Security News > 2023 > April
The supply chain attack targeting 3CX was the result of a prior supply chain compromise associated with a different company, demonstrating a new level of sophistication with North Korean threat actors. Google-owned Mandiant, which is tracking the attack event under the moniker UNC4736, said the incident marks the first time it has seen a "Software supply chain attack lead to another software supply chain attack."
Volumes are increasing rapidly, and so is the complexity of the digital storage facilities: healthcare providers today house patient information on multiple data platforms such as on-premises servers, electronic health record systems and public/private cloud services. What's more, modern healthcare environments also span sophisticated medical systems and Internet of Things devices that are interconnected with each other and, in some cases, externally to the internet.
Websites of multiple U.S. universities are serving Fortnite and 'gift card' spam. BleepingComputer confirmed the malicious campaign was live, and had targeted additional scholastic websites including that of the University of Michigan.
On Call It's always twelve o'clock somewhere, the saying goes, but Friday comes around but once a week and only this day dies The Register offer a fresh instalment of On Call, our reader-contributed tales of tech support torture and turmoil. "Being a helpful kind of guy he is, and a CompSci student, he jumped into troubleshooting mode," Hank Senior told On Call.
Cisco and VMware have released security updates to address critical security flaws in their products that could be exploited by malicious actors to execute arbitrary code on affected systems. The most severe of the vulnerabilities is a command injection flaw in Cisco Industrial Network Director, which resides in the web UI component and arises as a result of improper input validation when uploading a Device Pack.
It's been estimated that more than 50% of IT application acquisition is now business-led, and that the average company still adds 18-20 new applications every month to its portfolio. The problem, when it comes to uncovering shadow IT, is that information about what applications exist and who has access to them is spread across a company, in many different silos.
Money mules, individuals whose bank accounts are used by fraudsters to transfer money, are becoming an increasingly prominent aspect of cybercriminals' economic business models too. In the US particularly, fraudsters are targeting unwitting consumers to become money mules.
The report surveyed over 17,500 employees in 16 markets across the globe about their priorities when it comes to health and well-being, highlighting the voice of the employee so employers can better address their needs. Addressing employee stress and burnout starts with addressing psychological safety in the workplace.
Attackers are using Eval PHP, an outdated legitimate WordPress plugin, to compromise websites by injecting stealthy backdoors. Eval PHP is an old WordPress plugin that allows site admins to embed PHP code on pages and posts of WordPress sites and then execute the code when the page is opened in the browser.
DOUG. Juicejacking, public psychotherapy, and Fun with FORTRAN. All that and more on the Naked Security podcast. DOUG. Well, you might say, "You can't spell 'FORTRAN' without 'fun'."