Maryland Attorney General Brian E. Frosh has warned Marylanders that their medical and other private information may have been compromised by a cyberattack against American Medical Collection Agency, a third-party collection agency for laboratories, hospitals, physician groups, medical providers and others. The known list of those impacted affects over 20 million patients. https://twitter.com/wjz/status/1138819495290691584 Expert Comments: Tim Erlin, VP, Product Management and Strategy at Tripwire: “A criminal with the details about patients’ medical bills is in a good position to fraudulently collect money from those patients. Imagine if you received an email with accurate details about a medical bill you actually have, and a link…
ISBuzz Team
A Google researcher has discovered a vulnerabiliy in the SymCrypt cryptographic library of Microsoft’s OS that can trigger a DDoS disruption in Windows 8 servers and above, causing a perpetual operation “when calculating the modular inverse on specific bit patterns with bcryptprimitives!SymCryptFdefModInvGeneric.” https://twitter.com/taviso/status/1138469652571467776 https://twitter.com/vcsjones/status/1123089141481254917 Expert Comments: Adam Laub, SVP Product Management at STEALTHbits Technologies: “This finding demonstrates just how important this type of research is in helping organizations mitigate risks no one ever knew existed. The frightening part about this vulnerability and others that can be remedied with a simple patch, however, is that many organizations will have a very difficult time actually implementing the fix. When I first…
Citrix, a company which works with the likes of the FBI and US military, recently hit the headlines when it fell victim to hackers. The cyber criminals allegedly used a technique called password spraying, which exploits weak passwords. This is just one example of why the traditional username and password combination is no longer fit for purpose, in both our personal and business life. The problem with traditional password systems is not with the concept of the username and password combination. Rather, it is that the system relies on the weakest part in any infosecurity chain: the human. Historically, this method has…
Citrix, a company which works with the likes of the FBI and US military, recently hit the headlines when it fell victim to hackers. The cyber criminals allegedly used a technique called password spraying, which exploits weak passwords. This is just one example of why the traditional username and password combination is no longer fit for purpose, in both our personal and business life. The problem with traditional password systems is not with the concept of the username and password combination. Rather, it is that the system relies on the weakest part in any infosecurity chain: the human. Historically, this method has…
Yesterday, Microsoft published its monthly roll-up of security updates, known as Patch Tuesday. This month, the OS maker has patched 88 vulnerabilities, among which 21 received a rating of “Critical,” the company’s highest severity ranking. Experts Comments: Satnam Narang, Senior Research Engineer at Tenable: “This month’s Patch Tuesday release contains updates for nearly 90 CVEs, including fixes for four zero-day elevation of privilege vulnerabilities: “bearlpe,” “InstallerBypass,” “CVE-2019-0841-BYPASS,” and “sandboxescape,” that werepublicly disclosed by SandboxEscaper in late May. “CVE-2019-1069, the “bearlpe” flaw, is an elevation of privilege vulnerability in the way the Task Scheduler Service validates file operations. “CVE-2019-0973, “InstallerBypass,” is an elevation of privilege…
HackerOne is revealing the top 10 most impactful security vulnerabilities which have earned hackers over $54 million in bounties. Based on the 120,000+ security vulnerabilities that hackers have reported across over 1,400 HackerOne customer programs, the data represents real-world risks that existed in organisations, including technology unicorns, governments, start-ups, financial institutions and open source projects. HackerOne has launched an interactive site showing the vulnerability types with the highest severity scores, the largest total report volumes and the most reported by industry. HackerOne’s top 10 security vulnerabilities ranked by total bounties paid on the platform are: Cross-site Scripting – All Types (dom, reflected, stored, generic) Improper Authentication – Generic …
New threat intelligence from F5 Labs shows that Europe suffers more attacks from within its borders than any other part of the world; Majority of attacks stem from IP addresses in the Netherlands, followed by the United States, China, Russia, and France F5 Labs identified top attacking networks and ISPs, as well as most prominently targeted ports from 1 December 2018 to 1 March 2019 Europe endures more cyberattacks from within its own geographic region than any other part of the world, according to new analysis by F5 Labs1. The discovery was made after studying attack traffic destined for European…
UK’s secret service, MI5, may have broken the law by holding large volumes of citizens’ private data without proper protections, according to documents released today in the High Court. https://twitter.com/MiddleEastEye/status/1138470349337694220 Expert Comments: Fouad Khalil, VP of Compliance at SecurityScorecard: “As we consider MI5’s recent privacy violation we confirm that no one and no entity is out of GDPR reach. MI5 seems to have falsely claimed that they had the right to keep personal data and that they had sufficient controls to protect it. We have a situation here where MI5 may have violated many of the laws and regulations enacted for…
With 55% of installed software on PCs worldwide out of date, Avast’s new service will help small businesses prioritize, manage and deploy critical security updates Redwood City, California, June 11, 2019 – Avast (LSE:AVST), the world leader in digital security products, has today launched a new Patch Management service to help small and mid-sized businesses manage necessary security updates more easily and efficiently. Around 50% of software vulnerabilities exploited occur within 2-4 weeks of a software update being released, however, the time-intensive evaluation and required testing of patches means businesses on average take 120 days to implement the updates, exposing them to…
Emails delivering RTF files equipped with an exploit that requires no user interaction (except for opening the booby-trapped file) are hitting European users’ inboxes, Microsoft researchers have warned. Theexploit takes advantage of a vulnerability in an older version of the Office Equation Editor, which was manually patched by Microsoft in November 2017. https://twitter.com/MsftSecIntel/status/1137118977983897600 https://twitter.com/SecurityMetrics/status/1138127553321791488 Expert Comments: Roy Rashti, Cybersecurity Expert at Bitdam: “This exploit is still being observed in attacks because, ultimately, it still works. The reason it still works is that people tend to ignore updates and patches, which makes them vulnerable to N-day exploits. This is the same reason that WannaCry proliferated so…