Security and Proprietary Blunders
-
Ghostwriter: Open-source project management platform for pentesters
In this Help Net Security video, Christopher Maddalena, Director of Internal and Community Product at SpecterOps, showcases Ghostwriter, which helps you manage clients, projects, reports, and infrastructure in one application.
The tool does not replace some of the more common or traditional project management tools, such as CRMs. Still, it does consolidate all relevant project information in a way for users to easily curate every aspect of their projects.
-
LinkedIn Adds Verified Emails, Profile Creation Dates [Ed: Microsoft and security are opposites]
Responding to a recent surge in AI-generated bot accounts, LinkedIn is rolling out new features that it hopes will help users make more informed decisions about with whom they choose to connect. Many LinkedIn profiles now display a creation date, and the company is expanding its domain validation offering, which allows users to publicly confirm that they can reply to emails at the domain of their stated current employer.
-
This Week In Security: OpenSSL Fizzle, Java XML, And Nothing As It Seems
The security world held our collective breaths early this week for the big OpenSSL vulnerability announcement. Turns out it’s two separate issues, both related to punycode handling, and they’ve been downgraded to high severity instead of critical. Punycode, by the way, is the system for using non-ASCII Unicode characters in domain names. The first vulnerability, CVE-2022-3602, is a buffer overflow that writes four arbitrary bytes to the stack. Notably, the vulnerable code is only run after a certificate’s chain is verified. A malicious certificate would need to be either properly signed by a Certificate Authority, or manually trusted without a valid signature.
-
Congressional report finds health care sector ‘uniquely vulnerable’ to cyber attacks [iophk: Windows TCO]
The report, which is divided into three sections, recommends that the federal government improve the country’s cybersecurity risk posture in the health care sector, help the private sector mitigate cyber threats and assist health care providers in responding and recovering from cyberattacks.
“Unfortunately, the health care sector is uniquely vulnerable to cyberattacks and the transition to better cybersecurity has been painfully slow and inadequate,” Warner said in the report.
-
Cybersecurity is Patient Safety: Policy Options in the Health Care Sector [PDF] [iophk: Windows TCO]
The health care sector is vulnerable to cyberattacks for a number of reasons, including its reliance on legacy technology, a wide and highly varied attack surface (that only grows more complex from the ever-increasing number of connected devices), a high-pressure environment where even the slightest delay can have life-or-death consequences, funding constraints, and an outdated mode of thinking that views cybersecurity as a secondary or tertiary concern.
-
VMware partners with She Loves Data to help women reboot careers in data and technology
While VMware’s VMinclusion Taara aims to upskill women by providing free technical education and certification courses in Cloud Management & Automation, Data Centre Virtualization, Networking and Digital Workplaces, SLD will help more women become data-literate through their signature programmes on technology, mentorship, essential skills development, and offer networking opportunities, as per the statement.
-
Europol adds suspected psychotherapy centre extortionist to 'most wanted' list [iophk: Windows TCO]
Europol has added Aleksanteri Kivimäki, suspected of hacking patient data at the psychotherapy centre Vastaamo, to its "most wanted list," Finland's National Bureau of Investigation (NBI) announced on Thursday.
The sensitive, confidential information of about 30,000 patients was stolen and used in an attempt to extort money from the company and its clients.
-
Ransomware most destructive online crime, ACSC report claims [iophk: Windows TCO]
Ransomware attacks are more or less exclusively limited to systems running versions of Microsoft's Windows operating system.
This was one of the trends that the ACSC mentioned, but most of the others — cyber space has become a battleground, Australia’s prosperity is attractive to cyber criminals, Worldwide, critical infrastructure networks are increasingly targeted and the rapid exploitation of critical public vulnerabilities became the norm — are hardly new.
-
Facebook and the conglomerate curse
In the middle is Amazon, which has over-invested in e-commerce and expanded too far, crushing its cashflow and returns. Mr Bezos, who remains executive chairman, owns less than 15% of the firm’s voting rights, so he has to be at least somewhat responsive to investors. Apple and Microsoft are at the benign end of the spectrum. Both firms are older, no longer have founders with controlling stakes and operate on the principle of one share, one vote. Both listen to outsiders. In 2013 Tim Cook, Apple’s boss, sat down for dinner with Carl Icahn, a fiery investor, and took on board his request to return money to shareholders through buybacks. In 2014 Microsoft invited an activist investor, Mason Morfit, onto its board. The two firms have performed the best of the big five this year.
-
How to download an e-mail from Gmail
You can also download all of your Gmail data at once, including unread, read, sent, draft, and archived messages. If your e-mail is part of a school or organization, you may not be able to download certain things, if anything at all. If you have Super Administrator privileges of your own domain, you can download anything.