CISA Releases Guidance: IPv6 Considerations for TIC 3.0

The federal government has prioritized the transition of federal networks to Internet Protocol version 6 IPv6 since the release of Office of Management and Budget OMB Memorandum 05-22 in 2005. In 2020, OMB renewed its focus on IPv6 through the publication of OMB Memorandum 21-07. That memorandum...

CISA Insights on Risk Considerations for Managed Service Provider Customers

CISA has released a new CISA Insights, Risk Considerations for Managed Service Provider Customers MSPs, which provides Managed Service Provider MSP customers a framework for reducing risk. This framework is designed for government and private sector organizations of all sizes, and it suggests...

Cold wallet, hot wallet, or empty wallet? What is the safest way to store cryptocurrency?

In August of 2021, a thief stole about $600 million in cryptocurrencies from The Poly Network. They ended up giving it back, but not because they were forced to. Slightly more than one week later, Japanese cryptocurrency exchange Liquid was hacked and lost $97 million worth of digital coins. Thes...

Micro Frontend Guide: Technical Integrations

In this article, we will take a closer look at the technical considerations for developing web applications with a Micro Frontend...

NETGEAR R7000 缓冲区溢出漏洞（CVE-2021-31802）

SSD Advisory – NETGEAR Nighthawk R7000 httpd PreAuth RCE April 26, 2021 SSD Disclosure / Technical Lead Uncategorized TL;DR Find out how a vulnerability in NETGEAR R7000 allows an attacker to run arbitrary code without requiring authentication with the device. Vulnerability Summary A vulnerabilit...

FAQ: Receiver for Windows 4.2

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Q: When was Citrix Receiver 4.2 publicly released? A: Dec 3, 2014 Q: What features does Citrix...

How to Configure and Secure Amazon S3

In this article, we’ll dive into some of the workarounds and considerations you may encounter with Amazon S3, since it’s the most used—and misused—cloud storage option on AWS...

This Week in Security News: A Look Inside the Bulletproof Hosting Business and Amazon Prime Day Spurs Spike in Phishing, Fraud Attacks

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about how cybercriminals secure their assets and survive in the business in a new Trend Micro report. Also, read about a how...

Threat Source newsletter for Aug. 20, 2020

Newsletter compiled by Jon Munshaw. Good afternoon, Talos readers. Hactivism always seems to cool and noble in the movies. Video games and TV shows have no shortage of their “hacker heroes,” too. But what are the real-world consequences of users who release sensitive information or carry out data...

Securing Weak Points in Serverless Architectures

The big shift to serverless computing is imminent. Gain insights on the security considerations and recommendations for serverless environments that can help ensure your serverless deployments are secure...

Update on NIST's Post-Quantum Cryptography Program

NIST has posted an update on their post-quantum cryptography program: After spending more than three years examining new approaches to encryption and data protection that could defeat an assault from a quantum computer, the National Institute of Standards and Technology NIST has winnowed the 69...

A week in security (June 8 – 14)

Last week on Malwarebytes Labs, we looked into nasty search hijackers that worried a lot of Chrome users; a list of considerations for MSPs when looking for an RMM platform; the complaint faced by ParetoLogic, the company that issues SpeedyPC, a product that claims to find and remove various PC...

Ethical dilemmas with responsible disclosure

We do a LOT of disclosures, probably starting one a day on average. Between us, we spend a man day or so per week just managing disclosures. It creates pain for us and consumes time, particularly when the vendor won’t listen. We get the occasional legal threat, which takes time and money to slap...

How To Migrate from Device Administration to Android Enterprise

This article discusses considerations and recommendations for migrating from legacy Android device administration to Android Enterprise. Google is deprecating the Android Device Administration API. That API supported enterprise apps on Android devices. Android Enterprise is the modern management...

Security guidance for remote desktop adoption

As the volume of remote workers quickly increased over the past two to three months, the IT teams in many companies scrambled to figure out how their infrastructures and technologies would be able to handle the increase in remote connections. Many companies were forced to enhance their capabiliti...

Secure Your Digital Transformation

Digital transformation DX is on the mind, IT budget sheet, and board meeting agenda for the majority of enterprise-level organizations. The term digital transformation is becoming ubiquitous, but its definition can be ambiguous. Within the context of this blog, DX refers to how organizations...

Is Service Mesh right for your infrastructure?

Andrew Jenkins of Aspen Mesh identifies three deployment options with regards to how a Service Mesh delivers its services: As a sidecar that runs alongside your microservice container As a library that can be built into each of the microservices As an agent that sit in the container infrastructur...

PostgresSQL -- TYPE in pg_temp execute arbitrary SQL during `SECURITY DEFINER` execution

The PostgreSQL project reports: Versions Affected: 9.4 - 11 Given a suitable SECURITY DEFINER function, an attacker can execute arbitrary SQL under the identity of the function owner. An attack requires EXECUTE permission on the function, which must itself contain a function call having inexact...

Security Only Update for .NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows 8.1 and Server 2012 R2 (KB4507413)

Security Only Update for .NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows 8.1 and Server 2012 R2 KB4507413 Applies to: Microsoft .NET Framework 3.5 Microsoft .NET Framework 4.5.2 Microsoft .NET Framework 4.6 Microsoft .NET Framework 4.6.1 Microsoft .NET Framework...

The global data privacy roadmap: a question of risk

For most American businesses, complying with US data privacy laws follows a somewhat linear, albeit lengthy, path. Set up a privacy policy, don’t lie to the consumer, and check the specific rules if you’re a health care provider, video streaming company, or kids’ app maker. For American businesse...