A week in security (May 25 – 31)

Last week on Malwarebytes Labs, we published our most recent episode of our podcast Lock and Code, providing an in-depth discussion on web browser privacy, looked at the membership bump for the Coalition against Stalkerware, and dug into EDR solutions. We also looked at twists added to the threat...

Bringing Intrinsic Security to Containers: VMware Acquires Octarine

UPDATE: On May 27, 2020 VMware officially closed its acquisition of Octarine. The blog post below has been amended to reflect that announcement. Today is a very exciting day for VMware and for our customers as we announce our acquisition of Octarine, whose innovative security platform for...

netius realm problem vulnerability

netius is a Python library that can be used to create asynchronous non-blocking servers and clients from the Hive Solutions team in Portugal. An environmental issue vulnerability exists in versions prior to netius 1.17.58. The vulnerability stems from an unreasonable environmental factor in a...

Long Tail Analysis: A New Hope in the Cybercrime Battle

Our hyper-connected world and its ever-faster network speeds have resulted in mountains of diverse data that needs to be processed. It has also resulted in an ever-expanding attack surface, requiring cybersecurity solutions to scale like never before. These days, scale is about more than traffic...

The vulnerability of the openstack-mistral component is a platform for building cloud-based OpenStack solutions. It allows an attacker to gain unauthorized access to protected information.

The vulnerability of the openstack-mistral component, a platform for building OpenStack cloud solutions, is related to the lack of protection for operational data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

Using Real-Time Events in Investigations

To understand what a threat actor did on a Windows system, analysts often turn to the tried and true sources of historical endpoint artifacts such as the Master File Table MFT, registry hives, and Application Compatibility Cache AppCompat. However, these evidence sources were not designed with...

Testing ModSecurity for false positives by books texts

The main things that prevent enabling security solutions like WAF/RASP/IDS/IPS in a blocking mode are false positives. Probably the second one is their inline performance and additional latency, but still. As a cloud-native WAF vendor, we at Wallarm are actively checking our products for false...

Design/Logic Flaw

An exploitable code execution vulnerability exists in the PLCTask functionality of 3S-Smart Software Solutions GmbH CODESYS Runtime 3.5.14.30. A specially crafted network request can cause remote code execution. An attacker can send a malicious packet to trigger this vulnerability...

CVE-2020-6081

An exploitable code execution vulnerability exists in the PLCTask functionality of 3S-Smart Software Solutions GmbH CODESYS Runtime 3.5.14.30. A specially crafted network request can cause remote code execution. An attacker can send a malicious packet to trigger this vulnerability...

CVE-2020-6081: Insufficient Verification of Data Authenticity

An exploitable code execution vulnerability exists in the PLCTask functionality of 3S-Smart Software Solutions GmbH CODESYS Runtime 3.5.14.30. A specially crafted network request can cause remote code execution. An attacker can send a malicious packet to trigger this vulnerability...

3S-Smart Software Solutions GmbH CODESYS Runtime PLC_Task Code Execution Vulnerability

Summary An exploitable code execution vulnerability exists in the PLCTask functionality of 3S-Smart Software Solutions GmbH CODESYS Runtime 3.5.14.30. A specially crafted network request can cause remote code execution. An attacker can send a malicious packet to trigger this vulnerability. Tested...

Remote spring: the rise of RDP bruteforce attacks

With the spread of COVID-19, organizations worldwide have introduced remote working, which is having a direct impact on cybersecurity and the threat landscape. Alongside the higher volume of corporate traffic, the use of third-party services for data exchange, and employees working on home...

Accelerate Migration from Legacy WAM While Enabling Zero Trust Access with EAA and Single-Host Access

Customers are in the process of replacing their legacy proxy/WAM solutions with modern Identity-Aware Proxies to enable Zero Trust access to business applications and services. Akamai's Identity Aware proxy enables secure remote access for end users from anywhere, on any device, to business...

Accelerator Program for Early-Stage Innovations in Water Update: Introducing our Innovators!

This Earth Day, we are excited to announce the first two grantees of Akamai's Accelerator Program for Early-Stage Innovations in Water: the Ashoka Trust for Research in Ecology and the Environment ATREE and the Foundation for Environmental Monitoring ffem. The Akamai Technologies India Corporate...

We Need to Change the Structure of Security to Transform Security

We Need to Change the Structure of Security to Transform Security Tom Corn, Senior Vice President of Security Products at VMware, was recently recorded giving his overview of the fundamental problem companies have with security today. His answer — we’ve got too much happening in silos and too muc...

This Week in Security News: 5 Reasons to Move Your Endpoint Security to the Cloud Now and ICEBUCKET Group Mimics Smart TVs to Steal Ad Money

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about 5 reasons your organization should consider moving to a cloud managed solution. Also, read about a massive online fraud operatio...

Apple and Google Respond to Covid-19 Contact Tracing Concerns

Apple and Google's Bluetooth-based system isn't perfect. But many of the biggest concerns have solutions...

Security Bulletin: IBM Maximo Asset Management is vulnerable to cross-site scripting (CVE-2019-4749)

Summary IBM Maximo Asset Management is vulnerable to cross-site scripting. Vulnerability Details CVEID: CVE-2019-4749 DESCRIPTION: IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the...

Security Bulletin: IBM Maximo Asset Management is vulnerable to cross-site scripting (CVE-2019-4644)

Summary IBM Maximo Asset Management is vulnerable to cross-site scripting. Vulnerability Details CVEID: CVE-2019-4644 DESCRIPTION: IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the...

Residential Internet Connections are now Business Connections: What about Security and Compliance?

Near-global mandates to stay at home have completely reshaped the internet security landscape. Remote work is the new normal, inverting the traditional office model. Attackers are not relenting as they see opportunity to take advantage of a world with a singular focus. Here are a couple of recent...