Category Archives: The Coming Storm

Tourists Give Themselves Away by Looking Up. So Do Most Network Intruders.

Posted on by

In large metropolitan areas, tourists are often easy to spot because they’re far more inclined than locals to gaze upward at the surrounding skyscrapers. Security experts say this same tourist dynamic is a dead giveaway in virtually all computer intrusions that lead to devastating attacks like ransomware, and that more organizations should set simple virtual tripwires that sound the alarm when authorized users and devices are spotted exhibiting this behavior. Continue reading Tourists Give Themselves Away by Looking Up. So Do Most Network Intruders.→

Meet the Brains Behind the Malware-Friendly AI Chat Service ‘WormGPT’

Posted on by

WormGPT, a private new chatbot service advertised as a way to use Artificial Intelligence (AI) to help write malicious software without all the pesky prohibitions on such activity enforced by ChatGPT and Google Bard, has started adding restrictions on how the service can be used. Faced with customers trying to use WormGPT to create ransomware and phishing scams, the 23-year-old Portuguese programmer who created the project now says his service is slowly morphing into “a more controlled environment.”

The large language models (LLMs) made by ChatGPT parent OpenAI or Google or Microsoft all have various safety measures designed to prevent people from abusing them for nefarious purposes — such as creating malware or hate speech. In contrast, WormGPT has promoted itself as a new LLM that was created specifically for cybercrime activities. Continue reading Meet the Brains Behind the Malware-Friendly AI Chat Service ‘WormGPT’→

How Malicious Android Apps Slip Into Disguise

Posted on by

Researchers say mobile malware purveyors have been abusing a bug in the Google Android platform that lets them sneak malicious code into benign mobile apps and evade security scanning tools. Google says it has updated its app malware detection mechanisms in response to the new research. Continue reading How Malicious Android Apps Slip Into Disguise→

Russia Sends Cybersecurity CEO to Jail for 14 Years

Posted on by

The Russian government today handed down a treason conviction and 14-year prison sentence on Iyla Sachkov, the former founder and CEO of one of Russia’s largest cybersecurity firms. Sachkov, 37, has been detained for nearly two years under charges that the Kremlin has kept classified and hidden from public view, and he joins a growing roster of former Russian cybercrime fighters who are now serving hard time for farcical treason convictions. Continue reading Russia Sends Cybersecurity CEO to Jail for 14 Years→

CISA Order Highlights Persistent Risk at Network Edge

Posted on by

The U.S. government agency in charge of improving the nation’s cybersecurity posture is ordering all federal civilian agencies to take new measures to restrict access to Internet-exposed networking equipment. The directive comes amid a surge in attacks targeting previously unknown vulnerabilities in widely used security and networking appliances. Continue reading CISA Order Highlights Persistent Risk at Network Edge→

Many Public Salesforce Sites are Leaking Private Data

Posted on by

A shocking number of organizations — including banks and healthcare providers — are leaking private and sensitive information from their public Salesforce Community websites, KrebsOnSecurity has learned. The data exposures all stem from a misconfiguration in Salesforce Community that allows an unauthenticated user to access records that should only be available after logging in. Continue reading Many Public Salesforce Sites are Leaking Private Data→

3CX Breach Was a Double Supply Chain Compromise

Posted on by

We learned some remarkable new details this week about the recent supply-chain attack on VoIP software provider 3CX, a complex, lengthy intrusion that has the makings of a cyberpunk spy novel: North Korean hackers using legions of fake executive accounts on LinkedIn to lure people into opening malware disguised as a job offer; malware targeting Mac and Linux users working at defense and cryptocurrency firms; and software supply-chain attacks nested within earlier supply chain attacks. Continue reading 3CX Breach Was a Double Supply Chain Compromise→

Microsoft (& Apple) Patch Tuesday, April 2023 Edition

Posted on by

Microsoft today released software updates to plug 100 security holes in its Windows operating systems and other software, including a zero-day vulnerability that is already being used in active attacks. Not to be outdone, Apple has released a set of important updates addressing two zero-day vulnerabilities that are being used to attack iPhones, iPads and Macs. Continue reading Microsoft (& Apple) Patch Tuesday, April 2023 Edition→

Microsoft Patch Tuesday, March 2023 Edition

Posted on by

Microsoft on Tuesday released updates to quash at least 74 security bugs in its Windows operating systems and software. Two of those flaws are already being actively attacked, including an especially severe weakness in Microsoft Outlook that can be exploited without any user interaction. Continue reading Microsoft Patch Tuesday, March 2023 Edition→

Highlights from the New U.S. Cybersecurity Strategy

Posted on by

The Biden administration today issued its vision for beefing up the nation’s collective cybersecurity posture, including calls for legislation establishing liability for software products and services that are sold with little regard for security. The White House’s new national cybersecurity strategy also envisions a more active role by cloud providers and the U.S. military in disrupting cybercriminal infrastructure, and names China as the single biggest cyber threat to U.S. interests. Continue reading Highlights from the New U.S. Cybersecurity Strategy→