 The emails of Germany's Green Party have been hacked, according to its co-leaders, Omid Nouripour and Ricarda Lang. The Green Party is one of the three ruling parties in the government coalition, together with SPD and FDP. More: - Nouripour and Lang, who serve as co-leaders of the third-largest party in Germany, stated that they were among the numerous hacking victims within the party. The threat actor is unknown so far.
- The breach is particularly worrying because hackers managed to breach not only the party's email addresses and communications system, which they use to exchange confidential information, but also government email accounts.
- According to the party, the emails were not fully accessed by the hackers, as they only managed to automatically forward certain emails to a point of direction that they chose.
- The attack was uncovered by the IT company that provides its services to the Green Party, while authorities are currently handling the case.
- This breach comes as the relationship between Germany and Russia is progressively worsening due to the war in Ukraine. Russia has vowed to decrease its energy supply to Europe if it continues to support Ukraine. Germany is one of the most dependent countries when it comes to Russian energy, causing fear that a potential hack may lead to information that Russia may abuse to gain leverage.
Zoom Out: - This is not the first time that key German actors have been targeted, as German fuel suppliers were attacked a few months ago.
| |
 Microsoft 365 suffered an outage in Europe that lasted for at least eight hours, as suspicions exist whether the outage is linked to protests in the U.K. Microsoft users were unable to use 365 office products such as Microsoft Teams, Exchange, Universal Print, etc. More: - Microsoft released a number of tweets addressing the issue, stating that the underlying cause of the outage is unknown, but they are redirecting the traffic to a source that can handle and maintain the traffic.
- The outage was still ongoing for most users even after Microsoft addressed the issues, which can be found in the company's admin center. The cases are tracked as EX394347 and MO394389.
- Most of the affected users were located in Europe, coinciding with the day that a strike in the U.K.'s railway industry is ongoing, and workers in this industry are working from home.
- Earlier today, many websites worldwide suffered an outage when Cloudflare, a company that provides the digital infrastructure for many companies on the internet, went down.
| |
 A message from SECURITY COMPASS Current approaches to Threat Modeling simply don’t work. - They are manual and inconsistent
- They take too long
- They don’t scale
- They don’t give developers what they need
Here you can find a series of posts breaking down how you can anticipate threats earlier in the software development life cycle to create more secure software. Learn more about current threat modeling challenges. See how a new, developer-centric approach to threat modeling can help your organization deliver secure software faster. Read Series on Threat Modeling And, yes, we understand that threat modeling is a time-consuming process that requires the expertise of security professionals and figuring out the best approach to mature application security programs can be difficult, especially with increasing internal demands for a faster time to market. According to this Total Economic Impact™study, SD Elements enabled its users to decrease the time needed to develop security requirements for products by 90%. See How
| |
 Gas transportation, windmill energy generation, and industrial manufacturing could be hacked due to the 56 flaws found in the software systems of Siemens, Motorola, Omron, etc. The flaws affect different parts of their software but pose a major risk to the companies and clients. More: - Researchers, who named the report Icefall in reference to the large amount of work the companies have to do to patch the bugs, separated the bugs into four main categories: Insecure engineering protocols, weak cryptography, insecure firmware updates, and remote code execution risk.
- While all of these risks can be manipulated in different ways, they share the same end result, which is that the victim can be breached and have their data abused.
- The reasons these risks are still present at these companies vary, but one of the main contributors was ignoring security protocols.
- 38% of the bugs were related to credential compromising.
- Firmware manipulation stood at 21%, while remote code execution and configuration manipulation were at 14% and 8%, respectively.
- Not all companies, however, shared the same issues.
- For example, Bently Nevada is risked by a threat tracked as CVE-2022-29953. This threat makes the company liable for remote code execution due to its bugs in the interface management system.
- Emerson is risked by multiple bugs, such as CVE-2022-29957, CVE-2022-29962, CVE-2022-29963, etc.
- While Bently is risked mainly by RCE attacks, Emerson is at risk for numerous compromise of credentials attacks. This company is the most liable out of all the companies mentioned in the report.
- Companies such as Siemens and Motorola are also liable for numerous attacks. Motorola is susceptible to bugs such as CVE-2022-30276 (Configuration manipulation), CVE-2022-30273 (Authentication bypass), CVE-2022-30270 (Compromise of credentials), etc. Siemens is noticeably less liable to breaches, being highlighted for only one flaw, which is tracked as CVE-2022-33139.
- Some of the scenarios in which hackers can breach these systems are natural gas transportation, wind energy generation, manufacturing, etc.
| |
 A U.S. citizen was sentenced to two years in federal prison for running two popular DDoS services. The 33-year-old, named Mathew Gatrel, was sentenced during a short trial that lasted nine days. More: - Through his two websites, downthem.org and ampnode.com, Gatrel provided a subscription service that allowed people who paid for those services to launch powerful DDoS attacks against specific targets. The power of the attacks depended on how much the users paid for the services.
- Besides being able to launch the attacks themselves, Gatrel also provided consultation on which methods were the most effective as a way of luring people to pay, as well as offering to undertake the attack himself.
- The service was able to launch over 200,000 attacks and attract over 2,000 paying users.
- These attacks affected victims worldwide and managed to breach both individuals as well as organizations such as universities, hospitals, financial institutions, government institutions, etc.
- Gatrel was not the only one that was sentenced in the case, as 29-year-old Juan Martinez pleaded guilty to helping Gatrel launch the attacks and administer the website.
- The official charges in which Mathew Gatrel was found guilty are conspiracy to commit unauthorized impairment of a protected computer, conspiracy to commit wire fraud, and unauthorized impairment of a protected computer.
| |
 A message from MONDAY.COM Success and efficiency go hand in hand. And a big part of efficiency comes down to great teamwork. monday.com is the customizable work platform that empowers your team members to collaborate seamlessly and reach new heights, by simplifying and effectivizing workflows. Here’s how: - clever automations eliminate tedious tasks, such as reminders and status updates.
- ready-made templates let you plan, track, and manage everything from simple to complex projects - in one place.
- communication and collaboration in real-time on visually intuitive boards enables everyone to spend less time in meetings, and get more done.
- integrations connect your favorite tools, so you can continue using them all within the platform.
There are even more ways monday.com can help you and your team do your best work. Let us show you how. Get Started 
| |
 A new bug could let hackers take control of your Windows network. The bug, tracked as DSFCoerce, takes advantage of weaknesses in security protocols, potentially resulting in a remote-controlled hack. More: - DSFCoerce takes advantage of Microsoft's Active Directory Certificate Services. This service is used by companies who have Windows installed with the purpose of verifying which user is real and which is not in a specific Windows domain.
- This process has been highlighted to be susceptible to coercion attacks through a variation of the old PetitPotam variant. Through this breach, the hackers can falsely send a signal that intercepts the user and the network, getting in between the two. From there, the threat actor can coerce the server and take control of the network and/or devices involved.
- Microsoft has acknowledged the bug, recommending its users to utilize the Extended Protection for Authentication and disable HTTP on AD CS servers. Further steps that the company instructs its clients to take are to disable NTLM Authentication in their Windows domains, disabling NTLM on AD CS servers, etc.
| |
Quick Hits: - Learn why many SMEs are pivoting away from perimeter-based security to a Zero Trust model.*
- EvolutionQ has raised a $5.5M Series A funding round.
- Cybersecurity job hiring in North America is going up exponentially compared to the same period in the previous year.
- Israeli cybersecurity experts are claiming that Iran may be behind a cybersecurity attack in which the emergency sirens were activated in multiple cities.
- Latin American countries may be more susceptible to cyberattacks due to their lack of investment in the field so far.
- Adobe tools help you create, manage, and distribute personalized content. Take this self-assessment to test your brand’s content velocity.*
*This is a sponsored post.
| |
Upcoming events at Inside: - June 22 - AMA with Daniel Stedman (Pressto) (Register Here)
- June 30 - HR Strategies to Retain Remote Employees (Register Here)
- July 20 - The Rise of Metaverse Gaming (Register Here)
- July 27 - Need To Know NoCoder - Yassine Tahi (Kinetix) (Register Here)
- August 17 - Build Your Diversified Portfolio: How To Invest in Bear Markets (Register Here)
- September 14 - Are Electric Cars Worth It? (Register Here)
| |
 |  | Arbër is an Inside writer who also has experience in entrepreneurship. He has experience covering Consumer Tech, Venture Capital, NFTs, Crypto, etc. Arbër holds a Bachelor's degree in Business from XAMK University in Finland. When he is not reading(and writing) business news, he chooses to watch sports or anime...and then read news about sports or anime. |   | | Editor | Aaron Crutchfield is based in the high desert of California. Over the last two decades, he has spent time writing and editing at various local newspapers and defense contractors in California. When he's not working, he can often be found looking at the latest memes with his kids or working on his 1962 Ford. | |
Security Compass is on a mission to accelerate software time-to-market while managing risk. | |
Boost your team’s efficiency and streamline workflows - with the help of monday.com. | |
Comments
Post a Comment