Microsoft Security tips for mitigating risk in mergers and acquisitions

Sixty-two percent of organizations that undertake mergers and acquisitions face significant cybersecurity risks or consider cyber risks their biggest concern post-acquisition.1 Threat actors that focus on corporate espionage often target the acquiring company, which we will refer to as the Parent...

Microsoft Security tips for mitigating risk in mergers and acquisitions

Sixty-two percent of organizations that undertake mergers and acquisitions face significant cybersecurity risks or consider cyber risks their biggest concern post-acquisition.1 Threat actors that focus on corporate espionage often target the acquiring company, which we will refer to as the Parent...

Firing Your Entire Cybersecurity Team? Are You Sure?

What on earth were they thinking? That's what we – and other security experts – were wondering when content giant Patreon recently dismissed its entire internal cybersecurity team in exchange for outsourced services. Of course, we don't know the true motivations for this move. But, as outsiders...

Prompt Injection/Extraction Attacks against AI Systems

This is an interesting attack I had not previously considered. The variants are interesting, and I think were just starting to understand their implications...

Facebook engineers aren't sure where all user data is kept

If it takes a village to raise a child, apparently it takes Facebook a team to tell you what data the company keeps about you and where they keep it. In the recently unsealed transcript of a hearing led by "Discovery Special Master" Daniel Garrie, an expert appointed by the court, two Facebook...

CVE-2020-35536

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

Event-Driven Architectures & the Security Implications

This article explores event-driven architecture EDA with a detailed definition and explains how EDA offers many essential benefits to developers. It concludes with an outline of some best practices for mitigating security concerns...

Is it Illegal to Scrape a Website for Content?

Web scraping is the process of using bots to extract information from a website. In recent years, the debate over web scraping is growing more complex as business intelligence and data privacy issues arise. The practice of web scraping has gone on for nearly as long as there have been websites. T...

Who Has Control: The SaaS App Admin Paradox

Imagine this: a company-wide lockout to the company CRM, like Salesforce, because the organization's external admin attempts to disable MFA for themselves. They don't think to consult with the security team and don't consider the security implications, only the ease which they need for their team...

PT-2022-32689

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.54 Description The issue concerns a potential security vulnerability in the Linux Kernel. It involves the m can read fifo,echo tx event function, where a shift of the timestamp to full 32 bits may have...

“Orwellian in the extreme” food store installs facial recognition cameras to stop crime, faces backlash

A convenience shop chain is under fire and facing legal charges for installing cameras with facial recognition software in 35 of its branches across the UK. The cameras analyze and convert video face captures into biometric data. The data is compared with a database of people who have committed...

PT-2022-31876

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.121 Description The issue is related to the arm64 compatibility mode in the Linux Kernel, where a bad syscall number is not properly handled, potentially leading to security implications. The actual impact...

PT-2022-32036

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.198 Description The issue is related to the arm64 compatibility mode in the Linux Kernel, where a bad syscall number is not properly handled, potentially leading to security implications. The actual impact a...

PT-2022-31698

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 4.19 through 5.15.45 Description The issue is related to the drm/vc4 txp component, where a specific condition is not properly handled, potentially leading to security implications. The actual impact and attack plausibili...

PT-2022-31405

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 4.19 through 5.17.13 Description The issue is related to the drm/vc4 txp component, where a specific condition is not properly handled, potentially leading to security implications. The actual impact and attack plausibili...

CVE-2019-25071

A vulnerability was found in Apple iPhone up to 12.4.1. It has been declared as critical. Affected by this vulnerability is Siri. Playing an audio or video file might be able to initiate Siri on the same device which makes it possible to execute commands remotely. Exploit details have been...

MantisBT XSS in manage_custom_field_update.php

An issue was discovered in MantisBT through 2.24.3. In the helperensureconfirmed call in managecustomfieldupdate.php, the custom field name is not sanitized. This may be problematic depending on CSP settings...

ICE Is a Domestic Surveillance Agency

Georgetown has a new report on the highly secretive bulk surveillance activities of ICE in the US: When you think about government surveillance in the United States, you likely think of the National Security Agency or the FBI. You might even think of a powerful police agency, such as the New York...

PT-2022-29709

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.16.19 Description The issue concerns ignoring IPv6 endpoints when IPv6 is disabled, potentially leading to security implications. The actual impact and attack plausibility have not yet been proven...

What Generation Z can teach us about cybersecurity

Girl Security National Security Fellows Program fellow Amulya, a 17-year-old interested in countering online disinformation, said she feels her sense of personal privacy has been largely nonexistent “growing up in a media-saturated world.” She believes her sense of privacy was stolen by a...