Security News

September sees a bundle of 129 CVE-listed flaws patched by Microsoft. Of the nearly two-dozen critical patches, Zero Day Initiative's Dustin Childs says that far and away the most serious is CVE-2020-16875, a memory object error in Exchange Server that allows a poisoned email to execute code with System clearance.

Netskope announced the Cloud Threat Exchange, one of the industry's first cloud-based solutions for the ingestion, curation, and real-time sharing of threat intelligence across enterprise security enforcement points. Any certified, partner, vendor, or customer may use Cloud Threat Exchange to automate the delivery and distribution of high-value, actionable threat intelligence, thus reducing the time to protection and eliminating gaps in coverage.

New Zealand's spy agency has been brought in to help fight back against cyberattacks that crippled the country's stock exchange for a fourth straight day on Friday. Finance Minister Grant Robertson said the Government Communications Security Bureau intelligence agency had joined efforts to contain the threat, which market operator NZX claimed was foreign-sourced but provided no further details.

New Zealand's stock exchange has closed for a third day thanks to a distributed denial-of-service attack. The exact nature of the incident is not known: an NZX spokesperson told The Register that "Network connectivity issues relating to DDoS cybersecurity attacks" were behind the decision to close the market after around 70 minutes of Thursday today.

Crucial steps toward building such an internet are already underway in the Chicago region, which has become one of the leading global hubs for quantum research. One of the hallmarks of quantum transmissions is that they are exceedingly difficult to eavesdrop on as information passes between locations.

Microsoft Exchange servers are an ideal target for attackers looking to burrow into enterprise networks, says Microsoft, as "They provide a unique environment that could allow attackers to perform various tasks using the same built-in tools or scripts that admins use for maintenance." According to Microsoft, April was the month when multiple campaigns began to target Exchange servers.

Threat actors have revamped a popular malware loader into a stealthy infostealer that targets Microsoft Exchange servers to pilfer enterprise mailing information, passwords and enterprise certificates, researchers have found. Valak was first observed as a loader in 2019 but has now gone through "a series of dramatic changes, an evolution of over 30 different versions in less than six months," Cybereason Nocturnus researchers Eli Salem, Lior Rochberger and Assaf Dahan said in a report posted online Thursday.

Equinix, the global interconnection and data center company, announced one of its largest expansions of Equinix Cloud Exchange Fabric in seven new EMEA markets to help global businesses simplify hybrid and multicloud infrastructures. In response to this market shift, Equinix is extending its ECX Fabric service in EMEA to help digital businesses simplify hybrid multicloud deployments and expand their global interconnection opportunities on Platform Equinix®.

TLS 1.3: Slow adoption of stronger web encryption is empowering the bad guysTLS provides secure communication between web browsers, end-user facing applications and servers by encrypting the transmitted information, preventing eavesdropping or tampering attacks. Actively exploited MS Exchange flaw present on 80% of exposed serversAttackers aiming to exploit CVE-2020-0688, a critical Microsoft Exchange flaw patched by Microsoft in February 2020, don't have to look hard to find a server they can attack.

Attackers looking to exploit CVE-2020-0688, a critical Microsoft Exchange flaw patched by Microsoft in February 2020, don't have to look hard to find a server they can attack: according to an internet-wide scan performed by Rapid7 researchers, there are at least 315,000 and possibly as many as 350,000 vulnerable on-premise Exchange servers out there. Over 31,000 Exchange 2010 servers have not been updated since 2012.