Dark Reading Daily -- January 26, 2023

North Korea's Top APT Swindled $1B From Crypto Investors in 2022

The DPRK has turned crypto scams into big business to replenish its depleted state coffers.

Microsoft Azure-Based Kerberos Attacks Crack Open Cloud Accounts

Two common attacks against on-premises Kerberos authentication servers — known as Pass the Ticket and Silver Ticket — can be used against Microsoft's Azure AD Kerberos, a security firms says.

Researchers Pioneer PoC Exploit for NSA-Reported Bug in Windows CryptoAPI

The security vulnerability allows attackers to spoof a target certificate and masquerade as any website, among other things.

GoTo Encrypted Backups Stolen in LastPass Breach

Encrypted backups for several GoTo remote work tools were exfiltrated from LastPass, along with encryption keys.

Log4j Vulnerabilities Are Here to Stay — Are You Prepared?

Don't make perfect the enemy of good in vulnerability management. Context is key — prioritize vulnerabilities that are actually exploitable. Act quickly if the vulnerability is on a potential attack path to a critical asset.

Can't Fill Open Positions? Rewrite Your Minimum Requirements

If you or your company can't find good infosec candidates, consider changing up the qualifications to find more nontraditional talent.

'DragonSpark' Malware: East Asian Cyberattackers Create an OSS Frankenstein

Hackers cleverly cobbled together a suite of open source software — including a novel RAT — and hijacked servers owned by ordinary businesses.

Chat Cybersecurity: AI Promises a Lot, but Can It Deliver?

Machine learning offers great opportunities, but it still can't replace human experts.

Security and the Electric Vehicle Charging Infrastructure

When EVs and smart chargers plug in to critical infrastructure, what can go wrong? Plenty.

Ticketmaster Blames Bots in Taylor Swift 'Eras' Tour Debacle

Ticketmaster testified in the Senate that a cyberattack was to blame for the high-profile Taylor Swift concert sales collapse, but some senators aren't so sure.

LATEST FROM THE EDGE

Google Pushes Privacy to the Limit in Updated Terms of Service

In the Play Store's ToS, a paragraph says Google may remove "harmful" applications from users' devices. Is that a step too far?

LATEST FROM DR TECHNOLOGY

Snyk Gets Nod of Approval With ServiceNow Strategic Investment

One of the most closely watched security startups continues to build bank because its platform appeals to both developers and security pros.

The Promise and Reality of Cloud Security