-
Jan 13, 2025 | 
kaspersky.com | Stan Kaminsky |Enoch Root |Mikhail Sytnik
The old saying, “A chain is only as strong as its weakest link”, directly applies to enterprise cybersecurity. Businesses these days often rely on dozens or even hundreds of suppliers and contractors, who, in turn, use the services and products of yet more contractors and suppliers. And when these chains involve not raw materials but complex IT products, ensuring their security becomes significantly more challenging.
-
Jan 10, 2025 | 
kaspersky.com | Enoch Root |Stan Kaminsky |Mikhail Sytnik
Researchers from three European universities recently demonstrated the so-called BadRAM attack. This attack is made possible because of a vulnerability in AMD EPYC processors, and primarily threatens cloud-solution providers and virtualization systems. In the worst-case scenario, the vulnerability could be used to compromise data from highly secure virtual machines. However, implementing this scenario in practice would be quite difficult.
-
Sep 27, 2024 | 
kaspersky.com | Evgeniya Russkikh |Enoch Root |Stan Kaminsky
Skills shortages in the cybersecurity industry are hardly a new phenomenon; however, in recent years it has become painfully acute. The trigger was the coronavirus pandemic, which provoked rapid digitalization of most everything in the world, and an equally rapid increase in the number of cyberattacks. This led to demand for cybersecurity professionals seriously outstripping supply. ISC2, a leading cybersecurity expert-certification company, publishes its Cybersecurity Workforce Study every year.
-
Sep 26, 2024 | 
kaspersky.com | Enoch Root
-
Aug 30, 2024 | 
kaspersky.com | Alanna Titterington |Enoch Root |Stan Kaminsky
After many years of research and testing, in mid-August 2023, the U.S. National Institute of Standards and Technology (NIST) finally introduced fully-fledged post-quantum encryption standards — FIPS 203, FIPS 204, and FIPS 205. So let’s discuss them and see why they should be adopted as soon as possible. Why do we need post-quantum cryptography? First, let’s briefly outline the threat quantum computers pose to cryptography.
-
Aug 29, 2024 | 
kaspersky.com | Enoch Root |Stan Kaminsky
Thanks to scientists at the University of the Republic (Uruguay), we now have a much better understanding of how to reconstruct an image from spurious radio emissions from monitors; more specifically — from signals leaked during data transmission via HDMI connectors and cables. Using state-of-the-art machine-learning algorithms, the Uruguayan researchers demonstrated how to use such radio noise to reconstruct text displayed on an external monitor. What, no one’s done it before?
-
Apr 17, 2024 | 
kaspersky.com | Stan Kaminsky |Enoch Root
The industrial scale of surveillance of internet users is a topic we keep returning to. Every click on a website, every scroll in a mobile app, and every word you type into a search bar is tracked by dozens of tech companies and advertising firms. And it affects not only phones and computers, but also smart watches, smart TVs and speakers — even cars. As it turns out, these motherlodes of information are used not only by advertisers offering vacuum cleaners or travel insurance.
-
Apr 16, 2024 | 
kaspersky.co.uk | Enoch Root |Stan Kaminsky
Scientific research of hardware vulnerabilities often paints captivating espionage scenarios, and a recent study by researchers from universities in the United States and China is no exception. They found a way to steal data from surveillance cameras by analyzing their stray electromagnetic emissions — aptly naming the attack EM Eye.
-
Apr 16, 2024 | 
kaspersky.com | Enoch Root |Stan Kaminsky
Scientific research of hardware vulnerabilities often paints captivating espionage scenarios, and a recent study by researchers from universities in the United States and China is no exception. They found a way to steal data from surveillance cameras by analyzing their stray electromagnetic emissions — aptly naming the attack EM Eye.
-
Mar 31, 2024 | 
kaspersky.com | Enoch Root |Stan Kaminsky |Alexey Sadylko
Unknown actors implanted malicious code into the versions 5.6.0 and 5.6.1 of the open source compression tools set XZ Utils. To make matters worse, Trojanized utilities managed to find their way into several popular builds of Linux released this March, so this incident could be regarded as a supply chain attack. This vulnerability has been assigned the number CVE-2024-3094. What makes this malicious implant so dangerous?
