Dark Reading Daily -- November 17, 2023

'CacheWarp' AMD VM Bug Opens the Door to Privilege Escalation

Academics in Germany figured out how to reverse time in AMD virtualization environments, then reap the spoils.

Dangerous Apache ActiveMQ Exploit Allows Stealthy EDR Bypass

There's no time to waste: For organizations on the fence about patching the critical bug in ActiveMQ, the new proof-of-concept exploit should push them towards action.

Unpatched Critical Vulnerabilities Open AI Models to Takeover

The security holes can allow server takeover, information theft, model poisoning, and more.

'Randstorm' Bug: Millions of Crypto Wallets Open to Theft

The security vulnerability in a component of a widely used JavaScript implementation of Bitcoin makes passwords guessable via brute-force attacks.

APTs Swarm Zimbra Zero-Day to Steal Government Info Worldwide

At least four separate campaigns against CVE-2023-37580 in the popular Zimbra Collaboration Suite aimed to siphon up reams of sensitive mail data.

Despite Hype, the Password-Free Workplace Is Still a Long Way Off

More than half of organizations are nowhere near ditching passwords, even as cyberattackers continue to have a field day with workers' poor credential choices.

Consumer Software Security Assessment: Should We Follow NHTSA's Lead?

Vehicles are required to meet basic safety standards. Having similar requirements for software would give consumers greater control over their privacy and security.

3 Ways Behavioral Economics Obstructs Cybersecurity

People are not robots; their decisions are based on emotion as much as data. Often, this can lead them to make mistakes with serious security implications for the business.

'AlphaLock' Hackers Launch 'Pen-Testing Training' Group

With a two-pronged approach, the group trains its hackers in penetration testing, only to set them free to build a marketplace for pen-testing services.

Defending Against Attacks on Vulnerable IoT Devices

Organizations must approach cybersecurity as if they are defending themselves in a cyberwar.

Microsoft Zero-Days Allow Defender Bypass, Privilege Escalation

Another two bugs in this month's set of fixes for 63 CVEs were publicly disclosed previously but have not been exploited yet.

SEC Suit Ushers in New Era of Cyber Enforcement

A federal push to enforce cybersecurity requirements is holding public companies and government contractors accountable as a matter of law and for national security.

Rackspace Ransomware Costs Soar to Nearly $12M

Rackspace's 2022 ransomware attack costs only continue to mount, with lawsuits in the offing — and show the long-tail costs of a cyberattack.

LATEST FROM THE EDGE

IT Pros Worry Generative AI Will Be a Major Driver of Cybersecurity Threats

Organizations are concerned about generative AI technologies as being a major driver of cybersecurity threats in 2024.

LATEST FROM DR TECHNOLOGY

Cybersecurity Investment Involves More Than Just Technology

Organizations are also looking at threat intelligence, risk assessment, cyber insurance, and third-party risk management.

LATEST FROM DR GLOBAL

FBI Warns: 5 Weeks In, Gaza Email Scams Still Thriving

Cybercriminals are playing both sides with simple disaster scams, and it's working.

Tips for a Streamlined Transition to Zero Trust