Security News > 2021 > September
More than half of wireless subscribers polled were extremely or somewhat satisfied with the security offered by their mobile operators, according to a mobile security survey released by Global Wireless Solutions. Even in this heightened cyber threat environment, 57% of wireless subscribers across the big U.S. mobile operators - AT&T, Verizon, and T-Mobile- expressed satisfaction with the mobile security being offered.
A recent wave of spear-phishing campaigns leveraged weaponized Windows 11 Alpha-themed Word documents with Visual Basic macros to drop malicious payloads, including a JavaScript implant, against a point-of-sale service provider located in the U.S. The attacks, which are believed to have taken place between late June to late July 2021, have been attributed with "Moderate confidence" to a financially motivated threat actor dubbed FIN7, according to researchers from cybersecurity firm Anomali. "The group's goal appears to have been to deliver a variation of a JavaScript backdoor used by FIN7 since at least 2018.".
Microsoft has shared technical details about a now-fixed, actively exploited critical security vulnerability affecting SolarWinds Serv-U managed file transfer service that it has attributed with "High confidence" to a threat actor operating out of China. "The Serv-U SSH server is subject to a pre-auth remote code execution vulnerability that can be easily and reliably exploited in the default configuration," Microsoft Offensive Research and Security Engineering team said in a detailed write-up describing the exploit.
Apple is temporarily hitting the pause button on its controversial plans to screen users' devices for child sexual abuse material after receiving sustained blowback over worries that the tool could be weaponized for mass surveillance and erode the privacy of users. In August, Apple detailed several new features intended to help limit the spread of CSAM on its platform, including scanning users' iCloud Photos libraries for illicit content, Communication Safety in Messages app to warn children and their parents when receiving or sending sexually explicit photos, and expanded guidance in Siri and Search when users try to perform searches for CSAM-related topics.
The healthcare cybersecurity market registered a CAGR of 15.6% over the forecast period 2021 - 2026, according to ResearchAndMarkets. Hospitals to drive the healthcare cybersecurity market.
Indonesian authorities have admitted that the COVID-19 vaccination certificate of the nation's President has circulated online and tried to explain that it's an indication of admirable transparency, rather than lamentable security. In one camp are those who argue that the document's unplanned public debut is more evidence that Indonesia's government is bad at securing information.
Windows 11 brings a redesigned user interface and an overhaul to the system sounds, including different sounds for Light Mode and Dark Mode. Unlike all previous versions of Windows, Microsoft also created different versions of the system sounds for Windows 11, depending on whether you are in Light Mode or Dark Mode.
Microsoft plans to allow Office 365 admins ensure that end-users can't ignore organization-wide policies set up to block active content on Trusted Documents. Redmond says trusted docs are files with active content functions that don't require user interaction) that open without warnings after the content has been enabled.
Vulnerabilities allow attackers to remotely deactivate home security systemA DiY home security system sold to families and businesses across the US sports two vulnerabilities that, while not critical, "Are trivially easy to exploit by motivated attackers who already have some knowledge of the target," Rapid7 warns. Cyber threats, passenger vessels and superyachts: The current state of playIn this interview with Help Net Security, Peter Broadhurst, Maritime Senior VP Safety, Security, Yachting and Passenger, Inmarsat, talks about the impact of cyber threats on passenger vessels and superyachts, and provides an inside look at maritime cybersecurity today.
TensorFlow, a popular Python-based machine learning and artificial intelligence project developed by Google has dropped support for YAML, to patch a critical code execution vulnerability. Maintainers behind both TensorFlow and Keras, a wrapper project for TensorFlow, have patched an untrusted deserialization vulnerability that stemmed from unsafe parsing of YAML. Tracked as CVE-2021-37678, the critical flaw enables attackers to execute arbitrary code when an application deserializes a Keras model provided in the YAML format.