Security News
TYPES OF 2FA. Secondary authentication factors vary in how they are used in the verification of user identities. The simple expedient of texting a time-sensitive code to a mobile device is usually enough to keep most accounts secure.
Costs associated with ransomware attacks on critical national infrastructure organizations skyrocketed in the past year. There's a good chance that the numbers would be skewed if 100 percent of the total CNI ransomware victims polled were entirely transparent with their figures.
MarineMax, self-described as the world's largest recreational boat and yacht retailer, is notifying over 123,000 individuals whose personal information was stolen in a March security breach claimed by the Rhysida ransomware gang. While the Florida-based yacht seller initially stated in a March 12 SEC filing that no sensitive data was stored on the compromised systems, two weeks later, it said in a new 8-K filing that the attackers had stolen personal data belonging to an undisclosed number of people.
Organizations need to perform regular user access reviews on applications in scope to determine who still has access, verify that they need continued access, and remove access from anyone who doesn't. Recent supply chain attacks have underscored the fact that the modern attack surface is the SaaS attack surface, which means organizations preparing for these certifications need to account for their organization's SaaS sprawl and shadow IT. The secret to simplifying user access reviews? Automation.
London's inner city district of Hackney says the UK's data protection watchdog has misunderstood and "Exaggerated" details surrounding a ransomware attack on its systems in 2020. During the attack, thieves stole data of 280,000 Hackney residents, council employees and more, and some of the system's backups were deleted after the crooks broke into a server using an insecure password on a dormant account.
Elevated Privileges: Accidental download of malware by an insider can grant attackers elevated privileges, allowing them to tamper with critical systems or steal large amounts of data. Attackers can impersonate managers and colleagues to manipulate insiders into divulging sensitive information or exercising their privileges to the benefit of the external threat.
The financially motivated threat actor known as FIN7 has been observed using multiple pseudonyms across several underground forums to likely advertise a tool known to be used by ransomware groups like Black Basta. "AvNeutralizer, a highly specialized tool developed by FIN7 to tamper with security solutions, has been marketed in the criminal underground and used by multiple ransomware groups," cybersecurity company SentinelOne said in a report shared with The Hacker News.
Avast SecureLine VPN and NordVPN are virtual private network services competing in the same general price range. Winner: NordVPN. Avast SecureLine VPN has one of the smallest server pools for VPNs in its price range, with 700 servers in 58 cities in 34 countries.
A China-linked threat actor called APT17 has been observed targeting Italian companies and government entities using a variant of a known malware referred to as 9002 RAT. The two targeted attacks took place on June 24 and July 2, 2024, Italian cybersecurity company TG Soft said in an analysis published last week. "The first campaign on June 24, 2024 used an Office document, while the second campaign contained a link," the company noted.
Australian Craig Wright has finally admitted he is not the inventor of Bitcoin after losing several cases in the High Court of England and Wales, whose judge has suggested he be investigated for perjury. Wright has for years claimed to be Satoshi Nakamoto - the pseudonym used by whoever wrote the whitepaper that defined Bitcoin and created the reference architecture for the cryptocurrency.