All the latest news on Cybersecurity

This week in cybersecurity from the editors at Cybercrime Magazine – Listen to the Cybercrime Magazine Podcast Interview Sausalito, Calif. – May 8, 2024 The chief information security officer (CISO) role dates back to 1994, when financial services giant Citigroup (then Citicorp, ranked 17th on the The post Backstory Of The World’s Second CISO appeared first on Cybercrime Magazine.

Hackers exploit the weaponized shortcut files due to their ability to execute malicious code without knowing the user being targeted. Shortcut files are generally well-known and widely used, and due to this, they provide a good platform for deploying malware. The use of these harmless shortcuts is one of the best ways for hackers to […] The post Hackers Using Weaponized Shortcut Files To Deploy CHM Malware appeared first on Cyber Security News.

Deploy CHM Shortcut Files Weaponized Shortcut

A new group known as MorLock ransomware has intensified its attacks on Russian businesses, causing disruptions and financial losses. This group, first identified at the beginning of 2024, has already compromised nine medium to large Russian companies. The Rise of Morlock Morlock has quickly become one of the most active cyber gangs targeting Russian entities. […] The post MorLock Ransomware Attacking Organizations to Steal Business Data appeared first on Cyber Security News.

MorLock Ransomware Steal Business

Description Presented at CODE BLUE 2023, this project titled Enhanced Vulnerability Hunting in WDM Drivers with Symbolic Execution and Taint Analysis introduces IOCTLance, a tool that enhances its capacity to detect various vulnerability types in Windows Driver Model (WDM) drivers. In a comprehensive evaluation involving 104 known vulnerable WDM drivers and 328 unknow n ones, IOCTLance successfully unveiled 117 previously unidentified vulnerabilities within 26 distinct drivers. As a result, 41 CVEs were reported, encompassing 25 cases of denial of service, 5 instances of insufficient access control, and 11 examples of elevation of privilege. Features Target Vulnerability Types map physical memory controllable process handle buffer overflow null pointer dereference read/write controllable address arbitrary shellcode execution arbitrary wrmsr arbitrary out dangerous file operation Optional Customizations length limit loop bound total timeout IoControlCode timeout recursion symbolize data section Build Docker (Recommand) docker build . Local dpkg --add-architecture i386apt-get updateapt-get install git build-essential python3 python3-pip python3-dev htop vim sudo openjdk-8-jdk zlib1g:i386 libtinfo5:i386 libstdc++6:i386 libgcc1:i386 libc6:i386 libssl-dev nasm binutils-multiarch qtdeclarative5-dev libpixman-1-dev libglib2.0-dev debian-archive-keyring debootstrap libtool libreadline-dev cmake libffi-dev libxslt1-dev libxml2-devpip install angr==9.2.18 ipython==8.5.0 ipdb==0.13.9 Analysis # python3 analysis/ioctlance.py -husage: ioctlance.py [-h] [-i IOCTLCODE] [-T TOTAL_TIMEOUT] [-t TIMEOUT] [-l LENGTH] [-b BOUND] [-g GLOBAL_VAR] [-a ADDRESS] [-e EXCLUDE] [-o] [-r] [-c] [-d] pathpositional arguments: path dir (including subdirectory) or file path to the driver(s) to analyzeoptional arguments: -h, --help show this help message and exit -i IOCTLCODE, --ioctlcode IOCTLCODE analyze specified IoControlCode (e.g. 22201c) -T TOTAL_TIMEOUT, --total_timeout TOTAL_TIMEOUT total timeout for the whole symbolic execution (default 1200, 0 to unlimited) -t TIMEOUT, --timeout TIMEOUT timeout for analyze each IoControlCode (default 40, 0 to unlimited) -l LENGTH, --length LENGTH the limit of number of instructions for technique L engthLimiter (default 0, 0 to unlimited) -b BOUND, --bound BOUND the bound for technique LoopSeer (default 0, 0 to unlimited) -g GLOBAL_VAR, --global_var GLOBAL_VAR symbolize how many bytes in .data section (default 0 hex) -a ADDRESS, --address ADDRESS address of ioctl handler to directly start hunting with blank state (e.g. 140005c20) -e EXCLUDE, --exclude EXCLUDE exclude function address split with , (e.g. 140005c20,140006c20) -o, --overwrite overwrite x.sys.json if x.sys has been analyzed (default False) -r, --recursion do not kill state if detecting recursion (default False) -c, --complete get complete base state (default False) -d, --debug print debug info while analyzing (default False) Evaluation # python3 evaluation/statistics.py -husage: statistics.py [-h] [-w] pathpositional arguments: path target dir or file pathoptional arguments: -h, --help show this help message and exit -w, --wdm copy the wdm drivers into <path>/wdm Test Compile the testing examples in test to generate testing driver files. Run IOCTLance against the drvier files. Reference ucsb-seclab/popkorn-artifact eclypsium/Screwed-Drivers koutto/ioctlbf Living Off The Land Drivers Download Ioctlance

CODE BLUE default False Enhanced Vulnerability titled Enhanced WDM Drivers

Threat actors are exploiting a high-severity vulnerability in the LiteSpeed Cache plugin for WordPress to take over web sites. WPScan researchers reported that threat actors are exploiting a high-severity vulnerability in LiteSpeed Cache plugin for WordPress. LiteSpeed Cache for WordPress (LSCWP) is an all-in-one site acceleration plugin, featuring an exclusive server-level cache and a collection […]

Cache WordPress

The University System of Georgia (USG) announced that the confidential information of approximately 800,000 students, faculty, and staff was exposed in the recent MOVEit data breach. The breach occurred due to a vulnerability in the MOVEit Secure File Transfer software used by USG and hundreds of other organizations to store and transfer sensitive data. In […] The post University System of Georgia Says 800,000 Students Impacted in MOVEit Hack appeared first on Cyber Security News.

Students Students Impacted

The City of Wichita, Kansas, experienced a disruption when it fell victim to a ransomware attack. This cyber assault encrypted data across various city systems, prompting officials to shut down the affected networks as a containment measure. The attack has impacted several city services, causing inconvenience to the residents and raising concerns about data security. […] The post City of Wichita Ransomware Attack: Services Impacted appeared first on Cyber Security News.

Services Impacted Wichita Ransomware

Kaisen Linux is a distribution dedicated for IT professional based on Debian GNU/Linux. Large tools are integrated for diagnostics, rescue system and networks, lab creation and many more!

Today, Nineteen Group has announced the opening of registration for the highly anticipated International Cyber Expo (ICE) 2024. Set against the iconic Olympia London on September 24th and 25th, ICE 2024 promises to be an unparalleled convergence of the brightest minds and ground-breaking innovations in cybersecurity. Featuring over 150 leading cyber suppliers and welcoming 6,500+ […] The post Registration Opens for International Cyber Expo 2024: Where Cyber Leaders Converge to Shape Tomorrow's Defences first appeared on IT Security Guru. The post Registration Opens for International Cyber Expo 2024: Where Cyber Leaders Converge to Shape Tomorrow’s Defences appeared first on IT Security Guru.

Leaders Converge Shape Tomorrow

This week, Salt Security, a frontrunner in API security, have unveiled its groundbreaking API Security Protection Platform. This platform, powered by Pepper, Salt’s own Large Language Model (LLM) AI, represents a leap forward in API protection. By integrating AI across the entire API lifecycle, it simplifies and strengthens API discovery, posture management, and threat detection, […] The post Salt Security Unveils First AI-Infused API Security Platform to Address Proliferation of GenAI Application Development first appeared on IT Security Guru. The post Salt Security Unveils First AI-Infused API Security Platform to Address Proliferation of GenAI Application Development appeared first on IT Security Guru.

Address Proliferation

WordPress plugins make WordPress more useful, but most have flaws that hackers may try to exploit to get unauthorized entry or introduce malicious code. The popularity and widespread use of common plugins make them an easier target for attackers. Similarly, out-of-date or neglected plugins with unfixed vulnerabilities tend to offer vulnerable entry points that even […] The post Hackers Exploit Litespeed Plugin Flaw To Create Rogue Admin Accounts appeared first on Cyber Security News.

Create Rogue Exploit Litespeed Litespeed Plugin

As Anti-Ransomware Day approaches, Kaspersky shares insights into the ransomware threat landscape and trends in 2023, and recent anti-ransomware activities by governments and law enforcement.

Day approaches