Security Boulevard

Authors/Presenters:Qinhong Jiang, Xiaoyu Ji, Chen Yan, Zhixin Xie, Haina Lou Wenyuan Xu

Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access. Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.

Permalink

The post USENIX Security ’23 – GlitchHiker: Uncovering Vulnerabilities of Image Signal Transmission with IEMI appeared first on Security Boulevard.

GRU Unit 29155 is well known for carrying out cyber attacks with the sole purpose of espionage, sabotage, and reputational harm.

The post SafeBreach Coverage for AA24-249A (GRU Unit 29155) appeared first on SafeBreach.

The post SafeBreach Coverage for AA24-249A (GRU Unit 29155) appeared first on Security Boulevard.

via the respected Software Engineering expertise of Mikkel Noe-Nygaard and the lauded Software Engineering / Enterprise Agile Coaching work of Luxshan Ratnaravi at Comic Agilé!

Permalink

The post Comic Agilé – Mikkel Noe-Nygaard, Luxshan Ratnaravi – #305 – Two Full Days on Big Room Planning appeared first on Security Boulevard.

Eaten by a GRU: Fake ransomware created by Russian GRU Unit 29155 attacked Ukraine and NATO—a month before the full scale invasion.

The post Russian ‘WhisperGate’ Hacks: 5 More Indicted appeared first on Security Boulevard.

You can now test the security of persisted GraphQL Queries with Escape's platform. This new capability enhances our GraphQL API security testing

The post Product Updates: Persisted GraphQL Query Support appeared first on Security Boulevard.

Cryptography and digital certificates form the security backbone of modern digital enterprises. As organizations increasingly adopt multi-cloud strategies to leverage the best services from different cloud providers, they face significant challenges in managing digital certificates. Mismanaged certificates can lead to outages, security breaches, and compliance violations—issues that no organization can afford. This blog provides a […]

The post Navigating Certificate Lifecycle Management in Multi-Cloud Environments appeared first on Security Boulevard.

Reading Time: 3 min Configure BIMI for Zoho Mail and display your brand logo with a verified checkmark! Boost brand trust with Zoho BIMI.

The post BIMI Setup Guide for Zoho Mail – Getting the Blue Verified Checkmark appeared first on Security Boulevard.

NIST has released Version 2.0 of its widely used Cybersecurity Framework (CSF), a guidance document for mitigating cybersecurity risks. This update is not just a revision but a transformative approach to secure digital assets and infrastructures. The new version represents a significant advancement in addressing the evolving and complex cyber threats, offering a forward-looking perspective […]

The post NIST CSF 2.0 Cyber Security Framework appeared first on Kratikal Blogs.

The post NIST CSF 2.0 Cyber Security Framework appeared first on Security Boulevard.

The lifecycle of software inevitably draws to a close, leaving many organizations grappling with the challenges of upgrading legacy systems. For Linux users, particularly those reliant on CentOS 7 and CentOS Stream 8, the recent end-of-life (EOL) dates have presented a daunting dilemma. The end of support means no more security updates, patches, or official […]

The post Beyond End of Life: Securing Legacy Linux Systems Like CentOS 7 appeared first on TuxCare.

The post Beyond End of Life: Securing Legacy Linux Systems Like CentOS 7 appeared first on Security Boulevard.

A healthy approach to GenAI is one in which organizations build security protections from the start. Here are tips on how to integrate security into your organization's GenAI strategy from day zero.

The post Why and How to Secure GenAI Investments From Day Zero appeared first on Security Boulevard.

Zero-trust, rooted in the principle of "never trust, always verify," requires organizations to assume that every access request, whether internal or external, is potentially harmful.

The post Overcoming the Challenges of Zero-Trust appeared first on Security Boulevard.

The inherent limitations of signature-based approaches have often driven practitioners and vendors to shift toward behavioral methods.

The post Is Cloud Security Ready for a Pivot to Behavioral Detection & Response appeared first on Security Boulevard.

In light of recent cybercrime events, details pertaining to the Cisco zero-day flaw that has now been patched have emerged. As per the details, the flaw, if exploited, could allow threat actors to seize control of appliances and aid in evading detection. In the article, we’ll dive deep into the Cisco zero-day flaw and determine […]

The post Velvet Ant Exploits Cisco Zero-Day Flaw For System Control appeared first on TuxCare.

The post Velvet Ant Exploits Cisco Zero-Day Flaw For System Control appeared first on Security Boulevard.

 

The National Public Data breach has been a nightmare, exposing names, addresses, birthdates, emails, phone numbers, and Social Security Numbers of countless individuals — including mine.

As a California resident, I have the legal right to demand that they delete my personal data to prevent further exploitation. I simply don’t trust them ever having my data. However, my experience with their opt-out process has been incredibly frustrating and disheartening.

I tried to take action. First, I checked whether my data was part of the breach via their lookup page (https://npdbreach.com/). Unfortunately, I was indeed affected.

Next, I followed the instructions on their Opt-Out page (https://nationalpublicdata.com/optout.html). The automated call system repeatedly informed me that no one was available to take my call. It allowed me to leave a voicemail, but I have little faith that this will result in any action — especially considering the sheer scale of this breach, involving billions of exposed records.

Curiously, they also direct privacy requests to their Sales email account ([email protected]). Why is this critical issue routed through their sales department? It doesn’t inspire confidence that my data deletion request will be handled properly or even taken seriously.

I’ve left a voicemail and sent an email, covering all possible bases. Yet, I remain skeptical. My concern is that this difficult, convoluted process further disrespects the privacy rights of many citizens. My guess is that this friction for customers to request data deletion is purposeful and will become a serious liability for National Public Data.

Has anyone else successfully navigated this data-deletion process with this company? And does anyone know if there is a California class action lawsuit related to this breach?

We need to protect ourselves and hold organizations accountable for securing our personal information.

The post Frustration Trying to Opt-Out After the National Public Data Breach appeared first on Security Boulevard.

LoginRadius analyzed data from its Consumer IAM (CIAM) Platform, utilized by over 500 brands globally. The report offers a unique perspective on global consumer identity trends in 2024, delivering insights into consumer behavior regarding digital identities and providing a comprehensive analysis of their behavior patterns and lifecycle.

The post LoginRadius Releases 2024 Consumer Identity Report, Highlights the Shifting Trends in Consumer Preferences appeared first on Security Boulevard.

Axio Senior Cybersecurity Advisor, Richard Caralli’s recent article in Dark Reading, Why Are Organizations Losing the Ransomware Battle? examines the growing problem of ransomware attacks, emphasizing that many organizations are

Read More

The post Why Are Organizations Losing the Ransomware Battle? appeared first on Axio.

The post Why Are Organizations Losing the Ransomware Battle? appeared first on Security Boulevard.

Trackers are everywhere and come in many different forms. Some tracking methods are more invasive than others; this post aims to explain what "trackers" are, how they work, and give examples of the data they collect.

TABLE OF CONTENTS

• A word on Fingerprinting
• What are trackers?
• • Tracking pixels
  • • Meta Pixel
  • Tracking Cookies
  • Tracking URLs
  • Analytics software
• What data do trackers collect?
• Enter: Server-side tracking
• Blocking trackers
• Final thoughts

A word on Fingerprinting

Fingerprinting, tracking, and trackers go hand-in-hand. Generally, fingerprinting focuses on reliably identifying unique users - this identity is often then used by tracking mechanisms.

Fingerprinting uses the information found on/sent by your device to identify you and subsequently track you. Identification by unique properties such as browser settings, device information, and connected networks (to include nearest cell towers) are the building blocks of creating a unique user profile.

Fingerprinting takes into account your entire device and factors directly surrounding it - your browser, connected networks, the operating system (exact build and version), browser settings, browser add-ons/extensions, hardware of the device, and more. Fingerprinting is as invasive as it is accurate; for example, the EFF has estimated that only 1 in 286,777 browsers will share the same fingerprint. Naturally, some fingerprinting techniques are more invasive than others.

Fingerprinting has evolved so much so that it is next to impossible to simply "block all fingerprinting" techniques. In fact, it has been demonstrated that on some devices - such as smartphones - some fingerprinting attacks are not possible to block.

What are trackers?

Trackers come in many forms. Generally, regardless of what form of tracking is used, trackers are designed to either 1) track you across different websites, web services, and web apps or 2) collect identifying information about you and your device(s). Frequently, they do both.

Many proponents of tracking say that it is beneficial for users because they can get personalized recommendations. While this is true, it comes at the price of the user's privacy; often times, users don't understand just what this privacy cost entails even if they are aware of it.

Though as we collectively learn of tracking (and fingerprinting) technologies/methods, what data they can capture, and just who that data is shared with - we should strongly consider: Is the price worth it?

Tracking pixels

Tracking pixels (also known as web beacons or pixel tags) are 1x1 pixel-sized images typically embedded in web pages, ads, and emails. Though they are images and load like images, they're so small that they're invisible to the human eye.

Once loaded, tracking pixels capture data typically about user activity and engagement. For example, tracking pixels are almost ubiquitously used in emails - particularly, marketing emails - to track if and when a recipient opens an email; tracking pixels embedded in emails can report the exact date and time an email was opened, location of the device used to open the email, and in which email client the email was opened.

Source: Ionos

Tracking pixels are also commonly found in advertisements. Tracking pixels embedded in advertisements are often called "ad trackers" - though this term could also include other tracking methods, such as tracking cookies; they can track views, clicks, referral sources, and conversions in displayed advertisements.

Some websites use tracking pixels as well. They're typically used in combination with analytics software and tracking cookies, though of course this varies immensely between websites. Some may even use multiple tracking pixels, of which are commonly JavaScript code provided by third parties (like the Meta Pixel).

Tracking pixels are versatile and depending on where they are embedded and the entities using them, they can collect many pieces of data such as (but not limited to):

• Browsing history
• Search history
• Location data
• Device information (type, operating system, etc)
• Conversions
• Clicked ads within the ad network
• Data submitted to websites
• Email client information
• Email open data, time
• Information from cookies stored on your device (are you signed into another service?)
• Social media profile information

Meta Pixel

A rather well-known and infamous tracking pixel is the Meta Pixel (formerly: Facebook Pixel). It is embedded on millions of websites and has shown to be ruthlessly efficient in collecting massive amounts of data - including sensitive data such as tax record information, veteran statuses, addresses, and even health information.

The Meta Pixel in recent times has been the subject of privacy litigation in 2022 and 2023 (and likely going forward), mostly due to it facilitating sensitive data and information sharing - especially where the data was not to be shared with third parties "by law" (think: violating HIPAA) without expressed consent from users.

Tracking Cookies

Cookies are bits of data that get stored on your web browser by websites. You've probably heard of first-party and third-party cookies; first-party cookies are placed by the website itself whereas third-party cookies are placed with a different entity that loads on that same website, such as ads served by an ad network.

Some cookies are essential for certain websites to function. Some websites have many cookies that retain many bits of differing information that could get annoying for users to continuously define on subsequent visits. For example, session cookies may be used to reauthenticate you to a website on a subsequent visit - you don't have to login again. Session cookies may also retain saved preferences (dark mode or light mode?) and other details between visits.

Source: CookieYes

Of course, some cookies in your browser may also be tracking cookies. Note that tracking cookies don't do the active tracking themselves, but they store information websites interested in tracking your activity can retrieve and read later, often collecting personal information. Tracking cookies can be first-party or third-party, but are commonly third-party.

For collection by calling websites/hosts, tracking cookies can store:

• Browsing history (visited sites)
• Length of stay on a given site
• Interaction data with a site (ex: how many pages you click through)
• Advertisements clicked
• Purchased products
• Information put into web forms (even without pressing the submit button)
• Location data
• Personal information given to a website

Once upon a time, due to Safari and Firefox blocking third party cookies by default and laws such as the EU's GDPR coming into effect, third-party cookies were seemingly on their way out. Big Tech companies - such as Google and Microsoft - sought to kill the cookie and rolled out plans to do so. Specifically, the initiative to phase out tracking cookies was spearheaded by Google in anticipation of rolling out their Topics API/Privacy Sandbox (which was initially "FloC").

However, in July 2024, Google announced it was no longer...

The post An Introduction to Trackers and the Data They Collect appeared first on Security Boulevard.

Authors/Presenters:Zheng Li, Ning Yu, Ahmed Salem, Michael Backes, Mario Fritz, Yang Zhang

Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access. Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.

Permalink

The post USENIX Security ’23 – UnGANable: Defending Against GAN-based Face Manipulation appeared first on Security Boulevard.

When Google decided to stop trusting new TLS certificates from Entrust, it didn’t just create a technical challenge—it unleashed an operational crisis for many organizations. If your business uses Entrust TLS certificates, you are facing one of two realities right now. If you are using a certificate lifecycle management (CLM) platform that provides Certificate Authority […]

The post Managing Certificate Chaos After Google’s Entrust Distrust first appeared on Accutive Security.

The post Managing Certificate Chaos After Google’s Entrust Distrust appeared first on Security Boulevard.

via the comic & dry wit of Randall Munroe, creator of XKCD

Permalink

The post Randall Munroe’s XKCD ‘Lava Lakes’ appeared first on Security Boulevard.