Gone Phishing For The Holidays

Written by Or Katz and Amiram Cohen Overview: While our team, Akamai's Enterprise Threat Protector Security Research Team, monitored internet traffic throughout the 2017 holiday season, we spotted a wide-spread phishing campaign targeting users through an advertising tactic. During the six week...

WordPress Admin Menu Tree Page View 2.6.9 Plugin - Cross-Site Request Forgery / Privilege Escalation

Exploit for php platform in category web applications Exploit Title: Admin Menu Tree Page View CSRF, Privilege Escalation Exploit Author: Panagiotis Vagenas Author Link: https://twitter.com/panVagenas Vendor Homepage: http://eskapism.se/ Software Link:...

Chromium, Google Chrome: Multiple vulnerabilities

Background Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. Google Chrome is one fast, simple, and secure browser for all your devices Description Multiple vulnerabilities have been discovered in Chromium and...

Implementing the CIS 20 Critical Security Controls: Slash Risk of Cyber Attacks by 85%

If a CISO needed to cut cyber attack risk by 85%, how would this security chief go about accomplishing that? Would the CISO even know where to begin? It’s safe to say that such a mandate would be considered daunting, and maybe even overwhelming. CISOs are scrambling to protect IT infrastructures...

couchdb -- multiple vulnerabilities

Apache CouchDB PMC reports: Database Administrator could achieve privilege escalation to the account that CouchDB runs under, by abusing insufficient validation in the HTTP API, escaping security controls implemented in previous releases...

Excerpts from The Ransomware Economy: Emergence and Innovation

Carbon Black recently published an investigative report on the Dark Web marketplace for ransomware. This is an excerpt from that report, which you can find here. For more information about the rise of ransomware, and what you can do about it, check out the Future-Proof Your Ransomware Prevention...

Webcast Q&A: Automating the CIS Critical Security Controls

Qualys Product Management Director Tim White and SANS Institute Analyst John Pescatore did a deep dive into the Center for Internet Security’s Critical Security Controls during a recent webcast, and answered questions from audience members about these 20 foundational security practices, and about...

Chromium, Google Chrome: Multiple vulnerabilities

Background Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. Google Chrome is one fast, simple, and secure browser for all your devices Description Multiple vulnerabilities have been discovered in Chromium and...

Hackers Take Aim at SSH Keys in New Wave of Attacks

SSH private keys are being targeted by hackers who have stepped up their scanning of thousands of servers hosting WordPress websites in search of private keys. Since Monday, security researchers said they have observed a single entity scanning as many as 25,000 systems a day seeking vulnerable SS...

GDPR Requirements: Get Started with Classifier

The GDPR requires that organizations exhibit commitment to individuals’ data privacy by implementing a data protection by design and by default approach, meaning organizations need to build privacy and protection into their products, services, and applications. GDPR also mandates that organizatio...

Achieve Continuous Security and Compliance with the CIS Critical Security Controls

For InfoSec pros, it’s easy to get overwhelmed by the constant noise from cybersecurity industry players — vendors, research firms, consultants, industry groups, government regulators and media outlets. A good antidote for this hyperactive chatter is to refocus on foundational InfoSec practices...

ROPEMAKER Exploit Allows for Changing of Email Post-Delivery

Researchers say a new exploitable attack vector for email, one that could enable the changing of email content content post-delivery, could let attackers bypass security controls and trick victims into clicking through to a malicious site. Details of the exploit called ROPEMAKER, which stands for...

Adobe Acrobat and Reader Security Bypass Vulnerability

Adobe Acrobat and Reader are the United States of America Audobee Adobe company's products. The former is a set of PDF file editing and conversion tools, the latter is a set of PDF document reading software. Adobe Acrobat and Reader security bypass vulnerability exists. Remote attackers can use t...

Amazon Macie and Deep Security

Amazon S3 stores trillions of objects and regularly peaks at millions of requests per second. By any metric, it’s massive. With unparalleled durability and availability, it’s the backbone of AWS’ data services. This morning at the AWS Summit in New York City, AWS launched a new service: Amazon...

Qualys Policy Compliance Notification: Policy Library Update

Qualys’ library of built-in policies makes it easy to comply with commonly adhered to security standards and regulations. Qualys provides a wide range of policies, including many that have been certified by CIS as well as ones based on security guidelines from vendors such as Microsoft and VMware...

McAfee Security Scan Plus Man-in-the-Middle Security Bypass Vulnerability

McAfee Security Scan Plus is a free set of diagnostic tools from McAfee USA. The product proactively checks your computer for up-to-date antivirus, firewall, and Web security software so that you always know if your computer is safe so that it is protected. A security bypass vulnerability exists ...

Upcoming Video Series – “Breaking Bad Security” – Series Introduction

Welcome to another new video series, “Breaking Bad Security!” This security series is designed to teach you about different tests, tricks and free tools you can use to validate your security controls to ensure your environment is secure. In this series, we will provide easy-to-follow tutorials th...

Common Sense Clarity on GDPR

Having recently returned from the first phase of Carbon Black’s official General Data Protection Regulation GDPR Data Security and Privacy tour, where I participated in the data privacy and security enablement of numerous European global businesses, I’ve collected many valuable insights on the...

July 7, 2017 – Morning Cyber Coffee Headlines – “Spiderman” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! July 7, 2017 - Headlines Carbon Black in the News: Residents of these states ar...

The CIS Critical Security Controls Series

What are the CIS Critical Security Controls? The Center for Internet Security CIS Top 20 Critical Security Controls previously known as the SANS Top 20 Critical Security Controls, is an industry-leading way to answer your key security question: "How can I be prepared to stop known attacks?" The...