Why Medium-sized Companies Waste 80% of Their IT Security Budget
In 2008 I was involved in a research project that looked at the effectiveness of training IT engineers and administrators. The program used scientific methods to evaluate technical product training against control groups with no training in their trades' tools and technologies. As an interesting side note, that research company would go on to be purchased and rebranded as Microsoft MODL. READ MORE...
AT&T alerts 9 million customers of data breach after vendor hack
AT&T is notifying roughly 9 million customers that some of their information was exposed after a marketing vendor was hacked in January. "Customer Proprietary Network Information from some wireless accounts was exposed, such as the number of lines on an account or wireless rate plan," AT&T told BleepingComputer. "The information did not contain credit card information, Social Security Number, account passwords or other sensitive personal information. We are notifying affected customers." READ MORE...
DC health exchange breach affects former national security officials, Congress
A sample of data stolen from Washington, D.C.'s health insurance exchange includes the personal information of a prominent former defense official and employees of lobbying firms, an indication that the breach may be the latest in a string to expose the personal information belonging to members of the U.S. national security establishment. The District of Columbia's health insurance exchange confirmed Wednesday that it was working with law enforcement to investigate data posted on a public forum. READ MORE...
Cerebral Informing 3.1 Million Individuals of Inadvertent Data Exposure
Emotional health care provider Cerebral is informing over 3.1 million individuals that their protected health information (PHI) might have been inadvertently exposed via third-party tracking technologies on its platforms. Cerebral has been using tracking technologies - such as those provided by Facebook, Google, TikTok, and others - since 2019, but disabled, reconfigured, or removed them after learning that some of the data shared with the third-parties also included PHI. READ MORE...
Data protection vendor Acronis admits to data leak as 12GB trove appears online
The CISO of Swiss cybersecurity firm Acronis has acknowledged a breach of the company's systems but stated the incident only impacted a single customer and that all other data remains safe. A Thursday post [PDF] to the notorious Breached Forums leak-mart brought news of the breach. In that post an attacker named kernelware - who also cracked Acer - claimed he/she had hacked and leaked certificate files, command logs, system configurations, system information logs, etc. READ MORE...
Akamai mitigates record-breaking 900Gbps DDoS attack in Asia
Akamai reports having mitigated the largest DDoS (distributed denial of service) attack ever launched against a customer based in the Asia-Pacific region. DDoS is an attack that involves sending a large volume of garbage requests to a targeted server, depleting its capacity, and thus rendering the websites, applications, or other online services it hosts unreachable by legitimate users. READ MORE...
Update Android now! Two critical vulnerabilities patched
The March security updates for Android include fixes for two critical remote code execution (RCE) vulnerabilities impacting Android systems running versions 11, 12, 12L, and 13. Users should update as soon as they can. The March 2023 Android Security Bulletin contains the details of the security vulnerabilities affecting Android devices. Security patch levels of 2023-03-05 or later address all of these issues. READ MORE...
Malware infecting widely used security appliance survives firmware updates
Threat actors with a connection to the Chinese government are infecting a widely used security appliance from SonicWall with malware that remains active even after the device receives firmware updates, researchers said. SonicWall's Secure Mobile Access 100 is a secure remote access appliance that helps organizations securely deploy remote workforces. Customers use it to grant granular access controls to remote users, provide VPN connections to networks, and set unique profiles for each employee. READ MORE...
Xenomorph Android malware now steals data from 400 banks
The Xenomorph Android malware has released a new version that adds significant capabilities to conduct malicious attacks, including a new automated transfer system (ATS) framework and the ability to steal credentials for 400 banks. Xenomorph was first spotted by ThreatFabric in February 2022, which discovered the first version of the banking trojan on the Google Play store, where it amassed over 50,000 downloads. READ MORE...
Alleged seller of NetWire RAT arrested in Croatia
This week, as part of a global law enforcement operation, federal authorities in Los Angeles successfully confiscated www.worldwiredlabs[dot]com, a domain utilized by cybercriminals to distribute the NetWire remote access trojan (RAT) allowed perpetrators to assume control of infected computers and extract a diverse range of sensitive information from their unsuspecting victims. READ MORE...
FBI finally admits to buying location data on Americans, horrifying experts
At a Senate Intelligence Committee hearing yesterday, FBI Director Christopher Wray confirmed for the first time that the agency has in the past purchased the location data of US citizens without obtaining a warrant. This revelation, which has alarmed privacy advocates, came after Sen. Ron Wyden (D-Ore.) asked Wray directly, "Does the FBI purchase US phone-geolocation information?" Wray's response provided a rare insight into how the FBI has used location data to surveil Americans. READ MORE...
- ...in 1876, the first discernible speech is transmitted over a telephone system by inventor Alexander Graham Bell.
- ...in 1971, actor Jon Hamm ("Mad Men", "Unbreakable Kimmy Schmidt") is born in St. Louis, MO.
- ...in 1977, astronomers James Elliot, Edward Dunham, and Jessica Mink definitively confirm that the planet Uranus has rings.
- ...in 2000, the NASDAQ Composite index peaks at 5,048.62, marking the beginning of the end for the early online boom known as the "Dot-com bubble."
