By Deeba Ahmed
Previously, when the group exploited LinkedIn, it managed to pilfer a staggering $625 million from the Ronin Network (RON) blockchain network.
This is a post from HackRead.com Read the original post: Lazarus APT Exploiting LinkedIn to Target Spanish Aerospace Firm

****_KEY FINDINGS_****

*   **An aerospace firm in Spain is the target of an organized attack where scammers contact the company’s employees as recruiters from LinkedIn.**

*   **The activity is attributed to Lazarus as part of its Operation DreamJob campaign.**

*   **The targets are lured into opening a file masqueraded as a coding challenge/quiz, but it is a malicious executable.**

*   **Attackers have used DLL side-loading to deliver payloads and employed four execution chains.**

*   **LightlessCan backdoor is the highlight of this attack, as it can evade detection from real-time security monitoring software and even scrutiny from cybersecurity experts.**

*   **LightlessCan is the predecessor of Lazarus’ signature RAT BlindingCan.**

ESET Research has published a report describing a newly detected cyberespionage campaign from the Lazarus group. The report, authored by Peter Kálnai, revealed that Lazarus APT is exploiting the professional social networking platform LinkedIn in this campaign, which ESET believes is a part of the group’s Operation DreamJob.

Reportedly, the attackers are luring employees of a Spanish aerospace firm by impersonating recruiters from LinkedIn. Their targets are company employees using corporate computers for personal purposes. ESET’s primary discovery was that Lazarus used a previously undocumented backdoor in this campaign, dubbed LightlessCan.

It is noteworthy that since 2019, the Lazarus Group has displayed significant interest in the space industry. In November 2019, the group targeted the Indian space agency, coinciding with the country’s Chandrayaan-2 moon landing attempt.

The use of LinkedIn to target large firms is not new for the North Korea-based Lazarus group. In July 2022, it was revealed that the group used fake LinkedIn job offers to steal $625 million from the Ronin Network (RON), a blockchain network that underpins the popular crypto game Axie Infinity and Axie DAO.

Further probing into this new LightlessCan revealed that it is currently in its evolutionary phase and is a complex tool exhibiting highly sophisticated mechanisms in its design and operation. This indicates that threat actors continually advance their attack tactics and tools since LightlessCan is much more malicious than its predecessor, BlindingCan.

Initial access to the company’s network was achieved in 2022 through a spearphishing attack where the attackers masqueraded as Meta recruiters. They contacted the employees through the LinkedIn Messaging feature. The victim receives two coding challenges to complete the hiring process. This challenge has to be downloaded and executed on a company computer.

(Credit: ESET)

The first challenge is to display the phrase “Hello World!” The second challenge is printing a Fibonacci sequence where each number is the sum of the earlier two numbers. The victim is expected to self-compromise the system by luring them into executing a trojanized PDF viewer to view the job offer or connect with a trojanized SSL/VPN client that comes with an IP address and login credentials.

According to ESET, Multiple employees were targeted with this technique. The targets are requested to prove their proficiency in C++ programming by completing the challenge/quiz. The recruiter sends two executables titled Quiz1.exe and Quiz2.exe. These executables are delivered via two image files (Quiz1.iso and Quiz2.iso). These files are hosted on a third-party cloud storage platform and are basic command-line applications requiring user input.

During the final stages of the attack chain, the attacker infects the system with an HTTP(S) downloader, NickelLoader to deploy any program into the infected system’s memory.

Through NickelLoader, they deliver two RATs, the Lazarus’ flagship toolkit BlindingCan backdoor’s simplified version miniBlindingCan and the new tool ESET named LightlessCan. This is BlindingCan’s successor that supports up to 68 different commands and is indexed in a custom function table. 

(Credit: ESET)

There are two versions of LightlessCan detected by ESET. The current version (1.0) supports only 48 commands with limited functionality. It is based on BlindingCan source code with certain indexing changes.

This new toolkit can mimic the functions of several native Windows commands, e.g. ping, ipconfig, systeminfo, sc, net, enable discreet execution within the RAT, and feature enhanced stealthiness that makes detecting/analyzing it a huge challenge.

Victor Acin, KrakenLabs Manager at Outpost24 commented on the issue and told Hackread.com that “As companies increase their cybersecurity capabilities, modernize their infrastructure, and consolidate their technology, it becomes more and more difficult to exploit vulnerabilities in the traditional way. This, as well as finding faults within the application logic and its programming that allow an attacker to gain access to that server, makes zero-days rare.”

Acin added “It’s not a surprise that threat actors resort to attacks that target the weakest component of the link – the user behind the screen. Social engineering attacks are the most common way to gain access to companies, and with the abundance of data about the employees from sources such as social media to leaks containing PII, it becomes simpler every day to put together a credible target package.”

For your information, Lazarus, aka Hidden Cobra, is a cyberespionage group from North Korea. It was first detected in 2009 and has successfully conducted several high-profile incidents, including the Sony Pictures Entertainment hack (2016) and the WanaCryptor aka WannaCry attack (2017).

Aerospace firms aren’t unusual targets for North Korea-sponsored APT groups like Lazarus as they want to access sensitive technology and gain money from cyberattacks to further the development of North Korea’s missiles.

****_RELATED ARTICLES_****

1.  North Korean Hackers Targeting Banks Globally: Report
2.  South Korea Blames North Korean Hackers For Stealing Bitcoin
3.  Hackers steal personal details of 1,000 North Korean Defectors
4.  South Korean subway system hacked, North Korea a possible culprit
5.  Elite North Koreans aren’t opposed to exploiting internet for financial gain

Lazarus APT Exploiting LinkedIn to Target Spanish Aerospace Firm

By Owais Sultan
DevOps streamlines cloud migration by automating deployment and operations, ensuring a seamless transition and efficient management of cloud…
This is a post from HackRead.com Read the original post: The Role of DevOps in Streamlining Cloud Migration Processes

DevOps streamlines cloud migration by automating deployment and operations, ensuring a seamless transition and efficient management of cloud resources, leading to faster and more reliable deployments. It also fosters collaboration between development and operations teams, enhancing agility and reducing errors during the migration process.

In the past, when companies wanted to migrate to the cloud, it was often a lengthy process that took months or even years. However, as more companies move their infrastructure and applications to the cloud, this process has become much easier. The use of DevOps tools can greatly speed up your migration efforts so that you can get started working in the cloud sooner than ever before.

****Benefits of Cloud Migration****

As we’ve seen, there are many benefits to cloud migration. In fact, it’s not uncommon for companies to experience a 50% cost reduction after moving their business to the cloud.

One of the most important things you can do when migrating your business is avoid vendor lock-in; this means that you should always make sure that your cloud provider offers an open API or SDK so that you can easily migrate between them if necessary (or even move back on-premise). For more information on avoiding vendor lock-in and ensuring a smooth migration, visit the website.

Another major benefit of using a public cloud provider is reduced time to market: instead of having to build out hardware and software infrastructure as part of your migration process, all resources are ready at hand when using these services!

This allows organizations who want more flexibility without sacrificing security or uptime capability – two things that were previously difficult for small businesses with limited budgets but high needs for scalability/flexibility in their IT systems to fully benefit from the cloud.

****Challenges in Cloud Migration****

As you can see, cloud migration is a complex process that involves a lot of different teams and tools. It can be difficult to coordinate, especially if the organizations involved don’t have much experience with each other. While some tools are designed specifically for cloud migration, others may not be as helpful or efficient in this context.

In short: Cloud migration doesn’t come easily or quickly and it often requires multiple tools (like those mentioned above) to get right.

****What is DevOps?****

DevOps is a software development process that emphasizes communication, collaboration, integration and automation. DevOps is not a process or tool; it’s a culture of people collaborating across functions to deliver better apps faster than before possible.

Because DevOps involves collaboration between developers and operations staff members, it can help improve your cloud migration processes by ensuring that both sides understand each other’s roles in the migration process.

****The Intersection of DevOps and Cloud Migration****

DevOps and cloud migration are both about automation. DevOps is the process of automating the development process while migrating to the cloud is all about automating your migration process. Both have benefits and challenges that must be considered when implementing them in your organization.

The intersection of these two technologies can provide a better experience for developers and users alike by combining their strengths: DevOps provides tools for automating testing and packaging applications, while cloud migrations enable faster deployments with less downtime (and associated costs).

****Continuous Integration (CI) in Cloud Migration****

Continuous integration is a software development practice that requires developers to integrate code into a shared repository several times a day. The main goal of CI is to promote the idea of continuous improvement by integrating incremental changes and testing the software as early as possible.

For example, if you have an existing application running on-premises and want to migrate it to the cloud, you can use CI tools such as Jenkins or Travis CI for automated testing before deploying your application in production. This will help identify bugs faster than manual testing which can take weeks or even months depending on how complex your project is (and who’s doing it).

****Continuous Deployment (CD) in Cloud Migration****

Continuous deployment is the process of automating the deployment of software. It allows teams to deploy their code frequently and reliably, with minimal risk to production systems. In the context of cloud migration, continuous deployment can help you automate the process of moving your applications from on-premises environments into the cloud.

This approach involves several key steps:

*   Automate infrastructure provisioning through Terraform or CloudFormation templates
*   Use Ansible playbooks to build your application stack on top of these prebuilt stacks (e.g., databases)
*   Deploy containers using Docker Compose where appropriate; otherwise, use Kubernetes for container orchestration

****Monitoring and Feedback Loops****

In order to be successful at anything, you need to know what you’re working towards. Before you begin any project, it’s important that you define the problem and set goals for yourself. For example: “I want to lose 15 pounds in 6 months.” This can be accomplished by creating a plan with specific steps that will help you reach your goal.

When setting fitness goals for yourself or others (like your team), make sure that they are realistic and achievable within a reasonable time frame especially if they’re part of an ongoing process like DevOps transformation!

****Automation and Infrastructure as Code (IaC)****

DevOps is a culture, a mindset, and a practice. It’s also a toolchain that includes automation tools like Puppet and Chef; configuration management systems like Ansible; orchestration frameworks like Kubernetes; and monitoring platforms like Prometheus.

Finally, DevOps represents the team that uses these technologies to work together on improving their product delivery process through collaboration between software developers (or application engineers) and operations teams (or system administrators).

****Conclusion****

In conclusion, DevOps is a powerful tool that can be used to streamline the process of cloud migration. It allows for faster development cycles and more efficient collaboration between developers and IT professionals. The best part about DevOps is that it’s not just limited to cloud migration it can be applied in any environment where automation and continuous improvement are necessary!

The Role of DevOps in Streamlining Cloud Migration Processes

By Deeba Ahmed
Chinese hackers have struck again!
This is a post from HackRead.com Read the original post: Chinese Hackers Stole 60,000 US State Department Emails from Microsoft

Thousands of emails belonging to the US State Department were stolen in a data breach targeting Microsoft Outlook accounts.

Chinese hackers are responsible for breaching the security of Microsoft’s cloud-based Exchange email platform, which occurred in May 2023. Apart from stealing tens of thousands of emails from official accounts, the attackers obtained a list of all email accounts belonging to the State Department, Reuters reported.

As reported by Hackread.com, Microsoft revealed the breach in July 2023, explaining that threat actors breached Outlook accounts used by 25 organizations, including the US State and Commerce Departments, and other charges linked to these entities. The tech giant didn’t disclose the names of the impacted organizations and government entities.

The scope of the breach was disclosed at a Senate staff briefing on September 28, 2023. It was revealed at least 60,000 emails belonging to state department officials stationed in the Pacific, East Asia, and Europe were stolen. The compromised accounts mainly belonged to personnel focusing on Indo-Pacific diplomacy.

In a press briefing, State Department’s spokesperson Matthew Miller confirmed the data breach, explaining that “classified systems” weren’t hacked in that incident. Miller also added that the department is yet to make an attribution, but there’s no reason to doubt Microsoft’s attribution.

“Again, this was a hack of Microsoft systems that the State Department uncovered and notified Microsoft about,” Miller told reporters.

On the other hand, Senator Eric Schmitt said in his official statement that there’s a growing need to “harden” security defences against such intrusions in the future. Moreover, Schmitt believes that the federal government’s dependence on a single vendor should also be reviewed as this could be a weak link.

Microsoft has blamed the Chinese cyber-espionage group called Storm-0558 for the email breach. This group is known for infiltrating email systems of its targets to steal sensitive data.

According to a Microsoft representative, Storm-0558 accessed a Windows crash dump and obtained a consumer signing key, which could be used to compromise Exchange Online and Azure Active Directory accounts. The key was obtained by exploiting an already patched zero-day validation flaw that affected the GetAccessTokenForResourceAPI.

By exploiting this flaw, the attackers could create counterfeited signed access tokens and impersonate any account belonging to their target organizations. With this technique, Storm-0558 compromised the corporate account of a Microsoft engineer and managed to access the government email accounts.

Microsoft has revoked the stolen signing key and launched an investigation into the incident. The company has confirmed no further evidence of repeated unauthorized access to customer accounts using the same access token counterfeiting method.

Upon CISA’s insistence, Microsoft agreed to expand access to cloud logging data, which so far was only available to users having Purview Audit (Premium) logging licenses, free of charge so that network defenders can quickly identify breach attempts.

Mike Newman, CEO of My1Login, has commented on this incident, stating that this attack is crucial because hackers accessed sensitive government data from Outlook.

“Attackers appear to have accessed highly sensitive information in this breach by coupling together a number of attack vectors. These are complex and sophisticated techniques that signal Microsoft was facing a determined adversary that was highly motivated to carry out this attack.”

Newman further noted that encryption is the best defence against such incidents, and the workforce shouldn’t be allowed to access user credentials so that they cannot be lost or solved. Moreover, Microsoft shouldn’t have access to consumers’ private keys in the first place. 

“It should be mandatory for security that customer data (i.e. emails, stored credentials, documents) is encrypted using keys that are only known to the customer, meaning they cannot be accessed by the cloud software provider or an external, malicious actor.”

**RELATED ARTICLES**

1.  Chinese Group Storm-0558 Hacked European Govt Emails
2.  Chinese APT Flax Typhoon uses legit tools for cyber espionage
3.  Chinese Hackers Stole Signing Key to Breach Outlook Accounts
4.  Chinese Hackers Using Stolen Ivacy VPN Certificate To Sign Malware
5.  Chinese APT Slid Fake Signal, Telegram Apps onto Official App Stores

Chinese Hackers Stole 60,000 US State Department Emails from Microsoft

By Waqas
Is it really necessary to display advertisements within an AI chatbot?
This is a post from HackRead.com Read the original post: Malicious Ads Infiltrate Bing AI Chatbot in Malvertising Attack

The Bing AI chatbot labeled the malicious website as the official website of an IP scanner provider and recommended users to visit it, despite its involvement in the malvertising attack campaign.

In the wake of OpenAI’s ChatGPT‘s soaring success, Microsoft’s Bing AI Chatbot emerged as a challenging player in the world of artificial intelligence, boasting over 100 million active users. While this achievement underscores the growing influence of AI, it has also attracted the attention of cybercriminals seeking to exploit this massive user base.

Recent revelations indicate that Bing AI has become the latest target of malvertising attacks, raising significant concerns within the cybersecurity community.

In a blog post, Jérôme Segura, a senior security researcher at Malwarebytes Labs, shed light on the alarming exploitation of Bing AI Chatbot by malicious actors. The attackers have cleverly embedded malicious advertisements within the chatbot, representing a novel approach to malvertising.

It’s crucial to note that the advertising mechanism within Bing AI Chatbot operates similarly to conventional search results, where advertisers bid on specific keywords to have their ads displayed to users conducting related searches. However, there are noteworthy distinctions in how these ads manifest within chatbots.

The attack unveiled by Malwarebytes involved cybercriminals masquerading as the Advanced IP Scanner provider to lure users into clicking on their malicious ads. Advanced IP Scanner is a tool commonly used by network administrators, hinting at the possibility that the culprits behind this campaign may be specifically targeting IT and cybersecurity professionals, although this remains unconfirmed.

In a screenshot shared by Segura, the top ad slot prominently features a website address **(mynetfoldersipcfd)**, claiming to be the official source for downloading Advanced IP Scanner. To make things worse for unsuspecting users, Bing AI itself promoted this malicious website as the legitimate destination.

The true intent behind mynetfoldersipcfd is to segregate genuine victims from bots, sandboxes, or security researchers. It accomplishes this by scrutinizing various factors, including users’ IP addresses, time zones, and system settings, such as web rendering preferences that identify virtual machines.

Human users are redirected to a deceptive site **(advenced-ip-scannercom)**, mimicking the official platform. Meanwhile, other unsuspecting visitors are rerouted to a decoy page. The subsequent step involves duping users into downloading and installing a fake malicious version of Advanced IP Scanner, facilitating the theft of user data. It is crucial to emphasize that the official website for downloading Advanced IP Scanner is advanced-ip-scanner.com, not **(advenced-ip-scannercom)**.

The difference between the two sites is the use of **_a_** and **_e_** in their addresses: adv**_a_**nced-ip-scanner.com and (adv**_e_**nced-ip-scannercom). This is a typical case of Typosquatting. **Typosquatting** is a type of attack that involves registering domain names that are similar to popular websites but with common misspellings.

The malvertising campaign doesn’t stop here. Segura also flagged another malicious ad served through Bing AI Chatbot, where the same threat actor replicated Mycase.com, a US-based cloud legal practice management software solution. Mycase.com is instrumental in aiding attorneys and law firms in managing cases, clients, and communications.

Bing AI chatbot pushing Malvertising campaign (Image: Malwarebytes)

This incident emphasised the importance of exercising extreme caution when encountering ads within chatbots and search engines. Although malvertising attacks are not novel, their execution through an AI chatbot platform is definitely an unsettling development.

To safeguard against such threats, it is advisable to employ updated anti-malware solutions, leverage browser scanning applications or plugins, and stay vigilant by keeping software and systems up-to-date. In an era of evolving cybersecurity challenges, these precautions are essential to protect against the ever-creative tactics of cybercriminals.

****RELATED ARTICLES****

1.  Google Indexed Bard AI User Chats in Search Results
2.  New AI tool aims to make CAPTCHA a thing of the past
3.  AI Image Editing Tool Cutout Leaked User Images and Data
4.  Following WormGPT, FraudGPT Emerges for AI-Driven Cyber Crime

Malicious Ads Infiltrate Bing AI Chatbot in Malvertising Attack

By Waqas
This was revealed by the Internet Watch Foundation, a UK-based internet watchdog.
This is a post from HackRead.com Read the original post: Dark Web Pedophiles Using Open-Source AI to Generate CSAM

Pro tip: Do not upload images of your children on the internet, including your social media profile, even if your friends list consists of people you know or trust.

****RELATED ARTICLES****

*   **The availability and sophistication of generative AI platforms is a growing issue of concern. Cybercriminals can easily manipulate videos, images, and audio to create deep fake content.**

*   **A UK-based internet watchdog has shared startling details of how paedophiles have switched to generative AI to create child sexual abuse content.**

*   **Research revealed that paedophiles use freely available AI software to create illegal child pornographic material.**

*   **The Internet Watch Foundation observed that paedophiles are openly discussing how to modify the software to manipulate children’s photographs on the dark web.**

*   **This can make it challenging to help real-life victims.**

We all know OpenAI’s **ChatGPT** chatbot. You may also be aware that cybercriminals have developed malicious alternatives of ChatGPT known in the cybersecurity community as **FraudGPT and WormGPT**. The bottom line is that cybercriminals will go to great lengths to turn the power of Artificial Intelligence (AI) to their advantage for malicious purposes.

Now, according to a **report** published by a UK-based internet watchdog, the Internet Watch Foundation (IWF), cybercriminals are turning to generative AI platforms to create child sexual abuse material (CSAM).

As per the research from IWF, cybercriminals’ increasing preference to create deep fake content fabricating people or events is a concerning issue because of the sheer scope of damage it can cause. The problem becomes more concerning when it involves minors, particularly children. The ease with which sex offenders can create this imagery can also encourage its widespread acceptability.

The IWF found that there’s been a sudden surge in AI-generated child sexual abuse content available online. The organization noticed discussions among paedophile rings on dark web forums frequently used by sex offenders regarding tips on creating fake images of children via open-source AI models.

Child safety experts and law enforcement agencies are afraid that the availability of realistic photos will make it challenging to help real-life victims of child sexual abuse. It must be noted that creating photorealistic content is illegal in the UK.

Open-source AI models differ from closed AI models like Google’s Imagen, as anyone can download them. It is easier to use these models because they can download and run them on PCs, and there’s no need to run them on the cloud. So, they can evade the controls and detection tools on the cloud and distribute the content online more regularly than they do now.

Offenders can use a basic source image-generating model containing billions of tagged images and fine-tune the images with child sexual abuse images to create a similar model with low-rank adaptation. Hence, with minimal computation, they can produce realistic images and mislead law enforcement by diverting their focus on child victims that don’t exist.

**Earlier**, the IWF’s chief executive, Susie Hargreaves OBE, had warned the government regarding the seriousness of this issue. 

In May 2023, the Internet Watch Foundation (IWF) initiated the recording of instances involving AI-generated child sexual abuse material, marking a significant development for its hotline. Over the span of May 24 to June 30, the IWF diligently investigated 29 reports encompassing URLs suspected of housing AI-generated child sexual abuse imagery. These reports came from concerned members of the public.

Among these cases, the IWF successfully verified that seven of the reported URLs indeed contained AI-generated child sexual abuse imagery. Notably, these URLs often hosted multiple images, which could be entirely AI-generated or a combination of AI-generated and authentic content.

Disturbingly, the addressed URLs covered a distressing range of material, spanning from Category A to Category B, and depicted children as young as 3 to 6 years old, comprising both female and male victims.

“We are not currently seeing these images in huge numbers, but it is clear to us the potential exists for criminals to produce unprecedented quantities of life-like child sexual abuse imagery. This would be potentially devastating for internet safety and for the safety of children online. We have a chance, now, to get ahead of this emerging technology, but legislation needs to be taking this into account and must be fit for purpose in the light of this new threat,” Hargreaves had said.

The head of the UK government’s AI task force, Ian Hogarth, had raised red flags about child sexual abuse material created using open-source AI models, claiming that it was amongst the “most heinous things out there.”

The IWF **chief** Dan Sexton regarded this as a “public health epidemic” that will get only worse as cybercriminals switch their focus on generative AI technology.

The IWF is a non-profit organization founded in 1996 to monitor the internet for sexual abuse content and receive tips about such content, especially involving children.

****How to Protect your Child and their Photos from Malicious Elements on Dark Web?****

Here are 10 ways parents can protect their children and their photos from exposure to the dark web and individuals with malicious intent:

1.  **Educate Your Children**: Teach your kids about online safety, including the importance of not sharing personal information, photos, or engaging with strangers online.
2.  **Use Privacy Settings**: Adjust the privacy settings on social media platforms to ensure that only trusted contacts can view your child’s content.
3.  **Regularly Check Friend Lists**: Encourage your child to regularly review their friend lists and followers on social media and remove anyone they don’t know in real life.
4.  **Watermark Photos**: If you choose to share photos of your children online, consider watermarking them to deter unauthorized use.
5.  **Limit Location Sharing**: Disable location sharing on your child’s devices and social media accounts to prevent tracking by malicious individuals.
6.  **Use Secure Devices**: Ensure your child’s devices have up-to-date security software and are protected with strong passwords or biometrics.
7.  **Teach Responsible Posting**: Encourage responsible posting by discussing the potential consequences of oversharing personal information or photos.
8.  **Monitor Online Activity**: Keep an eye on your child’s online activity without being overly invasive. Use parental control software if necessary. **Use parental control apps**!
9.  **Promote Open Communication**: Create an environment where your child feels comfortable discussing any online interactions or concerns they may have.
10.  **Report Suspicious Activity**: Teach your child how to recognize and report suspicious behavior or content to both you and the relevant authorities.

****RELATED ARTICLES****

1.  Hackers Claiming to Jailbreak AI Chatbots to Write Phishing Emails
2.  Microsoft’s new tool detects & reports pedophiles from online chats
3.  Fake ChatGPT and AI pages on Facebook are spreading infostealers
4.  Operation Narsil – INTERPOL Busts Decade-Old Child Abuse Network

Dark Web Pedophiles Using Open-Source AI to Generate CSAM

By Deeba Ahmed
Cisco Releases Security Patches for Critical Vulnerabilities in Catalyst SD-WAN Manager.
This is a post from HackRead.com Read the original post: Unpatched Cisco Catalyst SD-WAN Manager Systems Exposed to DoS Attacks

Cisco has confirmed that these vulnerabilities have not been exploited in the wild, at least as of now.

****KEY FINDINGS****

*   **Multiple vulnerabilities have been found in Cisco’s Catalyst SD-WAN Manager.**

*   **There isn’t any workaround available for these issues.**

*   **Catalyst SD-WAN Manager is a centralized network management system.**

*   **It is highly crucial to patch the system to stay protected.**

*   **In total four vulnerabilities have been reported, one with a Critical severity level, 3 having a High severity level, and one was assigned Medium severity.**

*   **Unpatched systems can allow cybercriminals to gain unauthorized access to user accounts, make changes as they desire, and even cause DoS attacks.**

Networking, IT, telecom, and cybersecurity solutions provider Cisco has released a critical security **advisory** to alert users about the vulnerabilities found in its Catalyst SD-WAN Manager, previously known as Cisco SD-WAN vManage.

The company discovered **multiple vulnerabilities** in the product, which can let an attacker obtain unauthorized access or launch a Denial of Service (DoS) attack on the infected system. An attacker with elevated privileges can install programs, modify/view/delete data, and create new user accounts with full rights. However, users having accounts with fewer rights may not be as impacted compared to those having accounts with administrative rights.

Cisco’s advisory read that none of the vulnerabilities depend on each other. This means it isn’t necessary to exploit multiple flaws to succeed. Moreover, a software version impacted by one of these flaws may not necessarily be impacted by other software flaws.

****Vulnerable Products:****

*   Cisco Catalyst SD-WAN Manager 20.3 – 20.12

****Non-Vulnerable Products:****

*   IOS XE Software
*   SD-WAN cEdge Routers
*   SD-WAN vEdge Routers

Cisco has confirmed that these vulnerabilities haven’t yet been exploited in the wild. The high-risk entities include large to medium government institutions/organizations, whereas risk intensity for small government entities is medium and low for home users.

****Vulnerabilities Details****

**CVE-2023-20252** has a critical severity level with a CVSS score of 9.8. It allows unauthorized access to the SD-WAN Manager through SAML (Security Assertion Markup Language) APIs. An unauthenticated actor can gain unauthorized access to the application as an arbitrary user.

**CVE-2023-20253** has been rated High and has a CVSS score of 8.4. It was found in the CLI (command-line interface) of the manager. It can let an authenticated, local actor with read-only privileges evade the authorization process, reverse controller configurations, and deploy them to downstream users.

**CVE-2023-20034** is also rated High and was assigned a CVVSS Base Score of 7.5. It is an information disclosure vulnerability that allows an unauthenticated, remote attacker to access the Elasticsearch database of an impacted system by obtaining Elasticsearch user privileges.

**CVE-2023-20254** has a high severity rating and a CVSS score of 7.2. It is linked to the session management system of the manager’s multi-tenant feature. An unauthorized, remote actor can access another tenant and make unauthorized configuration changes or cause a DoS attack.

**CVE-2023-20262** is a medium-severity vulnerability with a CVSS score of 5.3. It was found in the manager’s SSH (Secure Shell) service and can lead to a crash, causing a DoS situation for SSH access.

These issues impact the Cisco Catalyst SD-WAN Manager. Cisco has released **free software updates** to address these issues. Since no workarounds are available for these issues, it is necessary to fix the software to stay protected.

****RELATED ARTICLES****

Unpatched Cisco Catalyst SD-WAN Manager Systems Exposed to DoS Attacks

By Waqas
Ensure Your Chrome Browser Is Up to Date and Secure: Enable Automatic Updates to Safeguard Against Cybersecurity Threats
This is a post from HackRead.com Read the original post: Critical Chrome Update Counters Spyware Vendor’s Exploits

The Recent Chrome Update Follows Unveiling of Cytrox’s Predator Spyware Targeting iOS Devices of Egyptian Politician by Google TAG and University of Toronto’s Citizen Lab.

In a swift response to a potentially dangerous cybersecurity threat, Google has released an urgent update for its Chrome web browser. The update, available for Windows, macOS, and Linux users, is aimed at patching a zero-day vulnerability that was reportedly exploited by a commercial spyware vendor.

On Tuesday, Google officially unveiled the stable channel update for Chrome, which brings the browser to version 117.0.5938.132. While this update addresses a total of ten vulnerabilities, three of them are particularly noteworthy, according to the company’s advisory.

The most critical of these vulnerabilities, identified as CVE-2023-5217, has been characterized as a “heap buffer overflow in vp8 encoding in libvpx.” This security flaw was reported to the Chrome development team by Clement Lecigne, a member of Google’s Threat Analysis Group (TAG), just days before the patch’s release.

What makes CVE-2023-5217 particularly concerning is that it has already been exploited in the wild. Although Google’s advisory does not delve into specifics regarding the nature of these attacks, insights from Maddie Stone, a researcher with Google TAG, reveal that the zero-day vulnerability was leveraged by a commercial surveillance vendor.

This revelation comes hot on the heels of an announcement by Google TAG and the University of Toronto’s Citizen Lab group regarding an operation with malicious intentions. The operation aimed to deliver a potent piece of spyware, ominously named “Predator,” to an opposition politician in Egypt.

The analysis of this operation uncovered a disconcerting use of various zero-day vulnerabilities and man-in-the-middle (MitM) attacks. These tactics were deployed to surreptitiously deliver the spyware to both Android and iOS devices, marking a troubling development in the realm of cyber espionage.

The urgency with which Google responded to this zero-day vulnerability underscores the ever-present and evolving nature of online threats. In an age where cybersecurity is paramount, users are reminded once again to remain vigilant, keep their software up to date, and exercise caution when browsing the web.

As technology continues to advance, so do the capabilities of those who seek to exploit it. In the ongoing cat-and-mouse game between cybersecurity experts and threat actors, swift responses like Google’s are essential in safeguarding cyberspace.

****RELATED ARTICLES****

1.  Google reveals spyware attack on Android, iOS, and Chrome
2.  Israeli Spyware Vendor Uses Chrome 0day to Target Journalists
3.  Fake Chrome Browser Update Installs NetSupport Manager RAT

Critical Chrome Update Counters Spyware Vendor’s Exploits

By Owais Sultan
Generative AI is a technology that is still receiving a lot of attention from individuals and businesses to…
This is a post from HackRead.com Read the original post: Using GenAI in Your Business? Here Is What You Need To Know

Generative AI is a technology that is still receiving a lot of attention from individuals and businesses to date. At the peak of the attention to generative AI, everyone on the internet knew about **ChatGPT** and how OpenAI was the company behind it. Even more impressive was when their users grew to a whopping 100 million within a few months. But ChatGPT isn’t the only generative AI solution. 

Recently, many businesses have been **integrating generative AI** into their operations to improve their functionality. However, learning how it benefits a business and some of its challenges before using generative is vital. Brace yourself, as this article will provide deep insights into how generative AI works and how beneficial it is to a business. 

****What is Generative AI (GenAI)?****

Generative AI (GenAI ) and **enterprise browser security solutions** are some of the new technologies organizations are using to improve their business. Generative AI is an innovative technology powered by artificial intelligence that can automatically create high-quality texts, images, videos, and other forms of content. In other words, it is a type of artificial intelligence that uses machine language to take in users’ input and create an output based on the user’s suggestions. 

Generative AI is created by **programmers and data scientists**, who provide training on how to create different media formats from user input. Furthermore, these scientists feed this AI model with data to identify trends and act on them based on user input. While there’s been a massive buzz about this type of technology for the past months, it has been around for the longest time. 

Generative AI technology has been around since the 1960s, with the creation of the **first generative AI chatbot, Eliza**. However, recent improvements, such as the introduction of generative adversarial networks in 2014 and Google releasing its Transformers paper in 2018, kicked off the frenzy around GenAI. This type of technology could also create convincing media formats such as text, images, audio, and the rest. 

****The Use Cases of Generative AI** **

*   **Virtual Assistants Such as Chatbots** 

Virtual assistants such as Siri and Google Assistant function using generative AI models. There are layers of generative AI technology within these assistants to take in voice or text inputs from users and respond in kind. The most common among businesses are using chatbots to provide customer service and help customers. These chatbots have already been fed large language models **(LLMs)** to help them provide customers with text-based answers. 

*   **Image Generation** 

The creation of images with generative AI has grown to become a major use case of this technology. Nowadays, one doesn’t really need a photo shoot to create images of countries you haven’t been to. It is also great with image manipulation, as one can easily create pictures of creatures in different situations. For instance, one can use generative AI to create images of lions in military attire. 

*   **Text and Video Content Creation** 

The use case of generative AI didn’t end with images. This type of technology also has some incredible use cases in creating text-based content, such as blog posts and videos. 

****Benefits Of Generative AI to Businesses** **

Using web security solutions like LayerX isn’t the only technology that offers expansive benefits to businesses. Using generative AI provides several advantages that a company shouldn’t ignore. 

*   **Providing An Edge Over Competitors** 

Especially for small businesses, using generative AI can provide a much-needed edge against competitors. For instance, assuming an organization is using generative AI in the form of chatbots, they are more likely to provide better customer service and support. 

*   **Increases Productivity Among Workers** 

Generative AI can significantly improve productivity among employees by reducing the amount of tasks they do. In most cases, these employees will only be required to monitor the GenAI technology and ensure it keeps to the instructions. 

For instance, a business can quickly deploy generative AI to create email and blog post images, summarize long-form content, and even help write codes. Another benefit of this technology for business is that it is beneficial in creating and deciphering complex analyses. 

*   **Reduction in Operational Costs** 

One of the major benefits of generative AI is how it helps a business to eliminate some operational costs. Since this technology handles many tasks, it reduces the need to employ more labor for specific tasks. For instance, when it comes to functions like data entry, image creation, and even email writing, many generative AI tools can handle them effectively. 

*   **Enhance Customer Service For a Business**

As mentioned above, one of the use cases of generative AI is that it helps create chatbots and virtual assistants for customer communication. The implication of this is that it helps to improve customer service, as there’s an improved response rate from chatbots. 

With **natural language processing (NLP)**, a chatbot can learn some of the features your company’s products or services offer and the problems customers might face from using such products. It then provides a helpful answer whenever customers make an input regarding these products and services.

****Limitations of Generative AI** **

Like many other technologies, generative AI solutions have limitations, and they are:

*   **Security Concerns** 

While generative AI provides different avenues for helping a business, it can also create security vulnerabilities. Especially for businesses, generative AI, such as chatbots and other virtual assistants, have access to certain data about the company. 

Cyber attackers accessing and exploiting this data could lead to further corruption of other data. Using web security solutions like LayerX will always provide full-fledged security against browser security vulnerabilities. 

*   **Human Bias** 

Despite being an artificial intelligence, generative AI still depends on the data humans feed them to operate. So, assuming the human feeding them with the data they work with is biased, they (GenAI) become biased too. For instance, there are many times when generative AI solutions have human biases in their answers about religion and race. 

****Wrapping Up** **

Generative AI is a new technology model that can help create text-based content, images, audio, and videos with user input. Many businesses are now integrating this type of technology into their daily operations. 

Some benefits businesses can gain from using this type of technology are increased productivity, reduced operational costs, and many others. On the other hand, some of the downsides are human biases, and it can be **susceptible to cyber attacks**.

Using GenAI in Your Business? Here Is What You Need To Know

By Owais Sultan
Snapchat is a platform that may not be suitable for everyone, especially if the user is an underage child. So, what can you do?
This is a post from HackRead.com Read the original post: Snapchat Safety for Parents: How to Safeguard Your Child

Here are some important steps and guidelines that are essential for parents whose children use social media, especially platforms like Snapchat.

In this digital age, social media platforms like Snapchat and **TikTok** have become an integral part of our lives, especially for the younger generation. While Snapchat offers a unique way to connect with friends, it also raises concerns for parents regarding their child’s online safety.

As a parent, you might be wondering, “How can I protect my child on Snapchat?” This article will provide you with a comprehensive guide to keeping your child safe while using this popular platform.

However, before we begin, it’s important to note that Snapchat’s age restriction allows only children aged 13 and above to register an account. Nevertheless, considering the type of content and abusive incidents related to children on Snapchat, it is advisable to ensure that kids aged 18 and above are the only ones allowed to use the platform.

In fact, CBC Canada recently published an **article** titled “Child Luring and Exploitation on the Rise Through Snapchat” that delves deeply into the issue, shedding light on how children are increasingly exposed to and exploited on Snapchat.

****Understanding the Snapchat Landscape****

Before we delve into safety measures, it’s crucial to understand how Snapchat works. Snapchat allows users to send photos and videos that disappear after a short period, providing a sense of privacy. However, it also offers features like Stories and Discover, where users can share content with their friends or the public.

****Setting Privacy Settings****

One of the first steps in safeguarding your child on Snapchat is configuring their privacy settings. Here’s what you need to do:

**1\. Enable Ghost Mode**

Ghost Mode is a feature that hides your child’s location on the Snap Map. To enable this feature, go to your child’s profile, click on the gear icon, select ‘See My Location,’ and choose ‘Ghost Mode.’ This prevents their location from being visible to others.

**2\. Limit Who Can Send Snaps**

Ensure that only friends can send snaps to your child. To do this, go to ‘Settings,’ then ‘Who Can…’ and set ‘Send Me Snaps’ to ‘My Friends.’ This reduces the chances of strangers sending unsolicited snaps.

**3\. Control Who Can View Their Story**

To maintain a tighter circle around your child’s Snapchat activity, set ‘View My Story’ to ‘My Friends’ in the ‘Who Can…’ section under ‘Settings.’ This way, only trusted individuals can view their stories.

****Educating Your Child About Strangers****

Snapchat is a platform where your child can receive friend requests from strangers. It’s crucial to teach them not to accept requests from people they don’t know personally. Remind them that not everyone on the internet has good intentions, and sharing personal information can lead to risks.

****Utilizing Parental Control Apps****

**Consider using parental control apps** to further enhance your child’s online safety and monitor your child’s Snapchat without them knowing. These apps allow you to set screen time limits, track your child’s online activity, and receive alerts if they engage in potentially harmful behavior on Snapchat.

****Encouraging Open Communication****

Maintaining open communication with your child is paramount. Make sure your child knows they can approach you with any concerns or uncomfortable experiences on Snapchat. A trusting relationship will make it easier for your child to seek help when needed.

****Monitoring Their Activity****

While trust is essential, it’s also wise to monitor your child’s Snapchat activity discreetly. You can do this by:

**1\. Adding Them as a Friend**

By adding your child as a friend on Snapchat, you can view their snaps and stories without them knowing. This allows you to keep an eye on their interactions without invading their privacy.

**2\. Checking Their Friends List**

Regularly review your child’s friends list to ensure they only have real-life friends added. If you notice any unfamiliar usernames, inquire about them. This helps in identifying potential risks.

****Teaching Responsible Posting****

Snapchat encourages sharing moments, but your child should be aware of the consequences of oversharing. Remind them not to post sensitive information, such as their location or personal details, and to avoid sharing inappropriate content. Once something is online, it’s challenging to remove it entirely.

****Conclusion****

In conclusion, ensuring your child’s safety on Snapchat and other platforms involves a combination of setting privacy settings, educating them about online dangers, maintaining open communication, discreetly monitoring their activity, teaching responsible posting, and using parental control apps. By taking these proactive steps, you can provide a secure environment for your child to enjoy social media responsibly.

Remember that staying involved in your child’s online world is the key to their safety. By being aware of their Snapchat usage and providing guidance, you can help them make informed choices and navigate the digital landscape with confidence.

****RELATED ARTICLES****

Teen girl facing up to 10 years for sending nude selfie

Student uses Snapchat’s gender filter to bust pervert cop

9 risky apps that you need to monitor on your kids’ smartphone

Microsoft’s new tool detects, reports pedophiles from online chats

Snapchat Safety for Parents: How to Safeguard Your Child

By Owais Sultan
A virtual phone number, also known as an online phone number, is a telephone number that is not tied to a specific physical phone line or location.
This is a post from HackRead.com Read the original post: How to Obtain a Virtual Phone Number and Why You Need One

There are numerous options available for acquiring virtual phone numbers, and some even offer the option to generate one for free.

Every day, people around the world face threats related to cybercrime, account hijacking, and identity theft. In such situations, it is necessary to take measures to protect yourself and your data.

One effective tool that contributes to improving privacy and security is the use of your phone number. However, sharing your number with social media platforms constitutes a breach of privacy, and this issue is often not discussed. In such cases, a virtual phone number becomes a savior. So what is a virtual phone number and how to get one?

****What is a virtual phone number and how to get one?****

A virtual phone number, also known as an online phone number or virtual phone line, is a telephone number that is not tied to a specific physical phone line or location. Instead, it operates through the internet, allowing you to make and receive calls and text messages using various devices, such as smartphones, tablets, or computers.

Virtual phone numbers are commonly used for various purposes, including maintaining privacy, account verification, separating personal and business communications, and enabling international calling without the need for a physical SIM card.

There are numerous options available for acquiring virtual phone numbers, and some even offer the option to generate one for free. One such solution is the mobile number generator provided by eSimPlus, enabling you to register for apps and services while preserving your anonymity.

****Advantages of virtual phone numbers****

A mobile number generator is an online tool that generates random phone numbers to be used in place of a real number when signing up on websites or applications. These numbers are not associated with actual individuals or SIM cards, making it impossible to identify or contact the owner.

One of the primary benefits of a fake number generator is enhanced online privacy. Typically, when registering on websites or apps, you are required to provide a phone number. However, using your real number can expose you to unwanted marketing messages, spam, or even data breaches, putting your personal information at risk. Utilizing a virtual number helps you avoid these issues.

Furthermore, a virtual number generator proves valuable when using services that necessitate temporary registration, such as ordering a taxi or reserving a hotel. Rather than supplying a real phone number that hackers could exploit, you can opt for a fake number that remains valid only for a specified duration and does not leave a trail behind. This provides an added layer of security for your online activities which, of course, should remain legal.

****How to ensure online privacy and security****

It’s important to emphasize that while a virtual number generator can enhance your online and offline privacy, it’s not a one-size-fits-all solution for all internet threats. It’s just one tool among many that can contribute to your overall security. In addition to using virtual numbers, implementing other measures to safeguard your data is essential.

First and foremost, use common sense. It is the best solution against both known and unknown threats. then, using strong passwords is crucial. Your passwords should be complex and unique for each account to minimize the risk of unauthorized access.

Secondly, exercise caution when opening email attachments or downloading files from untrustworthy sources. Viruses and malware can infiltrate your computer and compromise your personal information.

Third, make sure to regularly update your software and operating systems. Developers release updates that patch security vulnerabilities, so keeping your system up-to-date can help protect it from potential attacks.

Internet security is an ongoing concern that we encounter daily. While a mobile number generator is a useful tool for bolstering security and safeguarding personal data, it’s essential to complement it with strong password practices, cautious online behavior, and regular software updates to ensure comprehensive protection.