A former Cisco employee pleaded guilty to accessing the company's cloud infrastructure in 2018, five months after resigning, to deploy code that led to the shut down of more than 16,000 WebEx Teams accounts and the deletion of 456 virtual machines. According to a plea agreement filed on July 30, 2020, 30-year-old Sudhish Kasaba Ramesh accessed Cisco's cloud infrastructure hosted on Amazon Web Services without permission on September 24, 2018 - he resigned from the company in April 2018. READ MORE...
A researcher responsibly disclosed multiple vulnerabilities to Slack that allowed an attacker to hijack a user's computer, and they were only rewarded a measly $1,750. Using these vulnerabilities, an attacker could simply upload a file and share with another Slack user or channel to trigger the exploit on a victim's Slack app. In his detailed writeup shared privately with Slack in January 2020, security engineer Oskars Vegeris of Evolution Gaming shared extensive details on the vulnerability. READ MORE...
Researchers with ETH Zurich have identified vulnerabilities in the implementation of the payment card EMV standard that allow for the mounting of attacks targeting both the cardholder and the merchant. In a newly published paper, David Basin, Ralf Sasse, and Jorge Toro-Pozo from the department of computer science at ETH Zurich, explain that vulnerabilities identified in the standard EMV implementation could be exploited to render the PIN verification useless on Visa contactless transactions. READ MORE...
Email service provider Sendgrid is grappling with an unusually large number of customer accounts whose passwords have been cracked, sold to spammers, and abused for sending phishing and email malware attacks. Sendgrid's parent company Twilio says it is working on a plan to require multi-factor authentication for all of its customers, but that solution may not come fast enough for organizations having trouble dealing with the fallout in the meantime. READ MORE...
There is a whole category of cyber-attacks largely untouched by the media. With breaking threat discoveries usually focused on targeted spear-phishing campaigns or widespread ransomware, cyber-attacks targeting cloud and SaaS are often overlooked. Many of these attacks can be traced back to two things - compromised credentials or misconfigurations - which simply aren't as exciting as salacious dirt on the rich and famous or an AI-created voicemail phishing attack. Although they are often overlooked. READ MORE...
If you're a Google Android user, you may have been pestered over the past week by popup notifications that you didn't expect and certainly didn't want. The first mainstream victim seems to have been Google's own Hangouts app. Users all over the world, and therefore at all times of day (many users complained of being woken up unnecessarily), received spammy looking messages like this: Hangouts now FCM Messages Test Notification!!!! READ MORE...
One of the world's largest domain registrars, Namecheap has been hit with a series of mysterious outages today and it is not clear why. The company with over 11 million registered users and 10 million domains offers domain registration, hosting, private email services, and TLS/SSL certificates and has become one of the most recognizable names in the industry. I noticed this since as early as 2:00 AM ET (7:00 AM UK time) when trying to get to my website without luck through my smartphone. READ MORE...
Services to include spotting racial bias, developing guidelines around AI projects. Companies pay cloud-computing providers like Amazon, Microsoft, and Google big money to avoid operating their own digital infrastructure. Google's cloud division will soon invite customers to outsource something less tangible than CPUs and disk drives-the rights and wrongs of using artificial intelligence. The company plans to launch new AI ethics services before the end of the year. READ MORE...
The Network Computing, Communications and Storage research group at Aarhus University has developed a completely new way to compress data. The new technique provides possibility to analyze data directly on compressed files, and it may have a major impact on the so-called "data tsunami" from massive amounts of IoT devices. The method will now be further developed, and it will form the framework for an end-to-end solution to help scale-down the exponentially increasing volumes of data from IoT devices. READ MORE...