A timely warning to keep systems patched has appeared, via a jointly-released report from Onapsis and SAP. The report details how threat actors are “targeting and potentially exploiting unprotected mission-critical SAP applications”. Some of the vulnerabilities used were weaponised fewer than 72 hours after patches are released. In some cases, a newly deployed SAP instance could be compromised in … [Read more...]
April 7, 2021
February 15, 2021
Talking Emotet’s takedown with Adam Kujawa: Lock and Code S02E01
This week on Lock and Code, we discuss the top security headlines generated right here on Labs and around the Internet. In addition, we talk to Adam Kujawa, security evangelist and director of Malwarebytes Labs, about Emotet, the former public enemy No. 1 in the cybercrime world. What began in 2014 as a simple banking Trojan evolved into one of the most sophisticated malware types in the … [Read more...]
February 10, 2021
February 2021 Patch Tuesday Roundup
After a many-months hiatus, we’re back with the monthly summary of security updates released by Microsoft for its array of consumer and enterprise products. The world has changed since my last post on this topic almost a year ago, but if anything, computers and the Internet have become even more important parts of our lives. […] The post February 2021 Patch Tuesday Roundup first appeared on … [Read more...]
August 17, 2020
May 13, 2020
How CVSS works: characterizing and scoring vulnerabilities
The Common Vulnerability Scoring System (CVSS) provides software developers, testers, and security and IT professionals with a standardized process for assessing vulnerabilities. You can use the CVSS to assess the threat level of each vulnerability, and then prioritize mitigation accordingly. This article explains how the CVSS works, including a review of its components, and describes the … [Read more...]
February 25, 2020
Biotech health care innovations meet security challenges
The level and speed of innovations taking place in the biotech industry are baffling. On the one hand, it makes us hopeful we can quickly reduce the number of illnesses and their consequences through technological advancement—saving thousands of lives. On the other, concerns about the application of Internet-connected technology leave us wondering: at what cost? Where does the mix of technology … [Read more...]
October 21, 2019
A week in security (October 14 – 20)
Last week on Malwarebytes Labs, we tried to unlock the future of the password (its vulnerabilities, current alternatives, and possible future disappearance), analyzed the lagging response by many businesses in adopting a patch for Pulse VPN vulnerability, looked at Instagram’s bulked-up security against phishing emails scams, and were reminded that ransomware remains a dominant threat facing … [Read more...]
October 18, 2019
Pulse VPN patched their vulnerability, but businesses are trailing behind
In April 2019, Pulse Secure published an advisory about a vulnerability in their software. In August, cybercriminals were massively scanning for systems that were running a vulnerable version. Now it’s October, and still many organizations have not applied the patches that are available for this vulnerability. This is a trend we’ve seen repeated with dozens of other publicly-known … [Read more...]
September 24, 2019
15,000 webcams vulnerable to attack: how to protect against webcam hacking
Webcams may have been around for a long time, but that doesn’t mean we know what we’re doing with them. Webcam hacking has been around for equally as long, yet new research from Wizcase indicates that more than 15,000 private, web-connected cameras are exposed and readily accessible to the general public. So forget hacking, cybercriminals can just take a stroll through the Internet and grab … [Read more...]
September 13, 2019
Hacking with AWS: incorporating leaky buckets into your OSINT workflow
Penetration testing is often conducted by security researchers to help organizations identify holes in their security and fix them, before cybercriminals have the chance. While there’s no malicious intent for the researcher, part of his job is to think and act like a cybercriminal would when hacking, or attempting to breach, an enterprise network. Therefore, in this article, I will review … [Read more...]
