Dark Reading Daily -- August 05, 2022

Cyberattackers Increasingly Target Cloud IAM as a Weak Link

At Black Hat USA, Igal Gofman plans to address how machine identities in the cloud and the explosion of SaaS apps are creating risks for IAM, amid escalating attention from attackers.

Massive China-Linked Disinformation Campaign Taps PR Firm for Help

A global network of inauthentic news sites present themselves as independent news outlets, offering content favoring China's government and articles critical of the US.

35K Malicious Code Insertions in GitHub: Attack or Bug-Bounty Effort?

In the last month, "Pl0xP" cloned several GitHub repositories, adding malicious code to the forks that would attempt to infect developer systems and steal sensitive files that included software keys.

High-Severity Bug in Kaspersky VPN Client Opens Door to PC Takeover

The CVE-2022-27535 local privilege-escalation security vulnerability in the security software threatens remote and work-from-home users.

Time to Patch VMware Products Against a Critical New Vulnerability

A dangerous VMware authentication-bypass bug could give threat actors administrative access over virtual machines.

The Myth of Protection Online — and What Comes Next

It's a myth that consuming and processing alerts qualifies as security. Today's technology allows better detection and prevention, rather than accepting the low bar for protection set by ingrained incident response reactions.

Ping Identity to Go Private After $2.8B Acquisition

The identity-services company is being acquired by Thoma Bravo software investment for cash, before being delisted.

5 Ways Chess Can Inspire Strategic Cybersecurity Thinking

Rising interest in chess may feed the next generation of cybersecurity experts.

School Kid Uploads Ransomware Scripts to PyPI Repository as 'Fun' Project

The malware packages had names that were common typosquats of a legitimate widely used Python library. One was downloaded hundreds of times.

Thousands of Mobile Apps Leaking Twitter API Keys

New finding comes amid report of overall surge in threats targeting mobile and IoT devices over the past year.

Massive New Phishing Campaign Targets Microsoft Email Service Users

The campaign uses adversary-in-the-middle techniques to bypass multifactor authentication, evade detection.

LATEST FROM THE EDGE

Understanding Proposed SEC Rules Through an ESG Lens

Cyber threats are putting environmental, social, and governance discussions at the forefront of board meetings and C-suite discussions around the globe.

LATEST FROM DR TECHNOLOGY

Credential Canaries Create Minefield for Attackers

Canary tokens — also known as honey tokens — force attackers to second-guess their potential good fortune when they come across user and application secrets.

Black Hat USA 2022 Attendee Report