News

PerimeterX, the company that protects the world’s largest and most reputable websites and mobile applications from malicious activities, today released “Third-Party Code: The Hidden Risk in Your Website,” a survey of security professionals that underscores the lack of awareness people have about vulnerabilities in third-party client-side scripts and the unaddressed threats that can result. Industry estimates state that the typical website is comprised of approximately 70 percent third-party code. The survey found that while almost...

Securonix, Inc., a leader in modern SIEM, announced an analytics and threat hunting content package that leverages the MITRE ATT&CK framework as a standard for predicting, detecting and investigating advanced cyber threats. The updated content includes 350+ use cases that are mapped to 100+ MITRE ATT&CK and PRE-ATT&CK techniques. The content will be integrated into the Securonix threat library version 6.3 for automated delivery and deployment to existing and new customers. Cyber security today is...

Research from Gurucul has uncovered 74 per cent of companies are being driven to actively take steps to mitigate security risks posed by third party vendors following recent breaches. The study also found that Managed Service Providers (MSPs) are the biggest third-party concern amongst IT security professionals, ahead of systems integrators and developers. Gartner has recently predicted that managed and subscription-based security services will account for half of all cyber-security spending by 2020, highlighting the...

Exclusive Scotiabank leaked online a trove of its internal source code, as well as some of its private login keys to backend systems, The Register can reveal. Over the past 24 hours, the Canadian financial giant has torn down GitHub repositories, inadvertently left open to the public, that contained this sensitive information, after The Register raised the alarm. These repositories featured, among other things, software blueprints and access keys for a foreign exchange rate system, mobile application code, and login...

Cyber security threat researchers at multiple companies have reported that the prolific Emotet email trojan-turned-botnet has re-emerged as an active threat to inboxes after an apparent summer hiatus lasting three-and-a-half months. One of the most widely distributed and dangerous email attacks of the past few years, the resurgence began early on the morning of Monday 16 September, hitting targets across Europe and the US, with the latest attack introducing Spanish and Italian language variants for the first...

When Teemu Airamo moved into his company's new Manhattan office in shared workspace provider WeWork, he had one overriding priority: to run a security scan on the building's Wi-Fi network. After all, he shared a space with more than 200 companies also co-working in the Financial District hub and didn't want anyone snooping around.  Source: CNET

A couple of Android apps found in Google Play included functionality that stealthy recording audio without user consent. The apps posed as selfie camera filters and had been installed over 1.5 million times. The main activity of the two apps was not spying on users but aggressively pushing adware that covered the entire screen of the Android device. Source: Bleeping Computer

On the heels of its acquisition by Chegg, developer education site Thinkful said an authorized third party had breached its systems. “We recently discovered that an unauthorized party may have gained access to certain Thinkful company credentials so, out of an abundance of caution, we are notifying all of our users,” company Vice President of Operations Erin Rosenblatt told users in an email. “As soon as we discovered this unauthorized access, we promptly changed the...

A Magecart card-skimming campaign this month sabotaged the mobile websites of two hotel chains by executing a supply chain attack on a third-party partner, researchers have reported. The third party in both instances was Roomleader, a Barcelona-based provider of digital marketing and web development services. One of the ways Roomleader helps hospitality companies build out their online booking functionality is through a library module called “viewedHotels,” which saves viewed hotel information in visitors’ browser cookies. Source: SC...

Attackers can exploit a critical security vulnerability in Harbor cloud native registry for container images to obtain admin privileges on a vulnerable hosting system. Harbor is open source and can integrate with Docker Hub and various image registries like Docker Registry and Google Container Registry, to add security, identity, and management features. Source: Bleeping Computer