Security News > 2021

Civil liberties activists are suing a company that provides facial recognition services to law enforcement agencies and private companies around the world, contending that Clearview AI illegally stockpiled data on 3 billion people without their knowledge or permission. The lawsuit says the company has built "The most dangerous" facial recognition database in the nation, has fielded requests from more than 2,000 law enforcement agencies and private companies, and has amassed a database nearly seven times larger than the FBI's.

Zipx extension to obfuscate EXE payloads, crooks might be hoping to sneak the elderly NanoCore remote-access trojan through users' email and endpoint-scanning software. Instead, said the email security firm, these malicious attachments "Are actually image binary files, with attached extra data, which happens to be RAR".

F5 Networks is warning users to patch four critical remote command execution flaws in its BIG-IP and BIG-IQ enterprise networking infrastructure. The company released an advisory, Wednesday, on seven bugs in total, with two others rated as high risk and one rated as medium risk, respectively.

Patient data protection provider Tausight this week announced that it has raised $20 million in Series A funding. The new funding, Tausight says, will help expand the go-to-market team and invest in a healthcare-specific solution designed to identify security flaws in clinical workflows.

At least 10 threat actors are currently involved in the targeting of Microsoft Exchange servers that are affected by recently disclosed zero-day vulnerabilities, according to cybersecurity firm ESET. On March 2, Microsoft announced patches for four bugs that were part of a pre-authentication remote code execution attack chain already being exploited in the wild. Now, ESET reveals that at least 10 threat actors are actively engaged in such attacks, including Tick, LuckyMouse, Calypso, Websiic, Winnti Group, Tonto Team, ShadowPad, Mikroceen, and DLTMiner.

Getting to grips with the HAFNIUM gang/vulnerabilities/exploits/webshells/attacks. Why it's important to think before you share those home-based selfies.

Security researchers at Intezer have discovered a previously undocumented backdoor dubbed RedXOR, with links to a Chinese-sponsored hacking group and used in ongoing attacks targeting Linux systems. Based on command-and-control servers still being active, the Linux backdoor is being used in ongoing attacks targeting both Linux servers and endpoints.

Science has a paper (and commentary) on generating 250 random terabits per second with a laser. I don’t know how cryptographically secure they are, but that can be cleaned up with something like...

"Application security was traditionally very low on CISOs' priority list but, as the attacks targeting applications increase in frequency, it's getting more attention," Eugene Dzihanau, Senior Director of Technology Solutions at EPAM Systems, told Help Net Security. He also notes that separating the application security domain is not advisable - it's best to look at application and cloud infrastructure security together and holistically.

A new UK law will explicitly authorise the "Voluntary" slurping of data from mobile phones of crime suspects and witnesses. The Police, Crime, Sentencing and Courts Bill, which was introduced to Parliament this week, contains clauses that will allow police and others to extract data from mobile phones if the user "Voluntarily" hands the device over.