2021 : année record pour la découverte de failles zero-day réellement exploitées

2021 : année record pour la découverte de failles zero-day réellement exploitées,

L’industrie de la cybersécurité a considérablement amélioré sa capacité de détection, avec près de 60 failles zero-day trouvées l’année passée. Mais il reste encore du chemin à parcourir.

,

L’industrie de la cybersécurité a considérablement amélioré sa capacité de détection, avec près de 60 failles zero-day trouvées l’année passée. Mais il reste encore du chemin à parcourir.

, ,
https://www.01net.com/actualites/2021-annee-record-pour-la-decouverte-de-failles-zero-day-reellement-exploitees-2055952.html

Researchers Detail Bug That Could Paralyze Snort Intrusion Detection System

Researchers Detail Bug That Could Paralyze Snort Intrusion Detection System,

Details have emerged about a now-patched security vulnerability in the Snort intrusion detection and prevention system that could trigger a denial-of-service (DoS) condition and render it powerless against malicious traffic.
Tracked as CVE-2022-20685, the vulnerability is rated 7.5 for severity and resides in the Modbus preprocessor of the Snort detection engine. It affects all open-source Snort

,

Details have emerged about a now-patched security vulnerability in the Snort intrusion detection and prevention system that could trigger a denial-of-service (DoS) condition and render it powerless against malicious traffic.
Tracked as CVE-2022-20685, the vulnerability is rated 7.5 for severity and resides in the Modbus preprocessor of the Snort detection engine. It affects all open-source Snort

, ,
https://thehackernews.com/2022/04/researchers-detail-bug-that-could.html

[eBook] The Ultimate Security for Management Presentation Template

[eBook] The Ultimate Security for Management Presentation Template,

Are you a CISO, CIO, or IT Director?
In your role, you’re responsible for breach protection – which means you oversee and govern the process of designing, building, maintaining, and continuously enhancing your organization’s security program. 
But getting buy-in from leadership can be difficult when they are a non-technical audience.
On top of managing your organization’s breach protection

,

Are you a CISO, CIO, or IT Director?
In your role, you’re responsible for breach protection – which means you oversee and govern the process of designing, building, maintaining, and continuously enhancing your organization’s security program. 
But getting buy-in from leadership can be difficult when they are a non-technical audience.
On top of managing your organization’s breach protection

, ,
https://thehackernews.com/2022/04/ebook-ultimate-security-for-management.html

Okta Says Security Breach by Lapsus$ Hackers Impacted Only Two of Its Customers

Okta Says Security Breach by Lapsus$ Hackers Impacted Only Two of Its Customers,

Identity and access management provider Okta on Tuesday said it concluded its probe into the breach of a third-party vendor in late January 2022 by the LAPSUS$ extortionist gang.
Stating that the « impact of the incident was significantly less than the maximum potential impact » the company had previously shared last month, Okta said the intrusion impacted only two customer tenants, down from 366

,

Identity and access management provider Okta on Tuesday said it concluded its probe into the breach of a third-party vendor in late January 2022 by the LAPSUS$ extortionist gang.
Stating that the « impact of the incident was significantly less than the maximum potential impact » the company had previously shared last month, Okta said the intrusion impacted only two customer tenants, down from 366

, ,
https://thehackernews.com/2022/04/okta-says-security-breach-by-lapsus.html

Hackers Exploiting Recently Reported Windows Print Spooler Vulnerability in the Wild

Hackers Exploiting Recently Reported Windows Print Spooler Vulnerability in the Wild,

A security flaw in the Windows Print Spooler component that was patched by Microsoft in February is being actively exploited in the wild, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned.
To that end, the agency has added the shortcoming to its Known Exploited Vulnerabilities Catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to address the issues by

,

A security flaw in the Windows Print Spooler component that was patched by Microsoft in February is being actively exploited in the wild, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned.
To that end, the agency has added the shortcoming to its Known Exploited Vulnerabilities Catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to address the issues by

, ,
https://thehackernews.com/2022/04/hackers-exploiting-recently-reported.html

New Lenovo UEFI Firmware Vulnerabilities Affect Millions of Laptops

New Lenovo UEFI Firmware Vulnerabilities Affect Millions of Laptops,

Three high-impact Unified Extensible Firmware Interface (UEFI) security vulnerabilities have been discovered impacting various Lenovo consumer laptop models, enabling malicious actors to deploy and execute firmware implants on the affected devices.
Tracked as CVE-2021-3970, CVE-2021-3971, and CVE-2021-3972, the latter two « affect firmware drivers originally meant to be used only during the

,

Three high-impact Unified Extensible Firmware Interface (UEFI) security vulnerabilities have been discovered impacting various Lenovo consumer laptop models, enabling malicious actors to deploy and execute firmware implants on the affected devices.
Tracked as CVE-2021-3970, CVE-2021-3971, and CVE-2021-3972, the latter two « affect firmware drivers originally meant to be used only during the

, ,
https://thehackernews.com/2022/04/new-lenovo-uefi-firmware.html

Experts Uncover Spyware Attacks Against Catalan Politicians and Activists

Experts Uncover Spyware Attacks Against Catalan Politicians and Activists,

A previously unknown zero-click exploit in Apple’s iMessage was used to install mercenary spyware from NSO Group and Candiru against at least 65 individuals as part of a « multi-year clandestine operation. »
« Victims included Members of the European Parliament, Catalan Presidents, legislators, jurists, and members of civil society organizations, » the University of Toronto’s Citizen Lab said in a

,

A previously unknown zero-click exploit in Apple’s iMessage was used to install mercenary spyware from NSO Group and Candiru against at least 65 individuals as part of a « multi-year clandestine operation. »
« Victims included Members of the European Parliament, Catalan Presidents, legislators, jurists, and members of civil society organizations, » the University of Toronto’s Citizen Lab said in a

, ,
https://thehackernews.com/2022/04/experts-uncover-spyware-attacks-against.html

FBI, U.S. Treasury and CISA Warn of North Korean Hackers Targeting Blockchain Companies

FBI, U.S. Treasury and CISA Warn of North Korean Hackers Targeting Blockchain Companies,

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), along with the Federal Bureau of Investigation (FBI) and the Treasury Department, warned of a new set of ongoing cyber attacks carried out by the Lazarus Group targeting blockchain companies.
Calling the activity cluster TraderTraitor, the infiltrations involve the North Korean state-sponsored advanced persistent threat (APT)

,

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), along with the Federal Bureau of Investigation (FBI) and the Treasury Department, warned of a new set of ongoing cyber attacks carried out by the Lazarus Group targeting blockchain companies.
Calling the activity cluster TraderTraitor, the infiltrations involve the North Korean state-sponsored advanced persistent threat (APT)

, ,
https://thehackernews.com/2022/04/fbi-us-treasury-and-cisa-warns-of-north.html

GitHub Notifies Victims Whose Private Data Was Accessed Using OAuth Tokens

GitHub Notifies Victims Whose Private Data Was Accessed Using OAuth Tokens,

GitHub on Monday noted that it had notified all victims of an attack campaign, which involved an unauthorized party downloading private repository contents by taking advantage of third-party OAuth user tokens maintained by Heroku and Travis CI.
« Customers should also continue to monitor Heroku and Travis CI for updates on their own investigations into the affected OAuth applications, » the

,

GitHub on Monday noted that it had notified all victims of an attack campaign, which involved an unauthorized party downloading private repository contents by taking advantage of third-party OAuth user tokens maintained by Heroku and Travis CI.
« Customers should also continue to monitor Heroku and Travis CI for updates on their own investigations into the affected OAuth applications, » the

, ,
https://thehackernews.com/2022/04/github-notifies-victims-whose-private.html

Researchers Share In-Depth Analysis of PYSA Ransomware Group

Researchers Share In-Depth Analysis of PYSA Ransomware Group,

An 18-month-long analysis of the PYSA ransomware operation has revealed that the cybercrime cartel followed a five-stage software development cycle from August 2020, with the malware authors prioritizing features to improve the efficiency of its workflows.
This included a user-friendly tool like a full-text search engine to facilitate the extraction of metadata and enable the threat actors to

,

An 18-month-long analysis of the PYSA ransomware operation has revealed that the cybercrime cartel followed a five-stage software development cycle from August 2020, with the malware authors prioritizing features to improve the efficiency of its workflows.
This included a user-friendly tool like a full-text search engine to facilitate the extraction of metadata and enable the threat actors to

, ,
https://thehackernews.com/2022/04/researchers-share-in-depth-analysis-of.html