BuzzSec

Iranian state-sponsored actors are leaving no stone unturned to exploit unpatched systems running Log4j to target Israeli entities, indicating the vulnerability’s long tail for remediation. Microsoft attributed the latest set of activities to the umbrella threat group tracked as MuddyWater (aka Cobalt Ulster, Mercury, Seedworm, or Static Kitten), which is linked to the Iranian intelligence from The Hacker News https://thehackernews.com/2022/08/iranian-hackers-exploiting-unpatched.html

ORIGINALLY AIRED ON AUGUST 22, 2022 00:00 – PreShow Banter™ — Ralph’s Birthday00:53 – BHIS – Talkin’ Bout [infosec] News 2022-08-2203:27 – Story # 1: PC store told it can’t […] The post Talkin’ About Infosec News – 8/26/2022 appeared first on Black Hills Information Security . from Black Hills Information Security https://www.blackhillsinfosec.com/talkin-about-infosec-news-8-26-2022/

Lockbit is by far this summer’s most prolific ransomware group, trailed by two offshoots of the Conti group. from Threatpost https://threatpost.com/ransomware-attacks-are-on-the-rise/180481/

A growing number of regulations require organizations to report significant cybersecurity incidents. We've created a chart that summarizes 11 proposed and current cyber incident reporting regulations and breaks down their common elements, such as who must report, what cyber incidents must be reported, the deadline for reporting, and more. Download the chart now This chart is intended as an educational tool to enhance the security community’s awareness of upcoming public policy actions, and provide a big picture look at how the incident reporting regulatory environment is unfolding. Please note, this chart is not comprehensive (there are even more incident reporting regulations out there!) and is only current as of August 8, 2022. Many of the regulations are subject to change. This summary is for educational purposes only and nothing in this summary is intended as, or constitutes, legal advice. Peter Woolverton led the research and initial drafting of this chart. NEVER MI...

ARN just reported: "The metaverse is seen by many companies as a great business opportunity and for new ways of working. Security provider Trend Micro, however, warns in a recent  research  report that cyber criminals could misuse the technology for their own purposes. from KnowBe4 Security Awareness Training Blog https://blog.knowbe4.com/researchers-warn-of-darkverse-emerging-from-the-metaverse

I’ve been saying that complexity is the worst enemy of security for a long time now. ( Here’s me in 1999.) And it’s been true for a long time. In 2018, Thomas Dullin of Google’s Project Zero talked about “cheap complexity.” Andrew Appel summarizes : The anomaly of cheap complexity. For most of human history, a more complex device was more expensive to build than a simpler device. This is not the case in modern computing. It is often more cost-effective to take a very complicated device, and make it simulate simplicity, than to make a simpler device. This is because of economies of scale: complex general-purpose CPUs are cheap. On the other hand, custom-designed, simpler , application-specific devices, which could in principle be much more secure, are very expensive. This is driven by two fundamental principles in computing: Universal computation , meaning that any computer can simulate any other; and Moore’s law , predicting that each year the number of transistors on a chip wil...

Password management service LastPass confirmed a security incident that resulted in the theft of certain source code and technical information. The security breach is said to have occurred two weeks ago, targeting its development environment. No customer data or encrypted passwords were accessed. “An unauthorized party gained access to portions of the LastPass development from The Hacker News https://thehackernews.com/2022/08/hackers-breach-lastpass-developer.html