Security News > 2022 > November
Researchers have disclosed details of three new security vulnerabilities affecting operational technology products from CODESYS and Festo that could lead to source code tampering and denial-of-service. The vulnerabilities, reported by Forescout Vedere Labs, are the latest in a long list of flaws collectively tracked under the name OT:ICEFALL. "These issues exemplify either an insecure-by-design approach - which was usual at the time the products were launched - where manufacturers include dangerous functions that can be accessed with no authentication or a subpar implementation of security controls, such as cryptography," the researchers said.
A threat actor with a suspected China nexus has been linked to a set of espionage attacks in the Philippines that primarily relies on USB devices as an initial infection vector. The reliance on infected USB drives to propagate the malware is unusual if not new.
A threat actor with a suspected China nexus has been linked to a set of espionage attacks in the Philippines that primarily relies on USB devices as an initial infection vector. The reliance on infected USB drives to propagate the malware is unusual if not new.
In this context, device buyers should consider where their devices come from and regional regulations. Let's look at why the origin of connected devices today matters more than ever.
In this interview with Help Net Security, Ben Smith, Field CTO at NetWitness, talks about how the wave of lay-offs has impacted the cyber resilience of many businesses, but also what are the threats organizations should be aware of in these times of crises. Perhaps the most obvious cybersecurity impact in the context of lay-offs is the insider threat.
A company's supply chain is like a body's nervous system: a mesh of interconnected manufacturers, vendors, sub-contractors, service delivery firms, even coding and collaboration tools. A recent study by NCC Group estimated that supply chain attacks increased by 51% in the last six months of 2021, and the BlackHat 2022 conference featured a number of talks highlighting the vulnerability of supply chains not just between companies connected by business operations, but also software coding practices.
While the world slides into a recession, the resulting increased debt, supply chain delays, and inflation create increased pressure on individuals to make ends meet. In this Help Net Security video, Ari Jacoby, CEO at Deduce, discusses how cybercriminals see times of downturn as an opening to exploit potential vulnerabilities.
Cloudflare has found a way to extend some of its services across the Great Firewall and into mainland China. "Packets crossing the China border often experience reachability, congestion, loss, and latency challenges on their way to an origin server outside of China."
Elastic released the 2022 Elastic Global Threat Report, detailing the evolving nature of cybersecurity threats, as well as the increased sophistication of cloud and endpoint-related attacks. 33% of attacks in the cloud leverage credential access, indicating that users often overestimate the security of their cloud environments and consequently fail to configure and protect them adequately.
BlueFort Security has announced the results of its 2022 CISO survey, which revealed that while CISOs are still experiencing challenges around visibility, intelligence and control, 47% are proactively focused on digital transformation and cloud migration. While 37% of CISOs still have their cybersecurity budget defined as a subset of their organization's general IT budget, 58% of CISOs expect world events to cause an increase in their cybersecurity budget over the next budget cycle.