Dark Reading Daily -- September 06, 2023

Hackers Target High-Privileged Okta Accounts via Help Desk

Threat actors convince employees to reset MFA for Super Admin accounts in the IAM service to leverage compromised accounts, impersonating users and moving laterally within an organization.

Researchers Discover Critical Vulnerability in PHPFusion CMS

No patch is available yet for the bug, which can enable remote code execution under the correct circumstances.

LockBit Leaks Documents Filched From UK Defense Contractor

A company that builds physical perimeter defenses failed to keep the LockBit group from penetrating its cyber defenses.

Data Initiatives Force Closer Partnership Between CISOs, CDOs

Though security leaders and chief data officers both care about data management, their different missions have created a tension that needs addressing.

GhostSec Leaks Source Code of Alleged Iranian Surveillance Tool

GhostSec has made the source code for what it calls a powerful surveillance tool openly available in a 26GB file, but FANAP denies its legitimacy.

Peiter 'Mudge' Zatko Lands Role as CISA Senior Technical Adviser

The former hacker and Twitter security executive will use his role to help fulfill the Biden administration's plans for the National Cybersecurity Strategy.

As LotL Attacks Evolve, So Must Defenses

Because living-off-the-land (LotL) attacks masquerade as frequently used, legitimate companies, they are very difficult to block and detect.

How Companies Can Cope With the Risks of Generative AI Tools

To benefit from AI yet minimize risk, companies should be cautious about information they share, be aware of AI's limitations, and stay vigilant about business implications.

(Sponsored Article) How to Choose a Managed Detection and Response (MDR) Solution

MDR empowers organizations with enhanced security. Look for these four capabilities when selecting an MDR product.

MSSQL Databases Under Fire From FreeWorld Ransomware

The sophisticated attacks, tracked as DB#JAMMER, run shell commands to impair defenses and deploy tools to establish persistence on the host.

A Brief History of ICS-Tailored Attacks

It's on the cyber defenders to learn from the past and make industrial control system networks hostile to attackers.

NYC Subway Disables Trip-History Feature Over Tap-and-Go Privacy Concerns

The move by New York's Metropolitan Transit Authority (MTA) follows a report that showed how easy it is for someone to pull up another individual's seven-day ride history through the One Metro New York (OMNY) website.

Should Senior IT Professionals Be Accountable for Professional Decisions?

Everyone makes mistakes — but what if your mistakes risk the security of millions of people?

Proposed SEC Cybersecurity Rule Will Put Unnecessary Strain on CISOs

The Security and Exchange Commission's Proposed Rule for Public Companies (PPRC) is ambiguous.

LATEST FROM THE EDGE

Name That Edge Toon: Prized Possessions

Come up with a clever caption, and our panel of experts will reward the winner with a $25 Amazon gift card.

LATEST FROM DR TECHNOLOGY

NIST Publishes First Draft Standards for Post-Quantum Cryptography

Publication of the first draft PQC standards opens a 90-day period for public comment and paves the way for interoperability testing.

LATEST FROM DR GLOBAL

Russia Undertakes Disinformation Campaign Across Africa

Following coups in some African nations, Russia is exploiting the instability with the manipulation of media channels to stoke anti-French sentiment, among other things.

Where and When Automation Makes Sense for Enterprise Security