Zoom Security Gets a Boost With Keybase Acquisition

Plus: A GoDaddy breach, a ransomware attack, and more of the week's top security news...

Zoom Beefs Up End-to-End Encryption to Thwart 'Zoombombers'

Video calling platform Zoom is boosting its security profile via the acquisition of a small startup called Keybase. The 25-person, New York-based company will provide more robust encryption for Zoom calls on paid subscriptions by implementing an end-to-end architecture. “Logged-in users will...

Linux kernel double-acquisition vulnerability

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A double-acquisition vulnerability exists in the 'mptctlioctl' function in the drivers/message/fusion/mptctl.c file in versions of Linux kernel prior to 5.4.14, no...

ABB MicroSCADA Pro SYS600 Access Control Error Vulnerability

ABB MicroSCADA Pro SYS600 is a suite of monitoring and data acquisition software from ABB Switzerland. The software is used for substation automation, SCADA electrical, distribution management applications and industrial power management. An access control error vulnerability exists in ABB...

LCDS LAquis SCADA Information Disclosure Vulnerability (CNVD-2020-25541)

LCDS LAquis SCADA is a SCADA Data Acquisition and Supervisory Control system from the Brazilian company LCDS. The system is mainly used for data acquisition and process control of equipment with communication technology. An information disclosure vulnerability exists in LCDS LAquis SCADA version...

LCDS LAquis SCADA Input Validation Error Vulnerability

LCDS LAquis SCADA is a SCADA Data Acquisition and Supervisory Control system from the Brazilian company LCDS. The system is mainly used for data acquisition and process control of equipment with communication technology. An input validation error vulnerability exists in LCDS LAquis SCADA version...

Triangle MicroWorks SCADA Data Gateway Type Obfuscation Vulnerability

Triangle MicroWorks SCADA Data Gateway is a SCADA data gateway product from Triangle MicroWorks, Inc. A type confusion vulnerability exists in Triangle MicroWorks SCADA Data Gateway, which can be exploited by an attacker to execute arbitrary code...

The vulnerability of the SCADA system MasterSCADA, related to the operation of buffers in memory outside the system’s boundaries, allows a intruder to trigger an emergency termination of the program process.

The vulnerability of the SCADA system MasterSCADA relates to the execution of operations outside the buffer in memory, as well as the use of memory after it has been freed. Exploiting this vulnerability can allow an intruder to cause the program to terminate abnormally...

Microsoft Buys Corp.com

A few months ago, Brian Krebs told the story of the domain corp.com, and how it is basically a security nightmare: At issue is a problem known as "namespace collision," a situation where domain names intended to be used exclusively on an internal company network end up overlapping with domains th...

Defender Behavior in 2019

Security is a team sport, or at least it should be. Given the constant behavior evolution we see from attackers and the vast IT footprint attackers can target, IT and security teams clearly face an uphill battle. Whereas attackers only have to be right once to succeed, defenders must be right 100...

Have I Been Pwned No Longer For Sale

After announcing last year that he was looking to sell Have I Been Pwned HIPB, Troy Hunt said this week that the popular service has been pulled off the market and will instead continue to be run independently. HIBP offers a free service for consumers to check if their usernames and passwords hav...

Multiple Siemens Products Input Validation Error Vulnerability (CNVD-2020-23038)

Siemens SIMATIC PCS 7 and SIMATIC WinCC are both products of Siemens, Germany.SIMATIC PCS 7 is a process control system.SIMATIC WinCC is an automated data acquisition and monitoring SCADA system. An input validation error vulnerability exists in multiple Siemens products and can be exploited by a...

Microsoft Windows WIA Junction Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Windows Image...

Amazon Takes a Swipe at PayPal's $4 Billion Acquisition

The retail giant warned holiday shoppers that Honey, a popular browser extension, was a “security risk.” Honey denies the claim...

Analysing the Attack Surface of an Industrial Data Acquisition Device

Introduction The Data Station Plus from Red Lion Controls was handed to me to analyse the attack surface. The device is designed to connect to SCADA data acquisition devices over Modbus, Profibus, etc. by Serial or Ethernet connection. Data is collected and recorded to a local compact flash card...

License Acquisition Error 500 or (-13) or (-8)

After a licensing failure, and subsequent recovery of the license server, individual member servers might experience issues when users attempt to log on, and the following error message appears:“-License Acquisition Error 500” Note: This is observed on XenApp 6.5 versions and below...

DFIRtriage - Digital Forensic Acquisition Tool For Windows Based Incident Response

DFIRtriage is a tool intended to provide Incident Responders with rapid host data. Written in Python, the code has been compiled to eliminate the dependency of python on the target host. The tool will run a variety of commands automatically upon execution. The acquired data will reside in the roo...

Dell Technologies + VMware Carbon Black: Better Together

It’s been an exciting few months for the VMware Carbon Black team and we’re excited to share some big news with you. Today, from VMworld Europe 2019 in Barcelona, VMware announced an enhanced partnership with Dell Technologies that will make Carbon Black Cloud, along with Dell Trusted Devices and...

This Week in Security News: Trend Micro Acquires Cloud Conformity and Apple Removes Malicious iOS Apps from App Store

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about Trend Micro’s recent acquisition of Cloud Conformity. Also, read about a fake photo editing app on Google Play and the 17...

Trend Micro Acquires Cloud Conformity

Developers who are responsible for managing their business’s IT infrastructure day-to-day often have to work with the technology providers they’re given. Our goal is to make sure our security solutions work for developers, providing seamless, automated security, rather than a roadblock to work...