Gezielte Härtung der Endpunktsicherheit
@Bitdefender_DE #Cybersecurity #EndpunktSicherheit #ExposureManagement #ExtendedDetection #künstlicheIntelligenz #LOTL #MachineLearning @Bitdefender
https://netzpalaver.de/2025/04/24/gezielte-haertung-der-endpunktsicherheit/
Phishing-Angriffe zunehmend via Google-Drive
#Cybersecurity #Cybersicherheit #EMailSchutz #GoogleDrive #HumanRiskManagement @KnowBe4 #Phishing #SecurityAwareness #SocialEngineering
https://netzpalaver.de/2025/04/24/phishing-angriffe-zunehmend-via-google-drive/
So you like domain intel.
What if we presented 2024 findings and went deep into the analytical methods?
What if we provided some awesome scatterplots showing intel-relevant convergences?
What if I said....Shannon Entropy?
And if we gave you topic-based heatmaps?
Well, get in here, then. Our first annual Domain Intelligence Report is out.
Read: https://hackread.com/sessionshark-phishing-kit-bypass-mfa-steal-office-365-logins/
AI is rapidly changing cybersecurity. From data poisoning to deepfakes, new threats are emerging while old risks like breaches and resource hijacking get amplified.
Let's dive into my latest blog for a clear-eyed look at AI's security landscape. The future of defense starts now.
#AI #Cybersecurity
https://www.korte.co/kpbd
Whoa, that Commvault SSRF to RCE vulnerability is *ugly*! 
Here's the lowdown: An SSRF vulnerability in "deployWebpackage.do" isn't being filtered properly. What does that mean? Attackers can just upload a ZIP file containing a JSP payload, and *boom* – they get remote code execution. It's a stark reminder that backup systems, unfortunately, are often prime targets precisely because they get overlooked.
So, listen up: If you're running Commvault Command Center versions anywhere from 11.38.0 up to 11.38.19, you need to patch immediately. Get yourself onto version 11.38.20 or 11.38.25 right away! And while you're at it, take a good look at your configuration settings. Good news is, watchTowr Labs has put out a detection tool – definitely make use of that!
Just a friendly reminder on best practices, too: Your backup systems absolutely belong in their own, separate network segment. Crucially, regular penetration tests are a must; don't just rely on automated scans, they simply won't cut it for stuff like this. That's just how it is. 
How about you? Got Commvault deployed? Have you already checked your setup against this vulnerability? What kind of hardening measures do you have in place for your backup infrastructure? Drop your thoughts below! 
No need to hack when it’s leaking: Atrium Health edition:
https://databreaches.net/2025/04/24/no-need-to-hack-when-its-leaking-atrium-health-edition/
Informationssicherheitsbeauftragter (w/m/d) am Standort Stuttgart, unbefristet in Vollzeit, Entgeltgruppe 14 TV-L / Besoldungsgruppe A 14) | https://interamt.de/koop/app/trefferliste?1&behoerdenlink=http://www.landesarchiv-bw.de | https://bibliojobs.eu/stellenangebote/114010/
#bibliojobs
#A14 #absofort #CyberSecurity #E14 #höherertechnischerInformationsdienst #Informatik #Informationssicherheitsbeauftragter #ISB #IT-Sicherheit #Systemadministration #unbefristet #Vollzeit
Wow, it's kinda scary how hospitals have become such a prime target for cyberattacks lately! 
From my perspective as a pentester, I often see there's a *lot* of room for improvement in healthcare security. Things like legacy systems and wide-open ports? That's basically rolling out the welcome mat for attackers. 
So, what's your take? How secure do you feel your local healthcare facilities are? 
Massive number of SQL Injection Vulnerabilities reported Siemens TeleControl Server Basic
Siemens has disclosed 67 SQL injection vulnerabilities in their TeleControl Server Basic product affecting critical infrastructure sectors including Energy, Water, and Transportation Systems. Three of the flaws are critical and allowi unauthenticated attackers to bypass authorization controls and 64 high-severity issues that could enable database manipulation, denial-of-service conditions, and code execution with system permissions.
**If you are using TeleControl Server Basic, make sure it's isolated from the internet and accessible only from trusted networks. Restrict access to port 8000 only to trusted IP addresses, and plan a quick patch cycle. The list of vulnerabilities is huge, and any isolation will eventually be compromised through phishing, malware or a disgruntled employee. So patch your TeleControl.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/massive-number-of-sql-injection-vulnerabilities-reported-siemens-telecontrol-server-basic-h-1-y-e-y/gD2P6Ple2L
Insolvenz nach #Cyberangriff: Gerade im Mittelstand werden immer wieder Fälle bekannt, in denen erfolgreiche Cyberangriffe zur #Insolvenz des betroffenen Betriebs führen. Zumeist sind derartige Ereignisse nicht der einzige Auslöser für die wirtschaftliche Schieflage, verstärken jedoch durch den #Betriebsausfall bestehende Missstände:
"Ein schwerer Cyberangriff verschärfte die wirtschaftlich prekäre Lage."
https://www.t-online.de/finanzen/aktuelles/wirtschaft/id_100691634/eu-rec-recycling-firma-muss-nach-hacker-angriff-insolvenz-anmelden.html #cybersecurity #cybercrime
Multiple vulnerabilities reported in IBM Hardware Management Console
IBM has patched multiple security vulnerabilities in its Power Hardware Management Console (HMC), including a critical flaw (CVE-2025-1950, CVSS 9.3) that allows local users to execute commands with elevated privileges due to improper validation.
**First, make sure your IBM Hardware Management Console (HMC) is isolated and accessible only from trusted networks and trusted personnel. Also check whether you are running vulnerable versions (V10.2.1030.0 and V10.3.1050.0). If you are, plan a patch cycle, because any isolation will eventually be breached.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/multiple-vulnerabilities-reported-in-ibm-hardware-management-console-n-n-l-r-j/gD2P6Ple2L
Cars and Key Fobs: Attacks on Car Remotes
https://web.stanford.edu/class/ee26n/Assignments/Assignment5.html
ConfusedComposer vulnerability in reported in Google Cloud Composer tool
The "ConfusedComposer" vulnerability in Google Cloud Platform allows attackers to exploit a privilege escalation flaw by injecting malicious PyPI packages into Cloud Composer's custom-package configuration. This enables them to run arbitrary code that extracts and exfiltrates the highly privileged Cloud Build service account token. Google has fixed this vulnerability by modifying Cloud Composer to use a more restricted service account for PyPI module installations.
**You can't do much about this flaw, it was part of the GCP Cloud environment and it's fixed. Just be aware of these flaws to be better aware of the quality and patching discipline of your cloud providers.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/confusedcomposer-vulnerability-in-reported-in-google-cloud-composer-tool-o-4-f-t-c/gD2P6Ple2L
Onsite Mammography data breach exposes data of 357K individuals
A phishing attack on October 2, 2024 compromised an employee's email account at Onsite Mammography (operating as Onsite Women's Health), exposing sensitive data of 357,265 individuals. The healthcare provider has secured the affected account, engaged forensic investigators, notified law enforcement, and is offering affected individuals 12 months of complimentary credit monitoring and identity protection services.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/onsite-mammography-data-breach-exposes-data-of-357k-individuals-0-a-u-s-j/gD2P6Ple2L
We're thrilled to welcome Mario Kahlhofer to #Honeynet2025 in Prague to present Koney — a first-of-its-kind Kubernetes operator for cyber deception.
Malicious code injected Ripple's xrpl.js npm package, compromises cryptocurrency private keys
A supply chain attack has compromised multiple versions of the popular cryptocurrency JavaScript library xrpl.js (used for XRP Ledger blockchain interactions). Attackers have inserted malicious code that harvests and exfiltrates users' private keys to the domain "0x9c[.]xyz", allowing unauthorized access to cryptocurrency wallets and assets.
**If you are using xrpl.js, update it to versions 4.2.5 or 2.14.3 IMMEDIATELY. If you've used compromised versions (4.2.1-4.2.4 or 2.14.2) since April 21st, assume your keys may be compromised and transfer funds to new, secure wallets. And implement package verification signatures for external packages to reduce malicious code injection - it's not simple but it does help.**
#cybersecurity #infosec #advisory #databreach
https://beyondmachines.net/event_details/malicious-code-injected-ripple-s-xrpl-js-npm-package-compromises-cryptocurrency-private-keys-6-g-5-3-s/gD2P6Ple2L
Data of more than 2,000 SA patients hacked in ransomware attack
The personal data of more than 2,000 inpatients involved sleep studies at the Women's and Children's Hospital in Adelaide since 2018 has been accessed in a ransomware attack, with those affected being warned of identity theft risks.
https://www.abc.net.au/news/2025-04-24/sleep-study-patient-data-hack-sa-health-compumedics/105211278
Neue Folge! Wir haben mit Angela Sasse über #HumanCenteredSecurity gesprochen. Es geht um die Effektivität von Awareness Trainings, um den Trade-off zwischen Produktivität und #ITSicherheit und um Prozesse, die Mitarbeitenden sicheres Verhalten in Organisationen ermöglichen.
Hier und überall, wo es Podcasts gibt: https://www.sicherheitsluecke.fm
