IRS Reminds Tax Professionals: Create a Data Security Plan

The Internal Revenue Service IRS has issued a news release reminding professional tax preparers that they are required by law to have a written data security plan. Creating and maintaining a data security plan ensures that tax professionals are reviewing their data security protections and...

Chinese Academy of Sciences 13th Five-Year Informatization Special Scientific Big Data Project Building System suffers from SQL Injection Vulnerability

The Chinese Academy of Sciences CAS is China's top academic institution in natural sciences, the highest advisory body for science and technology, and a center for comprehensive research and development in natural sciences and high technology. A SQL injection vulnerability exists in the 13th...

Inside the MSRC – Building your own security incident response process

This is the third and last in a series of posts that looks at how Microsoft responds to elevated threats to customers through the Microsoft Security Response Center’s MSRC Software and Services Incident Response Plan SSIRP. Our previous posts discussed how Microsoft protects customers against...

Inside the MSRC – Building your own security incident response process

This is the third and last in a series of posts that looks at how Microsoft responds to elevated threats to customers through the Microsoft Security Response Center’s MSRC Software and Services Incident Response Plan SSIRP. Our previous posts discussed how Microsoft protects customers against...

Inside the MSRC – Anatomy of a SSIRP incident

This is the second in a series of blog posts that shares how the MSRC responds to elevated threats to customers through the Software and Services Incident Response Plan SSIRP. In our last blog post, we looked at the history of the Microsoft Security Response Center and SSIRP, and how Microsoft...

Inside the MSRC – Anatomy of a SSIRP incident

This is the second in a series of blog posts that shares how the MSRC responds to elevated threats to customers through the Software and Services Incident Response Plan SSIRP. In ourlast blog post, we looked at the history of the Microsoft Security Response Center and SSIRP, and how Microsoft tak...

A Plan to Stop Breaches With Dead Simple Database Encryption

Database giant MongoDB has a new encryption scheme that should help slow the scourge of breaches...

How to recover from a security breach

Experts estimate that ransomware attacks are up over 600 percent. For most companies, the issue isn’t if a cyberattack is going to happen, but when. Some security experts advise that the best way to recover from a security breach is to plan for it before it happens. Today we take you through:...

Description of the security update for SharePoint Enterprise Server 2016: June 11, 2019

None None...

Service plan is not found when adding Office 365 organization

Connecting to the Office 365 organization fails with the “Check Exchange plan: No Exchange plan found” or “Check SharePoint plan: No SharePoint plan found” error...

‘If You Want to Kill Someone, We Are the Right Guys’

In a small Minnesota town, an IT technician found his way to the darkest corner of the web. Then he made a deadly plan...

2 Plan Team 1.0.4 Cross Site Scripting

==================================================================================================================================== | Title : 2 Plan Team 1.0.4 - XSS Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 65.032-bit | | Vendor :...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : QEMU vulnerabilities (USN-3923-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3923-1 advisory. Michael Hanselmann discovered that QEMU incorrectly handled the Media Transfer Protocol MTP. An attacker inside the guest could u...

USN-3923-1 qemu vulnerabilities

Michael Hanselmann discovered that QEMU incorrectly handled the Media Transfer Protocol MTP. An attacker inside the guest could use this issue to read or write arbitrary files and cause a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.10. CVE-2018-16867...

USN-3923-1: QEMU vulnerabilities

Michael Hanselmann discovered that QEMU incorrectly handled the Media Transfer Protocol MTP. An attacker inside the guest could use this issue to read or write arbitrary files and cause a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.10. CVE-2018-16867...

Mastercard Wades Into Murky Waters With Its New Digital ID

The credit card company has more details about its plan for a decentralized, universal digital ID, but questions remain...

Partner Perspectives: Stay Proactive with Automated Threat Blocking from Carbon Black and IntSights

Alon Yotvat is a Senior Solutions Architect for IntSights. Carbon Black and IntSights have joined forces to combine next-gen endpoint security solutions with powerful external threat intelligence. This potent integration of cybersecurity technologies gives enterprises the protection they need to...

5 Best Practices for your SAST Evaluation

Static Application Security Testing SAST solutions analyze the source code of applications for vulnerabilities without running or deploying the code. In case you are not sure if SAST is the right approach for you or what different SAST approaches exist we recommend reading our previous blog post...

A week in security (February 11 – 17)

Last week on Malwarebytes Labs we discussed the return of the Sextortion Bitcoin scams, we gave you an early overview of the exploit kits in the winter of 2019, we talked about the destruction of VFEmail service, for consumers we discussed whether you should remove yourself from social media, for...

Businesses: It’s time to implement an anti-phishing plan

Businesses: phishers aren’t just coming for you. They’re coming for your employees and your customers, too. Phishing attacks are on the rise this year, thanks in part to massive Emotet and TrickBot campaigns, which make use of phishing emails to deliver their payloads. If you don't already have o...