Large Orgs Plagued with Bugs, Face Giant Patch Backlogs

Large companies find an average of 779,935 individual security bugs when running routine vulnerability scans; and over the course of six months, an average of 28 percent of those vulnerabilities will remain unmitigated. This leaves many of these organizations in a sitting-duck position for...

Medical Debt Collection Firm R1 RCM Hit in Ransomware Attack

R1 RCM Inc. NASDAQ:RCM, one of the nations largest medical debt collection companies, has been hit in a ransomware attack. Formerly known as Accretive Health Inc., Chicago-based R1 RCM brought in revenues of $1.18 billion in 2019. The company has more than 19,000 employees and contracts with at...

DDoS attacks in Q2 2020

News overview Not just one but two new DDoS amplification methods were discovered last quarter. In mid-May, Israeli researchers reported a new DNS server vulnerability that lurks in the DNS delegation process. The vulnerability exploitation scheme was dubbed "NXNSAttack". The hacker sends to a...

P2PE v3.0 – Why organizations should prepare now

The Payment Card Industry Security Standards Council PCI SSC published version 3.0 of the Point-To-Point Encryption P2PE standard back in December 2019. The new version simplifies and adds flexibility to the process for component and solution providers to validate their P2PE products for cardhold...

Data Accountability and Transparency Act of 2020 looks beyond consent

In the United States, data privacy is hard work—particularly for the American people. But one US Senator believes it shouldn’t have to be. In June, Democratic Senator Sherrod Brown of Ohio released a discussion draft of a new data privacy bill to improve Americans’ data privacy rights and their...

Hyperledger: Vulnerabilities in Endorsement Mechanism of Private Data Related Transactions in Hyperledger Fabric 2.0

To whom it may concern, We report design flaws that can be exploited by private data collection non-member organizations to forge endorsements of read-related transactions and return fake values to a user. When a user issues a read-only transaction proposal to a endorser in the private data...

Source code of over 50 high profile organizations leaked online

By Deeba Ahmed Source code leak took place due to a misconfiguration error. This is a post from HackRead.com Read the original post: Source code of over 50 high profile organizations leaked online...

So Long, Privacy Shield

In whats rapidly becoming the splashiest news to hit the privacy space in years, the Court of Justice of the EU CJEU, the highest court in the European Union, invalidated the U.S. Privacy Shield, a legal instrument that made it possible for organizations operating in the United States to transfer...

First-Ever Russian BEC Gang, Cosmic Lynx, Uncovered

Researchers say they have discovered the first-ever reported Russian business email compromise BEC cybercriminal ring, showing that sophisticated attackers beyond the usual Nigerian scammers are setting their sights on the email-based attack vector. The BEC gang is called Cosmic Lynx, and has bee...

Healthcare Enterprises Share Risk Reduction Insight

Healthcare organizations are subject to strict regulations, including data security and privacy. Three enterprises discuss risk reduction within a sector where a data leak could prove disastrous...

The Fear of Vendor Lock-in Leads to Cloud Failures

Vendor lock-in has been an often-quoted risk since the mid-1990’s. Fear that by investing too much with one vendor, an organization reduces their options in the future. Was this a valid concern? Is it still today? The Risk Organizations walk a fine line with their technology vendors. Ideally, you...

Over 100 New Chrome Browser Extensions Caught Spying On Users

Google recently removed 106 more extensions from its Chrome Web Store after they were found illegally collecting sensitive user data as part of a "massive global surveillance campaign" targeting oil and gas, finance, and healthcare sectors. Awake Security, which disclosed the findings late last...

AcidBox Malware Uncovered Using Repurposed VirtualBox Exploit

Advanced malware, dubbed AcidBox, has been identified by researchers who say a mysterious cybergang used it twice against Russian organizations as far back as 2017. In a report released Wednesday, Palo Alto Networks’ Unit 42 sheds new light onto attacks against the popular open-source...

Hackers Target Military and Aerospace Staff by Posing as HRs Offering Jobs

Cybersecurity researchers today took the wraps off a new sophisticated cyber-espionage campaign directed against aerospace and military organizations in Europe and the Middle East with an aim to spy on key employees of the targeted firms and, in some case, even to siphon money. The campaign, dubb...

Sodinokibi ransomware gang auctions off stolen data

Is it legal to buy stolen data from criminals? In most countries the answer would be no. But will it lead to a penalty or a fine? That is a different question and I’m afraid some companies and organizations will be inclined to seriously consider the last question even when they know the answer to...

Helium: Read-Only user can delete users

hello this endpoint DELETE /api/invitations/0ff7e9f9-877a-40cc-b99f-f6b3b1bea3f8 vulnerable to Insecure Direct Object Reference Steps to reproduce the bug Let's assume that three accounts exist: [email protected] role Administrator [email protected] role Read-Only [email protected] invited user...

Planning Ahead to Prevent Vulnerabilities

The cost to remediate vulnerabilities increases as those vulnerabilities make it further into the development process. If they make it into a final release, those vulnerabilities can leave organizations vulnerable to attacks, costing time and resources to address, as well as causing damage to the...

Logic flaws exist in A8+ Group Edition of Beijing Zhiyuan Internet Software Co.

Zhiyuan Collaboration Management Software A8 is a collaborative office management platform for medium-sized, large and group organizations. There is a logic flaw vulnerability in the A8+ Collaboration Management Software Group Edition of Beijing Zhiyuan Internet Software Co., Ltd, which can be...

PT-2020-13393 · Gitea +1 · Gitea +1

Name of the Vulnerable Software and Affected Versions: Gitea versions through 1.11.5 Description: An issue was discovered in Gitea where an attacker can trigger a deadlock by initiating a transfer of a repository's ownership from one organization to another. Recommendations: For Gitea versions...

Am I doing it right? An introspective look at "why it's like this"

Cybersecurity, as a practice within organizations, has existed for decades. Larger or government organizations have had dedicated cybersecurity functions in place since at least the 90s. By the early 2000s, organizations were appointing CISOs, and by the end of that decade over 85% of large...