Increasing resilience against Solorigate and other sophisticated attacks with Microsoft Defender

­Even as investigations into the sophisticated attack known as Solorigate are still underway, details and insights about the tools, patterns, and methods used by the attackers point to steps that organizations can take to improve their defenses against similar attacks. Solorigate is a cross-domai...

VMware Carbon Black Cloud™ Awarded Cyber Catalyst Designation

VMware Carbon Black Cloud has been awarded a Cyber CatalystSM designation for its cloud native endpoint and workload protection platforms, which helps more than 20,000 organizations worldwide detect and stop emerging attacks. The designation is part of the annual Cyber Catalyst by Marsh℠ program,...

Security Update for Forefront Endpoint Protection (January 2021)

The Malware Protection Engine version of Forefront Endpoint Protection installed on the remote Windows host is prior to 1.1.17600.5. It is, therefore, affected by an unspecified remote code execution vulnerability. An authenticated, local attacker can exploit this to bypass authentication and...

2021 Cybersecurity Trends: Bigger Budgets, Endpoint Emphasis and Cloud

After shrinking in 2020, cybersecurity budgets in 2021 climb higher than pre-pandemic limits. Authentication, cloud data protection and application monitoring will top the list of CISO budget and cybersecurity priorities. According to experts, these are just a few of the themes to dominate the ye...

Malwarebytes Endpoint Protection Backlink Vulnerability

Malwarebytes Endpoint Protection is an endpoint protection software from the US-based Malwarebytes Inc. The software provides complete malware protection and remediation with accurate threat detection, proactive threat blocking, and thorough remediation. A security vulnerability exists in...

Serious Vulnerabilities in Dualog Connection Suite

TL;DR The flaws found in this maritime comms and connection suite were many, and not insignificant: Directory traversal 2FA challenge/response is performed in a client-side application Default install password SQL injection User data leakage Easily brute forcible password hashes Introduction Duri...

Digital Defense integrates with Microsoft to detect attacks missed by traditional endpoint security

This blog post is part of the Microsoft Intelligent Security Association MISA guest blog series. You can learn more about MISA here. Cybercriminals have ramped up their initial compromises through phishing and pharming attacks using a variety of tools and tactics that, while numerous, are simple...

Digital Defense integrates with Microsoft to detect attacks missed by traditional endpoint security

This blog post is part of the Microsoft Intelligent Security Association MISA guest blog series. You can learn more about MISA here. Cybercriminals have ramped up their initial compromises through phishing and pharming attacks using a variety of tools and tactics that, while numerous, are simple...

Defining Cloud Workload Protection

Organizations are now turning to an increasingly hybrid cloud infrastructure model to support remote workforces, a trend that has accelerated significantly amid the recent global health crisis. This presents a new challenge as cloud environments both private and public require a purpose-built...

Surviving college distance learning during the pandemic: a cybersecurity guide

Social distancing, the wearing of face masks, practicing hand hygiene, and disinfecting often-touched surfaces have become human necessities during the pandemic era. For schools, theyve also had to adapt quickly to incorporate distance learning methods that let students continue their studies. Bu...

EDR Solutions Require Comprehensive Telemetry to Fend Off Multi-Vector Attacks

Endpoint devices are under increasingly aggressive and sophisticated attacks, so protecting them effectively from cyber criminals has become a thorny and vexing challenge as the threat landscape expands. It doesn’t help that endpoint protection today fluctuates between two strategies that are...

Deception Technology: No Longer Only A Fortune 2000 Solution

A cyber-attacker successfully breaks into your environment and begins sneaking around to find something valuable - intellectual property, bank account credentials, company plans, whatever. The attacker makes his way to a certain host on a network node to browse the directories, and suddenly, his...

Better Together: Akamai Enhances Zero Trust Network Access with CrowdStrike

More than ever before, users and applications no longer reside at the office. Organizations are managing a mobile and globally distributed workforce that needs access to corporate systems, applications, and data from outside the traditional network perimeter. In addition, cyberattackers are...

Insecure RDP

There are active attack campaigns as of October 2020 targeting RDP servers without multi-factor authentication enabled. Recent assessments: zeroSteiner at October 09, 2020 6:36pm UTC reported: Over the past couple of years 2018-2020 attacks against RDP have become more and more common. Recent...

Symantec Endpoint Protection Installed (macOS)

Binary data symantecendpointprotectionmacosinstalled.nbin...

Top Three Demos at VMworld 2020: Security, Threat Hunting, and Beyond

VMworld 2020 Sept. 29- Oct. 1 is fast approaching. This year, and for the first time ever, VMworld will showcase a new intrinsic security track featuring 50+ sessions on the future of workspace and workload security. Attendees will have the opportunity to participate in hands-on workshops, hunt f...

Product Overview: Cynet Takes Cyber Threat Protection Automation to the Next Level with Incident Engine

We have all heard of the “cybersecurity skills gap” – the inability of firms to hire and retain high-level cybersecurity talent. This gap has been manifesting in two ways. First, companies that want to hire cybersecurity talent simply cannot find candidates with sufficient skills. Second, compani...

VMware Carbon Black First to Block Hidden Malicious Commands in Obfuscated Scripts

For a long time now, our Threat Analysts have flagged the growing threat of script-based attacks, especially from Microsoft PowerShell and Windows Management Interface script commands, and their ability to escape notice in many antivirus solutions. Increasingly, these types of attacks have become...

PAN-OS: URL filtering policy is not enforced on TLS handshakes for decrypted HTTPS sessions

When SSL/TLS Forward Proxy Decryption mode has been configured to decrypt the web transactions, the PAN-OS URL filtering feature inspects the HTTP Host and URL path headers for policy enforcement on the decrypted HTTPS web transactions but does not consider Server Name Indication SNI field within...

The vulnerability of the Global Protect Agent for Linux’s endpoint protection software lies in its insecure handling of privileges. This allows attackers to elevate their privileges to the root level.

The vulnerability of the Global Protect Agent for Linux endpoint protection software lies in the insecure management of privileges. Exploiting this vulnerability can allow an attacker to elevate their privileges to the root level...