Dark Reading Daily -- September 02, 2022

Code-Injection Bugs Bite Google, Apache Open Source GitHub Projects

The insecurities exist in CI/CD pipelines and can be used by attackers to subvert modern development and roll out malicious code at deployment.

Apple Quietly Releases Another Patch for Zero-Day RCE Bug

Apple continues a staged update process to address a WebKit vulnerability that allows attackers to craft malicious Web content to load malware on affected devices.

Threat Actor Phishing PyPI Users Identified

"JuiceLedger" has escalated a campaign to distribute its information stealer by now going after developers who published code on the widely used Python code repository.

Skyrocketing IoT Bug Disclosures Put Pressure on Security Teams

The expanding Internet of Things ecosystem is seeing a startling rate of vulnerability disclosures, leaving companies with a greater need for visibility into and patching of IoT devices.

Neopets Hackers Had Network Access for 18 Months

Neopets has confirmed that its IT systems were compromised from January 2021 through July 2022, exposing 69 million user accounts and source code.

Real-World Cloud Attacks: The True Tasks of Cloud Ransomware Mitigation

Cloud breaches are inevitable — and so is cloud ransomware. (Second of two parts.)

Phishing Campaign Targets PyPI Users to Distribute Malicious Code

The first-of-its-kind campaign threatens to remove code packages if developers don’t submit their code to a "validation" process.

The Inevitability of Cloud Breaches: Tales of Real-World Cloud Attacks

While cloud breaches are going to happen, that doesn't mean we can't do anything about them. By better understanding cloud attacks, organizations can better prepare for them. (First of two parts.)

Crypto-Crooks Spread Trojanized Google Translate App in Watering-Hole Attack

The ongoing campaign is spreading worldwide, using the lure of a fully functional Google Translate application for desktops that has helped the threat stay undetected for months.

Google Fixes 24 Vulnerabilities With New Chrome Update

But one issue that lets websites overwrite content on a user's system clipboard appears unfixed in the new Version 105 of Chrome.

LATEST FROM THE EDGE

Ghost Data Increases Enterprise Business Risk

IT has to get its hands around cloud data sprawl. Another area of focus should be on ghost data, as it expands the organization's cloud attack surface.

LATEST FROM DR TECHNOLOGY

New Guidelines Spell Out How to Test IoT Security Products

The proposed AMTSO guidelines offer a roadmap for comprehensive testing of IoT security products.

Ransomware Resilience and Response: The Next-Generation