5 Questions You Need to Ask About Your Firewall Security

5 Questions You Need to Ask About Your Firewall Security,

Often, organizations think of firewall security as a one-and-done type of solution. They install firewalls, then assume that they are « good to go » without investigating whether or not these solutions are actually protecting their systems in the best way possible. « Set it and forget it! »
Instead of just relying on firewalls and assuming that they will always protect their businesses from cyber

,

Often, organizations think of firewall security as a one-and-done type of solution. They install firewalls, then assume that they are « good to go » without investigating whether or not these solutions are actually protecting their systems in the best way possible. « Set it and forget it! »
Instead of just relying on firewalls and assuming that they will always protect their businesses from cyber

, ,
https://thehackernews.com/2022/07/5-questions-you-need-to-ask-about-your.html

Researchers Uncover New Variants of the ChromeLoader Browser Hijacking Malware

Researchers Uncover New Variants of the ChromeLoader Browser Hijacking Malware,

Cybersecurity researchers have uncovered new variants of the ChromeLoader information-stealing malware, highlighting its evolving feature set in a short span of time.
Primarily used for hijacking victims’ browser searches and presenting advertisements, ChromeLoader came to light in January 2022 and has been distributed in the form of ISO or DMG file downloads advertised via QR codes on Twitter

,

Cybersecurity researchers have uncovered new variants of the ChromeLoader information-stealing malware, highlighting its evolving feature set in a short span of time.
Primarily used for hijacking victims’ browser searches and presenting advertisements, ChromeLoader came to light in January 2022 and has been distributed in the form of ISO or DMG file downloads advertised via QR codes on Twitter

, ,
https://thehackernews.com/2022/07/researchers-uncover-new-variants-of.html

Researchers Uncover New Attempts by Qakbot Malware to Evade Detection

Researchers Uncover New Attempts by Qakbot Malware to Evade Detection,

The operators behind the Qakbot malware are transforming their delivery vectors in an attempt to sidestep detection.
« Most recently, threat actors have transformed their techniques to evade detection by using ZIP file extensions, enticing file names with common formats, and Excel (XLM) 4.0 to trick victims into downloading malicious attachments that install Qakbot, » Zscaler Threatlabz

,

The operators behind the Qakbot malware are transforming their delivery vectors in an attempt to sidestep detection.
« Most recently, threat actors have transformed their techniques to evade detection by using ZIP file extensions, enticing file names with common formats, and Excel (XLM) 4.0 to trick victims into downloading malicious attachments that install Qakbot, » Zscaler Threatlabz

, ,
https://thehackernews.com/2022/07/researchers-uncover-new-attempts-by.html

Microsoft Releases Fix for Zero-Day Flaw in July 2022 Security Patch Rollout

Microsoft Releases Fix for Zero-Day Flaw in July 2022 Security Patch Rollout,

Microsoft released its monthly round of Patch Tuesday updates to address 84 new security flaws spanning multiple product categories, counting a zero-day vulnerability that’s under active attack in the wild.
Of the 84 shortcomings, four are rated Critical, and 80 are rated Important in severity. Also separately resolved by the tech giant are two other bugs in the Chromium-based Edge browser, one

,

Microsoft released its monthly round of Patch Tuesday updates to address 84 new security flaws spanning multiple product categories, counting a zero-day vulnerability that’s under active attack in the wild.
Of the 84 shortcomings, four are rated Critical, and 80 are rated Important in severity. Also separately resolved by the tech giant are two other bugs in the Chromium-based Edge browser, one

, ,
https://thehackernews.com/2022/07/microsoft-releases-fix-for-zero-day.html

TikTok Postpones Privacy Policy Update in Europe After Italy Warns of GDPR Breach

TikTok Postpones Privacy Policy Update in Europe After Italy Warns of GDPR Breach,

Popular video-sharing platform TikTok on Tuesday agreed to pause a controversial privacy policy update that could have allowed it to serve targeted ads based on users’ activity on the social video platform without their permission to do so.
The reversal, reported by TechCrunch, comes a day after the Italian data protection authority — the Garante per la Protezione dei Dati Personali — warned the

,

Popular video-sharing platform TikTok on Tuesday agreed to pause a controversial privacy policy update that could have allowed it to serve targeted ads based on users’ activity on the social video platform without their permission to do so.
The reversal, reported by TechCrunch, comes a day after the Italian data protection authority — the Garante per la Protezione dei Dati Personali — warned the

, ,
https://thehackernews.com/2022/07/tiktok-postpones-privacy-policy-update.html

Avoiding Death by a Thousand Scripts: Using Automated Content Security Policies

Avoiding Death by a Thousand Scripts: Using Automated Content Security Policies,

Businesses know they need to secure their client-side scripts. Content security policies (CSPs) are a great way to do that. But CSPs are cumbersome. One mistake and you have a potentially significant client-side security gap. Finding those gaps means long and tedious hours (or days) in manual code reviews through thousands of lines of script on your web applications. Automated content security

,

Businesses know they need to secure their client-side scripts. Content security policies (CSPs) are a great way to do that. But CSPs are cumbersome. One mistake and you have a potentially significant client-side security gap. Finding those gaps means long and tedious hours (or days) in manual code reviews through thousands of lines of script on your web applications. Automated content security

, ,
https://thehackernews.com/2022/07/avoiding-death-by-thousand-scripts.html

Microsoft Windows Autopatch is Now Generally Available for Enterprise Systems

Microsoft Windows Autopatch is Now Generally Available for Enterprise Systems,

Microsoft on Monday announced the general availability of a feature called Autopatch that automatically keeps Windows and Office software up-to-date on enrolled endpoints.
The launch, which comes a day before Microsoft is expected to release its monthly round of security patches, is available for customers with Windows Enterprise E3 and E5 licenses. It, however, doesn’t support Windows Education

,

Microsoft on Monday announced the general availability of a feature called Autopatch that automatically keeps Windows and Office software up-to-date on enrolled endpoints.
The launch, which comes a day before Microsoft is expected to release its monthly round of security patches, is available for customers with Windows Enterprise E3 and E5 licenses. It, however, doesn’t support Windows Education

, ,
https://thehackernews.com/2022/07/microsoft-windows-autopatch-is-now.html

Cloud-based Cryptocurrency Miners Targeting GitHub Actions and Azure VMs

Cloud-based Cryptocurrency Miners Targeting GitHub Actions and Azure VMs,

GitHub Actions and Azure virtual machines (VMs) are being leveraged for cloud-based cryptocurrency mining, indicating sustained attempts on the part of malicious actors to target cloud resources for illicit purposes.
« Attackers can abuse the runners or servers provided by GitHub to run an organization’s pipelines and automation by maliciously downloading and installing their own cryptocurrency

,

GitHub Actions and Azure virtual machines (VMs) are being leveraged for cloud-based cryptocurrency mining, indicating sustained attempts on the part of malicious actors to target cloud resources for illicit purposes.
« Attackers can abuse the runners or servers provided by GitHub to run an organization’s pipelines and automation by maliciously downloading and installing their own cryptocurrency

, ,
https://thehackernews.com/2022/07/cloud-based-cryptocurrency-miners.html

What It Takes to Tackle Your SaaS Security

What It Takes to Tackle Your SaaS Security,

It’s not a new concept that Office 365, Salesforce, Slack, Google Workspace or Zoom, etc., are amazing for enabling the hybrid workforce and hyper-productivity in businesses today. However, there are three main challenges that have arisen stemming from this evolution: (1) While SaaS apps include a host of native security settings, they need to be hardened by the security team of the organization

,

It’s not a new concept that Office 365, Salesforce, Slack, Google Workspace or Zoom, etc., are amazing for enabling the hybrid workforce and hyper-productivity in businesses today. However, there are three main challenges that have arisen stemming from this evolution: (1) While SaaS apps include a host of native security settings, they need to be hardened by the security team of the organization

, ,
https://thehackernews.com/2022/07/what-it-takes-to-tackle-your-saas.html

Hackers Used Fake Job Offer to Hack and Steal $540 Million from Axie Infinity

Hackers Used Fake Job Offer to Hack and Steal $540 Million from Axie Infinity,

The $540 million hack of Axie Infinity’s Ronin Bridge in late March 2022 was the consequence of one of its former employees getting tricked by a fraudulent job offer on LinkedIn, it has emerged. 
According to a report from The Block published last week citing two people familiar with the matter, a senior engineer at the company was duped into applying for a job at a non-existent company, causing

,

The $540 million hack of Axie Infinity’s Ronin Bridge in late March 2022 was the consequence of one of its former employees getting tricked by a fraudulent job offer on LinkedIn, it has emerged. 
According to a report from The Block published last week citing two people familiar with the matter, a senior engineer at the company was duped into applying for a job at a non-existent company, causing

, ,
https://thehackernews.com/2022/07/hackers-used-fake-job-offer-to-hack-and.html