Dark Reading Daily -- December 23, 2022

Google WordPress Plug-in Bug Allows AWS Metadata Theft

A successful attacker could use the SSRF vulnerability to collect metadata from WordPress sites hosted on an AWS server, and potentially log in to a cloud instance to run commands.

Inside the Next-Level Fraud Ring Scamming Billions Off Holiday Retailers

"Largest attack of its kind": A potent Southeast Asian e-commerce fraud ring has declared war on US retailers, targeting billions in goods in just the past month and forcing mules into its scheme.

Zerobot Adds Brute Force, DDoS to Its IoT Attack Arsenal

Threat actors continue to evolve the malicious botnet, which has also added a list of new vulnerabilities it can use to target devices.

Security on a Shoestring? Cloud, Consolidation Best Bets for Businesses

With a recession potentially coming, some companies are cutting security teams. But moving more infrastructure to the cloud and reducing the number of vendors through consolidation may be the best ways to prepare.

Threat Modeling in the Age of OpenAI's Chatbot

New technical chatbot capabilities raise the promise that their help in threat modeling could free humans for more interesting work.

Biden Signs Post-Quantum Cybersecurity Guidelines Into Law

The new law holds the US Office of Budget and Management to a road map for transitioning federal systems to NIST-approved PQC.

New Brand of Security Threats Surface in the Cloud

Tech Insight report co-produced by Black Hat, Dark Reading, and Omdia examines how cloud security is evolving in a rapid race to beat threat actors to the (cloud) breach.

'Sextortion,' Business Disruption, and a Massive Attack: What Could Be in Store for 2023

Our growing interconnectedness poses almost as many challenges as it does benefits.

Godfather Banking Trojan Masquerades as Legitimate Google Play App

The malware has resurfaced, using an icon and name similar to the legitimate Google Play app MYT Music, a popular app with more than 10 million downloads.

Name That Toon: Kiss and Tell

Feeling creative? Submit your caption and our panel of experts will reward the winner with a $25 Amazon gift card.

Why Security Teams Shouldn't Snooze on MFA Fatigue

Employee education, biometric and adaptive authentication, and zero trust can go a long way in strengthening security.

Ransomware Attackers Bypass Microsoft's ProxyNotShell Mitigations With Fresh Exploit

The Play ransomware group was spotted exploiting another little-known SSRF bug to trigger RCE on affected Exchange servers.

LATEST FROM THE EDGE

What Kind of Data Gets Stolen When a Developer is Compromised?

What is the worst that can happen when a developer's machine is compromised? Depending on the developer's position, attackers gain access to nearly everything: SSH keys, credentials, access to CI/CD pipelines and production infrastructure, the works.

LATEST FROM DR TECHNOLOGY

Security Is a Second-Class Citizen in High-Performance Computing

Vendors and operators attempt to balance power and security, but right now, power is the highest goal.

The Promise and Reality of Cloud Security