I had rehearsed a whole opening for Episode 6 of The Unemployed: My Laid-Off Life but alas, I did not get the gig. This week, I share how I came close to landing a role through an internal referral—only to face rejection. But it’s not all bad news! I received some helpful feedback that I’m […]
The post The Unemployed Chronicles: Learn from My Mistakes appeared first on Security Boulevard.
OMB Memo M-24-15 published on July 24, 2024 directed GSA and the FedRAMP PMO to streamline the FedRAMP ATO process using NIST OSCAL. By late 2025 or early 2026 (18 months after the issuance of the memo), GSA must ensure the ability to receive FedRAMP authorization and continuous monitoring artifacts through automated, machine-readable means. Additionally, […]
The post Making FedRAMP ATOs Great with OSCAL and Components appeared first on Security Boulevard.
Why is Harnessing Non-Human Identities Central to Your Cybersecurity Strategy? In the realm of information security, managing identities – whether human or machine – is critical. This attention escalates further when you delve into the realm of Non-Human Identity (NHI) management. The importance can easily get obscured in the vast sphere of cybersecurity, but why […]
The post Confidently Secure: Leveraging PAM for Enhanced Protections appeared first on Entro.
The post Confidently Secure: Leveraging PAM for Enhanced Protections appeared first on Security Boulevard.
Why Is Secrets Rotation a Critical Aspect of Cybersecurity? Isn’t it intriguing how an object as intangible as ‘information’ can hold immense value in today’s digitally connected world? In the realm of cybersecurity, Secrets Rotation plays a key role in safeguarding this valuable asset. Secrets Rotation constitutes a dynamic process of creating, dispensing, and disabling […]
The post Stay Assured: Critical Insights into Secrets Rotation appeared first on Entro.
The post Stay Assured: Critical Insights into Secrets Rotation appeared first on Security Boulevard.
Author/Presenter: Lillian Ash Baker
Our sincere appreciation to DEF CON, and the Authors/Presenters for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.
The post DEF CON 32 – The Interplay between Safety and Security in Aviation Systems3 appeared first on Security Boulevard.
This is a news item roundup of privacy or privacy-related news items for 29 DEC 2024 - 4 JAN 2024. Information and summaries provided here are as-is for warranty purposes.
Note: You may see some traditional "security" content mixed-in here due to the close relationship between online privacy and cybersecurity - many things overlap; for example, major vulnerabilities in popular software, which may compromise the security of user's devices (and therefore pose a threat to their privacy) and large data breaches where significant personal information is exposed.
Items presented here are typically curated with the end user and small groups (such as families and small/micro businesses) in mind. Due to this focus, items primarily affecting enterprises or large organizations may not be included, even if they are widespread or "popular" stories.
TABLE OF CONTENTS
Primarily covers tools and services with a focus on maintaining/improving/respecting user privacy. Generally includes recommended services/tools found on avoidthehack, but also may feature upcoming/other privacy services not necessarily recommended or promoted by avoidthehack.com
Privacy ToolsDivestOS, Mull, Mulch, and Hypatia discontinued
DivestOS Mobile
The developer behind DivestOS (a privacy-oriented Android operating system forked from LineageOS), Mull (a privacy browser for Android), Mulch (security-oriented webview for Android), and Hypatia (an open source virus scanner for Android) has announced these projects will no longer be supported/updated as of December 2024.
For years DivestOS was a recommended alternative privacy-oriented Android operating system on avoidthehack. In a future site update, I will regretfully remove it as an official recommendation due to its EOL status.
Vulnerabilities and MalwarePrimarily includes severe and exploited vulnerabilities in devices or software used by end users (ex: a major router firmware flaw). Malware campaigns covered generally target/affect the end user.
This section will not contain every vulnerability/CVE or malware campaign reported, but will focus on those with the largest potential impact on a wide range of end users.
VulnerabilitiesHackers exploit Four-Faith router flaw to open reverse shells
Bleeping Computer
Attackers are exploiting an OS command injection vulnerability, tracked as CVE-2024-12856, to open reverse shells, which can be used for further exploitation of the device. Specifically, a command used for adjusting the system time can be manipulated (via HTTP POST request) to include a shell command.
As of writing, there is no security update available. It appears that primarily internet-facing devices are vulnerable (they typically have remote management interfaces exposed to the internet in most cases). Users should keep routers updated, use strong admin passwords (avoid using the default credentials), and avoid exposing the admin login page to the internet.
Note that affected router models are typically deployed in some critical infrastructure sectors, but may apply to some users.
Malware botnets exploit outdated D-Link routers in recent attacks
Bleeping Computer
Two botnets (Ficora and Capsaicin) continue to target D-Link routers that are EOL or running outdated firmware. Commonly, these botnets exploit CVE-2015-2051, CVE-2019-10891, CVE-2022-37056, and CVE-2024-33112 for initial access to vulnerable D-Link routers. They then execute their payloads, which can steal data and/or recruit the device into the botnet.
Users should be sure to keep their devices updated - especially routers. EOL devices should be replaced as soon as possible, as they are no longer supported by the manufacturer. For EOL devices, depending on model and/or submodel, users may be able to flash firmware (such as OpenWRT) to extend the life of the device.
MalwareNew details reveal how hackers hijacked 35 Google Chrome extensions
Bleeping Computer
A phishing campaign targeting Chrome extension developers (including a cybersecurity firm, Cyberhaven) has enabled attackers to compromise multiple Google Chrome extensions. The compromised extensions were injected with data-stealing code.
Developers were sent phishing emails pretending to be from Google; the emails linked to Google's OAuth authorization flow for the threat actor controlled app "Privacy Policy Extension," requesting permissions such as editing/updating Chrome store extensions users have access to. Naturally, after permissions are granted, the threat actors publish an "updated" (malicious version of the extension).
It appears threat actors in this campaign were specifically interested in targeting and hijacking Facebook business accounts, attempting to grab information such as the user's Facebook ID, access token, account info, account information, and any CAPTCHA mechanisms/QR code images associated with MFA.
Service Providers' Privacy PracticesThis section is dedicated to notable changes or developments in popular/large service provider's privacy practices.
Service providers listed here are not necessarily "privacy-focused," but may have privacy practice changes positively (ex: adopting end-to-end encryption for messaging or) or negatively (ex: increased sharing of data with affiliates) affecting a large amount of users.
Negative changesApple auto-opts everyone into having their photos analyzed by AI for landmarks
The Register
Apple appears to have auto-opted users into a new feature, likely introduced in an iOS 18.1 update, known as Enhanced Visual Search. The auto opt-in is believed to have happened in late October 2024.
Apparently, the process by which this feature works is "private enough," but the lack of notification and not seeking consent from users is concerning.
Legislation/Lawsuits/RegulationsPredominately focused on legal/regulation privacy practices outlined in US law (ex: FTC banning certain companies from sharing location data), but large enough changes in EU law may also be covered here. Also notable privacy-related lawsuits (again, predominately in the US) are found here.
LawsuitsApple to pay $95 million to settle Siri privacy lawsuit
Reuters
Lawsuit alleges Apple used Siri to listen to what people were saying - ads were then targeted at them based on what they mentioned.
Apple pays the settlement but continues to deny any "wrongdoing." Interestingly, Google is being sued by the same law firm for similar concerning Google Assistant (Google's answer to Siri).
LegislationThe US proposes rules to make healthcare data more secure
The Verge
US Department of Health and Human Services has proposed new cybersecurity requirements for covered entities (healthcare organizations). This is in response to the severity and scale of data breaches in the healthcare sector in the last ~3 years.
The requirements will require these organizations to encrypt patient data (I'm assuming both in transit and at rest), use multifactor authentications (MFA) for accessing systems, and keep compliance documentation.
Will be the first update to HIPAA in over a decade (the last update was in 2013)
Data Breaches and LeaksGenerally covers large data breaches (or data leaks) exposing sensitive information of users - typically the focus is on US companies and on data breaches...
The post Privacy Roundup: Week 1 of Year 2025 appeared first on Security Boulevard.
The post Top 5 Mistakes SAQ A-EP Merchants Are Making in 2025 That Will Knock Them Out of PCI 4.0 Compliance appeared first on Feroot Security.
The post Top 5 Mistakes SAQ A-EP Merchants Are Making in 2025 That Will Knock Them Out of PCI 4.0 Compliance appeared first on Security Boulevard.
Could Advanced Secrets Management be Your Way to Feeling Relieved? Think about it. If you could significantly decrease the likelihood of security breaches and data leaks in your organization, wouldn’t that be a massive weight lifted off your shoulders? But how to systematically fortify your cybersecurity? The answer lies in Non-Human Identities (NHIs) and Secrets […]
The post Feel Relieved: Advanced Secrets Management Techniques appeared first on Entro.
The post Feel Relieved: Advanced Secrets Management Techniques appeared first on Security Boulevard.
Where Does Your Cloud Security Stand? Does your organization’s data management strategy consider non-human identities (NHIs) and secret security management? In the intricate dance of safeguarding data, ensuring the security of machine identities, or NHIs, and their corresponding secrets is pivotal. This practice remains an essential element of best cloud security practices and an effective […]
The post Ensure Your Data’s Safety: Best Practices in Cloud Security appeared first on Entro.
The post Ensure Your Data’s Safety: Best Practices in Cloud Security appeared first on Security Boulevard.
Humans are spectacularly bad at predicting the future. Which is why, when someone appears to be able to do it on a regular basis, they are hailed as visionaries, luminaries and celebrated with cool names like Nostradamus and The Amazing Kreskin. Nostradamus made his fame on predictions about the distant future, but that technique has […]
The post Imperva’s Wildest 2025 AppSec Predictions appeared first on Blog.
The post Imperva’s Wildest 2025 AppSec Predictions appeared first on Security Boulevard.
Authors/Presenters: Lucas Potter, Meow-Ludo Disco Gamma Meow-Meow, Xavier Palmer
Our sincere appreciation to DEF CON, and the Authors/Presenters for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.
The post DEF CON 32 – The Past, Present, and Future of Bioweapons appeared first on Security Boulevard.
Firewalls and VPN appliances are critical gateways. Like all on-prem systems, a vulnerability can lead to a compromise that is used to open the door for attackers.
The post Best of 2024: If You are Reachable, You Are Breachable, and Firewalls & VPNs are the Front Door appeared first on Security Boulevard.
We want to wish you a Happy New Year!
The post Looking into 2025: Reflections & Observations from the Tidal Cyber Founders appeared first on Security Boulevard.
via the comic humor & dry wit of Randall Munroe, creator of XKCD
The post Randall Munroe’s XKCD ‘Time Capsule Instructions’ appeared first on Security Boulevard.
Authors/Presenters: J. Utley, P. Rhodes, J. Hill
Our sincere appreciation to DEF CON, and the Authors/Presenters for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.
The post DEF CON 32 – You Got A Lighter I Need To Do Some Electroporation appeared first on Security Boulevard.
Some of our astute readers noticed an apparent anomaly in the graph comparing the complexities of Shor’s algorithm and GNFS in the original blog. Specifically, it seemed as though GNFS (General Number Field Sieve) outperformed quantum-accelerated Shor’s algorithm for practical RSA key sizes (e.g., 2048 bits). This led to the seemingly absurd conclusion that RSA […]
The post Clarification on Shor’s Algorithm and GNFS Comparison appeared first on ColorTokens.
The post Clarification on Shor’s Algorithm and GNFS Comparison appeared first on Security Boulevard.
Effective Public Key Infrastructure (PKI) management needs to combine ways of handling PKI infrastructure along with the recommended best practices. In many cases, management of digital signatures or certificates is not that widely understood and can often lead to an outage that could have been proactively prevented. This mismanagement of certificates can also impact safe […]
The post Addressing PKI Management Pitfalls: From Chaos to Clarity appeared first on Security Boulevard.
August 27, 2024 Authors: Rui Ataide, Hermes Bojaxhi The GuidePoint Research and Intelligence Team (GRIT) has been tracking a highly […]
The post Best of 2024: So-Phish-ticated Attacks appeared first on Security Boulevard.
Cyberthreats are evolving fast, and staying ahead requires more than basic defenses. Threat detection and response (TDR) equips you to identify risks early and take action before they escalate. It’s a strategy for protecting your systems, preserving customer trust, and keeping your organization resilient against ever-changing threats.
The post What Is Threat Detection and Response (TDR)? A Guide appeared first on Security Boulevard.
Poor code quality can jeopardize your application’s performance and scalability. But more importantly, security vulnerabilities in code increase the risk of exploits, leading to data breaches, compliance failures, and loss of customer trust.
The post 10 Best Security Code Review Tools to Improve Code Quality appeared first on Security Boulevard.
