Security News > 2020 > November
This week, British music streaming service, Last.fm has fixed a credential leakage issue that revealed admin username and password. The leak had occurred due to a misconfigured PHP Symfony app running in "Debug" mode and exposing profiler logs.
Manchester United has been unable to fully restore its computer systems a week after being targeted in a cyberattack. "Following the recent cyberattack on the club, our IT team and external experts secured our networks and have conducted forensic investigations," United said in a statement.
Group-IB has revealed the results of its yearslong development of proprietary high-tech products for threat hunting and research - Threat Intelligence & Attribution and Threat Hunting Framework. The creation of TI&A marks the emergence of a new type of solutions for collecting data on threats and attackers relevant for a particular organization with the aim of examination and proactive hunting for threat actors, research, and protection of network infrastructure.
DDoS, web application, bot, and other attacks have surged exponentially compared to the first half of 2019, according to CDNetworks. In particular, attacks on web applications rose by 800%. These alarming statistics show that enterprises are experiencing challenging times in their attempts to defend against cyber attacks and protect their online assets.
Third-party risk management professionals increasingly do not trust that security questionnaires provide sufficient information to properly understand and act on their third-party risk, according to RiskRecon and Cyentia Institute. As a result, the study found more enterprises are moving towards data-driven third-party risk management programs.
26% of remote workers have experienced a cyber attack personally, while 45% of employers have asked their employees to use their personal devices for work since the start of the pandemic, according to a Microsoft research. The study surveyed 500 employees and 200 business decision makers in September 2020 about remote working, digital security behaviours, and the worries they now face.
External attacks on companies result in the most expensive cyber insurance losses, but it is employee mistakes and technical problems that are the most frequent generator of claims by number, according to a report from Allianz Global Corporate & Specialty. Growth of the global cyber insurance market fueling cyber insurance claims.
The AI in cybersecurity market is projected to generate a revenue of $101.8 billion in 2030, increasing from $8.6 billion in 2019, progressing at a 25.7% CAGR during 2020-2030, ResearchAndMarkets reveals. The market is categorized into threat intelligence, fraud detection/anti-fraud, security and vulnerability management, data loss prevention, identity and access management, intrusion detection/prevention system, antivirus/antimalware, unified threat management, and risk & compliance management, on the basis of application.
Check Point Research called out hackers affiliated with a group named Dark Caracal in a new report published yesterday for their efforts to deploy "Dozens of digitally signed variants" of the Bandook Windows Trojan over the past year, thus once again "Reigniting interest in this old malware family." The different verticals singled out by the threat actor include government, financial, energy, food industry, healthcare, education, IT, and legal institutions located in Chile, Cyprus, Germany, Indonesia, Italy, Singapore, Switzerland, Turkey, and the US. The unusually large variety of targeted markets and locations "Reinforces a previous hypothesis that the malware is not developed in-house and used by a single entity, but is part of an offensive infrastructure sold by a third party to governments and threat actors worldwide, to facilitate offensive cyber operations," the researchers said.
With that in mind, UK consumer magazine Which? recently went online and bought 11 different digital doorbells - a type of IoT device made popular by the Ring product - to see how they stacked up. For what it's worth, we might not describe all the vulnerabilities that Which? found as "High-risk" ourselves, given that it seems some of them aren't irremediably baked into the affected devices and can be avoided by taking the time to set up the devices correctly, such as picking a proper password.