The Age-Old Art of Social Engineering: Lessons from Sherlock Holmes’ Playbook Sherlock Holmes, the iconic detective created by Sir Arthur Conan Doyle, was long before his time. But what if we told you that this fictional character’s techniques are still being used today? In a fascinating session at DEF CON 34, University of West Florida’s … Read more
A growing number of cybersecurity researchers are being put at risk by outdated cybercrime laws that fail to distinguish between malicious hackers and those working in good faith. A recent study has highlighted this issue, revealing that many countries have yet to update their policies and laws to reflect the evolving nature of security research. … Read more
A Sneaky Supply Chain Attack Hits WordPress Sites, Leaving a Trail of Rogue Admins in Its Wake A sophisticated cyber attack has been discovered targeting BdThemes, a popular WordPress theme provider. The malicious scheme involves injecting poisoned JSON files into the supply chain, which ultimately creates rogue administrators on compromised sites. This brazen attack not … Read more
Sherlock Holmes: The Original Social Engineer In a fascinating display of how timeless social engineering techniques remain, Professor Elizabeth Rasnick has drawn parallels between the fictional detective Sherlock Holmes and modern-day tactics used by threat actors. Her session at DEF CON 34 highlighted the importance of prioritizing human element security awareness training in organizations. Holmes’s … Read more
Cybersecurity Researchers Face Prison Time Due to Outdated Laws A growing concern in the cybersecurity community is the outdated laws that put security researchers at risk. In some countries, including the United Kingdom, security researchers who responsibly disclose vulnerabilities can face imprisonment or fines under laws that don’t differentiate between malicious hackers and those working … Read more
Sophisticated iPhone exploit chains that were previously reserved for nation-state actors have suddenly and alarmingly spread to organized cybercrime groups around the globe. The complex malware frameworks, known as Coruna and DarkSword, are being used by a wide range of malicious actors, from advanced persistent threat (APT) groups to run-of-the-mill hackers. According to research firm … Read more
Cybersecurity teams are facing a daunting challenge in the form of a “patch gap,” where attackers are increasingly exploiting vulnerabilities before patches are even available, leaving defenders scrambling to keep up. This issue is not just about patching faster or prioritizing high-severity vulnerabilities, but rather about fundamentally changing how we approach vulnerability management. The recent … Read more
A Zero-Day SQL Injection Vulnerability in Metabase Cloud Threatens Widespread Consequences A critical vulnerability has been discovered in Metabase Cloud, a business analytics platform used by numerous organizations worldwide. The zero-day SQL injection flaw allows attackers to gain remote administrator access to affected instances, compromising sensitive data and potentially leading to further attacks on downstream … Read more
Sophisticated iPhone exploit chains once limited to nation-states are spreading rapidly to organized cybercrime groups, posing a significant threat to global security. Two advanced iOS exploit chains, Coruna and DarkSword, have been making headlines in recent months due to their complex nature and widespread adoption. Initially used by nation-state actors and commercial surveillance vendors, these … Read more
The Patch Gap: Why Traditional Vulnerability Management Won’t Cut It in Today’s Threat Landscape Imagine being told that, on average, it takes just four hours for attackers to exploit a newly discovered vulnerability after it’s publicly disclosed. Sounds alarming? That’s exactly what’s happening right now. The rate at which vulnerabilities are being exploited has increased … Read more