patched the vulnerability."An attacker who successfully exploited this vulnerability could gain administrator privileges. The attacker needs no privileges nor does the user need to perform any action." >> Full Article <<
AWS says an internal threat intel decoy system called MadPot has successfully trapped nation state-backed APTs like Volt Typhoon and Sandworm. September 29, 2023 By Ryan Naraine Cloud computing giant AWS says an internal threat intel decoy system called MadPot has been used successfully to trap malicious activity, including nation state-backed APTs like Volt Typhoon and Sandworm.MadPot, the brainchild of AWS software engineer Nima Sharifi Mehr, is described as “a sophisticated system of monitoring sensors and automated response capabilities” that entraps malicious actors, watches their movements, and generates protection data for multiple AWS security products. >> Full Article <<
The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. NVD is sponsored by CISA. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:High: vulnerabilities with a CVSS base score of 7.0–10.0 Medium: vulnerabilities with a CVSS base score of 4.0–6.9 Low: vulnerabilities with a CVSS base score of 0.0–3.9Entries may include additional information provided by organizations and efforts sponsored by CI
Version 118.0.1, first offered to Release channel users on September 28, 2023 Fixed Security fix. https://www.mozilla.org/en-US/firefox/118.0.1/releasenotes/?utm_source=firefox-browser&utm_medium=firefox-desktop&utm_campaign=about-dialog
