Week in review: Kali Linux 2022.1 released, attackers leveraging Microsoft Teams to spread malware
Here’s an overview of some of last week’s most interesting news, articles and interviews:
Kali Linux 2022.1 released: New tools, kali-linux-everything, visual changes
Offensive Security has released Kali Linux 2022.1, the latest version of its popular open source penetration testing platform.
DDoS attacks knock Ukrainian government, bank websites offline
Unknown attackers have mounted disruptive distributed denial-of-service (DDoS) attacks against several Ukrainian government organizations and state-owned banks.
Attackers use Microsoft Teams as launchpad for malware
Hackers are starting to realize that Microsoft Teams is a great means of spreading tentacles throughout an organization’s systems; since the start of the year, Avanan has been seeing hackers increasingly dropping malware in Teams conversation.
Open banking innovation: A race between developers and cybercriminals
In this interview with Help Net Security, Karl Mattson, CISO at Noname Security, explains the wide usage of open banking and how it can easily be exploited if adequate security measures are not implemented.
Online fraud skyrocketing: Gaming, streaming, social media, travel and ecommerce hit the most
An Arkose Labs report is warning UK commerce that it faces its most challenging year ever. Experts analyzed over 150 billion transaction requests across 254 countries and territories in 2021 over 12 months to discover that there has been an 85% increase in login attacks and fake consumer account creation at businesses.
Qualys Context XDR: Bringing context to an organization’s security efforts
In this interview with Help Net Security, Jim Wojno, Senior Director of XDR at Qualys, explains the advantages of using Qualys Context XDR and how it can provide clarity through context.
The importance of implementing security scanning in the software development lifecycle
Veracode published a research that finds most applications are now scanned around three times a week, compared to just two or three times a year a decade ago. This represents a 20x increase in average scan cadence between 2010 and 2021.
How QR code ease of use has broaden the attack surface
In this interview with Help Net Security, Neil Clauson, Regional CISO at Mimecast, talks about the threats of QR code phishing, explains the vulnerabilities of such technology and how to make sure not to fall prey to such attack.
Using mobile networks for cyber attacks as part of a warfare strategy
AdaptiveMobile Security published a research which highlights how vulnerabilities in mobile network infrastructure could be weaponized in offensive military operations.
How do I select an API security solution for my business?
To select a suitable API security solution, you need to think about a variety of factors. We’ve talked to several industry professionals to get their insight on the topic.
PCI SSC and the National Cybersecurity Alliance issue bulletin to highlight ransomware threat
The PCI Security Standards Council (PCI SSC) and the National Cybersecurity Alliance issued a joint bulletin on the increasing threat of ransomware attacks.
Democratizing security with Open XDR
Democratizing security means that all data and findings can and should be considered. It is not about augmenting a particular platform, but rather about creating an open environment that accepts information from all tools and sources without restrictions due to technical or marketing limitations.
The importance of implementing a zero trust strategy
Optiv has published a report based on a recent survey of cybersecurity leaders that highlights the critical importance of implementing zero trust as an effective way to reduce cyber risk.
Log4Shell: A retrospective
Now that the dust has settled on both the holiday season and the Log4j vulnerability that saw many of us working through it (CVE-2021-44228), it makes sense to look back and take stock of how things played out. What strategies worked in the face of one of the most notable vulnerabilities of the last decade?
The rise of the super malicious insider: Yes, we need to worry
DTEX Systems announced the release of a report which identifies a significant increase in industrial espionage incidents and the rise of the super malicious insider persona, and provides evidence that the abrupt shift to remote work has directly contributed to an escalation in psychosocial human behaviors that create organizational risk.
Securing IoT from the ground up
We live in a highly connected world. There are already approximately 10 billion connected Internet of Things (IoT) devices, and their number is expected to grow to over 25 billion by 2030. They also vary across every conceivable industry; simple IoT sensors and consumer-focused smart home gadgets have been joined by sophisticated medical devices, next-generation automotive technologies, industrial IoT hardware, and so on.
Energy, oil and utility sector most likely to pay ransoms
CyberSaint announced the release of a report which identifies which sectors pay the most in ransom, have the propensity to pay and delves into the future of ransomware.
Supply chain shortages create a cybersecurity nightmare
The White House has recently issued alerts noting that many manufacturers suffer from disrupted supply chains, and rebuilding supply chains is a major priority. Some analysts are suggesting that many months, and perhaps years are likely to transpire before the chaos subsides.
The seven themes driving the future of cybersecurity
Team8 announced the release of a report which details the seven themes shaping the future of cybersecurity. These themes are driven by the impact of the pandemic, the increase in remote work, and the rising number of cyberattacks, which are causing governments to respond.
Traditional MFA is creating a false sense of security
A report from HYPR and Cybersecurity Insiders, reveals that despite the zero trust initiative, many organizations are still highly exposed to credential attacks due to insufficient multi-factor authentication (MFA) methods and overall lack of urgency after potential exposure. In fact, 64% of those hacked did not enhance or improve their authentication controls following the attack.
Tackling supply chain security head-on
Supply chain security is no easy task, and no single entity has end-to-end control. With so many stages, organizations, and companies involved, it is no surprise that hackers are gaining from the lack of sufficient security.
How hackers could use popular virtual reality headsets to steal sensitive information
Researchers at Rutgers University-New Brunswick have published “Face-Mic,” the first work examining how voice command features on virtual reality headsets could lead to major privacy leakages, known as eavesdropping attacks.
Whitepaper: 5 steps to improved MFA adoption
5 steps to improved MFA adoption is an unbiased, comprehensive analysis of the present and future of multi-factor authentication, and challenges to widespread adoption.
eBook: The Ultimate Guide to Client-Side Security
The Ultimate Guide to Client-Side Security provides organizations with a guide for understanding how modern websites and web applications work within the context of client-side interactions and the dangers inherent in the client-side coding structures that underpin website functionality.
New infosec products of the week: February 18, 2022
Here’s a look at the most interesting products from the past week, featuring releases from Blueshift Cybersecurity, Bugcrowd, CoSoSys, F5 Networks, Mandiant, Orca Security, Stellar Cyber, and Verimatrix.