Security News > 2020 > March
The general availability of ICS-specific intrusion and attack tools is widening the pool of attackers capable of targeting operational technology networks and industrial control systems. "As ICS are a distinct sub-domain to information and computer technology, successful intrusions and attacks against these systems often requires specialized knowledge, establishing a higher threshold for successful attacks. Since intrusion and attack tools are often developed by someone who already has the expertise, these tools can help threat actors bypass the need for gaining some of this expertise themselves, or it can help them gain the requisite knowledge more quickly," FireEye researchers point out.
Four major U.S. carriers are developing a new single sign-on variant they believe will do away with the need for passwords. Their solution is new mobile app called ZenKey that securely ties the user's device to the carrier, and the carrier logs on to the service.
As working from home becomes more common for tech workers, ensuring proper security measures is important. Tom Merritt offers five security tips for employees working from home.
As working from home becomes more common for tech workers, ensuring proper security measures is important. Tom Merritt offers five security tips for employees working from home.
Contractors who previously provided these services physically, now need remote access to relevant equipment to support their contract and keep production lines running smoothly. In times like these, where every organization is reducing staff on site, the need for secure remote access is increased.
A vulnerability addressed recently in the WPvivid Backup Plugin could be exploited to obtain all files of a WordPress website, web security company WebARX reveals. WPvivid Backup Plugin is a free and open-source plugin that allows users to easily backup, migrate, and restore their WordPress installations to new hosts, or send backups to remote storage.
A cybersecurity researcher today disclosed technical details and proof-of-concept of a critical remote code execution vulnerability affecting OpenWrt, a widely used Linux-based operating system for routers, residential gateways, and other embedded devices that route network traffic. Tracked as CVE-2020-7982, the vulnerability resides in the OPKG package manager of OpenWrt that exists in the way it performs integrity checking of downloaded packages using the SHA-256 checksums embedded in the signed repository index.
Over the years, ICANN and the registries and registrars in the domain name industry have committed resources, financial, technical, and operational, to ensure that the domain name system remains stable and secure despite increasing attacks by parties trying to distribute malware, botnets, spam, and other forms of abuse. Although these industry efforts continue, domain name owners also need to take affirmative measures to protect their domain names from attack and hijack.
Researchers have discovered a new family of auto-clicker malware that commits mobile ad fraud, lurking in 56 apps on the Google Play store. Google's uphill battle against malware on Google Play is well known, and the vendor has made a concerted effort in the last couple of years to get rid of bad or unpatched apps and malware.
118 118 Money wrote to personal loans and credit card customers on 23 March to confirm the intrusion, saying in the letter - seen by us - that it is trying to ascertain what happened. Any punter who wants to contact 118 118 Money about their loans or credit card can use the chat function at the bottom of the mail it sent to customers, or they can call 08000 118 222.