 According to a new report, Shopify has vulnerable password protection measures. Researchers claim that hundreds of millions of passwords that were breached contain the same pattern as the ones used by Shopify users. More: - This company claims that Shopify requires that a password must be a least five characters and can't begin or end with a space.
- While the breached passwords do not belong to Shopify's users, the fact that almost 1 billion hacked passwords share the same pattern is enough for researchers to consider the practice unsafe.
- The e-commerce company also allows users to include the word Shopify in their passwords, resulting in a higher probability of being breached.
- The report was published by Specops.
| |
 Microsoft has warned of possible cyberattacks from a subgroup of the Iranian hacker group Phosphorous. The company is tracking the threat actor as DEV-0270. More: - The threat actor is presenting itself as Secnerd and Lifeweb.
- In the statement, Microsoft claims that the group is using off-the-land binaries as a precursor for BitLocker, a ransomware tool that enables them to deploy malware.
- Once the victim is breached, the timeline between the data extraction and the ransom note is two days.
- The group used a vulnerability tracked as CVE-2018-13379. The threat actor then used commands to discover domain control, gain access to log-in credentials, use unauthorized privileges, etc.
- Microsoft has recommended that organizations update to patch the following flaws:
- CVE-2021-26855,
- CVE-2021-26858,
- CVE-2021-26857, and
- CVE-2021-27065.
| |
 A message from SECURITY COMPASS This is your show developers! Come and interact with our panel through questions or advice on how we can all improve developer-centric threat modeling. What to expect: Earlier this year, Security Compass ran a survey that probed the mind of developers. During this webinar, we'll be discussing our findings with security experts who live in the developer and threat modeling space. What you will learn: - The connection between developer user stories or requirements, coding, and threat modeling.
- How to keep up with the ongoing discovery of software weaknesses.
- Practical advice for developers is to stay current on threat modeling practices.
When: September 14, 2022, at 11am EST Whether you are a developer, lead, architect, or thread modeler, this webinar will leave you with something to think about. Register Here
| |
 Chinese hackers are targeting government officials around the world. The threat actors are deploying malware tracked as PlugX. More: - The hacking campaign is being carried out by Bronze President, a China-based threat actor that is using its own tools as well as open-source technology. The hacker group is also known as HoneyMyte, Mustang Panda, Red Lich, and Temp.Hex.
- Bronze President is known for using RAT malware to infect its victims.
- The group uses an infected file masking as a normal PDF document to breach its targets. After the file's persistence is completed, the group uses its remote access control for cyberespionage.
Zoom Out: - Only a few weeks ago, the threat actor targeted the Russian government with a PlugX variant. The same variant was used to cyberattack officials in Asia, the EU, and the U.S.
| |
 Cisco has released new security patches that address flaws in numerous devices. The flaws included a bug with an 8.6 CVSS score. More: - The main bug patched, CVE-2022-28199, enabled the hackers to launch a DoS attack.
- DoS, short for Denial-of-Service, is a cyberattack that is meant to leave a server unable to complete its digital follow-up by overflowing it with traffic. Hackers also use other methods, such as sending false signals that are never completed, rendering the server useless.
- Another flaw that was patched is CVE-2022-20696. This bug has a CVSS score of 7.5 and allowed hackers to view messages sent to the system, enabling them to override that system.
- Two other flaws addressed by the company are CVE-2022-20863, with a CVSS score of 4.3, and CVE-2022-20923, with a CVSS score of 4.0. The latter is not going to be updated by Cisco since it affects devices that are no longer meant to be used by its clients.
| |
 A message from SECURITY COMPASS Current approaches to software threat modeling simply don’t work. They are manual, inconsistent, take too long, don’t scale, and don’t give developers what they need. When software security and compliance are considered more as an afterthought, rather than a vital step in the development process, organizations end up trying to remediate security and compliance issues after software has been written, rather than preventing issues in the first place. Here you can find a series of posts breaking down how you can anticipate threats earlier in the software development life cycle to create more secure and compliant software. Empower DevSecOps teams to make software secure and compliant by: - Design through automating threat modeling
- Generating application security requirements
- Providing secure development
- Compliance best practices
The SD Elements platform is the best solution for organizations who: - Need to scalably model software threats
- Identify countermeasures
- Deliver secure and compliant code quickly.
Learn How
| |
 HP has fixed a bug that affected the Support Assistant tool in HP devices. The tool is used to diagnose and troubleshoot problems. More: - The flaw is being tracked as CVE-2022-38395 and has a CVSS score of 8.2.
- Hackers could have taken control over devices remotely by exploiting the flaw with a DLL attack.
- The company did not offer more details on whether the flaw had been exploited, but it recommended its users update their devices as soon as possible. The systems that need to be updated are:
- HP Support Assistant versions earlier than 9.11., and
- Fusion versions earlier than 1.38.2601.0.
Zoom Out: - Multiple HP Support Assistant flaws had been tracked two years ago, as HP struggled to patch the bugs for a long period.
| |
Quick Hits: - Origin Investments’ IncomePlus Fund has seen its 27th consecutive month of positive returns, generating 18.7% over the past 12 months.*
- Researchers believe that the APT TA423 hacker group is carrying out a hacking campaign, attempting to plant the ScanBox tool.
- Hackers have breached over 2.5 million records belonging to students who pay loans on their tuition fees. The data was stolen from the Oklahoma Student Loan Authority.
- 0ktapus hacker group is believed to be behind a hacking campaign that has affected over 9,000 accounts that are administered by over 130 organizations across different states.
- The Mirai malware variant known as MooBot has been tracked. The variant is being used to exploit multiple flaws in D-Link devices.
*This is sponsored content.
| |
Upcoming events at Inside: - September 09 - AMA with Jay Ryan (U.S. Federal Government Program Manager at Security Compass) (Register Here)
- September 14 - What Do Developers Think of Threat Modeling? (feat. security experts from Security Compass, Dell, and Tricentis) (Register Here) *
- September 14 - AMA with Brian Dean (Founder of Backlinko) (Register Here)
- September 21 - AMA with Kristen Ruby (Founder of Ruby Media Group) (Register Here)
- September 28 - AMA with Leigh-Ann Buchanan (Founder of aīre ventures) (Register Here)
- October 05 - AMA with Ram Bartov (Chief Accounting Officer at TripActions)* (Register Here)
- October 12 - AMA with Bill Glenn (Executive Chairman at Crenshaw Associates) (Register Here)
- October 19 - AMA with Zecca Lehn (Responsibly VC) (Register Here)
- October 25 - Meet Our Fund 4, an Inside.com Summit (Register Here)
*This is a sponsored listing.
| |
 |  | Arbër is an Inside writer who also has experience in entrepreneurship. He has experience covering Consumer Tech, Venture Capital, NFTs, Crypto, etc. Arbër holds a Bachelor's degree in Business from XAMK University in Finland. When he is not reading(and writing) business news, he chooses to watch sports or anime...and then read news about sports or anime. |   | | Editor | Aaron Crutchfield is based in the high desert of California. Over the last two decades, he has spent time writing and editing at various local newspapers and defense contractors in California. When he's not working, he can often be found looking at the latest memes with his kids or working on his 1962 and 1972 Fords. | |
Register to learn What Do Developers Think of Threat Modeling? | |
Security Compass is on a mission to accelerate software time-to-market while managing risk. | |
