Dark Reading Daily -- November 30, 2022

Cyberattackers Selling Access to Networks Compromised via Recent Fortinet Flaw

The vulnerability, disclosed In October, gives an unauthenticated attacker a way to take control of an affected product.

The Metaverse Could Become a Top Avenue for Cyberattacks in 2023

Expect to see attackers expand their use of current consumer-targeting tactics while exploring new ways to target Internet users — with implications for businesses.

Acer Firmware Flaw Lets Attackers Bypass Key Security Feature

The manufacturer is working to fix a vulnerability — similar to a previous problem in Lenovo laptops — that allows threat actors to modify or disable Secure Boot settings to load malware.

Oracle Fusion Middleware Flaw Flagged by CISA

The bug could allow unauthorized access and takeover, earning it a spot on the Known Exploited Vulnerabilities Catalog.

Killnet Gloats About DDoS Attacks Downing Starlink, White House

Elon Musk-owned Starlink, WhiteHouse.gov, and the Prince of Wales were targeted by Killnet in apparent retaliation for its support of Ukraine.

CISA's Strategic Plan Is Ushering in a New Cybersecurity Era

Today's cyber environment requires less emphasis on detection and perimeter defenses and more focus on bolstering security with resilience.

Why the Culture Shift on Privacy and Security Means Today's Data Looks Different

A lack of federal regulatory legislation leaves US privacy concerns to battle for attention with other business priorities.

Cyber-Threat Group Targets Critical RCE Vulnerability in 'Bleed You' Campaign

More than 1,000 systems are exposed to a campaign hunting weak Windows servers and more.

Bring Your Own Key — A Placebo?

BYOK was envisioned to reduce the risk of using a cloud service provider processing sensitive data, yet there are several deficiencies.

Ducktail Cyberattackers Add WhatsApp to Facebook Business Attack Chain

The Vietnam-based financial cybercrime operation's primary goal is to push out fraudulent ads via compromised business accounts.

Cybersecurity Consolidation Continues, Even as Valuations Stall

Financing and acquisitions are trending toward smaller deals, which means fewer high-valuation purchases and funding, but likely fewer post-merger layoffs as well.

LATEST FROM THE EDGE

How to Use Cyber Deception to Counter an Evolving and Advanced Threat Landscape

Organizations must be prepared to root out bad actors by any means possible, even if it means setting traps and stringing lures.

LATEST FROM DR TECHNOLOGY

Microsoft Defender Gets New Security Protections

The new Microsoft Defender for Endpoint capabilities include built-in protection and scanning network traffic for malicious activity.

Creating an Effective Incident Response Plan