258 matches found
Block Admits Data Breach Involving Cash App Data Accessed by Former Employee
Block, the company formerly known as Square, has disclosed a data breach that involved a former employee downloading unspecified reports pertaining to its Cash App Investing that contained information about its U.S. customers. "While this employee had regular access to these reports as part of...
CVE-2021-23639
The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution RCE due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine...
2022 Planning: Simplifying Complex Cybersecurity Regulations
Compliance does not equal security, but it’s also true that a strong cybersecurity program meets many compliance obligations. How can we communicate industry regulatory requirements in a more straightforward way that enhances understanding while saving time and effort? How can we more easily...
Update to GLBA Security Requirements for Financial Institutions
Heads up financial institutions: the Federal Trade Commission FTC announced the first cybersecurity updates to the Gramm Leach-Bliley Act GLBA Safeguards Rule since 2003. The new rule strengthens the required security safeguards for customer information. This includes formal risk assessments,...
Remote dating: How do the apps safeguard our data?
The pandemic and the restrictions that came with it have led to an increase in the popularity of dating apps. For example, the total number of swipes on Tinder increased by 11% last year, with the daily number of swipes surpassing the 3 billion mark for the first time as early as March 2020. This...
User deposits can be turned into sponsors and then be stolen
Handle cmichel Vulnerability details Vulnerability Details When a user deposits to the treasury they first approve the contract and then call its deposit action which performs an ERC20.transferFrom. It's possible for an attacker to frontrun the final deposit transaction after the user approval an...
Extracting Personal Information from Large Language Models Like GPT-2
Researchers have been able to find all sorts of personal information within GPT-2. This information was part of the training data, and can be extracted with the right sorts of queries. Paper: "Extracting Training Data from Large Language Models." Abstract: It has become common to publish large...
Elections Globally Are Under Threat. Here's How to Protect Them
A new report calls for safeguards to reduce the dangers posed by misinformation, online extremism, and social media manipulation...
Thinking about the balance between compliance and security
Today, many organizations still struggle to adhere to General Data Protection Regulation GDPR mandates even though this landmark regulation took effect nearly two years ago. A key learning for some: being compliant does not always mean you are secure. Shifting privacy regulations, combined with...
Google Tightens Its Voice Assistant Rules Amid Privacy Backlash
Following Apple, Amazon, and others, Google will put in new safeguards against accidental voice assistant collection and transcription...
Bearer tokens are revealed in logs (audit finding TOB-K8S-001)
This issue was reported in the Kubernetes Security Audit Report Description Kubernetes requires an authentication mechanism to enforce users’ privileges. One method of authentication, bearer tokens, are opaque strings used to associate a user with their having successfully authenticated previousl...
Regulating International Trade in Commercial Spyware
Siena Anstis, Ronald J. Deibert, and John Scott-Railton of Citizen Lab published an editorial calling for regulating the international trade in commercial surveillance systems until we can figure out how to curb human rights abuses. Any regime of rigorous human rights safeguards that would make a...
IRS Releases Six Cybersecurity Safeguards
The Internal Revenue Service IRS has issued a news release outlining six cybersecurity safeguards to protect computers, email, and sensitive data. The recommendations are part of the Taxes. Security. Together. Checklist, which the IRS created to help tax professionals protect sensitive taxpayer...
Key considerations for building vs. buying identity access management solutions
Time and time again, organizations learn the hard way that no matter which security solutions they have in place, if they haven’t properly secured the end user, their efforts can be easily rendered moot. The classic slip-up most often associated with end-user-turned-insider-threat is falling for ...
What Will GDPR’s Impact Be On U.S. Consumer Privacy?
Will General Data Protection Regulation rules that go in effect on Friday impact the privacy of U.S. citizens? It depends who you ask, but the odds-on-favorite answer is “not by much.” The Facebook Cambridge Analytica scandal in March led to a firehose of rebuke against social media platforms,...
Intel’s ‘Virtual Fences’ Spectre Fix Won’t Protect Against Variant 4
Spectre and Meltdown fixes for Intel chips announced in March, to be embedded into new CPUs, do not address the newly disclosed Variant 4, sources said. Intel introduced hardware-based safeguards to its new chips to protect against the Spectre and Meltdown flaws that rocked the silicon industry...
John Summers Q&A - Evanta Global CIO Executive Summit
Akamai's John Summers, VP & CTO, spoke at the recent Evanta Global CIO Executive Summit, a gathering of 75 major organization CIOs. His session was titled, "Cloud Security - Adopt Zero Trust and Put Asset-Level Safeguards in Place." Here are some of the key questions he addressed. How do you...
Wapiti 3.0.0 - The Web-Application Vulnerability Scanner
Wapiti allows you to audit the security of your websites or web applications. It performs "black-box" scans it does not study the source code of the web application by crawling the webpages of the deployed webapp, looking for scripts and forms where it can inject data. Once it gets the list of...
pcc - PHP Secure Configuration Checker
Check current PHP configuration for potential security flaws. Simply access this file from your webserver or run on CLI. Author This software was written by Ben Fuhrmannek, SektionEins GmbH, in an effort to automate php.ini checks and spend more time on cheerful tasks. Idea one single file for ea...
