A new whitepaper from Microsoft highlights the risks of software supply chain attacks for organisations that pull package dependencies from public repositories like npm, RubyGems and PIP. A dependency confusion attack or supply chain substitution attack occurs when a software installer script is tricked into pulling a malicious code file from a public repository instead […]
What is a dependency confusion attack? Read More »
Described as the most sophisticated hack ever – what is the SolarWinds hack and how might it affect your business? SolarWinds provides network monitoring software to thousands of large enterprises and government departments. One of the SolarWinds products, called Orion, was compromised in a supply chain attack, and was then used to deliver Solarigate malware
SolarWinds and Solarigate Hacks Explained Read More »
Taiwan based Zyxel Networks has issued patches for their enterprise grade firewalls after a hard coded credential vulnerability was discovered by security researchers. The vulnerability provides attackers with root level access over SSH or the Web Administration interface allowing firewall rules to be changed to permit easy access to the network behind the firewall. Zyxel
100000 Zyxel firewalls have hardcoded backdoor exposed Read More »
SolarWinds provides tools used by security and network managers in many of the largest businesses and governments in the world. Since March 2020 hackers inserted their own code into SolarWinds Orion software which was downloaded by some 18,000 customers – providing a backdoor into those customers’ networks. SolarWinds Orion is a network health and performance
SolarWinds hack sends chills through security industry Read More »
Google has issued an urgent update for Chrome which patches a zero-day vulnerability under active exploitation. The Chrome team took just one day from report of the vulnerability to issuing the patch, such is the danger posed by this flaw. The patch is included in Chrome version v86.0.4240.111 (CVE-2020-15999) – any older versions should be
Google Patches Chrome Zero-Day Vulnerability Read More »
Microsoft has patched a Remote Code Execution vulnerability in Visual Studio which could be exploited by creating a code repository – such as for a popular open source tool – and convincing a developer to clone and open it. The vulnerability (CVE-2020-17023) exists in the handling of the ‘package.json’ file and can be exploited to
Visual Studio RCE Vulnerability Patched Read More »
Achilles is the name of a set of 400 security vulnerabilities found in the Qualcomm chips that power a billion Android devices – many of which may never get fixed. Discovered by researchers at CheckPoint, the vulnerabilities all relate the DSP chip which is part of the Snapdragon processor that powers the phones and tablets.
What is the Achilles vulnerability? Read More »
For 20 years a small two person firm in Ohio has licensed their TCP/IP software stack for use in embedded systems and IoT devices – from printers to medical devices. In June a collection of 19 vulnerabilities in this software was disclosed – affecting millions of devices from 50 different vendors. The collection of vulnerabilities
Ripple20 vulnerability affects millions of devices Read More »
Security Awareness Training is an essential component of any organisation’s information security. Even though it is mandated by frameworks such as PCI-DSS or ISO 27001, Security Awareness Training should be more than just a compliance exercise. A good security awareness training programme will drive changes in behaviour amongst staff, suppliers and customers that will improve
What is Security Awareness Training Read More »
Cable Haunt is a vulnerability in millions of cable modems which allows an attacker to execute arbitrary code on the modem. This vulnerability is interesting for two reasons – firstly the scale due to the number of vulnerable devices and secondly how the vulnerability came about. Cable Haunt is a buffer overflow defect in the
What is Cable Haunt? Read More »
SecureTeam Ltd,
Kemp House, 152 City Road,
London,
EC1V 2NX
10257784
GB 249480968
SecureTeam Ltd, Kemp House, 152 City Road,
London, EC1V 2NX
Mon – Fri: 09:00 – 17:00
Company Number: 10257784
VAT Registration No: GB 249480968
© SecureTeam 2023. All rights reserved.