Hostrisk

A driver privilege-escalation bug gives attackers kernel-mode access to millions of PCs used for gaming.

https://threatpost.com/hp-omen-hub-gamers-cyberattack/169739/

Dubbed OMIGOD, a series of vulnerabilities in the Open Management Infrastructure used in Azure on Linux demonstrate hidden security threats, researchers said.

https://threatpost.com/azure-zero-day-supply-chain/169508/

Two of IBM’s aging flagship server models, retired in 2020, won’t be patched for a command-injection flaw.

https://threatpost.com/no-patch-for-ibm-system-x-servers/169491/

Adobe releases security updates for 59 bugs affecting its core products, including Adobe Acrobat Reader, XMP Toolkit SDK and Photoshop.

https://threatpost.com/adobe-bugs-acrobat-experience-manager/169467/

The newly identified bug in a Zoho single sign-on and password management tool has been under active attack since early August.

https://threatpost.com/cisa-fbi-state-backed-apts-exploit-critical-zoho-bug/174768/

Microsoft and RiskIQ researchers have identified several campaigns using the recently patched zero-day, reiterating a call for organizations to update affected systems.

https://threatpost.com/microsoft-mshtml-ryuk-ransomware/174780/

A spyware effort bent on stealing cookies and logins is being driven by unsophisticated attackers cashing in on the initial-access-broker boom.

https://threatpost.com/airline-credential-theft-campaign/174264/

John Hammond, security researcher with Huntress, discusses a wallet-hijacking RAT, and how law enforcement recovered millions in Bitcoin after the Colonial Pipeline attack.

https://threatpost.com/financial-cybercrime-cryptocurrency-public-ledgers/169987/

Bitdefender worked with law enforcement to create a key to unlock victims encrypted in ransomware attacks before REvil’s servers went belly-up on July 13.

https://threatpost.com/revil-sodinokibi-ransomware-universal-decryptor/169498/

Many companies today automate their software development life cycle with continuous integration and continuous delivery (CI/CD). It’s part of the broader DevOps movement to speed software development while reducing errors. Continuous integration builds and tests code automatically, while continuous delivery automates the entire software release process up to production. In order to secure it, industry […]

The post How DevSecOps Can Secure Your CI/CD Pipeline appeared first on Security Intelligence.

https://securityintelligence.com/articles/how-devsecops-secure-cicd-pipeline/

As cybercriminals remain steadfast in their pursuit of unsuspecting ways to infiltrate today’s businesses, a new report by IBM Security X-Force highlights the top tactics of cybercriminals, the open doors users are leaving for them and the burgeoning marketplace for stolen cloud resources on the dark web. The big takeaway from the data is businesses […]

The post X-Force Report: No Shortage of Resources Aimed at Hacking Cloud Environments appeared first on Security Intelligence.

https://securityintelligence.com/posts/x-force-report-hacking-cloud-environments/

Malware can show up where you least expect it. Researchers discovered a logic bomb attack in the Python Package Index (PyPI) repository, which is code repository for Python developers and part of the software supply chain. Attackers aimed to get honest software developers to include the bombs in their applications by accident.  The researchers found […]

The post Cryptominers Snuck Logic Bomb Into Python Packages appeared first on Security Intelligence.

https://securityintelligence.com/articles/cryptominers-snuck-logic-bomb-into-python-packages/

Retail data breaches involving customer data happen often today. However, they tend to be smaller insize than health care, finance or government breaches. So, the general public notices them less. Yet, they happen more often than realized. Why? And how can you defend against them?  Human Error in Customer Data Theft All types of retail […]

The post What’s Behind the Leaks of Customer Data From Retailer Databases? appeared first on Security Intelligence.

https://securityintelligence.com/articles/behind-leaks-customer-data-retailer-databases/

After months of hard work, Amped Software brings you one of our biggest updates to Amped FIVE. They are very excited to introduce Time Calculator Tool, the Timestamp Adjustment filter, PTS Playback, and Advanced Conversion Procedures. Discover how these tools … Read more

The post Amped FIVE Now With Adjust Timestamp, Time Calculator, PTS Playback And Much More appeared first on Forensic Focus.

https://www.forensicfocus.com/news/amped-five-now-with-adjust-timestamp-time-calculator-pts-playback-and-much-more/

Magnet Forensics today announced that it has acquired DME Forensics Inc., a video and multimedia evidence solution company.

DME was founded in 2012, by Jimmy Schroering, a former forensic examiner with the U.S. Federal Bureau of Investigation’s Forensic Audio, Video … Read more

The post Magnet Forensics Acquires DME Forensics, A Leading Video And Multimedia Evidence Solution Company appeared first on Forensic Focus.

https://www.forensicfocus.com/news/magnet-forensics-acquires-dme-forensics-a-leading-video-and-multimedia-evidence-solution-company/

We are delighted to introduce the latest major update of our flagship product, Oxygen Forensic® Detective! Version 14.0 offers numerous innovations and enhancements that will make your job easier, cut backlogs, and allow access to previously unavailable evidence. Note: key … Read more

The post Oxygen Forensic Detective 14.0 Gives Investigators Access To More Data With The Latest Update appeared first on Forensic Focus.

https://www.forensicfocus.com/news/oxygen-forensic-detective-14-0-gives-investigators-access-to-more-data-with-the-latest-update/

You’re bought in to the idea of virtualizing your forensics lab with an AWS EC2 instance and you’re ready to get started! Now you just need to know how to actually set up your EC2 instance and get Magnet AXIOM … Read more

The post A Practical Guide To Virtualizing Your Forensics Workstation: Setting Up An Amazon EC2 Instance For AXIOM Cyber appeared first on Forensic Focus.

https://www.forensicfocus.com/articles/a-practical-guide-to-virtualizing-your-forensics-workstation-setting-up-an-amazon-ec2-instance-for-axiom-cyber/

Calls for Global Cryptocurrency Regulation Escalate as US Explores Options
Amid growing calls for cryptocurrency regulations, the U.S. acting comptroller of the currency has made a definitive statement on safeguarding investors and how cryptocurrency should intersect with traditional financial institutions.

https://www.inforisktoday.co.uk/occs-hsu-addresses-need-for-cryptocurrency-oversight-a-17557

Analysts Say the Gang Is Escalating Rhetoric to Scare Victims
Regarding the recent tactical innovation by the Grief ransomware gang that is threatening to wipe a victim’s data and decryption key if the victim engages a ransom negotiator, analysts are calling this a desperate ploy to scare a target into paying the ransom demand.

https://www.inforisktoday.co.uk/griefs-threat-to-wipe-decryption-key-believable-a-17556

But Does the ‘Policy Statement’ Warning Overstep the Intention of the Rule?
The FTC warns makers of personal health records, mobile health apps, fitness devices and a variety of similar products and services that they will face stiff civil monetary penalties for failure to comply with the commission’s 12-year-old - but never-yet enforced - Health Breach Notification Rule.

https://www.inforisktoday.co.uk/ftc-health-app-device-makers-must-report-breaches-a-17555