attack - Security Ticks

“Perfect” Windows downgrade attack turns fixed vulnerabilities into zero-days

0-day, attack, Don't miss, Hot stuff, News, research, SafeBreach, vulnerability, Windows, Windows Server / SecurityTicks

“Perfect” Windows downgrade attack turns fixed vulnerabilities into zero-days 2024-08-08 at 13:01 By Zeljka Zorz A researcher has developed a downgrade attack that can make Windows machines covertly, persistently and irreversibly vulnerable, even if they were fully patched before that. A downgrade attack exploiting the Windows Update process The direction of SafeBreach researcher Alon Leviev’s […]

React to this headline:

“Perfect” Windows downgrade attack turns fixed vulnerabilities into zero-days Read More »

Omni Hotels suffer prolonged IT outage due to cyberattack

attack, Closed Door Security, cyberattack, cybercrime, Don't miss, hospitality industry, Hot stuff, News, USA / SecurityTicks

Omni Hotels suffer prolonged IT outage due to cyberattack 2024-04-04 at 17:32 By Zeljka Zorz Texas-based Omni Hotels & Resorts has been responding to a cyberattack that started last Friday, which resulted in the unavailability of many of its IT systems. According to people staying at some of the 50 properties the company operates across

React to this headline:

Omni Hotels suffer prolonged IT outage due to cyberattack Read More »

Prisma Finance says $540K still at risk, hacker demands team reveal themselves

attack, exploit, Loan, Onchain Message, Onchain Proposal, Prisma Finance, Smart Contract Vulnerability, Trove / SecurityTicks

Prisma Finance says $540K still at risk, hacker demands team reveal themselves 2024-04-01 at 05:02 By Cointelegraph by Brayden Lindrea The decentralized borrowing protocol said there were still 14 accounts that have yet to revoke the affected smart contract that caused $11.6 million to be exploited last week. This article is an excerpt from Cointelegraph.com

React to this headline:

Prisma Finance says $540K still at risk, hacker demands team reveal themselves Read More »

Escalating cyber threats: Bots, fraud farms, and cryptojacking surge, urgently requiring attention

Abnormal Security, Aqua Security, Arkose Labs, Armis, attack, cybersecurity, Don't miss, Hornetsecurity, Imperva, Netwrix, News, Orange Cyberdefense, report, SonicWall, SpyCloud, survey, WatchGuard / SecurityTicks

Escalating cyber threats: Bots, fraud farms, and cryptojacking surge, urgently requiring attention 2024-01-05 at 06:32 By Help Net Security The motivations behind cyberattacks are as diverse as the methods employed. Whether driven by financial gain, political agendas, or sheer malice, cybercriminals exploit weaknesses in cybersecurity defenses, seeking entry points to compromise sensitive data, disrupt critical

React to this headline:

Escalating cyber threats: Bots, fraud farms, and cryptojacking surge, urgently requiring attention Read More »

Researchers automated jailbreaking of LLMs with other LLMs

Artificial Intelligence, attack, Don't miss, Hot stuff, machine learning, News, research, Robust Intelligence, Yale University / SecurityTicks

Researchers automated jailbreaking of LLMs with other LLMs 07/12/2023 at 13:47 By Zeljka Zorz AI security researchers from Robust Intelligence and Yale University have designed a machine learning technique that can speedily jailbreak large language models (LLMs) in an automated fashion. “The method, known as the Tree of Attacks with Pruning (TAP), can be used

React to this headline:

Researchers automated jailbreaking of LLMs with other LLMs Read More »

Transforming cybersecurity from reactive to proactive with attack path analysis

attack, Cloud, cybercriminals, cybersecurity, Don't miss, Hot stuff, risk, Skybox Security, Video / SecurityTicks

Transforming cybersecurity from reactive to proactive with attack path analysis 17/11/2023 at 08:03 By Help Net Security An attack path is important to prioritize potential risks in cloud environments. The attack path offers the ability to look at cloud environments from the attacker’s perspective. With today’s general awareness and concerted effort toward cybersecurity, cybercriminals rarely

React to this headline:

Transforming cybersecurity from reactive to proactive with attack path analysis Read More »

Why legacy system patching can’t wait

attack, Compliance, cybersecurity, Don't miss, Hot stuff, legacy technology, patching, resilience, software, TuxCare, Video / SecurityTicks

Why legacy system patching can’t wait 02/11/2023 at 07:32 By Help Net Security The persistent neglect of patching legacy systems is plaguing critical infrastructure and industries. The consequences of such neglect can be damaging to organizations, ranging from costly security vulnerabilities to compliance risk and operational inefficiencies. Thus, the question remains: why is the process

React to this headline:

Why legacy system patching can’t wait Read More »

Apple news: iLeakage attack, MAC address leakage bug

apple, attack, data theft, Don't miss, Hot stuff, iOS, iPad, macOS, Mysk, News, Privacy, research, vulnerability / SecurityTicks

Apple news: iLeakage attack, MAC address leakage bug 27/10/2023 at 12:31 By Zeljka Zorz On Wednesday, Apple released security updates for all supported branches of iOS and iPadOS, macOS, tvOS, watchOS and Safari. This time around, the updates did not garner as much attention as when they deliver a zero-day fix, though it has to

React to this headline:

Apple news: iLeakage attack, MAC address leakage bug Read More »

“Disappearing” implants, followed by first fixes for exploited Cisco IOS XE zero-day

0-day, attack, backdoor, Cisco, Don't miss, Hot stuff, News, Orange Cyberdefense, security update / SecurityTicks

“Disappearing” implants, followed by first fixes for exploited Cisco IOS XE zero-day 23/10/2023 at 13:04 By Zeljka Zorz Cisco has released the first fixes for the IOS XE zero-day (CVE-2023-20198) exploited by attackers to ultimately deliver a malicious implant. The fixes were made available on Sunday, but a curious thing happened the day before: several

React to this headline:

“Disappearing” implants, followed by first fixes for exploited Cisco IOS XE zero-day Read More »

Cisco IOS XE zero-day exploited by attackers to deliver implant (CVE-2023-20198)

0-day, attack, Cisco, Don't miss, Hot stuff, News / SecurityTicks

Cisco IOS XE zero-day exploited by attackers to deliver implant (CVE-2023-20198) 16/10/2023 at 22:33 By Zeljka Zorz A previously unknown vulnerability (CVE-2023-20198) affecting networking devices running Cisco IOS XE software is being exploited by a threat actor to take control of the devices and install an implant, Cisco Talos researchers have warned today. About CVE-2023-20198

React to this headline:

Cisco IOS XE zero-day exploited by attackers to deliver implant (CVE-2023-20198) Read More »

Dangerous vulnerability can be exploited to carry out massive DDoS attacks (CVE-2023-44487)

attack, attacks, AWS, Cloudflare, CVE, cybersecurity, DDoS, Google, News, threat, vulnerability / SecurityTicks

Dangerous vulnerability can be exploited to carry out massive DDoS attacks (CVE-2023-44487) 10/10/2023 at 16:21 By Help Net Security Cloudflare, Google, and Amazon AWS revealed that a zero-day vulnerability in the HTTP/2 protocol has been used to mount massive, high-volume DDoS attacks, which they dubbed HTTP/2 Rapid Reset. Decoding HTTP/2 Rapid Reset (CVE-2023-44487) In late

React to this headline:

Dangerous vulnerability can be exploited to carry out massive DDoS attacks (CVE-2023-44487) Read More »

Why zero trust delivers even more resilience than you think

access management, attack, cyber resilience, cybersecurity, Don't miss, Expert analysis, Expert corner, Hot stuff, NetScaler, News, opinion, policy, remediation, zero trust / SecurityTicks

Why zero trust delivers even more resilience than you think 10/10/2023 at 08:04 By Help Net Security Ten years ago, zero trust was an exciting, innovative perspective shift that security experts were excited to explore; today, it’s more likely to be framed as an inevitable trend than as a mere option on the security menu.

React to this headline:

Why zero trust delivers even more resilience than you think Read More »

Friend.tech users blame SIM swaps after more than 100 ETH drained in a week

attack, attacker, exploit, Friend Tech, hack, hackers, phishing scam, SIM swap / SecurityTicks

Friend.tech users blame SIM swaps after more than 100 ETH drained in a week 04/10/2023 at 10:03 By Cointelegraph By Jesse Coghlan In a short period of time, four friend.tech users reported their accounts were compromised and drained after hackers seized control of their mobile numbers. This article is an excerpt from Cointelegraph.com News View

React to this headline:

Friend.tech users blame SIM swaps after more than 100 ETH drained in a week Read More »

Is your identity safe? Exploring the gaps in threat protection

attack, credentials, cyber resilience, cybersecurity, data breach, Don't miss, Hot stuff, identity, MFA, Ransomware, Silverfort, threat, Video / SecurityTicks

Is your identity safe? Exploring the gaps in threat protection 27/09/2023 at 07:01 By Help Net Security A recent study from Silverfort has identified the identity attack surface as today’s most substantial weakness in cybersecurity resilience. Traditional approaches, such as MFA and PAM, have notable limitations that can lead to the exploitation of stolen credentials.

React to this headline:

Is your identity safe? Exploring the gaps in threat protection Read More »

Balancer blames ‘social engineering attack’ on DNS provider for website hijack

attack, Automated Market Maker, Balancer, DeFi Protocol, Domain Name System, Domain Registrar, EuroDNS, Frontend, Social Engineering Attack, User Interface / SecurityTicks

Balancer blames ‘social engineering attack’ on DNS provider for website hijack 21/09/2023 at 04:02 By Cointelegraph By Brayden Lindrea Blockchain security firms SlowMist and CertiK also believe the crypto wallet drainer Angel Drainer was involved in the estimated $238,000 exploit. This article is an excerpt from Cointelegraph.com News View Original Source React to this headline:

React to this headline:

Balancer blames ‘social engineering attack’ on DNS provider for website hijack Read More »

DeFi protocol Balancer frontend is under attack, users urged to stay away

attack, Balancer, DeFi Protocol, Frontend, User Interface / SecurityTicks

DeFi protocol Balancer frontend is under attack, users urged to stay away 20/09/2023 at 04:01 By Cointelegraph By Brayden Lindrea The platform notified its community on Sept. 19 at 11:49 pm UTC, urging users to not interact with Balancer’s protocol until further notice. This article is an excerpt from Cointelegraph.com News View Original Source React

React to this headline:

DeFi protocol Balancer frontend is under attack, users urged to stay away Read More »

IEEE 802.11az provides security enhancements, solves longstanding problems

access point, attack, Bandwidth, cybersecurity, Data Protection, Don't miss, Features, framework, Hot stuff, IEEE, IoT, network, News, opinion, standards, wireless, WLAN / SecurityTicks

IEEE 802.11az provides security enhancements, solves longstanding problems 25/08/2023 at 07:04 By Mirko Zorz In this Help Net Security interview, Jonathan Segev, IEEE 802.11 Task Group (TG) Chair of next-generation positioning (TGaz) at IEEE, discusses IEEE 802.11az. The new standard will enable accuracy to less than 0.1 meters, which is a significant improvement from the

React to this headline:

IEEE 802.11az provides security enhancements, solves longstanding problems Read More »

Ransomware dwell time hits new low

Active Directory, attack, cybercrime, cybersecurity, Incident Response, Malware, News, Ransomware, report, Sophos, threats / SecurityTicks

Ransomware dwell time hits new low 25/08/2023 at 06:34 By Help Net Security Median attacker dwell time—the time from when an attack starts to when it’s detected—shrunk from 10 to eight days for all attacks, and to five days for ransomware attacks during the first half of 2023, according to Sophos. In 2022, the median

React to this headline:

Ransomware dwell time hits new low Read More »

Almost all VPNs are vulnerable to traffic-leaking TunnelCrack attacks

attack, Cisco, Cloudflare, Data leak, Don't miss, Hot stuff, Malwarebytes, Mozilla, News, NordVPN, Privacy, research, VPN, vulnerability / SecurityTicks

Almost all VPNs are vulnerable to traffic-leaking TunnelCrack attacks 14/08/2023 at 16:47 By Zeljka Zorz Several vulnerabilities that affect most VPN products out there can be exploited by attackers to read user traffic, steal user information, or even attack user devices, researchers have discovered. “Our attacks are not computationally expensive, meaning anyone with the appropriate

React to this headline:

Almost all VPNs are vulnerable to traffic-leaking TunnelCrack attacks Read More »

How to accelerate and access DDoS protection services using GRE

attack, CISO, cybersecurity, DDoS, Don't miss, Gcore, Hot stuff, how-to, strategy, tips, Video / SecurityTicks

How to accelerate and access DDoS protection services using GRE 11/08/2023 at 06:31 By Help Net Security As we entered 2023, the cybersecurity landscape witnessed an increase in sophisticated, high-volume attacks, according to Gcore. The maximum attack power rose from 600 to 800 Gbps. UDP flood attacks were most common and amounted to 52% of

React to this headline:

How to accelerate and access DDoS protection services using GRE Read More »