A proof of concept (PoC) script was released exploiting a critical vulnerability in the latest version of Windows 10 and Windows Server additions. The vulnerability, tracked as CVE-2021-31166 was found in the HTTP Protocol Stack (HTTP.sys), used by the Windows Information (IIS) webserver. The Windows HTTP vulnerability has wormable properties, meaning it is self-propagating, unlike […]
13
May
May
Are your IoT devices secure? Internet of things (IoT) devices have seen year on year increases in business and personal use because they are usually beneficial in being convenient and easy to use. IoT devices are used for various purposes, from making smart homes to implementing a business’s security system. As with all internet connected […]
11
May
May
Cyber security firm, Onapsis, has warned of 6 critical vulnerabilities being actively exploited in the wild. The researchers recorded more than 300 successful attacks between mid-2020 and April 2021. SAP systems are used by many organisations for managing critical business processes, including product life-cycle management, customer relationship management, enterprise resource planning and supply chain management. […]
05
May
May
Older Dell users should be aware of a vulnerable driver that has been pushed out to consumer and enterprise computers for the last 12 years. The multiple vulnerabilities could lead to privilege escalation. Millions of Dell desktops, laptops and tablets received the vulnerable driver through BIOS updates. The 5 vulnerabilities tracked as CVE-2021-21551 discovered in […]
28
Apr
Apr
A currently unidentified threat actor has compromised the update mechanism of Passwordstate, a password manager application primarily catering to enterprise customers, and has deployed malware on its user’s devices. Click Studios, the firm behind Passwordstate, has notified 29,000 customers via email, according to communications obtained by a Polish tech news site. The malware was live […]
21
Apr
Apr
Let us begin by describing how to approach Cyber Supply Chain Risk Management (C-SCRM) and the risks your vendors pose to you. Then we will discuss if you should require them to show evidence that penetration testing was conducted and what remediations were taken. C-SCRM in a nutshell For simplicity let us split suppliers into […]
20
Apr
Apr
An ongoing “malvertising” campaign dubbed “Tag Barnakle” was identified as the breach point of more than 120 Advertisement servers over the past year. The threat actors aim to inject code to host Adware that redirects users to domains under threat actors’ control, exposing them to more malware. The adversaries behind the Tag Barnakle campaign are […]
14
Apr
Apr
What is a SOC? The difference between SOC 1, 2 and 3 is quite important assuming that you know what SOC is. Most people will have heard of a SOC audit report, but for those who do not understand what SOC stands for, let us start from the beginning. SOC is the acronym for System […]
07
Apr
Apr
additionally, Last update: 25 January 2022 Web applications are an essential component of any modern business. They can help convey the company vision, advertise services and deliver content to customers. Regardless of their use, they are a necessity to make oneself or a business known to the world. However, as beneficial as they can be […]
07
Apr
Apr
APT’s exploit Fortinet FortiOS vulnerabilities to compromise systems belonging to government and commercial entities, warn US agencies. Threat actors are scanning for three high severity vulnerabilities that have not been patched. CVE-2018-13379, CVE-2020-12812 and, CVE-2019-5591 are actively being exploited. Each of these vulnerabilities is public and the vendor issued patches, but unless IT administrators apply […]