Security News

PixieFail UEFI Flaws Expose Millions of Computers to RCE, DoS, and Data Theft
2024-01-18 09:19

Multiple security vulnerabilities have been disclosed in the TCP/IP network protocol stack of an open-source reference implementation of the Unified Extensible Firmware Interface (UEFI)...

Attribute-based encryption could spell the end of data compromise
2024-01-18 06:00

The future of data privacy is the end of compromise. With the world producing data at astounding rates, we need ways to put data to the best use while protecting against breaches and ensuring privacy, data protection and access control.

Skytrack: Open-source aircraft reconnaissance tool
2024-01-18 05:30

Skytrack is an open-source command-line tool for plane spotting and aircraft OSINT reconnaissance. The tool utilizes multiple data sources to collect information on aircraft, can produce a PDF report for a specific aircraft, and offers conversion between ICAO and Tail Number designations.

Ransomware negotiation: When cybersecurity meets crisis management
2024-01-18 05:00

He discusses ransomware gangs, the role of cyber insurance, and how governments and regulatory bodies are responding to the ransomware threat. In light of the increasing sophistication of ransomware attacks, can you discuss the dynamics of negotiating with ransomware gangs? How do these negotiations typically unfold, and what are the critical business considerations during these interactions?

The power of AI in cybersecurity
2024-01-18 04:30

Besides helping security teams perform these tasks more accurately, AI also helps them improve their working speed. Speed is also what cybercriminals are achieving when harnessing the power of AI: it allows them to quickly adapt their attacks to new security measures.

Iranian Hackers Masquerade as Journalists to Spy on Israel-Hamas War Experts
2024-01-18 04:16

High-profile individuals working on Middle Eastern affairs at universities and research organizations in Belgium, France, Gaza, Israel, the U.K., and the U.S. have been targeted by an Iranian...

Adversaries exploit trends, target popular GenAI apps
2024-01-18 04:00

While Netskope expects the total number of users accessing AI apps in the enterprise to continue rising moderately next year, there is an emerging population of power users who are steadily growing their use of generative AI apps. Overall adoption of cloud applications continued to rise throughout the year, with enterprise users consistently trying out new apps while increasing their usage of the most popular apps.

Insurance website's buggy API leaked Office 365 password and a giant email trove
2024-01-18 01:58

Toyota Tsusho Insurance Broker India, an Indo-Japanese joint insurance venture, operated a misconfigured server that exposed more than 650,000 Microsoft-hosted email messages to customers, a security researcher has found. Zveare then examined the calculator web page on the TTIBI website and saw that it included a client-side function that created a request to send email using a server-side API. "This caught my eye because this was a client-side email sending mechanism," he wrote in a post describing his findings.

Apple, AMD, Qualcomm GPU security hole lets miscreants snoop on AI training and chats
2024-01-17 23:21

Research made public on Tuesday detailed how miscreants can exploit the hole to read data they're not supposed to in a system's local GPU memory. While the flaw potentially affects all GPU applications on vulnerable chips, it is especially concerning for those processing machine-learning applications because of the amount of data these models process using GPUs, and therefore the amount of potentially sensitive information that could be swiped by exploiting this issue.

Have I Been Pwned adds 71 million emails from Naz.API stolen account list
2024-01-17 22:06

Have I Been Pwned has added almost 71 million email addresses associated with stolen accounts in the Naz.API dataset to its data breach notification service. The Naz.API dataset is a massive collection of 1 billion credentials compiled using credential stuffing lists and data stolen by information-stealing malware.