Latest Cybersecurity News and Articles

---

Secure code training ruled better investment than code scanning tools

EMA's Secure Coding Practices survey of 129 software development professionals found that code scanning tools were less effective than developers.

---

Copycat Criminals Mimicking Lockbit Ransomware Gang in Northern Europe

Despite not being the true LockBit Locker group, these micro criminals were still able to cause significant damage by encrypting a large number of internal files at SMBs in Belgium.

---

Meta Awards $27,000 Bounty for 2FA Bypass Vulnerability

Security researcher Gtm Manoz from Nepal discovered in September 2022 that a system designed by Meta for confirming a phone number and email address did not have any rate-limiting protection.

---

UK-Based JD Sports Details Data Breach Affecting 10 Million Customers

The company says the breach stems from a system containing customer data "relating to some online orders placed between November 2018 and October 2020" and that customers are at risk from scammers.

---

Automated security CyberTech Hadrian receives ABN AMRO backing

As part of the investment, ABN AMRO will integrate Hadrian technology into its platform. The company stated it has formed tens of thousands of digital endpoints as it has grown its digital infrastructure over the years.

---

Why large U.S. universities are blocking TikTok right now

In this edited interview excerpt from a Bloomberg Technology report, Check Point Security Evangelist Micki Boland discusses a new U.S.-based ban on TikTok, shares security insider insights, and provides actionable data privacy tips. As you know, select Texas universities have moved to block access to TikTok through campus wi-fi. What we’re hearing from users is […] The post Why large U.S. universities are blocking TikTok right now appeared first on CyberTalk.

---

Facebook bug meant anyone could bypass 2FA

EXECUTIVE SUMMARY: A bug in a new endpoint system developed by Meta could have allowed a hacker to turn off an account’s two-factor authentication. In simpler terms, a hacker could have turned off the two-factor authentication on your Facebook account at any time prior to mid-September of 2022. A hacker just needed a phone number […] The post Facebook bug meant anyone could bypass 2FA appeared first on CyberTalk.

---

GitHub Breach: Hackers Stole Code-Signing Certificates for GitHub Desktop and Atom

GitHub on Monday disclosed that unknown threat actors managed to exfiltrate encrypted code signing certificates pertaining to some versions of GitHub Desktop for Mac and Atom apps. As a result, the company is taking the step of revoking the exposed certificates out of abundance of caution. The following versions of GitHub Desktop for Mac have been invalidated: 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6,

---

QNAP Fixes Critical Vulnerability in NAS Devices with Latest Security Updates

Taiwanese company QNAP has released updates to remediate a critical security flaw affecting its network-attached storage (NAS) devices that could lead to arbitrary code injection. Tracked as CVE-2022-27596, the vulnerability is rated 9.8 out of a maximum of 10 on the CVSS scoring scale. It affects QTS 5.0.1 and QuTS hero h5.0.1. "If exploited, this vulnerability allows remote attackers to inject

---

MyGov app facing overhaul to centralise online identification

Audit review of government tool housing Medicare and Centrelink services recommends significant changesFollow our Australia news live blog for the latest updatesGet our morning and afternoon news emails, free app or daily news podcastThe federal government’s much-maligned myGov app faces an overhaul and could soon be used for online identity verification, as well as an increasing number of government services.An audit review, undertaken by former Telstra chief executive David Thodey and a panel of experts appointed by the Albanese government in September last year, recommended a significant overhaul of myGov, which houses Medicare and Centrelink.Sign up for Guardian Australia’s free morning and afternoon email newsletters for your daily news roundup Continue reading...

---

Cyberattack confirmed as cause for phone and IT problems at British music school

A specialist music academy in Guildford, southwest of London, has confirmed that a cyberattack is responsible for knocking out its phone lines and impacting the school’s IT systems.

---

Latvia confirms phishing attack on Ministry of Defense, linking it to Russian hacking group

A spokesperson for Latvia’s Ministry of Defense confirmed that the latest attack was “most likely” linked to Russia's Gamaredon, although the investigation is still ongoing.

---

Cobalt Sapling Uses Multiple Personas for Pro-Iranian Missions

The threat actor known as Cobalt Sapling was spotted targeting Saudi Arabia by creating a new sub-group dubbed Abraham's Ax. Researchers also found a connection between Moses Staff and Abraham's Ax. Both rely on the same custom cryptographic wiper malware for encrypting the victim’s data. To stay protected, experts recommend organizations audit the access controls by leveraging the available IOCs.

---

How businesses can bolster their cybersecurity defenses with open source

Organizations are optimistic about the security of open-source software development, with an average of 77% believing the security of open-source development will improve by the end of 2023, according to a 2022 Linux Foundation report.

---

The Untold Story of a Crippling Ransomware Attack

More than two years later, Hackney Council is still dealing with the colossal aftermath of a ransomware attack. While its services are now back up and running, parts of the council are still not operating as they were prior to the attack.

---

New PlugX Sample Uses Sneaky Methods, can Impact Air-gapped Systems

A new strain of the PlugX malware was found, which can hide malicious files on detachable USB drives and infect the Windows hosts they are connected to. The technique is stealthy and can impact air-gapped systems. Organizations are suggested to have in-depth and multi-layered security defense to protect all end-points.

---

QNAP fixes critical bug letting hackers inject malicious code

The vulnerability is tracked as CVE-2022-27596 and rated by the company as 'Critical' (CVSS v3 score: 9.8), impacting QTS 5.0.1 and QuTS hero h5.0.1 versions of the operating system.

---

Budget constraints force cybersecurity teams to do more with less

About 49% of organizations have sufficient budget to fully meet their current cybersecurity needs, and 11% can, at best, protect only their most critical assets, according to a survey by the Neustar International Security Council.

---

How the Silk Road Affair Changed Law Enforcement

The Silk Road was the first modern dark web marketplace, an online place for anonymously buying and selling illegal products and services using Bitcoin. Ross Ulbricht created The Silk Road in 2011 and operated it until 2013 when the FBI shut it down.

---

Update: GitHub revokes code signing certificates stolen in repo hack

GitHub says unknown attackers have stolen encrypted code-signing certificates for its Desktop and Atom applications after gaining access to some of its development and release planning repositories.