A Forbes article is making the rounds right now about America’s most cyber-secure companies, and I can already see the cybersecurity outrage machine up in arms. Full confession: I haven’t yet read the article, but I’m about to. I’m writing this in two parts: before I read the article, and after I read the article.
Part I: What are the most cyber-secure companies?
If you ask me to list the most cyber-secure companies (what does that even mean?), here is my shortlist, in roughly the order I think of them:
A vulnerability have been discovered in ShareFile Storage Zones Controller which could allow for remote code execution. Storage Zones Controller extends the ShareFile Software as a Service (SaaS) cloud storage. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
A cybercriminal group calling itself Diicot is performing mass SSH brute-force scanning and deploying a variant of the Mirai IoT botnet on compromised devices, according to researchers. The group also deploys a cryptocurrency mining payload on servers with CPUs that have more than four cores.
“Although Diicot have traditionally been associated with cryptojacking campaigns, Cado Labs discovered evidence of the group deploying an off-the-shelf Mirai-based botnet agent, named Cayosin,” researchers from Cado Security said in an analysis of the group’s recent and ongoing attack campaign. “Deployment of this agent was targeted at routers running the Linux-based embedded devices operating system, OpenWrt.”
It was discovered that in SVG++ library that the demo application incorrectly
managed memory resulting in a memory access violation
under certain circumstances. An attacker could possibly use this issue
to leak memory information or run a denial of service attack.
This issue only affected Ubuntu 18.04 LTS. (CVE-2019-6246)
It was discovered that in SVG++ library that the demo application
incorrectly handled null pointers under certain circumstances.
An attacker could possibly use this issue to cause
denial of service, leak memory information or manipulate
program execution flow. (CVE-2021-44960)
Trend Micro has announced the integration of generative AI into its flagship Vision One platform with the new AI tool, Companion. Companion uses advanced AI/machine learning analytics and correlated detection models to enhance extended detection and response (XDR) capabilities, according to the cybersecurity vendor. It has been designed to amplify security operations, improve accessibility and efficiency, and quicken threat hunting speeds for analysts of varying skill levels, Trend Micro claimed in a press release. The release marks the initial phase of a multi-quarter rollout of AI and large language model (LLM) capabilities embedded within Vision One, it added.
Team Cymru has launched Pure Signal Scout, an external threat-hunting and malicious infrastructure analysis tool to “level up” security operations centers (SOCs). Under the promise of being the “fastest” tool available for threat insights, Pure Signal Scout is expected to save analysts’ time by providing fast answers to complex queries.
“We are now achieving in one working day what used to take several,” Josh Picolet, team leader of Team Cymru’s S2 Threat Research, said in a statement. This includes determining if an IP is important to a threat investigation. Another point factoring in the speed of response is that Scout is cloud-based and designed to eliminate the need to deploy multiple data services and solutions. It also eliminates the need to create custom scripts to combine disparate threat feeds and data sources.
In the latest cyber incident affecting the US federal government, two arms of the US Department of Energy (DOE) and, according to press reports, the US Department of Agriculture and the Office of Personnel Management, have been swept up in a sprawling spree of attacks by the Russia-based Clop ransomware gang.
USN-6083-1 fixed a vulnerability in cups-filters. This update provides
the corresponding update for Ubuntu 16.04 LTS.
Original advisory details:
It was discovered that cups-filters incorrectly handled the beh CUPS
backend. A remote attacker could possibly use this issue to cause the
backend to stop responding or to execute arbitrary code.
