news
Security Leftovers
-
Bruce Schneier ☛ A Cyberattack Victim Notification Framework
Interesting analysis:
When cyber incidents occur, victims should be notified in a timely manner so they have the opportunity to assess and remediate any harm. However, providing notifications has proven a challenge across industry.
When making notifications, companies often do not know the true identity of victims and may only have a single email address through which to provide the notification. Victims often do not trust these notifications, as cyber criminals often use the pretext of an account compromise as a phishing lure.
This report explores the challenges associated with developing the native-notification concept and lays out a roadmap for overcoming them.
-
Security Week ☛ In Other News: $900k for XSS Bugs, HybridPetya Malware, Burger King Censors Research
Noteworthy stories that might have slipped under the radar: Huntress research raises concerns, Surveillance Giant Google paid out $1.6 million for cloud vulnerabilities, California web browser bill.
-
Scoop News Group ☛ DHS watchdog finds mismanagement in critical cyber talent program
CISA was paying employees without mission-critical cybersecurity backgrounds as part of a program for retaining cyber talent.
-
LWN ☛ Security updates for Friday
Security updates have been issued by Debian (cups, imagemagick, libcpanel-json-xs-perl, and libjson-xs-perl), Fedora (checkpointctl, chromium, civetweb, glycin, kernel, libssh, ruff, rust-secret-service, snapshot, and uv), Mageia (curl), Red Hat (kernel), SUSE (cups, curl, perl-Cpanel-JSON-XS, regionServiceClientConfigAzure, regionServiceClientConfigEC2, regionServiceClientConfigGCE, trivy, and xen), and Ubuntu (cups, node-cipher-base, and qemu).
-
Security Week ☛ Payment System Vendor Took Year+ to Patch Infinite Card Top-Up Hack: Security Firm
KioSoft was notified about a serious NFC card vulnerability in 2023 and only recently claimed to have released a patch.
-
Security Week ☛ VMScape: Academics Break Cloud Isolation With New Spectre Attack
Exploiting incomplete speculative execution attack mitigations extended to the branch predictor state, VMScape leaks arbitrary memory.
-
Security Week ☛ CISA: CVE Program to Focus on Vulnerability Data Quality
CISA says it is time for the CVE Program to focus on improving trust, responsiveness, and the caliber of vulnerability data.
-
Security Week ☛ DELMIA Factory Software Vulnerability Exploited in Attacks
A deserialization of untrusted data in the MOM software allows attackers to achieve remote code execution.