Security News > 2024 > July
Secretive is an open-source, user-friendly app designed to store and manage SSH keys within the Secure Enclave. Typically, SSH keys are stored on disk with appropriate permissions, which is usually sufficient.
Determine security requirements by evaluating business and product strategies, researching cloud security standards and new technologies, conducting system security and vulnerability analyses and performing risk assessments. Assess the enterprise infrastructure for current and potential vulnerabilities or security threats by leveraging automated security monitoring tools, conducting security assessments, and determining if anomalies are actual system compromises.
Niemiec explains how dynamic configuration evolves feature flagging, supports operational agility, and addresses compliance challenges across various sectors. How does dynamic configuration contribute to avoiding system outages? How does it enable faster response and resolution times during incidents?
DigiCert has given some unlucky customers 24 hours to replace their SSL/TLS security certificates it previously issued them - due to a five-year-old blunder in its backend software. The Register has asked exactly how many domains this represents, and we'll let you know if DigiCert can come up with a number.
A malicious campaign targeting Android devices worldwide utilizes thousands of Telegram bots to infect devices with SMS-stealing malware and steal one-time 2FA passwords for over 600 services. The SMS stealer is distributed either through malvertising or Telegram bots that automate communications with the victim.
A Fortune 50 company paid a record-breaking $75 million ransom payment to the Dark Angels ransomware gang, according to a report by Zscaler ThreatLabz. "In early 2024, ThreatLabz uncovered a victim who paid Dark Angels $75 million, higher than any publicly known amount- an achievement that's bound to attract the interest of other attackers looking to replicate such success by adopting their key tactics," reads the 2024 Zscaler Ransomware Report.
CISA has ordered U.S. Federal Civilian Executive Branch agencies to secure their servers against a VMware ESXi authentication bypass vulnerability exploited in ransomware attacks. Broadcom subsidiary VMware fixed this flaw discovered by Microsoft security researchers on June 25 with the release of ESXi 8.0 U3. CVE-2024-37085 allows attackers to add a new user to the 'ESX Admins' group-not present by default but can be added after gaining high privileges on the ESXi hypervisor-which will automatically be assigned full administrative privileges.
Thousands of accounts have been exposed after hackers used existing emails to create Google Workspace accounts and bypassed the verification process. One impacted user that shared their experience on a Google Cloud Community forum was notified by Google that someone had created a Workspace account with their email without verification and then used it to log into Dropbox.
Thousands of email addresses have been compromised after hackers used them to create Google Workspace accounts and bypassed the verification process. One impacted user that shared their experience on a Google Cloud Community forum was notified by Google that someone had created a Workspace account with their email without verification and then used it to log into Dropbox.
Delta Air Lines lost hundreds of millions of dollars due to the CrowdStrike outage earlier this month - and it has hired a high-powered law firm to claw some of those lost funds back, potentially from the Falcon maker and Microsoft itself. CNBC broke the news yesterday that Delta had hired famed lawyer David Boies to look into what the airline could do to recoup as much as an estimated $500 million in operational losses due to the July 19 CrowdStrike outage.