Dark Reading Weekly -- December 08, 2022

For Cyberattackers, Popular EDR Tools Can Turn into Destructive Data Wipers

Microsoft, three others release patches to fix a vulnerability in their respective products that enables such manipulation. Other EDR products potentially are affected as well.

Hacker Fails for the Win

Security researchers share their biggest initial screwups in some of their key vulnerability discoveries.

Infostealer Malware Market Booms, as MFA Fatigue Sets In

The successful combo of stolen credentials and social engineering to breach networks is increasing demand for infostealers on the Dark Web.

Machine Learning Models: A Dangerous New Attack Vector

Threat actors can weaponize code within AI technology to gain initial network access, move laterally, deploy malware, steal data, or even poison an organization's supply chain.

Shift to Memory-Safe Languages Gains Momentum

Software firms and the National Security Agency urge developers to move to memory-safe programming languages to eliminate a major source of high-severity flaws.

Zerobot Weaponizes Numerous Flaws in Slew of IoT Devices

The botnet exploits flaws in various routers, firewalls, network-attached storage, webcams, and other products and allows attackers to take over affected systems.

Artifact Poisoning in GitHub Actions Imports Malware via Software Pipelines

A vulnerability discovered in GitHub Actions could allow an attacker to poison a developer's pipeline, highlighting the risk that insecure software pipelines pose.

Where Advanced Cyberattackers Are Heading Next: Disruptive Hits, New Tech

Following a year of increasingly disruptive attacks, advanced persistent threat groups will likely only become emboldened in 2023, security experts say.

Android Serves Up a Slew of Security Updates, 4 Critical

Out of more than 80 flaws fixed this month, the most critical was a system component bug that could allow RCE over Bluetooth.

Hive Social Buzzing With Security Flaws, Analysts Warn

Twitter alternative Hive Social took down its servers after researchers discovered several critical vulnerabilities.

The Privacy War Is Coming

Privacy standards are only going to increase. It's time for organizations to get ahead of the coming reckoning.

Data Security Concerns Are Driving Changes in US Consumer Behavior and Demands

As consumers catch on to the dangers, protection could become a major topic for legislative bodies.

Will New CISA Guidelines Help Bolster Cyber Defenses?

Learn how BOD 23-01 asset inventory mandates can help all organizations tighten cybersecurity.

A Risky Business: Choosing the Right Methodology

Rather than regarding risk assessment as a negative exercise, consider it one that benefits your organization's aims, and then translate the risk level to its impact on operations, reputation, or finances.

Applying the OODA Loop to Cybersecurity and Secure Access Service Edge

Organizations can best defend themselves on the cyber battlefield by adopting a military-style defense.

Developing and Testing an Effective Breach Response Plan