Dark Reading Daily -- September 14, 2023

Microsoft Azure HDInsight Plagued With XSS Vulnerabilities

To boot, the technology could be riddled with other flaws via its Apache services components, a security vendor says.

'Scattered Spider' Behind MGM Cyberattack, Targets Casinos

The ransomware group is a collection of young adults, and also recently breached Caesars Entertainment and made a ransom score in the tens of millions range.

When LockBit Ransomware Fails, Attackers Deploy Brand-New '3AM'

Nothing good happens after 2 a.m., they say, especially when hackers have two kinds of ransomware at their disposal.

A 2-Week Prescription for Eliminating Supply Chain Threats

Giving users time to detect and then update hijacked packages can help developers avoid using malicious code in software development.

Federal Mandates on Medical-Device Cybersecurity Get Serious

In October, the US Food and Drug Administration will start rejecting medical devices that lack a secure design or a post-market cybersecurity plan.

Cybersecurity Skills Gap: Roadies & Gamers Are Untapped Talent

Gamers and former sound engineers and roadies can help boost the cybersecurity talent pool. Their flexible mindset and attention to detail make them valuable resources.

Kubernetes Admins Warned to Patch Clusters Against New RCE Vulns

All Windows endpoints within a vulnerable Kubernetes cluster are open to command injection attacks, new research finds.

Recent Rhysida Attacks Show Focus on Healthcare by Ransomware Actors

The operators of the Rhysida ransomware-as-a-service have claimed credit for a crippling attack on Mississippi's Singing River health system.

Microsoft Patches a Pair of Actively Exploited Zero-Days

Five critical bugs, zero-days exploited in the wild, Exchange Server, and more headline Microsoft's September 2023 Patch Tuesday release. Here's what to patch now.

Attackers Abuse Google Looker Studio to Evade DMARC, Email Security

Cyberattackers are tapping the legitimacy of the Web-based data-visualization tool in a campaign aimed at stealing credentials and defrauding hundreds of business users.

Overcoming the Rising Threat of Session Hijacking

Passkeys and multifactor authentication aren't enough for combating infostealer malware, which can exfiltrate corporate data before anyone knows an attack happened.

MGM Resorts Cyberattack Hobbles Las Vegas Strip Operations

Hospitality behemoth struggles to recover following a Sunday cyber incident that looks a lot like a ransomware attack.

LATEST FROM THE EDGE

Rail Cybersecurity Is a Complex Environment

CISOs in the rail industry must protect an older, more complex infrastructure than most industries. Here are some of the unique, high-stakes challenges.

LATEST FROM DR TECHNOLOGY

Microsoft, Google Take on Obsolete TLS Protocols

Google shortened the lifetime of Transport Layer Security (TLS) certificates, and Microsoft plans to downgrade support for older versions, giving companies more data security but also removing visibility into their own traffic.

LATEST FROM DR GLOBAL

Iran's Charming Kitten Pounces on Israeli Exchange Servers

Archrivals face off in the cyber plane, as opportunistic hackers prey on the unpatched and generally negligent.

How Supply Chain Attacks Work, and How to Stop Them