C410 A2BE CB73 EF77 746E 9682 E2C4 91CE D20D 800F
- Patch
- Defend
- Attacks / Breaches
- Other news
- Vulnerabilities
- Crying Wolf
- Policy
- Ransomware
- SolarWinds Things
- Breaches and Bugs
- 2020 InfoSec in Review
- SolarWinds Orion updates
- Education sector
- Learning
- Operational network security – training sessions Aug 2020 to Feb 2021 (new DNS security modules added) [GÉANT / DFN / DFN-CERT]
- Web application security
- General interest
- #LocalLeaks (ie Do we still have such a thing as personal information in SA?)
-
SABC confirms that its website was hacked [Jamie McKane, MyBroadband]
- Why email security matters
-
Phishing campaign spoofs Microsoft domain. Is lack of DMARC enforcement to blame? [Bradley Barth, SC Magazine]
-
How DMARC Can Stop Criminals Sending Fake Emails on Behalf of Your Domain [The Hacker News]
- US CERT Advisories
- It is very advisable to add Alerts and Tips > Current Activity to your RSS feed
-
Apache Releases Security Advisory for Apache Tomcat [US CERT]
-
Microsoft Releases December 2020 Security Updates [US CERT]
-
SAP Releases December 2020 Security Updates [US CERT]
-
OpenSSL Releases Security Update [US CERT]
-
Theft of FireEye Red Team Tools [US CERT]
-
NSA Releases Advisory on Malicious Cyber Actors Exploiting CVE-2020-4006 [US CERT]
- Bugs, bugs everywhere (insert Buzz Lightyear meme…)
-
NSA: Hackers exploit new VMware vulnerability to steal data [Sergui Gatlan, Bleeping Computer]
-
The patch that wasn’t: Cisco emits fresh fixes for NTLM hash-spilling vuln and XSS-RCE combo in Jabber app [Gareth Corfield, The Register]
-
Cisco fixes Security Manager vulnerabilities with public exploits [Sergiu Gatlan, Bleeping Computer]
-
4 major browsers are getting hit in widespread malware attacks [Dan Goodin, Ars Technica]
-
High-Severity Chrome Bugs Allow Browser Hacks [Tom Spring, Threat Post]
- New things in ransomware
-
Hackers are selling more than 85,000 MySQL databases on a dark web portal [Catalin Cimpanu, ZDNet]
-
Ransomware gangs are now cold-calling victims if they restore from backups without paying [Catalin Cimpanu, ZDNet]
-
RansomExx Ransomware Gang Dumps Stolen Embraer Data: Report [Elizabeth Montalbano, Threat Post]
- Farewell Flash
-
Adobe just released the last Flash update ever [Adi Robertson, The Verge]
- But do not despair, you can still get some Alien Homonid, Yeti Sports, and Strong Bad at The Internet Archive Do not click, time wasters…
-
ABSA Data Leak
-
Absa bank embroiled in data leak, rogue employee accused of theft [Charlie Osborne, ZDNet]
-
Absa data leak update: ID numbers, vehicle details among stolen info [Business Insider]
-
Details about person behind Absa data breach emerge [MyBroadband]
- Cybercrimess Bill Passed
-
Parliament passes Cybercrimes Bill [MyBroadband via BusinessTech]
- Exploitable Vulnerabilities
-
iPhone zero-click Wi-Fi exploit is one of the most breathtaking hacks ever [Dan Goodin, Ars Technica]
-
FortiNet: Update Regarding CVE-2018-13379 [Carl Windsor, Fortinet]
-
Multiple Botnets Exploiting Critical Oracle WebLogic Bug — PATCH NOW [Ravie Lakshmanan, The Hacker News]
-
VMWare VMSA-2020-0027.2 Update [VMWare]
-
Multiple vulnerabilities in WebKit [Jon Munshaw, Talos Intelligence]
- Education and Academia
-
Ransomware halts classes for 115,000 Baltimore pupils [BBC News]
-
University of Vermont Medical Center has yet to fully recover from October cyber attack [Pierluigi Paganini, Security Affairs]
-
Alabama school district shut down by ransomware attack [Lawrence Abrams, Bleeping Computer]
- Hacker Techniques
-
How attackers exploit Window Active Directory and Group Policy [Susan Bradley, CSO Online]
- Container Security
-
A scan of 4 Million Docker images reveals 51% have critical flaws [Perluigi Paganini, Security Affairs]
-
Half of all Docker Hub images have at least one critical vulnerability [Lucian Constantin, CSO Online]
-
Misconfigured Docker Servers Under Attack by Xanthe Malware [Lindsey O’Donnell, Threat Post]
- Governance and the Year in Review
-
Notable Enhancements to the New Version of NIST SP 800-53 [Steven Tipton, Tripwire]
-
The NCSC Annual Review 2020 [NCSC]
-
The biggest hacks, data breaches of 2020 [Charlie Osborne, ZDNet]
- Higher Education
- Budget
- Social Engineering / Awareness
- Smart cars / IOT
- Webinars and trainings
- Advisories / Vulnerabilities
- DDoS Mitigation
- General
- Patch EveryDay
-
Intel fixes 95 vulnerabilities in November 2020 Platform Update [BleepingComputer, Sergiu Gatlan]
-
Microsoft Exchange Server ExportExchangeCertificate WriteCertiricate File Write Remote Code Execution Vulnerability [SourceIncite]
-
Office November security updates fix remote code execution bugs [BleepingComputer, Sergiu Gatlan]
-
Remote kernel heap overflow in NFSv3 Windows Server [McAfee, Eoin Carroll and Steve Povolny]
-
Microsoft Security Update Guide [Microsoft]
-
Changes to Microsoft Security Bulletins [TripWire, Tyler Reguly]
- Attacks
-
DNS cache poisoning, the Internet attack from 2008, is back from the dead [Ars Technica, Dan Goodin]
-
How to get root on Ubuntu 20.04 by pretending nobody’s /home [Kevin Backhouse]
- Academia and Research
-
Cyberattack on University of Vermont hospital IT network [CyberScoop, Sean Lyngaas]
-
Price Dropped on Hacked Educational RDP Details [InfoSecurity Magazine, Dan Raywood]
-
Open University Targeted With Over a Million Malicious Email Attacks So Far This Year [InfoSecurity Magazine, James Coker]
-
European weather services hit by storm of malicious email attacks [NewScientist, Adam Vaughan]
- Sad News about the Arecibo Observatory
-
Second Cable Fails at Arecibo Observatory – Massive Radio Telescope Used in the Search for Alien Life [SciTechDaily]
- Vulnerabilities
- Academic and Education Sector
- Botnet News
- Ransomware News
- Awareness and Conferences
-
ENISA Threat Landscape 2020: Cyber Attacks Becoming More Sophisticated, Targeted, Widespread and Undetected [ENISA]
-
Privacy nightmare for Toledo Public Schools: Hackers dumped student and employee data [DISSENT]
-
Where Do Security Awareness Programs Belong on the Org Chart? [Tonia Dudley, Cofense]
-
4 Tips For Protecting Intellectual Property In Academia [Mike Chapple, EdTech / CDW]
-
Hacking Incident Has an Unusual Ending [Marianne Kolbasuk McGee, HealthcareInfoSecurity / ISMG]
- see also: Ransomware gang donates part of ransom demands to charity organizations
-
Quarterly Update: Ransomware Trends in Q3 [Jamie Hart, Digital Shadows]
-
Cisco warns of attacks targeting high severity router vulnerability [Sergiu Gatlan, Bleeping Computer]
- VMware Security Advisories
-
Government will force ISPs to crack down on piracy in South Africa [Jan Vermeulen, MyBroadband]
-
Vodacom and MTN have not notified Information Regulator of location data breach [Jan Vermeulen, MyBroadband]
-
What is confidential computing? How can you use it? [Mirko Zorz, Help Net Security]
-
Hackers hijack Telegram, email accounts in SS7 mobile attack [Ionut Ilascu, Bleeping Computer]
-
Popular Mobile Browsers Found Vulnerable To Address Bar Spoofing Attacks [Ravie Lakshmanan, The Hacker News]
-
Robot’s parents very proud of her for finally passing CAPTCHA test [Mary Gillis, The Beaverton]