Investigating and Mitigating Malicious Drivers

The security landscape continues to rapidly evolve as threat actors find new and innovative methods to gain access to environments across a wide range of vectors. As the industry moves closer to the adoption of a Zero Trust security posture with broad and layered defenses, we remain committed to...

Weidmueller Industrial WLAN 信任管理问题漏洞

Weidmueller Industrial WLAN devices is an industrial WIAN from Weidmueller, Germany. Weidmueller Industrial WLAN devices Trust Management Issue vulnerability, which stems from the use of hard-coded keys in the service agent binary, can be exploited by an attacker to decrypt captured traffic from ...

Weidmueller Industrial WLAN 信任管理问题漏洞

Weidmueller Industrial WLAN devices is an industrial WIAN from Weidmueller, Germany. A trust management issue vulnerability exists in Weidmueller Industrial WLAN devices, which stems from the fact that the device operating system contains an undisclosed encrypted password that can be exploited by...

Dell BIOSConnect信任管理问题漏洞

DELL Dell BIOSConnect is an underlying platform from Dell USA that enables BIOS to connect to Dell's HTTP backend and load images via the HTTP method. A trust management issue vulnerability exists in the Dell BIOSConnect feature and Dell HTTPS Boot feature that stems from an incorrect certificate...

How to Perform a Zero Trust AWS Assessment with Infection Monkey and ScoutSuite

Take action on issues highlighted in the report to ensure your AWS cloud defenses are protected in a data breach, minimizing impact and data loss...

NVIDIA Jetson 缓冲区错误漏洞

Nvidia NVIDIA Jetson is an embedded system development module from Nvidia Corporation. NVIDIA Jetson suffers from a buffer error vulnerability that stems from Trusty including a vulnerability in the HDCP service TA that lacks a boundary check in Command 11. An attacker could exploit this...

This Week in Security News June 18, 2021

Bash ransomware targets Linux Distributions and Trend Micro touts zero trust risk insights...

Enphase Energy Envoy Trust Management Issues Vulnerabilities

The Enphase Energy Envoy is a gateway device for connecting smart home devices from Enphase Energy USA. The Enphase Energy Envoy has a trust management issue vulnerability that stems from the installer and Enphase accounts having hard-coded web panel login passwords, which are hard-coded values...

Arlo Q Plus Trust Management Issue Vulnerability

Arlo Q Plus is a smart security camera from Arlo U.S.A. The Arlo Q Plus is vulnerable to a trust management issue that could be exploited by an attacker to escalate privileges and execute arbitrary code in the root context...

Synology Calendar 信任管理问题漏洞

Synology Calendar is a file protection program from Synology Inc. of Taiwan, China that runs on Synology NAS Network Storage Server devices. A trust management issue vulnerability exists in Synology Calendar prior to version 2.4.0-0761, which stems from the use of hardcoded credentials in the php...

VPNs and Trust

TorrentFreak surveyed nineteen VPN providers, asking them questions about their privacy practices: what data they keep, how they respond to court order, what country they are incorporated in, and so on. Most interesting to me is the home countries of these companies. Express VPN is incorporated i...

Enphase Envoy 信任管理问题漏洞

The Enphase Energy Envoy is a gateway device for connecting smart home devices from Enphase Energy USA. The Enphase Energy Envoy has a trust management issue vulnerability that stems from the installer and Enphase accounts having hard-coded web panel login passwords, which are hard-coded values...

Cisco Advanced Malware Protection 信任管理问题漏洞

Cisco Advanced Malware Protection AMP for Endpoints for Windows is a Windows-based endpoint security solution from Cisco. The product mainly features advanced threat prevention, monitoring and response. Cisco Advanced Malware Protection has a security vulnerability that allows an unauthenticated,...

Afternoon Cyber Tea: Microsoft’s cybersecurity response to COVID-19

On February 25, 2020, Microsoft Chief Information Security Officer CISO Bret Arsenault was attending the RSA Conference in San Francisco when the city declared a state of emergency because of COVID-19. Shortly after flying back to Seattle, Bret learned of the first death from the coronavirus in...

Afternoon Cyber Tea: Microsoft’s cybersecurity response to COVID-19

On February 25, 2020, Microsoft Chief Information Security Officer CISO Bret Arsenault was attending the RSA Conference in San Francisco when the city declared a state of emergency because of COVID-19. Shortly after flying back to Seattle, Bret learned of the first death from the coronavirus in...

Afternoon Cyber Tea: Microsoft’s cybersecurity response to COVID-19

On February 25, 2020, Microsoft Chief Information Security Officer CISO Bret Arsenault was attending the RSA Conference in San Francisco when the city declared a state of emergency because of COVID-19. Shortly after flying back to Seattle, Bret learned of the first death from the coronavirus in...

SASE & Zero Trust: The Dream Team

Zero Trust: We’ve been kicking that term around since 2003, by what exactly is it? In a nutshell, it’s not treating computers like humans, says Chase Cunningham, chief strategy officer at Ericom Software. Zero trust means “not putting trust relationships inside of computerized systems…and what we...

CVE-2021-3601

A flaw was found in the way OpenSSL will accept a certificate with explicitly set Basic Constraints to CA:FALSE as a valid CA if it is present in the trusted bundle. This flaw allows an attacker with access to a private key, of which the corresponding certificate is in the trust bundle, to use th...

An Expert Discussion on Zero Trust

Zero Trust is the key strategy moving forward to secure the always changing hybrid workplace. Listen in as two of our industry experts discuss how risk insights are key component of Zero Trust security...

Cybersecurity Executive Order 2021: What It Means for Cloud and SaaS Security

In response to malicious actors targeting US federal IT systems and their supply chain, the President released the "Executive Order on Improving the Nation's Cybersecurity Executive Order." Although directed at Federal departments and agencies, the Executive Order will likely have a ripple effect...