How to Improve Your API Security Posture

How to Improve Your API Security Posture,

APIs, more formally known as application programming interfaces, empower apps and microservices to communicate and share data. However, this level of connectivity doesn’t come without major risks. Hackers can exploit vulnerabilities in APIs to gain unauthorized access to sensitive data or even take control of the entire system. Therefore, it’s essential to have a robust API security posture to

,

APIs, more formally known as application programming interfaces, empower apps and microservices to communicate and share data. However, this level of connectivity doesn’t come without major risks. Hackers can exploit vulnerabilities in APIs to gain unauthorized access to sensitive data or even take control of the entire system. Therefore, it’s essential to have a robust API security posture to

, ,
https://thehackernews.com/2023/06/how-to-improve-your-api-security-posture.html

Urgent Security Updates: Cisco and VMware Address Critical Vulnerabilities

Urgent Security Updates: Cisco and VMware Address Critical Vulnerabilities,

VMware has released security updates to fix a trio of flaws in Aria Operations for Networks that could result in information disclosure and remote code execution.
The most critical of the three vulnerabilities is a command injection vulnerability tracked as CVE-2023-20887 (CVSS score: 9.8) that could allow a malicious actor with network access to achieve remote code execution.
Also patched by

,

VMware has released security updates to fix a trio of flaws in Aria Operations for Networks that could result in information disclosure and remote code execution.
The most critical of the three vulnerabilities is a command injection vulnerability tracked as CVE-2023-20887 (CVSS score: 9.8) that could allow a malicious actor with network access to achieve remote code execution.
Also patched by

, ,
https://thehackernews.com/2023/06/urgent-security-updates-cisco-and.html

Kimsuky Targets Think Tanks and News Media with Social Engineering Attacks

Kimsuky Targets Think Tanks and News Media with Social Engineering Attacks,

The North Korean nation-state threat actor known as Kimsuky has been linked to a social engineering campaign targeting experts in North Korean affairs with the goal of stealing Google credentials and delivering reconnaissance malware.
« Further, Kimsuky’s objective extends to the theft of subscription credentials from NK News, » cybersecurity firm SentinelOne said in a report shared with The

,

The North Korean nation-state threat actor known as Kimsuky has been linked to a social engineering campaign targeting experts in North Korean affairs with the goal of stealing Google credentials and delivering reconnaissance malware.
« Further, Kimsuky’s objective extends to the theft of subscription credentials from NK News, » cybersecurity firm SentinelOne said in a report shared with The

, ,
https://thehackernews.com/2023/06/kimsuky-targets-think-tanks-and-news.html

Barracuda Urges Immediate Replacement of Hacked ESG Appliances

Barracuda Urges Immediate Replacement of Hacked ESG Appliances,

Enterprise security company Barracuda is now urging customers who were impacted by a recently disclosed zero-day flaw in its Email Security Gateway (ESG) appliances to immediately replace them.
« Impacted ESG appliances must be immediately replaced regardless of patch version level, » the company said in an update, adding its « remediation recommendation at this time is full replacement of the

,

Enterprise security company Barracuda is now urging customers who were impacted by a recently disclosed zero-day flaw in its Email Security Gateway (ESG) appliances to immediately replace them.
« Impacted ESG appliances must be immediately replaced regardless of patch version level, » the company said in an update, adding its « remediation recommendation at this time is full replacement of the

, ,
https://thehackernews.com/2023/06/barracuda-urges-immediate-replacement.html

Microsoft to Pay $20 Million Penalty for Illegally Collecting Kids’ Data on Xbox

Microsoft to Pay $20 Million Penalty for Illegally Collecting Kids’ Data on Xbox

,

Microsoft has agreed to pay a penalty of $20 million to settle U.S. Federal Trade Commission (FTC) charges that the company illegally collected and retained the data of children who signed up to use its Xbox video game console without their parents’ knowledge or consent.
« Our proposed order makes it easier for parents to protect their children’s privacy on Xbox, and limits what information

,

Microsoft has agreed to pay a penalty of $20 million to settle U.S. Federal Trade Commission (FTC) charges that the company illegally collected and retained the data of children who signed up to use its Xbox video game console without their parents’ knowledge or consent.
« Our proposed order makes it easier for parents to protect their children’s privacy on Xbox, and limits what information

, ,
https://thehackernews.com/2023/06/microsoft-to-pay-20-million-penalty-for.html

Winning the Mind Game: The Role of the Ransomware Negotiator

Winning the Mind Game: The Role of the Ransomware Negotiator,

Get exclusive insights from a real ransomware negotiator who shares authentic stories from network hostage situations and how he managed them.
The Ransomware Industry
Ransomware is an industry. As such, it has its own business logic: organizations pay money, in crypto-currency, in order to regain control over their systems and data.
This industry’s landscape is made up of approximately 10-20

,

Get exclusive insights from a real ransomware negotiator who shares authentic stories from network hostage situations and how he managed them.
The Ransomware Industry
Ransomware is an industry. As such, it has its own business logic: organizations pay money, in crypto-currency, in order to regain control over their systems and data.
This industry’s landscape is made up of approximately 10-20

, ,
https://thehackernews.com/2023/06/winning-mind-game-role-of-ransomware.html

New PowerDrop Malware Targeting U.S. Aerospace Industry

New PowerDrop Malware Targeting U.S. Aerospace Industry,

An unknown threat actor has been observed targeting the U.S. aerospace industry with a new PowerShell-based malware called PowerDrop.
« PowerDrop uses advanced techniques to evade detection such as deception, encoding, and encryption, » according to Adlumin, which found the malware implanted in an unnamed domestic aerospace defense contractor in May 2023.
« The name is derived from the tool,

,

An unknown threat actor has been observed targeting the U.S. aerospace industry with a new PowerShell-based malware called PowerDrop.
« PowerDrop uses advanced techniques to evade detection such as deception, encoding, and encryption, » according to Adlumin, which found the malware implanted in an unnamed domestic aerospace defense contractor in May 2023.
« The name is derived from the tool,

, ,
https://thehackernews.com/2023/06/new-powerdrop-malware-targeting-us.html

New Malware Campaign Leveraging Satacom Downloader to Steal Cryptocurrency

New Malware Campaign Leveraging Satacom Downloader to Steal Cryptocurrency,

A recent malware campaign has been found to leverage Satacom downloader as a conduit to deploy stealthy malware capable of siphoning cryptocurrency using a rogue extension for Chromium-based browsers.
« The main purpose of the malware that is dropped by the Satacom downloader is to steal BTC from the victim’s account by performing web injections into targeted cryptocurrency websites, » Kaspersky

,

A recent malware campaign has been found to leverage Satacom downloader as a conduit to deploy stealthy malware capable of siphoning cryptocurrency using a rogue extension for Chromium-based browsers.
« The main purpose of the malware that is dropped by the Satacom downloader is to steal BTC from the victim’s account by performing web injections into targeted cryptocurrency websites, » Kaspersky

, ,
https://thehackernews.com/2023/06/new-malware-campaign-leveraging-satacom.html

Over 60K Adware Apps Posing as Cracked Versions of Popular Apps Target Android Devices

Over 60K Adware Apps Posing as Cracked Versions of Popular Apps Target Android Devices,

Thousands of adware apps for Android have been found to masquerade as cracks or modded versions of popular apps to redirect users to serve unwanted ads to users as part of a campaign ongoing since October 2022.
« The campaign is designed to aggressively push adware to Android devices with the purpose to drive revenue, » Bitdefender said in a technical report shared with The Hacker News. « However,

,

Thousands of adware apps for Android have been found to masquerade as cracks or modded versions of popular apps to redirect users to serve unwanted ads to users as part of a campaign ongoing since October 2022.
« The campaign is designed to aggressively push adware to Android devices with the purpose to drive revenue, » Bitdefender said in a technical report shared with The Hacker News. « However,

, ,
https://thehackernews.com/2023/06/over-60k-adware-apps-posing-as-cracked.html

5 Reasons Why IT Security Tools Don’t Work For OT

5 Reasons Why IT Security Tools Don’t Work For OT

,

Attacks on critical infrastructure and other OT systems are on the rise as digital transformation and OT/IT convergence continue to accelerate. Water treatment facilities, energy providers, factories, and chemical plants — the infrastructure that undergirds our daily lives could all be at risk. Disrupting or manipulating OT systems stands to pose real physical harm to citizens, environments, and

,

Attacks on critical infrastructure and other OT systems are on the rise as digital transformation and OT/IT convergence continue to accelerate. Water treatment facilities, energy providers, factories, and chemical plants — the infrastructure that undergirds our daily lives could all be at risk. Disrupting or manipulating OT systems stands to pose real physical harm to citizens, environments, and

, ,
https://thehackernews.com/2023/06/5-reasons-why-it-security-tools-dont.html