Skip to main content
To Customer Support To Customer Support

Welcome

News, Announcements, Tech Discussions

44849 Topics
TylerM
Administrator
TylerMSr. Security Analyst & Community Manager
published in News & Announcements
Introducing Secure Cloud: The Future of Cybersecurity for SMBs

We are thrilled to announce the launch of Secure Cloud, a game-changing platform designed to simplify cybersecurity for small and medium-sized businesses. Imagine having every essential cybersecurity tool at your fingertips all within one powerful, easy-to-use, single pane of glass platform.Built to empower SMBs, Secure Cloud transforms the way you manage your cybersecurity, making it easier, faster, and more efficient than ever before. Whether you're looking to protect sensitive data, prevent phishing attacks, or ensure business continuity, Secure Cloud is your all-in-one solution. Say goodbye to juggling multiple security vendors and tools—everything you need is now in one place, and it's as simple as a single click.This isn’t just a product launch, it’s the beginning of a new era in how SMBs can achieve cyber resilience with confidence and ease. Explore a smarter, streamlined approach to security, with cutting-edge automation and an interface designed to help you focus on growth, no

1225
S
New Member
5 hours ago
TripleHelix
Moderator
TripleHelixModerator
posted in Water Cooler
Goodnight Thread - 2

The old thread (10 years) has run it’s course as you can’t post in there anymore so I started a new one! Thanks @Ssherjj    

1599327
TripleHelix
Moderator
9 hours ago
TripleHelix
Moderator
TripleHelixModerator
posted in Security Industry News
Alert 2024 CWE Top 25 Most Dangerous Software Weaknesses Release Date November 20, 2024

The Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the Homeland Security Systems Engineering and Development Institute (HSSEDI), operated by MITRE, has released the 2024 CWE Top 25 Most Dangerous Software Weaknesses. This annual list identifies the most critical software weaknesses that adversaries frequently exploit to compromise systems, steal sensitive data, or disrupt essential services.Organizations are strongly encouraged to review this list and use it to inform their software security strategies. Prioritizing these weaknesses in development and procurement processes helps prevent vulnerabilities at the core of the software lifecycle.Addressing these weaknesses is integral to CISA’s Secure by Design and Secure by Demand initiatives, which advocate for building and procuring secure technology solutions:Secure by Design: Encourages software manufacturers to implement security best practices throughout the design and development phases. By proactively

70
TripleHelix
Moderator
11 hours ago
TripleHelix
Moderator
TripleHelixModerator
posted in Security Industry News
Google Chrome Stable Channel Update for Desktop Tuesday November 19, 2024

Tuesday, November 19, 2024The Stable channel has been updated to 131.0.6778.85/.86 for Windows, Mac and 131.0.6778.85 for Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop_19.html Webroot users make sure to re-add back to Privacy Protection!  

50
TripleHelix
Moderator
12 hours ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
MITRE shares 2024's top 25 most dangerous software weaknesses

November 20, 2024 By Sergiu Gatlan MITRE has shared this year's top 25 list of the most common and dangerous software weaknesses behind more than 31,000 vulnerabilities disclosed between June 2023 and June 2024.Software weaknesses refer to flaws, bugs, vulnerabilities, and errors found in software's code, architecture, implementation, or design.Attackers can exploit them to breach systems where the vulnerable software is running, enabling them to gain control over affected devices and access sensitive data or trigger denial-of-service attacks."Often easy to find and exploit, these can lead to exploitable vulnerabilities that allow adversaries to completely take over a system, steal data, or prevent applications from working," MITRE said today."Uncovering the root causes of these vulnerabilities serves as a powerful guide for investments, policies, and practices to prevent these vulnerabilities from occurring in the first place — benefiting both industry and government stakeholders."To

40
Jasper_The_Rasper
Moderator
12 hours ago
TripleHelix
Moderator
TripleHelixModerator
posted in Security Industry News
Alert CISA Adds Two Known Exploited Vulnerabilities to Catalog Release Date November 20, 2024

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.CVE-2024-38812 VMware vCenter Server Heap-Based Buffer Overflow VulnerabilityCVE-2024-38813 VMware vCenter Server Privilege Escalation VulnerabilityThese types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges al

30
TripleHelix
Moderator
12 hours ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Attackers wield password-spray attacks to zero-in on targets, research finds

Attackers most frequently targeted education, energy and transportation organisations November 20, 2024 By Cybersecurity Dive Password-spray attacks yielded prolific results for attackers across multiple sectors in North America and Europe during Q2 and Q3, the Trellix Advanced Research Center said in a report.The attack surface for password-spray attacks is vast, Trellix found. Attackers commonly target cloud-based systems, including Microsoft 365, Okta, Google Workspace, VPNs, Windows Remote Desktop, AWS, Google Cloud Platform and Microsoft Azure.Attackers most frequently targeted password-spray attacks at education, energy and transportation organisations during the six-month period, the report found. >>Full Article<<

30
Jasper_The_Rasper
Moderator
12 hours ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Ubuntu Linux impacted by decade-old 'needrestart' flaw that gives root

November 20, 2024 By Bill Toulas Five local privilege escalation (LPE) vulnerabilities have been discovered in the needrestart utility used by Ubuntu Linux, which was introduced over 10 years ago in version 21.04.The flaws were discovered by Qualys and are tracked as CVE-2024-48990, CVE-2024-48991, CVE-2024-48992, CVE-2024-10224, and CVE-2024-11003. They were introduced in needrestart version 0.8, released in April 2014, and fixed only yesterday, in version 3.8.Needrestart is a utility commonly used on Linux, including on Ubuntu Server, to identify services that require a restart after package updates, ensuring that those services run the most up-to-date versions of shared libraries.Summary of LPE flawsThe five flaws Qualys discovered allow attackers with local access to a vulnerable Linux system to escalate their privilege to root without user interaction.Complete information about the flaws was made available in a separate text file, but a summary can be found below:CVE-2024-48990: N

10
Jasper_The_Rasper
Moderator
14 hours ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Fintech Giant Finastra Investigating Data Breach

November 19, 2024 By Brian Krebs The financial technology firm Finastra is investigating the alleged large-scale theft of information from its internal file transfer platform, KrebsOnSecurity has learned. Finastra, which provides software and services to 45 of the world’s top 50 banks, notified customers of the security incident after a cybercriminal began selling more than 400 gigabytes of data purportedly stolen from the company.London-based Finastra has offices in 42 countries and reported $1.9 billion in revenues last year. The company employs more than 7,000 people and serves approximately 8,100 financial institutions around the world. A major part of Finastra’s day-to-day business involves processing huge volumes of digital files containing instructions for wire and bank transfers on behalf of its clients.On November 8, 2024, Finastra notified financial institution customers that on Nov. 7 its security team detected suspicious activity on Finastra’s internally hosted file transfe

20
Jasper_The_Rasper
Moderator
14 hours ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
“Sad announcement” email leads to tech support scam

 November 20, 2024 By Pieter Arntz Tech support scammers are again stooping low with their email campaigns. This particular one hints that one of your contacts may have met an untimely end.It all starts with an email titled “Sad announcement” followed by a full name of someone you know. The email may appear to come from the person themselves.A co-worker who received such an email pointed it out to our team. Looking around, I found the first report about such an email in a tweet dating back to February 5, 2024.With some more information about what I was looking for, I managed to find several more.There is a great deal of variation between the emails, but we do have enough samples to show you a pattern which looks like this:Subject: Sad announcement: <First name><Last name>Sometimes the colon is replaced by the word “from”.Then a short sentence to pique the reader’s curiosity, which often references photos. Here are some examples: >>Full Article<<

20
Jasper_The_Rasper
Moderator
14 hours ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Unsecured JupyterLab and Jupyter Notebooks servers abused for illegal streaming of Sports events

November 20, 2024 By Pierluigi Paganini Threat actors exploit misconfigured JupyterLab and Jupyter Notebooks servers to rip sports streams and illegally redistribute them.Researchers from security firm Aqua observed threat actors exploiting misconfigured JupyterLab and Jupyter Notebook servers to hijack environments, deploy streaming tools, and duplicate live sports broadcasts on illegal platforms.“threat actors using misconfigured servers to hijack environments for streaming sports events. By exploiting misconfigured JupyterLab and Jupyter Notebook applications, attackers drop live streaming capture tools and duplicate the broadcast on their illegal server, thus conducting stream ripping” reads the report published by Aqua.JupyterLab and Jupyter Notebook are widely used interactive tools for data science. While essential for data operations, improper security configurations can expose organizations to risks, making secure deployment critical.  >>Full Article<<

20
Jasper_The_Rasper
Moderator
14 hours ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
New Ghost Tap attack abuses NFC mobile payments to steal money

November 20, 2024 By Bill Toulas Cybercriminals have devised a novel method to cash out from stolen credit card details linked to mobile payment systems such as Apple Pay and Google Pay, dubbed 'Ghost Tap,' which relays NFC card data to money mules worldwide.The tactic builds upon the methods previously deployed by mobile malware like NGate, documented by ESET in August, which involved relaying Near Field Communication (NFC) signals from payment cards.Ghost Tap is more obfuscated and more challenging to detect, does not require the card or the victim's device, doesn't need continual victim interchange, and involves money mules on multiple remote locations interacting with Point of Sale (PoS) terminals.Mobile security firm Threat Fabric discovered Ghost Tap, which warns about the increasing adoption and potential of the new tactic, telling BleepingComputer it has recently seen a spike in using this tactic in the wild. >>Full Article<<

20
Jasper_The_Rasper
Moderator
14 hours ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Water Cooler
Good Morning Thread - 2

[b]For the original Good Morning Thread, please see here -[/b] [url=https://community.webroot.com/water-cooler-8/good-morning-thread-28916][b]Good Morning Thread[/b][/url] Good morning/afternoon/evening Webrooters. It is finally cooling down here again now but there are no storms forecast tonight a shame really.

52941138
TripleHelix
Moderator
17 hours ago
ProTruckDriver
Moderator
ProTruckDriverModerator
posted in Tech Talk
Hidden Mac keyboard shortcuts you might not know

 Mac keyboard shortcuts are a great way to speed yourself up when you’re using your computer. Mastering them means more time spent getting things done and less time spent moving your hands back and forth between keyboard and trackpad.There are the basic Mac keyboard shortcuts like Command-C and Command-V for copy and paste; Command-B, Command-I and Command-U for bold, italics and underline; Command-Z and Shift-Command-Z for undo and redo. But for a lot of people, that’s where their knowledge ends.You can do so much more than you may know. Here’s a guide to the best Mac keyboard shortcuts. ⇨⇨ Full Article ⇦⇦

192
russell.harris
Popular Voice
23 hours ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Botnet fueling residential proxies disrupted in cybercrime crackdown

November 19, 2024 By Ionut Ilascu The Ngioweb botnet, which supplies most of the 35,000 bots in the cybercriminal NSOCKS proxy service, is being disrupted as security companies block traffic to and from the two networks.Following an investigation of more than one year, researchers identified the complete architecture and traffic of the Ngioweb botnet proxy server, which was first observed in 2017.Ngioweb supplying 80% of NSOCKS proxiesSince late 2022, the proxy service at nsocks[.]net has been providing residential gateways for malicious activity under the NSOCKS name.Multiple cybersecurity companies have reported that many of the proxies offered by NSOCKS were from the Ngioweb botnet but not all its command-and-control (C2) nodes were discovered. Ngioweb post-compromise activitysource: Lumen >>Full Article<<

50
Jasper_The_Rasper
Moderator
1 day ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Apple Confirms Zero-Day Attacks Hitting macOS Systems

See Also Apple security updates and Rapid Security Responses 19th November 2024 Apple rushes out out major macOS and iOS security updates to cover a pair of vulnerabilities already being exploited in the wild. November 19, 2024 By Ryan Naraine  Apple has rushed out major macOS and iOS security updates to cover a pair of vulnerabilities already being exploited in the wild.The vulnerabilities, credited to Google’s TAG (Threat Analysis Group), are being actively exploited on Intel-based macOS systems, Apple confirmed in an advisory released on Tuesday.As is customary, Apple’s security response team did not provide any details on the reported attacks or indicators of compromise (IOCs) to help defenders hunt for signs of infections.Raw details on the patched vulnerabilities:CVE-2024-44308 — JavaScriptCore — Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.CV

10
Jasper_The_Rasper
Moderator
1 day ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Helldown ransomware exploits Zyxel VPN flaw to breach networks

November 19, 2024 By Bill Toulas The new 'Helldown' ransomware operation is believed to target vulnerabilities in Zyxel firewalls to breach corporate networks, allowing them to steal data and encrypt devices.French cybersecurity firm Sekoia is reporting this with medium confidence based on recent observations of Helldown attacks.Although not among the major players in the ransomware space, Helldown has quickly grown since its launch over the summer, listing numerous victims on its data extortion portal.Victim announcementsSource: Sekoia >>Full Article<<

20
Jasper_The_Rasper
Moderator
1 day ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Microsoft launches ‘Zero Day Quest’ competition to enhance cloud and AI security

The tech giant is upping the bounties attached to several popular systems. November 19, 2024 By Greg Otto Microsoft has announced the launch of Zero Day Quest, a significant expansion of its bug bounty programs, focused on uncovering high-impact security vulnerabilities in cloud and AI technologies. Under the program, Microsoft will double the bounty rewards for eligible AI vulnerabilities from Nov. 19, 2024, to Jan. 19, 2025, and give researchers direct access to the company’s dedicated AI engineers and the AI Red Team, which specializes in probing AI systems for potential security flaws. The initiative is part of Microsoft’s broader Secure Future Initiative, launched to pre-emptively address security vulnerabilities across its extensive suite of products and services.Microsoft will also be adding bonus bounty multipliers for valid, important or critical severity issues across Microsoft’s AI, Azure, Microsoft Identity, M365, Dynamics 365, and Power Platform for the length of the chall

20
Jasper_The_Rasper
Moderator
1 day ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Palo Alto Patches Firewall Zero-Day Exploited in Operation Lunar Peek

See Also Palo Alto Networks warns of critical RCE zero-day exploited in attacks Palo Alto Networks has released patches and CVEs for the firewall zero-days exploited in what the company calls Operation Lunar Peek. November 19, 2024 By Eduard Kovacs Palo Alto Networks on Monday released patches and assigned CVE identifiers for the firewall zero-days that have been exploited in what the company is tracking as Operation Lunar Peek.The security firm reported learning about a potential zero-day in early November — possibly after seeing a sales offer on a cybercrime forum — and confirmed in-the-wild exploitation of a new vulnerability on November 15. On Monday, the cybersecurity giant informed customers that two PAN-OS vulnerabilities have been exploited in these attacks, which targeted “a limited number of management web interfaces that are exposed to internet traffic coming from outside the network”.One of the zero-days is CVE-2024-0012, a critical authentication bypass flaw that allows an

20
Jasper_The_Rasper
Moderator
1 day ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Ford investgates alleged breach following customer data leak

November 19, 2024 By Bill Toulas Ford is investigating allegations that it suffered a data breach after a threat actor claimed to leak 44,000 customer records on a hacking forum.The leak was announced on Sunday by threat actor 'EnergyWeaponUser,' also implicating the hacker 'IntelBroker,' who supposedly took part in the November 2024 breach.The threat actors leaked on BreachForums 44,000 Ford customer records containing customer information, including full names, physical locations, purchase details, dealer information, and record timestamps.The exposed records aren't extremely sensitive, but they still contain personally identifiable information that could empower phishing and social engineering attacks targeting the exposed individuals. >>Full Article<<

00
Jasper_The_Rasper
Moderator
1 day ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Apple security updates and Rapid Security Responses 19th November 2024

Apple security updates and Rapid Security Responses 19th November 2024  Name and information link Available for Release date visionOS 2.1.1 Apple Vision Pro 19 Nov 2024 iOS 18.1.1 and iPadOS 18.1.1 iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later 19 Nov 2024 iOS 17.7.2 and iPadOS 17.7.2 iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later 19 Nov 2024 macOS Sequoia 15.1.1 macOS Sequoia 19 Nov 2024  https://support.apple.com/en-us/100100

30
Jasper_The_Rasper
Moderator
1 day ago
TripleHelix
Moderator
TripleHelixModerator
posted in Security Industry News
Alert CISA Adds Three Known Exploited Vulnerabilities to Catalog Release Date November 18, 2024

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.CVE-2024-1212·  Progress Kemp LoadMaster OS Command Injection Vulnerability·  CVE-2024-0012·  Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability·  CVE-2024-9474 Palo Alto Networks PAN-OS Management Interface OS Command Injection VulnerabilityUsers and administrators are also encouraged to review the Palo Alto Threat Brief: Operation Lunar Peekrelated to CVE-2024-0012 for additional information. These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 re

20
TripleHelix
Moderator
2 days ago
TripleHelix
Moderator
TripleHelixModerator
posted in Security Industry News
Vulnerability Summary for the Week of November 11, 2024 Released Nov 18, 2024

Document IDSB24-323The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores.Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:High: vulnerabilities with a CVSS base score of 7.0–10.0 Medium: vulnerabilities with a CVSS base score of 4.0–6.9 Low: vulnerabilities with a CVSS base score of 0.0–3.9Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletin is compi

30
TripleHelix
Moderator
2 days ago
TripleHelix
Moderator
TripleHelixModerator
posted in Security Industry News
Microsoft November 2024 Security Updates (Patch Tuesday)

This release consists of the following 89 Microsoft CVEs: Microsoft security update summary for November 2024November 12, 2024Here’s a summary of Microsoft security updates released on this date.Critical security updates.NET 9.0 installed on Linux .NET 9.0 installed on Mac OS .NET 9.0 installed on Windows Microsoft Visual Studio 2022 version 17.10 Microsoft Visual Studio 2022 version 17.11 Microsoft Visual Studio 2022 version 17.6 Microsoft Visual Studio 2022 version 17.8 Windows 11 Version 22H2 for ARM64-based Systems Windows 11 Version 22H2 for x64-based Systems Windows 11 Version 23H2 for ARM64-based Systems Windows 11 Version 23H2 for x64-based Systems Windows 11 Version 24H2 for ARM64-based Systems Windows 11 Version 24H2 for x64-based Systems Windows Server 2012 Windows Server 2012 (Server Core installation) Windows Server 2012 R2 Windows Server 2012 R2 (Server Core installation) Windows Server 2016 Windows Server 2016 (Server Core installation) Windows Server 2019 Windows Server

315
TripleHelix
Moderator
2 days ago
Jasper_The_Rasper
Moderator
Jasper_The_RasperModerator
posted in Security Industry News
Ransomware Attack on Oklahoma Medical Center Impacts 133,000

Great Plains Regional Medical Center says the personal information of 133,000 individuals was compromised in a ransomware attack. November 18, 2024 By Ionut Arghire Great Plains Regional Medical Center in Oklahoma is notifying over 133,000 individuals that their personal information was compromised in a ransomware attack.The public, not-for-profit healthcare system discovered the attack on September 8, 2024, when ransomware was deployed, but the attackers had access to its systems for at least three days prior.According to the medical center, the attackers accessed and encrypted certain files between September 5 and September 8, and exfiltrated information from its systems.“We learned that the bad actor copied some of those files. We quickly restored our systems and returned to normal operations, but we also determined that a limited amount of patient information was not recoverable,” Great Plains Regional Medical Center says in an incident notice. >>Full Article<<

30
Jasper_The_Rasper
Moderator
2 days ago

Badges

Show all badges

Join the Conversation

Terms & Conditions