Cybercriminals have recognized that instead of attacking an organization head-on, they can infiltrate through the software supply chain—like slipping counterfeit parts into an assembly line. According to the 2024 Sonatype State of the Software Supply Chain report, attackers are infiltrating open-source ecosystems at an alarming rate, with over 512,847 malicious packages detected last year alone—a 156% increase from the previous year. Traditional security tools and processes often miss these threats, leaving organizations unprepared.
Cloudflare CDN flaw leaks user location data, even through secure chat apps
A security researcher discovered a flaw in Cloudflare’s content delivery network (CDN), which could expose a person’s general location by simply sending them an image on platforms like Signal and Discord.
While the geo-locating capability of the attack is not precise enough for street-level tracking, it can provide enough data to infer what geographic region a person lives in and monitor their movements.
WH National Cyber Director Finalizing Software Liability Proposals
The outgoing White House national cyber director is highlighting the progress his office made over the last four years, while also queuing up key issues, like regulatory harmonization and software liability, for the incoming Trump administration.
White House National Cyber Director Harry Coker, speaking at the Foundation for the Defense of Democracies in Washington on Tuesday, ran down his office’s signature efforts, including the 2023 national cyber strategy and the push to establish minimum cyber standards for critical industries.
FBI, CISA say Chinese hackers are still lurking in US telecom systems
Leading U.S. cybersecurity agencies on Tuesday said that Chinese hackers likely still have access to critical telecommunications systems, and published guidance to help engineers and network defenders identify and remove the threat actors. In a call with reporters, senior officials at the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI said the agencies have been investigating the incident since late spring, and have uncovered an expansive campaign that some lawmakers are calling the worst telecom hack in the nation’s history.
Homeland Security Committee reveals Cyber Threat Snapshot on rising cyber threats from nation-states, hacker networks
The U.S. House Committee on Homeland Security published a new ‘Cyber Threat Snapshot’ examining growing threats posed by malign nation-states and criminal networks to the homeland and American data. Identifying some of the recent notable attacks, the report zeroed in on the Salt Typhoon attack by Chinese hackers, who reportedly infiltrated backdoors in major U.S. internet service providers; and activities by the Volt Typhoon adversaries, who compromised U.S. critical infrastructure for at least five years, targeting the transportation, telecommunications, and energy sectors.
LastPass warns of fake support centers trying to steal customer data
LastPass is warning about an ongoing campaign where scammers are writing reviews for its Chrome extension to promote a fake customer support phone number. However, this phone number is part of a much larger campaign to trick callers into giving scammers remote access to their computers, as discovered by BleepingComputer.
LastPass is a popular password manager that utilizes a LastPass Chrome extension to generate, save, manage, and autofill website passwords.
Supply Chain Attacks Can Exploit Entry Points in Python, npm, and Open-Source Ecosystems
Cybersecurity researchers have found that entry points could be abused across multiple programming ecosystems like PyPI, npm, Ruby Gems, NuGet, Dart Pub, and Rust Crates to stage software supply chain attacks.
“Attackers can leverage these entry points to execute malicious code when specific commands are run, posing a widespread risk in the open-source landscape,” Checkmarx researchers Yehuda Gelb and Elad Rapaport said in a report shared with The Hacker News.
14 Million Patients Impacted by US Healthcare Data Breaches in 2024
Over 14 million patients have been affected by data breaches caused by malware attacks on US healthcare organizations so far in 2024, according to a new analysis by SonicWall.
Most (91%) of these breaches have leveraged ransomware, with the report highlighting that attackers see the threat of exposing sensitive information held by healthcare organizations as an effective method for extorting ransom payments.
Managing supply chain resilience assessment model-relevant factors and activities using an FCM-FBWM approach
Supply chain resilience is essential for companies to survive in today’s competitive market, as they face environmental and unforeseeable challenges in their supply chain. This paper aims to model and manage the factors and activities that influence supply chain resilience and how they relate to each other. This will help us devise plans for enhancing the resilience of a supply chain.
Same destination, different roadmaps: the journey to zero trust architecture
While all federal agencies are striving to reach the same place, no two agencies are taking the same path to get there. Hear from cyber leaders at the Cybersecurity and Infrastructure Security Agency, the Interior Department, the Secret Service and Verizon:
- Louis Eichenbaum, zero trust program manager at Interior
- Sean Connelly, former director of CISA’s Zero Trust Initiative
- Roy Luongo, CISO for the Secret Service
- Wes Withrow, senior client executive for cybersecurity at Verizon