Cryptojacking is often treated as a nuisance-level threat — low on the priority list compared to ransomware or data exfiltration. But recent campaigns, including those attributed to the threat group JINX-0132, have exposed a far more systemic issue: attackers are abusing control plane misconfigurations in cloud and DevOps environments to quietly hijack compute at scale.

These attacks don’t rely on zero-day exploits. Instead, they capitalize on operational gaps — exposed APIs, lax access controls, and unaudited runtime behavior. The result is often a silent drain on cloud budgets and degraded infrastructure performance that goes undetected until costs spike or workloads fail to meet SLAs.

The Shift in Tactics: Control Plane, Not Code

Groups like JINX-0132 are targeting platforms such as HashiCorp Nomad, Consul, Docker, and Gitea. In many cases, systems are deployed with default settings that leave them publicly accessible or allow anonymous job execution. Once identified, attackers submit jobs or containers that run XMRig or similar mining payloads.

Because these operations use native APIs and run as seemingly legitimate workloads, they often bypass conventional security tools. What’s more, infrastructure teams may not realize that a new job pulling 90% of CPU/GPU over days is unauthorized — until cloud costs or capacity constraints trigger alarms.

Why Traditional Security Isn’t Catching It

The problem isn’t a lack of security tooling — it’s a lack of observability in the right layers. Most detection strategies focus on guest-level behavior or known malware signatures. But these attacks occur above the guest OS, often as authorized actions in an insecure or misconfigured environment.

What’s missing in many organizations is real-time visibility into:

• Infrastructure configuration drift, especially public exposures or weakened ACLs
• Control-plane activity, such as job deployments and container launches
• Anomalous resource utilization tied to previously unseen workloads

This is where infrastructure observability — traditionally seen as a performance or operations function — becomes critical to security.

Mapping the Cryptojacking Chain to Observability Signals

Chart courtesy of Crandall

By embedding observability into these phases, teams can reduce dwell time, contain resource abuse early, and ensure accurate attribution for response and remediation.

5 Practices to Reduce Exposure

1. Audit and monitor infrastructure configurations continuously, especially for cloud-native tools and internal platforms exposed to the internet.
2. Instrument control-plane activity, including job scheduling APIs, container deployments, and image fetches.
3. Establish baselines for workload behavior, then detect and respond to significant deviations in compute, memory, or egress.
4. Correlate operational telemetry with financial data, making cost anomalies a detection vector — not a retrospective audit.
5. Ensure traceability from deployed workloads back to the user, token, or system that triggered them.

Observability as a Security Signal

The infrastructure layer is no longer just a performance concern — it’s a security surface. As attackers increasingly rely on operational blind spots, organizations must evolve their visibility strategies. That means combining traditional performance telemetry with control plane insights and configuration state awareness to detect abuse that evades traditional controls.

Whether the goal is to detect cryptojacking, stop unauthorized lateral movement, or prevent supply chain tampering, the ability to observe and attribute behavior across the full stack is now essential.

Infrastructure observability isn’t just about uptime anymore — it’s about control. And for many organizations, it may be the only line of defense standing between misconfiguration and massive compute loss.

https://www.securitymagazine.com/articles/101802-devops-missteps-fuel-crypto-mining-why-infrastructure-observability-is-a-security-imperative

Lug 31, 2025 Marina Londei Attacchi, In evidenza, Intrusione, News, RSS 0

---

I ricercatori di IB-Group hanno individuato un attacco molto particolare a opera di UNC2891: il gruppo cybercriminale ha progettato un’intrusione ai sistemi bancari utilizzando un Raspberry Pi per l’accesso fisico agli ATM. 

La particolarità dell’attacco è che la tecnica usata non era documentata né riconosciuta dal framework MITRE ATT&CK e ha permesso al gruppo di accedere alla rete bancaria tenendo un basso profilo, eludendo i controlli di sicurezza tradizionali. “Group-IB è stato il primo a scoprire che UNC2891 ha installato fisicamente un Raspberry Pi nella rete interna di una banca – collegandolo allo stesso switch degli ATM – e usato un modem 4G per ottenere l’accesso remoto” spiegano i ricercatori della compagnia di sicurezza.

Collegando il dispositivo allo stesso switch di rete usato per gli ATM, il gruppo lo ha di fatto inserito direttamente nella rete bancaria; grazie al modem 4G del dispositivo, inoltre, gli attaccanti hanno potuto in seguito accedere da remoto. Il gruppo ha poi utilizzato la backdoor TINYSHELL per stabilire un canale di comunicazione C2 con la rete bancaria.

Sebbene la connessione del Raspberry Pi fosse visibile, il processo associato non aveva alcun ID associato, il che ha complicato l’analisi dei tool di forensica digitale. “Il beaconing in uscita avveniva ogni 600 secondi e si sono verificati ripetuti tentativi di connessione al Raspberry Pi sulla porta 929. Tuttavia, durante la fase di triage non sono stati rilevati ID di processo (PID) corrispondenti né processi sospetti” continuano i ricercatori.

L’analisi più approfondita della memoria ha permesso di individuare la backdoor, il cui processo era offuscato. La backdoor è riuscita a stabilire una connessione con il Network Monitoring Server e da lì con il Mail Server per mantenere la persistenza, anche nel momento in cui il Raspberry Pi è stato rimosso. Per il movimento laterale il gruppo ha usato dei processi soprannominati “lightdm”, nome usato per simulare l’esecuzione di LightDM, il display manager usato nei sistemi Linux.

Il team di Group-IB ha rivelato che l’obiettivo finale degli attaccanti era colpire il server di switching degli ATM per eseguire CAKETAP, un rootkit in grado di manipolare le risposte di HSM (Hardware Security Module), il dispositivo fisico per la gestione delle chiavi crittografate.

In seguito, il gruppo avrebbe potuto effettuare lo spoofing dei messaggi di autorizzazione delle transazioni finanziarie per eseguire operazioni fraudolente. Fortunatamente, la campagna è stata individuata e interrotta in tempo. Anche se è stato sventato, l’attacco deve servire da importante lezione per gli istituti bancari di proteggersi non soltanto dai vettori di accesso logici, ma anche fisici. 

---

---

---

https://www.securityinfo.it/2025/07/31/un-raspberry-pi-per-hackerare-accedere-alla-rete-bancaria-lattacco-di-unc2891/?utm_source=rss&utm_medium=rss&utm_campaign=un-raspberry-pi-per-hackerare-accedere-alla-rete-bancaria-lattacco-di-unc2891

A report from Veriff shows that 1 in 20 online identity verification attempts are fraudulent in the financial services sector.

The report suggests that the increase in online identity verification fraud in the sector corresponds with the increased sophistication in AI-driven tools, and year-over-year, online identity fraud has risen by 21%. 

Key findings from the report include: 

• A majority of consumers (82%) will not sign up for a financial services platform without confidence in the entity’s fraud fraud protection capabilities. 
• 38% of consumers say biometrics are their top pick for securing interactions, with facial recognition as the most popular. 
• 60% of financial services firms report an increase in AI attacks. 
• Among financial service respondents in the United States, 64% are currently using AI as a mechanism for fraud prevention. 20% intend to do so in the next year.

Notably, the report found that one-third of consumers in the U.S. experienced some form of non-refundable financial loss due to fraud. Most financial service sector senior fraud decision-makers (89%) anticipate an increase in fraud for 2025, particularly those powered by AI. 

https://www.securitymagazine.com/articles/101804-1-in-20-financial-service-online-identity-verification-attempts-is-fraudulent

In an era when data needs to be recognized as an asset in order to transform as a business, retrieving value from data becomes the topmost priority. As fiercely as organizations are investing in innovating new tools and techniques to get the best possible “data deal,” are they considering the risks of grabbing hold of diverse, complex and sensitive data? Should the safety of data that transforms a business not be on the priority list? 

Firstly, the perception about data protection has to change. Now that data is no longer seen as a by-product of business, the description of protection also needs to extend beyond building a defense against probable attacks. Otherwise, the data that is considered an asset can soon become a liability. 

Consider the case of Blackbaud, a California-based cloud computing provider whose customers range from nonprofit organizations to educational institutions. It faced a data breach in July 2020, which exposed personal data of more than 10,000 organizations and numerous individuals. This compromised information included Protected Health Information (PHI), bank account numbers, and Personally Identifiable Information (PII) like social security numbers. Not only did the company not implement the basic security controls such as multi-factor authentication or customer reminders to change their passwords periodically, but it also held on to the data unlawfully. 

This is an outright violation of the data minimization principle mentioned in most data protection laws, like the EU-GDPR, UK-DPA, California’s CCPA, Mexico’s LFPDPPP, Germany’s BDSG, and the Philippines’ PDPA. In addition, the lack of data retention policies permitted the exfiltration to take place. In June 2024, Blackbaud was ordered to pay $6.67 million as a settlement.

Some of the orders to Blackbaud by the Federal Trade Commission included producing a comprehensive information security program, deleting the data that is no longer purposeful, creating a schedule for data deletion, and alerting the FTC of any data breaches in the future. According to the state’s (California) orders, the company was required to create a design to take backups of only necessary data and establish a secure data process. 

Turns out control over data for longer than necessary can bring in more harm instead of the much-intended hike in revenue, reputation and customers. Who would have thought getting rid of data could be the open secret to protecting data?

The Reasons Behind the Crisis

Data is not numbers existing in the virtual world. Any kind of breach of this information impacts actual people in real life. From smart cities to smart phones, everything from equipment to infrastructure relies in some way or form on data. Predicting the impact of cyber-physical security incidents, Gartner states that 75% of CEOs will be held personally liable for professional scenarios. 

Leaders who wish to build a legacy of a secure data culture in their organization need to ingrain this sentiment in their employees. A leader does not have to be a data or security expert to create a culture that puts data protection at the core. The fact that employees look up to the leaders for inspiration should be enough for leaders to initiate the change and lead by example. A periodic email or an annual reminder regarding password change or security updates cannot replace the organizational practices followed by the leaders on a daily basis. Similarly, there are a few assumptions that lead up to a Pandora’s box of penalties, such as: 

• Not My Job: What often becomes a barrier to prioritizing data protection in the organization is a dangerous belief that securing data is the responsibility of the IT team. It not only increases the burden of the IT and security teams but also allows people of other departments to wash their hands off being accountable. This results in silos, which hampers the opportunities for cross-departmental collaboration.
• Ground Before Global: The amount of penalties that a business has to pay in case of an attack or a breach reaches millions and billions. For major businesses, these unfathomable loads of moolah in the form of lawsuits and fines are results of violations of global data protection laws and regulations. However, blunders are a culmination of daily careless mistakes on the ground that can easily be avoided by staying transparent with the data processing activities. 

Suggestions For the Secure Path Ahead

If organizations can go to lengths to gain ownership of personal data of other people, they also need to take the onus of ensuring it’s protected at all times. Also, if the leader gets the credit for the wins, they also need to bear the brunt of repercussions that a data breach brings. The leader can contribute to the creation of policies that prioritize data protection, the implementation of secure data processing practices, and the establishment of a culture that places cybersecurity at the center. Other solutions that can be incorporated are:

• Employee Training: An empowered workforce is a safe workforce. However, an annual learning and development program cannot serve the purpose of making data security a daily habit. Most people are aware of the usual security solutions, such as using strong passwords, multi-factor authentication, and VPNs. To encourage continuous learning, the training programs must be updated with the newer threats and security practices that can help safeguard the employees’ data. Often, such sessions either end up being boring or too technical. To make these lessons interesting, free them from technical jargon and fuse them with interactive activities to ensure more participation.
• Proactive, Not Reactive: “$15 million payment in lawsuit settlement by Hoosier Cash App” and “$370000 ransom paid by AT&T to hackers to get data deleted” are examples of cases where organizations reacted after the personal data of their customers had already been jeopardized. However, to be a secure organization, you have to be proactive in devising security strategies, fulfilling compliance requirements, and testing the implemented security solutions. An organization should consistently monitor and analyze the efficiency of their cybersecurity posture in preventing risks to their data and reducing the impact of cyberattacks. 

Embed Compliance Into Culture

An organization might be safe today because it complies with the governing laws and regulations. But unless and until data protection is viewed as a mere compliance requirement and not a safety solution for real-life entities, it can get tough to incorporate it into the organizational culture. An organization’s commitment to data security is not demonstrated by their capability of being able to stay in business post-crisis but by ensuring they abide by their values consistently without a watchdog or a complaint. 

https://www.securitymagazine.com/articles/101807-making-data-protection-an-organizational-priority

A recent report by Veracode found critical security flaws in AI-generated code. The study revealed that while AI produces functional code, it introduces security vulnerabilities in 45% of cases.

The research demonstrates a troubling pattern: when given a choice between a secure and insecure method to write code, GenAI models chose the insecure option 45% of the time. Research also uncovered a critical trend: despite advances in LLMs’ ability to generate syntactically correct code, security performance has not kept up, remaining unchanged over time.

AI is enabling attackers to identify and exploit security vulnerabilities quicker and more effectively. Tools powered by AI can scan systems at scale, identify weaknesses, and even generate exploit code with minimal human input. This lowers the barrier to entry for less-skilled attackers and increases the speed and sophistication of attacks, posing a significant threat to traditional security defenses. Not only are vulnerabilities increasing, but the ability to exploit them is becoming easier.

Download the report

https://www.securitymagazine.com/articles/101801-ai-introduces-security-vulnerabilities-within-code-in-45-of-cases

Questo articolo fa parte di una serie di approfondimenti dedicati alla Business Continuity e all’implementazione pratica della norma ISO 22301. Attraverso un caso studio applicabile a ogni tipo di organizzazione, esploriamo le modalità concrete per sviluppare un programma di continuità operativa efficace, con particolare focus su istituti finanziari e assicurativi. L’analisi si concentra sui primi step fondamentali: contesto organizzativo e leadership aziendale.

Business Continuity ISO 22301: implementazione pratica e case study

Il seguente documento mira a fornire un esempio pratico di implementazione della norma ISO 22301 tramite le linee guida esaminate nella Parte I del White Paper.

L’adozione di un programma di Business Continuity efficace può apportare svariati benefici, non solo in caso di incidenti dagli impatti e magnitudo considerevoli ma anche da un punto di vista strategico ed organizzativo, in quanto consente di avere un quadro ben definito di tutto ciò che compone e supporta l’organizzazione.

In questa seconda parte ci addentreremo dunque nelle modalità pratiche di implementazione di un programma di Business Continuity, tramite lo studio di un case history adattabile ad ogni tipo di organizzazione.

Per una maggiore comprensione del testo e della struttura della norma dal punto di vista pratico, i titoli scelti avranno come riferimento quelli della ISO 22301.

Analisi del contesto organizzativo per la Business Continuity

Ipotizzando di voler implementare un programma di Business Continuity in un istituto finanziario e/o assicurativo, dovremo iniziare con un’accurata analisi del contesto organizzativo interno ed esterno.

Nell’analisi del contesto interno è indispensabile identificare il core business dell’entità (che potrebbe essere, tra le tante, l’erogazione di finanziamenti o l’emissione di polizze vita caso morte), cioè quel servizio / processo i cui profitti hanno un rilievo determinante nel bilancio annuale.

Tale identificazione non viene effettuata dalle singole risorse impegnate nell’implementare un programma di Business Continuity, bensì dal Top Management, supportato da altre funzioni, tra cui anche quella della BC.

Oltre all’analisi del contesto interno, è indispensabile analizzare il contesto esterno al fine di comprendere la posizione dell’istituto stesso nel mercato e la posizione di eventuali competitor, nonché le principali ed emergenti tendenze del mercato.

Ad esempio, se emerge che la domanda dei clienti si sposta sempre più verso l’acquisto di fondi/titoli di investimento, rispetto ad altri servizi, l’istituto dovrà considerare la possibilità di adattare il proprio business sulla base di questo trend in crescita.

Identificare i nuovi trend consente di prepararsi con anticipo e in maniera strutturata, garantendo inoltre l’opportunità di identificare e gestire tempestivamente i principali rischi che possono derivarne.

In ottica di contesto dell’organizzazione, è indispensabile tenere conto anche del contesto geopolitico.

Gli Stati e le città in cui opera l’istituto possono essere fonti di rischi e criticità differenti. Si pensi alle prescrizioni del GDPR, a cui devono adempiere le entità operanti nel territorio europeo; o ai rischi geografici legati a un istituto finanziario operante a Venezia (per esempio) rispetto a realtà che si trovano in zone più esposte ad attacchi terroristici, come Roma.

Tutta questa serie di informazioni ci permette di avere un primo quadro generale dei rischi a cui un’entità è esposta. Tali rischi –- a differenza di quelli interni all’organizzazione – non possono essere controllati: è soltanto possibile limitare i relativi impatti e, ove fattibile, prevenirli.

Leadership

Come già riportato nel presente white paper (al punto 5.0 della Parte I), il Top Management di un’organizzazione riveste un ruolo cruciale nella realizzazione e nell’implementazione di un programma di Business Continuity, in quanto è la funzione che approva il programma di BC e la sua revisione annuale, accertandosi che sia in linea con la strategia aziendale.

Si pensi ad esempio ad un fornitore a supporto di un processo critico che non fornisce garanzie di continuità operativa, non riesce a rispettare gli RTO e RPO dell’entità stessa o non ha predisposto sufficienti soluzioni di Business Continuity da attivare al fine di ripartire a seguito di potenziali interruzioni.

Sarà il Top Management a decidere se accollarsi il rischio e mantenere il fornitore o se sostituirlo con uno differente, in grado di fornire maggiori garanzie in termini di continuità operativa e/o Disaster Recovery (l’attuale normativa europea, in particolare il Regolamento DORA e la Direttiva NIS2, si focalizza proprio su tali aspetti).

Prima dell’avvio e della messa a terra del programma di Business Continuity, le funzioni incaricate della gestione del programma stesso, con il supporto del Top Management, definiscono la policy di Business Continuity.

La policy è un documento in cui sono contenute le informazioni circa l’obiettivo del programma di continuità operativa, la normativa di riferimento, le funzioni incaricate della gestione del documento, la documentazione di riferimento, lo scopo del programma, lo scopo e le modalità delle verifiche e le modalità di escalation degli incidenti ad alto livello.

Un esempio di indice di policy di Business Continuity può essere:

• data di redazione e approvazione del documento;
• introduzione e obiettivi del documento;
• perimetro di applicazione del documento (se capogruppo e legal entities o solo parte di questi);
• definizioni e normativa di riferimento;
• documentazione interna di riferimento;
• destinatari del documento:
  • ruoli e responsabilità della realizzazione, gestione, divulgazione e approvazione del documento;
• scenari compresi e coperti dalla policy e programma di continuità operativa:
  • scenari emergenziali;
  • scenari di crisi;
  • scenari non coperti dal piano;
• perimetro dei processi oggetto di analisi:
  • modalità di conduzione delle Business Impact Analysis;
  • metriche per la conduzione delle Business Impact Analysis;
• ruoli e responsabilità per la gestione delle emergenze;
• ruoli e responsabilità per la gestione delle crisi;
• ricorso a soggetti esterni per la prestazione dei servizi ICT, fornitori, esternalizzazioni FEI e non, i.e.:
• modello di gestione del programma di Business Continuity per il rischio specifico e i modelli di controllo adottati.

Questa guida ha illustrato i primi step fondamentali per l’implementazione della norma ISO 22301, dall’analisi del contesto organizzativo alla definizione delle policy aziendali. Per approfondire ulteriormente questi concetti e scoprire metodologie avanzate, ti invitiamo a consultare il white paper completo elaborato da Chiara Cavicchioli e Federica Maria Rita Livelli dal titolo “Business Continuity: mito o realtà? La continuità nella discontinuità”.

Nel prossimo approfondimento della serie scopriremo come una volta identificato il contesto organizzativo e ottenuto il supporto del Top Management, è possibile avviare il processo di realizzazione e implementazione pratica di un programma di Business Continuity.

https://www.ictsecuritymagazine.com/articoli/business-continuity-iso-22301/

@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’);
@import url(‘https://fonts.googleapis.com/css2?family=Handlee&display=swap’); h3 { font-weight: bold; font-size: 18px; color: #C72026; }
.pqFull { display: block; border-width: 2px 0; border-style: solid; border-color: #404144; padding: 1.5em 0 0.5em; margin: 1.5em 0; position: relative; Handlee”, Arial, sans-serif; font-size: 20px; text-align: center; color: #0067A6;
}
.pqFull:before { content: ‘\275D’; position: absolute; top: -.10em; left: 50%; transform: translate(-50%, -50%); background: #fff; width: 4rem; height: 2rem; color: #666; text-align: center;
}
.pqFull:after { content: ; display: block; text-align: center; font-size: 18px; color: #404144;
}

In today’s hyper-connected world, wearable devices have transformed from niche gadgets to essential tech tools, with wearables market value projected to soar from $109.34 billion in 2024 to $303.98 billion by 2029. This boom offers cybersecurity professionals exciting opportunities alongside daunting challenges. As wearables become ingrained in personal and professional environments, from smartwatches and fitness trackers to AR glasses and health-monitoring devices — addressing the cybersecurity risks they pose is crucial to protect corporate assets and customer information.

Wearable devices collect vast amounts of personal data, often sensitive, such as health metrics and location information. Their integration into corporate environments complicates traditional cybersecurity frameworks, making them enticing targets for cybercriminals. A recent Verizon report indicated a 68% increase in security incidents targeting IoT devices, including wearables, over the past year, underscoring the escalating risk. Consider the 2023 breach in which vulnerabilities in fitness trackers compromised user credentials, which were then used to access a retailer’s loyalty program, leading to financial losses and reputational damage.

Developing and enforcing comprehensive security policies is foundational for safeguarding against wearable-related vulnerabilities. Policies should tackle unique challenges, covering device management, data protection, user authentication, and acceptable use. According to IBM’s 2023 Cost of a Data Breach Report, organizations with mature security policies and incident response plans can save an average of $1.49 million during breaches. Policies require regular review to align with evolving threats, leveraging resources like CVE databases and security advisories from device manufacturers such as Apple, Samsung, Fitbit, and Garmin to stay updated on vulnerabilities.

Prioritize a Robust Security Culture

With human error remaining a significant factor in cybersecurity incidents, fostering a culture of security awareness within organizations is paramount. Training programs should be tailored to the wearables’ context, emphasizing strong password practices, regular software updates, recognizing phishing attempts, and understanding social engineering tactics targeted through device data. A recent incident involved a global consulting firm in which a phishing campaign, exploiting data from employee fitness trackers, led to compromised client data, costing the firm substantial financial and reputational damage. Beyond formal training, promote a security-first mindset through continuous education initiatives, simulated phishing exercises, and encouragement of incident reporting.

Given the sensitive nature of wearable data, encryption is an essential element of security strategies. Implement AES-256 encryption for data at rest and TLS 1.2 or later for data in transit. Consider hardware security modules (HSMs) for key management and trusted execution environments (TEEs) in device architectures to enhance security.

Employ robust data classification and management protocols. Utilize Data Loss Prevention (DLP) solutions and, where feasible, adopt zero-trust architectures that validate every access request regardless of its origin, minimizing the impact on sensitive data even if a device is compromised.

With human error remaining a significant factor in cybersecurity incidents, fostering a culture of security awareness within organizations is paramount.

Prepare for inevitable cyber incidents with a comprehensive incident response plan outlining roles, responsibilities, and breach containment protocols. According to a recent study by IBM Security and the Ponemon Institute, organizations that regularly test their incident response plans save an average of $1.49 million on the cost of a data breach. A structured approach for wearables includes deploying SIEM solutions to detect anomalies, network segmentation to contain incidents, automated patching, and restoring systems from secure backups. Establish relationships with external cybersecurity firms to provide specialized expertise during incidents.

Wearables often require access to multiple systems and datasets, emphasizing the need for strong access controls. Employ multifactor authentication (MFA), and consider integrating biometric and context-aware authentication methods. The principle of least privilege is the guide for access allocation, with regular audits ensuring compliance.

Proactive Network Monitoring Needed

Proactive network monitoring enables real-time detection of anomalies. Deploy advanced Intrusion Detection and Prevention Systems (IDPS) to scrutinize wearable communications for atypical patterns. Investing in threat intelligence services allows firms to swiftly adapt security postures; according to Forrester, organizations leveraging threat intelligence can improve detection capabilities by up to 60%.

Wearables interact with external applications through APIs, which can be vulnerable. The OWASP API Security Project identifies insecure APIs as a significant threat vector. Regular API security assessments and penetration testing are crucial, prioritizing secure APIs using best practices such as implementing authentication and authorization mechanisms, validating inputs, and monitoring for anomalies.

Hold Vendors to Industry Standards

Vendor management presents another layer of complexity. Data breaches involving third parties rise continuously, emphasizing the importance of thoroughly vetting and monitoring vendors. Ensure vendors comply with industry standards like NIST or ISO 27001 and embed data breach responsibility clauses in contracts. Implement a risk-based approach to vendor management, prioritizing vendors that handle sensitive data or provide critical services.

Compliance with data privacy regulations (e.g., GDPR, HIPAA, CCPA) is crucial. Implement privacy by design principles, maintain detailed data processing records, and ensure transparency with users about data collection practices. Providing mechanisms to exercise privacy rights is vital for maintaining trust. Regularly conduct privacy impact assessments to identify and mitigate potential privacy risks associated with wearables.

Navigating this complex landscape effectively requires not just tools and policies, but also specialized knowledge of both cybersecurity and privacy principles. To enhance expertise in privacy, cybersecurity professionals should consider pursuing relevant privacy certifications like ISACA’s CDPSE or CompTIA Privacy+. These certifications offer valuable knowledge and skills in data protection, privacy program management, and privacy engineering. By obtaining these certifications, professionals can demonstrate a commitment to protecting wearable data and ensuring compliance with privacy regulations, building trust with both the company and its customers.

Embrace a Multifaceted Approach

Securing wearables requires a multifaceted approach involving policy development, technical controls, user education, and regulatory compliance. By implementing robust strategies, cybersecurity professionals can protect sensitive data and systems, ensuring both corporate resilience and customer trust in the digital age of wearables. As technology advances, adapting frameworks to encompass emerging risks associated with the latest wearable trends remain essential. Prioritizing a proactive and adaptive approach to security is crucial to staying ahead of evolving threats and maintaining a strong security posture.

https://www.securitymagazine.com/articles/101784-securing-the-digital-frontier-strategies-for-safeguarding-companies-and-customers-in-the-age-of-wearables

h3 {font-weight: bold;font-size: 18px;color: #C72026;}
.w3-panel:after,.w3-panel:before{content:””;display:table;clear:both}
.w3-panel{padding:5px;margin-top:16px;margin-bottom:16px}
.w3-card{box-shadow:0 2px 5px 0 rgba(0,0,0,0.16),0 2px 10px 0 rgba(0,0,0,0.12)}

In this episode of The Security Podcasts featuring Aimee Cardwell, CISO in Residence for Transcend, we discuss how CISOs should prepare for AI threats, cyberattacks and emergencies.

“In the conversations that I have had with security professionals, I think I’d say that most CISOs are not ready [for emerging AI risks], in part because most [organizations] that I’ve heard of still have privacy and security teams split, even though they’re trying to solve a lot of the same problems.”

Or check it out on our Apple Podcasts or Spotify channels. Don’t forget to like, follow, and rate and review our podcasts!

https://www.securitymagazine.com/articles/101791-how-should-cisos-prepare-for-ai-threats-cyberattacks-or-emergencies

Lug 30, 2025 Marina Londei In evidenza, News, RSS, Vulnerabilità 0

---

Martedì Apple ha rilasciato una fix che risolve una vulnerabilità 0-day presente in WebKit, il motore di rendering usato in Safari, già nota e sfruttata in Chrome in almeno un attacco.

Il bug, tracciato come CVE-2025-6558, risiede nei componenti open-source ANGLE e GPU di Google ed è causata da una validazione errata dell’input. Stando alla descrizione fornita, la vulnerabilità consente a un attaccante di eseguire un sandbox escape da remoto utilizzando una pagina HTML creata ad hoc.

Poiché WebKit utilizza i componenti open-source di Google, anche Safari è colpito dalla vulnerabilità. Google ha affermato di essere a conoscenza di un exploit che ha sfruttato il bug, ma non ha reso noto alcun dettaglio in merito. Il comunicato di Apple non accenna invece a potenziali exploit.

Nel caso di Safari, lo sfruttamento della vulnerabilità può portare al crash di Safari. Apple non ha condiviso altri dettagli.

La patch è disponibile in iOS 18.6 e iPadOS 18.6 per iPhone XS e successivi, iPad Pro da 13 pollici, iPad Pro da 12,9 pollici di terza generazione e successive, iPad Pro da 11″ di prima generazoine e successive, iPad Air di terza generazione e successive, iPad di settima generazione e successive e iPad mini di quinta generazione e successive.

Il fix è inoltre presente in iPadOS 17.7.9 per iPad Pro da 12.9 pollici di seconda generazione, iPad Pro da 10.5 pollici e iPad di sesta generazione; macOS Sequoia 15.6; in tvOS 18.6 per Apple TV HD e Apple TV 4K (tutti i modelli); in watchOS 11.6 per Apple Watch Series 6 e successivi e in visionOS 2.6 per Apple Vision Pro. Per quanto riguarda Chrome, la patch è disponibile nella versione 138.0.7204.157 del browser.

Anche lo scorso marzo Apple aveva avuto a che fare con una vulnerabilità 0-day in WebKit: la CVE-2025-24201, un problema di scrittura out-of-bound, permetteva a un attaccante di sfruttare un contenuto web creato ad hoc per uscire dalla sandbox del browser.

È consigliato aggiornare il prima possibile i prodotti vulnerabili.

---

---

---

https://www.securityinfo.it/2025/07/30/apple-rilascia-una-fix-per-una-vulnerabilita-di-safari-gia-sfruttata-in-chrome/?utm_source=rss&utm_medium=rss&utm_campaign=apple-rilascia-una-fix-per-una-vulnerabilita-di-safari-gia-sfruttata-in-chrome

On July 16, 2025, Allianz Life Insurance Company of North America experienced a data breach. According to a filing with the Office of the Maine Attorney General, the incident was described as an “external system breach.”

At this time, there is no further information about the data that may be compromised, or how many individuals may be affected. While the threat actor behind this attack is also unknown, there are some initial similarities to Scattered Spider, a group that has recently changed targets from retail to insurance. 

Below, security leaders weigh in on this attack. 

Security Leaders Weigh In  

Boris Cipot, Senior Security Engineer at Black Duck:

This breach highlights that the biggest threats don’t always come from direct attacks, but often a combination of vulnerabilities across the entire supply chain. In this case, the attacker used multiple techniques: social engineering to obtain access rights and a third-party solution as a backdoor into the system. 

Organizations must take a holistic view of their security posture. The supply chain is often the weakest link and must not be overlooked. Allianz responded appropriately by notifying the authorities and the affected customer, and by offering credit and identity monitoring services. However, impacted individuals should remain vigilant. The stolen data could still be used in follow-up social engineering attempts. Be cautious of unsolicited messages, especially those containing links or attachments. Don’t click on links or open files unless you’re absolutely sure they’re legitimate.

Mr. Piyush Pandey, CEO at Pathlock:

This breach is a stark reminder of how critical it is to have a comprehensive security and governance program around enterprise business applications such as CRM platforms, which store a massive amount of sensitive customer PII.

Specifically, it flags to us that it’s no longer enough for enterprises to rely on basic identity provisioning. Instead, it’s important to embrace real-time access risk analysis that continuously monitors whether corporate accounts have the right level of access based on their current context and behavior, not just their job title or group membership.

Additionally, it highlights the importance of adopting a cross-application governance model that can flag excessive privileges, identify dormant or high-risk accounts, and revoke inappropriate access before it can be exploited — and do so across the entire business application footprint.

And let’s not forget the compliance angle. For insurance companies, breaches of this nature can lead to compliance penalties under the laws like the Gramm-Leach-Bliley Act (GLBA) and other data protection regulations.

Mr. Agnidipta Sarkar, Chief Evangelist at ColorTokens:

While this does resemble Scattered Spider, it could also be ShinyHunter. Yes, the attack originated through a third-party CRM platform; however, the compromised data included personally identifiable information (PII) related to the majority of Allianz Life’s 1.4 million customers, financial professionals, and select employees. This poses a lot of questions about how the supply chain security was managed and monitored. The incident also raises questions about regulatory compliance, particularly under laws like the Cybersecurity Information Sharing Act of 2015, set to expire in September 2025, and state-specific data breach notification requirements. 

The exposure of PII poses significant risks to affected individuals, including identity theft, financial fraud, and phishing attacks. Victims may face unauthorized access to financial accounts, credit card fraud, or even medical identity theft, given Allianz Life’s role in life insurance and annuities. There were other similar breaches recently at Aflac and Anthem and to some extent, Allianz Life’s offer of 24 months of credit monitoring and identity theft protection through Kroll, could probably help many victims. 

https://www.securitymagazine.com/articles/101797-allianz-life-insurance-impacted-by-third-party-breach