Google to Roll Out Privacy Sandbox Beta on Android 13 by Early 2023

Google to Roll Out Privacy Sandbox Beta on Android 13 by Early 2023,

Internet behemoth Google on Tuesday said it plans to roll out Privacy Sandbox for Android in beta to mobile devices running Android 13 starting early next year.
« The Privacy Sandbox Beta will be available for ad tech and app developers who wish to test the ads-related APIs as part of their solutions, » the company said.
To that end, developers will need to complete an enrollment process in order

,

Internet behemoth Google on Tuesday said it plans to roll out Privacy Sandbox for Android in beta to mobile devices running Android 13 starting early next year.
« The Privacy Sandbox Beta will be available for ad tech and app developers who wish to test the ads-related APIs as part of their solutions, » the company said.
To that end, developers will need to complete an enrollment process in order

, ,
https://thehackernews.com/2022/11/google-to-roll-out-privacy-sandbox-beta.html

Critical RCE Flaw Reported in Spotify’s Backstage Software Catalog and Developer Platform

Critical RCE Flaw Reported in Spotify’s Backstage Software Catalog and Developer Platform

,

Spotify’s Backstage has been discovered as vulnerable to a severe security flaw that could be exploited to gain remote code execution by leveraging a recently disclosed bug in a third-party module.
The vulnerability (CVSS score: 9.8), at its core, takes advantage of a critical sandbox escape in vm2, a popular JavaScript sandbox library (CVE-2022-36067 aka Sandbreak), that came to light last

,

Spotify’s Backstage has been discovered as vulnerable to a severe security flaw that could be exploited to gain remote code execution by leveraging a recently disclosed bug in a third-party module.
The vulnerability (CVSS score: 9.8), at its core, takes advantage of a critical sandbox escape in vm2, a popular JavaScript sandbox library (CVE-2022-36067 aka Sandbreak), that came to light last

, ,
https://thehackernews.com/2022/11/critical-rce-flaw-reported-in-spotifys.html

PCSpoof: New Vulnerability Affects Networking Tech Used by Spacecraft and Aircraft

PCSpoof: New Vulnerability Affects Networking Tech Used by Spacecraft and Aircraft,

Credit: Marina Minkin
A novel attack method has been disclosed against a crucial piece of technology called time-triggered ethernet (TTE) that’s used in safety-critical infrastructure, potentially causing the failure of systems powering spacecraft and aircraft.
Dubbed PCspooF by a group of academics and researchers from the University of Michigan, the University of Pennsylvania, and the NASA

,

Credit: Marina Minkin
A novel attack method has been disclosed against a crucial piece of technology called time-triggered ethernet (TTE) that’s used in safety-critical infrastructure, potentially causing the failure of systems powering spacecraft and aircraft.
Dubbed PCspooF by a group of academics and researchers from the University of Michigan, the University of Pennsylvania, and the NASA

, ,
https://thehackernews.com/2022/11/pcspoof-new-vulnerability-affects.html

Researchers Reported Critical SQLi and Access Flaws in Zendesk Analytics Service

Researchers Reported Critical SQLi and Access Flaws in Zendesk Analytics Service,

Cybersecurity researchers have disclosed details of now-patched flaws in Zendesk Explore that could have been exploited by an attacker to gain unauthorized access to information from customer accounts that have the feature turned on.
« Before it was patched, the flaw would have allowed threat actors to access conversations, email addresses, tickets, comments, and other information from Zendesk

,

Cybersecurity researchers have disclosed details of now-patched flaws in Zendesk Explore that could have been exploited by an attacker to gain unauthorized access to information from customer accounts that have the feature turned on.
« Before it was patched, the flaw would have allowed threat actors to access conversations, email addresses, tickets, comments, and other information from Zendesk

, ,
https://thehackernews.com/2022/11/researchers-reported-critical-sqli-and.html

Deep Packet Inspection vs. Metadata Analysis of Network Detection & Response (NDR) Solutions

Deep Packet Inspection vs. Metadata Analysis of Network Detection & Response (NDR) Solutions

,

Today, most Network Detection and Response (NDR) solutions rely on traffic mirroring and Deep Packet Inspection (DPI). Traffic mirroring is typically deployed on a single-core switch to provide a copy of the network traffic to a sensor that uses DPI to thoroughly analyze the payload. While this approach provides detailed analysis, it requires large amounts of processing power and is blind when

,

Today, most Network Detection and Response (NDR) solutions rely on traffic mirroring and Deep Packet Inspection (DPI). Traffic mirroring is typically deployed on a single-core switch to provide a copy of the network traffic to a sensor that uses DPI to thoroughly analyze the payload. While this approach provides detailed analysis, it requires large amounts of processing power and is blind when

, ,
https://thehackernews.com/2022/11/deep-packet-inspection-vs-metadata.html

Researchers Say China State-backed Hackers Breached a Digital Certificate Authority

Researchers Say China State-backed Hackers Breached a Digital Certificate Authority,

A suspected Chinese state-sponsored actor breached a digital certificate authority as well as government and defense agencies located in different countries in Asia as part of an ongoing campaign since at least March 2022.
Symantec, by Broadcom Software, linked the attacks to an adversarial group it tracks under the name Billbug, citing the use of tools previously attributed to this actor. The

,

A suspected Chinese state-sponsored actor breached a digital certificate authority as well as government and defense agencies located in different countries in Asia as part of an ongoing campaign since at least March 2022.
Symantec, by Broadcom Software, linked the attacks to an adversarial group it tracks under the name Billbug, citing the use of tools previously attributed to this actor. The

, ,
https://thehackernews.com/2022/11/researchers-say-china-state-backed.html

Google to Pay $391 Million Privacy Fine for Secretly Tracking Users’ Location

Google to Pay $391 Million Privacy Fine for Secretly Tracking Users’ Location

,

Internet giant Google has agreed to pay a record $391.5 million to settle with 40 states in the U.S. over charges the company misled users about the collection of personal location data.
« Google misled its users into thinking they had turned off location tracking in their account settings, when, in fact, Google continued to collect their location information, » Oregon Attorney General Ellen

,

Internet giant Google has agreed to pay a record $391.5 million to settle with 40 states in the U.S. over charges the company misled users about the collection of personal location data.
« Google misled its users into thinking they had turned off location tracking in their account settings, when, in fact, Google continued to collect their location information, » Oregon Attorney General Ellen

, ,
https://thehackernews.com/2022/11/google-to-pays-391-million-privacy-fine.html

New « Earth Longzhi » APT Targets Ukraine and Asian Countries with Custom Cobalt Strike Loaders

New « Earth Longzhi » APT Targets Ukraine and Asian Countries with Custom Cobalt Strike Loaders

,

Entities located in East and Southeast Asia as well as Ukraine have been targeted at least since 2020 by a previously undocumented subgroup of APT41, a prolific Chinese advanced persistent threat (APT).
Cybersecurity firm Trend Micro, which christened the espionage crew Earth Longzhi, said the actor’s long-running campaign can be split into two based on the toolset deployed to attack its victims

,

Entities located in East and Southeast Asia as well as Ukraine have been targeted at least since 2020 by a previously undocumented subgroup of APT41, a prolific Chinese advanced persistent threat (APT).
Cybersecurity firm Trend Micro, which christened the espionage crew Earth Longzhi, said the actor’s long-running campaign can be split into two based on the toolset deployed to attack its victims

, ,
https://thehackernews.com/2022/11/new-earth-longzhi-apt-targets-ukraine.html

Over 15,000 WordPress Sites Compromised in Malicious SEO Campaign

Over 15,000 WordPress Sites Compromised in Malicious SEO Campaign,

A new malicious campaign has compromised over 15,000 WordPress websites in an attempt to redirect visitors to bogus Q&A portals.
« These malicious redirects appear to be designed to increase the authority of the attacker’s sites for search engines, » Sucuri researcher Ben Martin said in a report published last week, calling it a « clever black hat SEO trick. »
The search engine poisoning technique

,

A new malicious campaign has compromised over 15,000 WordPress websites in an attempt to redirect visitors to bogus Q&A portals.
« These malicious redirects appear to be designed to increase the authority of the attacker’s sites for search engines, » Sucuri researcher Ben Martin said in a report published last week, calling it a « clever black hat SEO trick. »
The search engine poisoning technique

, ,
https://thehackernews.com/2022/11/over-15000-wordpress-sites-compromised.html

What is an External Penetration Test?

What is an External Penetration Test?,

A penetration test (also known as a pentest) is a security assessment that simulates the activities of real-world attackers to identify security holes in your IT systems or applications. 
The aim of the test is to understand what vulnerabilities you have, how they could be exploited, and what the impact would be if an attacker was successful.
Usually performed first, an external pentest (also

,

A penetration test (also known as a pentest) is a security assessment that simulates the activities of real-world attackers to identify security holes in your IT systems or applications. 
The aim of the test is to understand what vulnerabilities you have, how they could be exploited, and what the impact would be if an attacker was successful.
Usually performed first, an external pentest (also

, ,
https://thehackernews.com/2022/11/what-is-external-penetration-test.html