https://www.securitymagazine.com/blogs/14-security-blog/post/101275-data-deregulation-to-ai-protection-security-priorities-in-2025

In 2012, an industry-wide coalition of hardware and software makers adopted Secure Boot to protect Windows devices against the threat of malware that could infect the BIOS and, later, its successor, the UEFI, the firmware that loaded the operating system each time a computer booted up.

Firmware-dwelling malware raises the specter of malware that infects the devices before the operating system even loads, each time they boot up. From there, it can remain immune to detection and removal. Secure Boot uses public-key cryptography to block the loading of any code that isn’t signed with a pre-approved digital signature.

2018 calling for its BIOS

Since 2016, Microsoft has required all Windows devices to include a strong, trusted platform module that enforces Secure Boot. To this day, organizations widely regard Secure Boot as an important, if not essential, foundation of trust in securing devices in some of the most critical environments.

Microsoft has a much harder time requiring Secure Boot to be enforced on specialized devices, such as scientific instruments used inside research labs. As a result, gear used in some of the world’s most sensitive environments still doesn’t enforce it. On Tuesday, researchers from firmware security firm Eclypsium called out one of them: the Illumina iSeq 100, a DNA sequencer that’s a staple at 23andMe and thousands of other gene-sequencing laboratories around the world.

The iSeq 100 can boot from a Compatibility Support Mode, so it works with older legacy systems such as 32-bit OSes. When this is the case, the iSeq loads from BIOS B480AM12, a version that dates to 2018. It harbors years’ worth of critical vulnerabilities that can be exploited to carry out the types of firmware attacks Secure Boot envisioned.

Additionally, Eclypsium said, firmware Read/Write protections aren’t enabled, meaning an attacker is free to modify the firmware on the device.

Eclypsium wrote:

It should be noted that our analysis was limited specifically to the iSeq 100 sequencer device. However, the issue is likely much more broad than this single model of device. Medical device manufacturers tend to focus on their unique area of expertise (e.g. gene sequencing) and rely on outside suppliers and services to build the underlying computing infrastructure of the device. In this case, the problems were tied to an OEM motherboard made by IEI Integration Corp. IEI develops a wide range of industrial computer products and maintains a dedicated line of business as an ODM for medical devices. As a result, it would be highly likely that these or similar issues could be found either in other medical or industrial devices that use IEI motherboards. This is a perfect example of how mistakes early in the supply chain can have far reaching impacts across many types of devices and vendors.

In an email, Eclypsium CTO Alex Bazhaniuk wrote: “To be fair, with an OS that does not get the most recent security updates, there are plenty of risks and threats, not to mention how each IT organization manages their own assets on their network.”

https://arstechnica.com/security/2025/01/widely-used-dna-sequencer-still-doesnt-enforce-secure-boot/

Reported CVEs have increased by a whopping 30% this year. The success of a threat actors’ CVE-based attacks isn’t always dependent on leveraging a zero day. Many individuals and organizations don’t respond to published CVEs in an expedited fashion. That’s why security leaders have also seen a 10% rise in the exploitation of old vulnerabilities — hackers don’t need to rush when outdated and insufficient processes give them the opportunity to take their time!

Take the example of Fortinet. 86,000 Fortinet instances remained vulnerable to a critical flaw (CVE-2024-23113), and attackers started exploiting it after it had flown under the radar for almost nine months.

There is only so much a security team can do to be proactive in these situations; they don’t operate in a bubble, and immediately patching production systems without proper testing comes with its own risks. Bandwidth can be limited, threats are constant, and it may feel like you’re always putting out fires. However, there is potential to optimize a response in the face of emerging threats and vulnerabilities. If security leaders can better maximize their time, processes and procedures then they can be more resilient.

Damage to the nth degree

Security teams understand the criticality of patching their devices and systems. Instead, what can often be inadvertently deprioritized or overlooked is the defensibility of the connected ecosystem.

Do you know how many of your partners, suppliers, and vendors connected to your business have taken the necessary steps to safeguard themselves, and have done so in a way that aligns with your risk tolerance? Most companies don’t have high confidence in their answers. Which is why organizations often see this “mad dash” to collect emergency third-party assessments when new threats emerge.

It is also why security leaders see widespread chaos after an incident. Take this year’s CrowdStrike incident, which caused massive outages with Microsoft Windows; flights were canceled, medical procedures were halted, and financial transactions were delayed. The global impact was similar following Log4j where widespread exploitation and hacks impacted payroll processing and higher education systems.

These incidents can cost companies billions of dollars due to operational impacts, ransomware payments, litigation fees, recovery efforts, and more.

Cybercriminals are exploiting CVEs because there has been a greater volume of reported CVEs year-over-year, it’s proven to be successful, and has significant implications across the software supply chain — creating notoriety for these groups as well as more opportunity for financial gain and opportunistic hacks. There is so much pressure placed on not only security teams, but also those within procurement and compliance.

While security teams are trying to contain any damage internally, they also must work with the rest of their third-party risk management stakeholders to identify vendors that require immediate attention in response to an emerging threat. Rapid response within the interconnected ecosystem is critical, and it’s important for teams to enact a more streamlined process.

Critical components for managing threats 

Here are the critical steps for managing threats:

1. Increase visibility into emerging threats. Knowledge is power. You can’t “fix” what you don’t know, so make sure to have the proper resources and technology to know when threats arise. Monitoring resources like CISA’s Known Exploited Vulnerabilities (KEV) catalog or NIST’s National Vulnerability Database (NVD) is a great place to start. Getting near real time alerts for vulnerabilities of interest will help reduce noise and give accurate information on the nature and severity of evolving risks.
2. Know who is susceptible. Sending out bulk assessments to all vendors isn’t effective, or a great use of valuable resources. Security leaders want to avoid chasing down assessments and analyzing responses from vendors who have little to no access to data or systems, or may not be utilizing the software. This is where security leaders can apply proactive measures. There are a variety of different feeds and sources organizations can tap into to gain better understanding of which software a given third-party is using. Before an incident even occurs, security leaders should have their third-party ecosystem tiered out from least critical (perhaps a maintenance supplier) to most critical (like a cloud provider) inherent risk, which will allow them to know who they should be assessing when a threat is uncovered. This is where security leaders need to have a satisfactory risk management process in place.
3. Assess. Organizations are now at a place where they can send out assessments to targeted list of critical or impacted vendors. Cut down on the noise and make sure vendors are given an assessment that is specific to the threat and doesn’t request information they already have. Security leaders want to be able to make it easy for the third-party to complete, and also more efficient for their team to review, score and act.
4. Don’t forget to communicate! Communication, and transparency, is key, especially during high stakes scenarios when there’s many eyes on a program. Senior leaders, customers and partners will want to know that the security team is taking the necessary steps to contain the incident. Communicating the status of any efforts and disseminating reports that showcase progress will keep everyone’s mind at ease.

Rapid response isn’t as rapid as security leaders would like it to be, taking valuable days, weeks or even months to be able to respond to critical activity. If security leaders speed up and streamline their processes, they’ll be able to increase resiliency and ultimately give a little bit more time back into important schedules.

https://www.securitymagazine.com/articles/101271-mitigating-cve-exploitations-putting-the-rapid-into-rapid-response

Gen 07, 2025 Marina Londei In evidenza, News, RSS, Vulnerabilità 0

---

Lo scorso venerdì Moxa, provider di reti industriali, ha pubblicato un advisory di sicurezza dove descrive due vulnerabilità critiche che colpiscono diversi modelli dei propri router e di device di sicurezza.

“I router cellulari, i firewall e le appliance di sicurezza di rete di Moxa sono affetti da due vulnerabilità critiche che rappresentano un rischio significativo per la sicurezza” si legge nel post.

Uno dei due bug, tracciato come CVE-2024-9138, è causato da credenziali hard-coded che consentono a un utente autenticato di effettuare l’escalation dei privilegi per ottenere permessi di root sul sistema. Un attaccante sarebbe quindi in grado di compromettere il funzionamento del sistema, ottenere dati sensibili e interrompere l’erogazione del servizio.

La seconda vulnerabilità, la CVE-2024-9140, è un bug di OS Command Injection che consente a un attaccante di usare caratteri speciali in un comando per superare le restrizioni di input ed eseguire codice da remoto.

I dispositivi serie EDR-810 (con versione del firmware 5.12.37 e precedenti) e della EDR-G902 (con versione del firmware 5.7.25 e precedenti) sono vulnerabili al primo bug, mentre i device della serie EDR-8010, EDR-G9004 (versioni 3.13.1 e precedenti), EDR-G9010 (versioni 3.13.1 e precedenti), EDF-G1002-BP (versioni 3.13.1 e precedenti), NAT-102 (versioni 1.0.5 e precedenti), OnCell G4302-LTE4 (versioni 3.13 e precedenti) e TN-4900 (versioni 3.13 e precedenti) sono vulnerabili a entrambi i bug.

Moxa ha rilasciato le patch per le vulnerabilità per la maggior parte dei dispositivi elencati. Per i dispositivi OnCell G4302-LTE4 e TN-4900, è necessario contattare il supporto tecnico della compagnia per applicare la patch di sicurezza.

Per i NAT-102 non c’è invece ancora una patch; in questo caso Moxa consiglia di non esporre i device a internet se non strettamente necessario, di limitare l’accesso SSH ai soli indirizzi IP e alle reti attendibili e di implementare IDS o IPS per individuare e bloccare eventuali tentativi di sfruttamento.

---

---

---

https://www.securityinfo.it/2025/01/07/le-vulnerabilita-dei-dispositivi-moxa-mettono-a-rischio-le-reti-industriali/?utm_source=rss&utm_medium=rss&utm_campaign=le-vulnerabilita-dei-dispositivi-moxa-mettono-a-rischio-le-reti-industriali

Questo articolo fa parte di una serie dedicata al Registro dei Trattamenti nel contesto del GDPR. In questa sezione, affronteremo l’argomento del Trasferimento di Dati Personali Soggetto a Garanzie Adeguate nel GDPR, esplorando le alternative disponibili quando non è presente una decisione di adeguatezza e le misure necessarie per garantire la protezione dei dati personali nei trasferimenti internazionali.

Trasferimento di Dati Senza Decisione di Adeguatezza: Garanzie Adeguate (art. 46 GDPR)

L’assenza di una decisione di adeguatezza non è ostativa al trasferimento dei dati in un paese extra-UE, che rimane comunque possibile in coerenza con altre disposizioni del GDPR e nel caso di specie in presenza delle garanzie adeguate che sono descritte dagli artt. 46-49 del GDPR.

A norma dell’art. 46 del GDPR, in mancanza di una decisione ai sensi dell’articolo 45, paragrafo 3 del GDPR, il titolare del trattamento o il responsabile del trattamento possono trasferire dati personali verso un paese terzo o un’organizzazione internazionale solo se hanno fornito garanzie adeguate e a condizione che gli interessati dispongano di diritti azionabili e mezzi di ricorso effettivi.

Tipologie di Garanzie Adeguate per il Trasferimento di Dati Personali nel GDPR

L’art. 46 par. 2 del GDPR recita: possono costituire garanzie adeguate di cui al paragrafo 1 senza necessitare di autorizzazioni specifiche da parte di un’autorità di controllo:

• Uno strumento giuridicamente vincolante e avente efficacia esecutiva tra autorità pubbliche o organismi pubblici;
• Le norme vincolanti d’impresa in conformità dell’articolo 47;
• Le clausole tipo di protezione dei dati adottate dalla Commissione secondo la procedura d’esame di cui all’articolo 93, paragrafo 2;
• Le clausole tipo di protezione dei dati adottate da un’autorità di controllo e approvate dalla Commissione secondo la procedura d’esame di cui all’articolo 93, paragrafo 2;
• Un codice di condotta approvato a norma dell’articolo 40, unitamente all’impegno vincolante ed esecutivo da parte del titolare del trattamento o del responsabile del trattamento nel paese terzo ad applicare le garanzie adeguate, anche per quanto riguarda i diritti degli interessati;
• Un meccanismo di certificazione approvato a norma dell’articolo 42, unitamente all’impegno vincolante ed esigibile da parte del titolare del trattamento o del responsabile del trattamento nel paese terzo ad applicare le garanzie adeguate, anche per quanto riguarda i diritti degli interessati.

L’art. 46 par. 3 del GDPR, inoltre, recita: possono inoltre, fatta salva l’autorizzazione dell’autorità di controllo competente, costituire garanzie adeguate di cui al paragrafo 1:

• Le clausole contrattuali tra il titolare del trattamento o il responsabile del trattamento e il titolare del trattamento, il responsabile del trattamento o il destinatario dei dati personali nel paese terzo o nell’organizzazione internazionale;
• Le disposizioni da inserire in accordi amministrativi tra autorità pubbliche o organismi pubblici che comprendono diritti effettivi e azionabili per gli interessati.

Applicazione delle Garanzie Adeguate nel Trasferimento Internazionale di Dati

Giova sottolineare come le garanzie adeguate di cui agli artt. 46-49 del GDPR rappresentano ipotesi sempre alternative e quindi da utilizzare solo in caso di assenza delle decisioni di adeguatezza. Le modalità contemplate nell’art. 46, par. 2 lett. a) e par. 3 lett. b) del GDPR concernono il trasferimento dei dati tra autorità pubbliche oppure organismi pubblici.

Accordi Internazionali e Trasferimento di Dati Personali

In tale contesto è utile richiamare il Cons. n. 108 che è utile per interpretare la differente scelta operata dal legislatore comunitario.

In tale contesto è utile richiamare anche il Cons. 102, nel quale è menzionato un esempio in tal senso, che così recita: “Il presente regolamento lascia impregiudicate le disposizioni degli accordi internazionali conclusi tra l’Unione e i paesi terzi che disciplinano il trasferimento di dati personali, comprese adeguate garanzie per gli interessati. Gli Stati membri possono concludere accordi internazionali che implicano il trasferimento di dati personali verso paesi terzi o organizzazioni internazionali, purché tali accordi non incidano sul presente regolamento o su qualsiasi altra disposizione del diritto dell’Unione e includano un adeguato livello di protezione per i diritti fondamentali degli interessati”.

In questo articolo, abbiamo esaminato le garanzie adeguate per il trasferimento di dati personali verso paesi terzi o organizzazioni internazionali in assenza di una decisione di adeguatezza. Abbiamo esplorato le varie opzioni disponibili, tra cui clausole contrattuali tipo, norme vincolanti d’impresa e meccanismi di certificazione, evidenziando l’importanza di garantire la protezione dei dati e i diritti degli interessati nei trasferimenti internazionali.

Vi invitiamo a proseguire la lettura con il prossimo contenuto della serie, dedicato alle “Norme Vincolanti di Impresa nel GDPR: Cosa Sono e Come Funzionano”, per approfondire ulteriormente questo importante aspetto della conformità al GDPR.

Per una panoramica completa e dettagliata su tutti gli aspetti del Registro dei Trattamenti e del trasferimento di dati personali nel GDPR, vi invitiamo a consultare il nostro white paper dal titolo “La compilazione del Registro dei trattamenti nel nuovo quadro normativo del Reg. UE 679/2016“, che contiene tutte le informazioni necessarie per una corretta implementazione delle norme sulla protezione dei dati.

https://www.ictsecuritymagazine.com/articoli/dati-personali-gdpr-2/

Gen Z, Gen X, Millennials, Boomers — organizations today have to cater to a myriad of generations with different preferences and habits, particularly when it comes to technology and digital experiences. Digitally-native generations like Gen Z who grew up using the internet and mobile devices have more familiarity with technology, and will therefore have differing preferences than those that did not grow up with these innovations. Just think — does the average grandparent know how to log into their Netflix account on their TV with a QR code? What does this all mean for businesses today when it comes to digital identity? 

As leaders, taking these preferences into consideration is critical in order to best appeal to customers and ensure memorable digital experiences. A recent report surveyed consumers about digital experiences and their concerns about identity security. The findings from this can help leaders better understand today’s consumers to ensure solutions are tailored to their preferences.

Prioritizing personalization?

Personalization can often make or break a customer interaction. The more personalized the digital journey is, the more likely the user will have repeat interactions and higher brand loyalty. Today, younger generations are more likely to say that personalization is important. In fact, 47% of Gen Z and 40% of millennials say so. However, this is decreasing year-over-year: Gen Z decreased by 10% and millennials by 16% compared to data gathered in 2023. 

This decrease could possibly be attributed to consumers becoming more aware of the data that organizations are collecting on them. In turn for not sharing as much personal data, they are expecting — and preferring — less personalized experiences. To combat this, it’s important that organizations strike a balance between creating a personalized experience for consumers who want it without collecting too much personal data. A great way to achieve this balance is to provide opt-in options, enabling the customer to control what additional information they want to provide to build out their profile. This will appeal to all generations, not just ones that want more personalization. It’s also a great practice to share why data is being collected so customers know the trade-off they are making when deciding whether or not to opt-in. 

Bring on the biometrics

It’s no surprise that digitally-native younger generations are more likely to want a quick and seamless biometrics login experience, given so much of their day-to-day relies on technology. Twenty-one percent of Gen Zers and 20% of Millennials say that if there was one thing they could change about the login process, they would want more biometric options such as face ID, fingerprint, or selfie verification. 

Ultimately, biometrics are a key option in delivering seamless and secure login options and therefore are a critical tool in the digital identity toolbelt. Traditional authentication, such as passwords, are a prime target for cyberattacks. What’s more, passwords are a huge cause of friction and frustration. When designing experiences for older generations, using biometric on their mobile devices can be an option or opt for a non-biometric option like magic links.  

Frets about fraud 

Financial fraud is a main concern across generations, however older generations seem to be more concerned about it. Fifty-five percent of Boomers and 57% of the Silent Generation list financial fraud as a top concern, while only 46% of Gen Z list it as one. On the other hand, younger generations are more concerned about personal data breaches. Gen Z has the most concern about this (35%) and the Silent Generation has the least concern (16%). Understanding what these generations are most concerned about when it comes to identity security means organizations can tailor security solutions to various customers. 

These generational differences are critical to keep in mind when designing customer experiences and login processes. When organizations need to cater to many of these generations, the problem is compounded, so flexibility in experiences is key to maintaining loyalty across generations. No matter which generation an organization are catering to, it’s important to understand that when it comes to identity security, a majority of consumers (89%) have concerns about AI. Not only that, but nearly all of consumers (97%) have concerns about their personal data being online. Organizations need to ensure that all login processes, no matter which generation is using them, are designed securely and with the user in mind. 

https://www.securitymagazine.com/articles/101274-what-leaders-need-to-know-about-generational-privacy-preferences

As cyberattacks grow more systemic and continue to mature, regulators have increased their focus on transparency and accountability. On October 22, 2024 the SEC announced a series of fines against four firms for making “materially misleading disclosures” regarding SolarWinds-related intrusions. The action highlights a marked shift in what the SEC expects of companies regarding cyber disclosures, targeting omissions that could leave investors in the dark about the scope and impact of security events. The SEC’s stance is clear: cybersecurity risk transparency is an essential component of a public corporation’s fiduciary duty to investors. This stance signals a shift in corporate oversight, where cybersecurity risk is now as critical to disclose as financial metrics. In much the same way the Sarbanes-Oxley Act transformed financial governance, the SEC’s actions mark a pivotal step in making cybersecurity accountability a core element of corporate governance.

The evolving role of CISOs under SEC’s “Cyber SOX”

As the fines demonstrate, security leaders are now tasked with bridging gaps between cyber risk and financial impact — combining an understanding of risk metrics and their financial impact that resonate at the board level. The cost of a cyberattack continues to weigh heavily on businesses; in 2024, U.S. companies paid an average of $9.36 million to recover from data breaches, only a slight decline from the previous year. Globally, the average cost was a staggering $4.88 million.

For today’s CISOs, this marks a turning point. Their responsibilities have expanded beyond the traditional duties of checkbox compliance requirements and control implementation. They are now critical players in corporate governance, tasked with ensuring that cyber risks are evaluated, managed and reported transparently to stakeholders. The SEC’s cybersecurity rule now demands that CISOs and boards take proactive steps to address the financial implications of cyber threats, focusing on clear and quantifiable disclosures. Beyond reporting on the technical state of cybersecurity, they must now align cyber risk metrics with operational and financial risk metrics, reinforcing cybersecurity as a foundational aspect of overall business health.

8-K filings and disclosure strategy

A notable aspect of the SEC’s cybersecurity ruling is the requirement for current and timely reporting of material cybersecurity incidents via Form 8-K filings. Since the rule took effect in 2023, there has been a sharp rise in 8K filings regarding cyber events, reflecting a broader shift in expectations for security leaders. While materiality is a well-understood economic concept that can be determined using modern risk quantification methods, discrepancies remain in how it’s interpreted. Executives often tie materiality to high revenue thresholds, but investors may view smaller breaches as significant when they indicate broader deficiencies in cyber risk management.

This adjustment period has led some organizations to adopt an overly cautious approach, submitting filings without fully quantifying the material impact. While technically compliant, this strategy can obscure meaningful disclosures and pose a risk to investors seeking transparency. The SEC’s stance on recent omissions brings a pointed message: failure to communicate critical cyber risk information isn’t just a lapse; it is a regulatory violation that can have major financial consequences.

For CISOs, this highlights the importance of cybersecurity disclosures as integral to investor relations. Cyber risk management, when done properly, ensures clear communication between information security and boards, promoting better decision making and transparency, much like standardized reporting practices implemented under SOX.

Bridging the knowledge gap in financial and cyber risk

One of the greatest challenges for security leaders in meeting these new requirements is the need for cross-disciplinary knowledge. Many security leaders are highly skilled in technical areas but may lack experience in financial terminology and its implications for cybersecurity. Yet, understanding these financial dimensions is essential. It allows CISOs to clearly communicate risk posture to boards and investors and align cyber risks with other critical business risks in financial terms.

Strong platforms emphasizing measurable, actionable cybersecurity programs provide tools that help close this gap. By translating cyber risk into language that resonates with other departments, such as finance and investor relations, CISOs can effectively communicate the full impact of cybersecurity incidents. This approach fosters a culture of transparency, in line with SEC expectations, while enhancing the organization’s ability to protect against cyber threats.

Focus on omissions: The SEC’s new emphasis on transparency

The SEC’s recent fines reflect a broader regulatory focus on omissions rather than misstatements. In the case of the four fined firms, the SEC’s rationale was rooted in a “reasonable investor” standard — essentially, investors have a right to expect clear and accurate information regarding material cyber risks. This emphasis on omissions challenges CISOs to ensure that cybersecurity reports are complete and understandable to stakeholders who may not have a technical background.

For cybersecurity leaders, risk management and disclosure go hand-in-hand, but each has distinct requirements. Under section 106(b), organizations must “show their work” by disclosing the processes they use to assess, identify, and manage cybersecurity risks. This transparency requires CISOs to work with other executives to ensure these processes are well-documented, consistent, and clearly communicated to investors.

In contrast, omissions in incident disclosures — addressed under Section 105 — can lead to significant consequences including fines and reputational damage. CISOs must balance these dual responsibilities by developing strategies that prioritize transparency in both ongoing risk management processes and incident-specific disclosures.

The irony of the fines: When transparency would have softened the blow

The recent SEC fines spotlight an ironic truth: had these companies quantified their cyber risks in financial terms, their disclosures may have seemed less alarming than the narrative implied by technical terms alone. By avoiding financial metrics, the companies presented cybersecurity events in vague, often unsettling terms, leaving investors to interpret risks without material context. Reporting a “ransomware attack” or “breach” without quantifiable impact can appear far more daunting than the financial implications might suggest.

This irony reveals the need for security leaders to integrate financial clarity into their cyber resilience efforts, making cyber disclosures a seamless part of corporate governance. The SEC’s rule is, in many ways, a call for CISOs and boards to present cybersecurity not as an isolated technical function but as a quantifiable, manageable element of operational and financial stability.

A new era of corporate governance and cybersecurity accountability

As SOX reshaped corporate governance around financial transparency, the SEC’s cybersecurity ruling has the same effect on cyber risk. It encourages CISOs to adopt a proactive and transparent approach to managing and disclosing cyber risks. By embedding cybersecurity into the core of corporate governance, companies can ensure resilience in the face of growing cyber threats, ultimately building greater trust among investors.

For CISOs, cybersecurity must be treated as a critical element of business continuity and investor confidence. As SOX set the stage for financial accountability, the SEC’s cybersecurity rule establishes a new standard for cybersecurity accountability that holds security leaders and boards to a higher level of transparency and integrity in the digital age.

By aligning cyber and business risks, CISOs can deliver the insights necessary to drive informed decisions and ensure compliance with SEC standards. With end-to-end tools, organizations can establish a cybersecurity culture that meets these evolving demands, delivering transparency, resilience and measurable business value.

https://www.securitymagazine.com/articles/101270-the-new-cybersecurity-accountability-sec-takes-action

Gen 06, 2025 Stefano Silvestri Attacchi, Hacking, Intrusione, Malware, News, Phishing, Tecnologia, Vulnerabilità 0

---

Nel corso della scorsa settimana, il CERT-AGID ha identificato e analizzato 14 campagne malevole nel contesto italiano di sua competenza.

Tra queste, 12 erano mirate specificamente a obiettivi italiani, mentre le altre 2, sebbene di natura generica, hanno comunque coinvolto l’Italia.

Ai propri enti accreditati, il CERT-AGID ha fornito 194 indicatori di compromissione (IoC) rilevati nel corso delle attività di monitoraggio.

I temi della settimana

Nella settimana passata sono stati individuati sette temi principali sfruttati per condurre campagne malevole sul territorio italiano.

Tra i più rilevanti si segnalano Delivery, utilizzato per campagne di smishing mirate contro i clienti di Poste Italiane.

Immancabilmente troviamo il Banking, tema centrale in campagne di phishing via PEC, in particolare contro i clienti di Intesa Sanpaolo. Lo stesso argomento è stato impiegato in una campagna generica di phishing che ha preso di mira Capital One.

Un altro tema gettonato è da sempre quello dei Pagamenti, stavolta sfruttato in due campagne malware, una di portata generica volta alla diffusione del trojan FormBook e una specificamente italiana che distribuisce il malware XWorm.

Il tema Booking è stato utilizzato come pretesto per la distribuzione dei malware AsyncRAT e LummaStealer, mentre gli altri temi individuati sono stati impiegati per una varietà di campagne di malware e phishing rivolte a diversi obiettivi.

Tra gli eventi più significativi della settimana si segnala un’intensificazione delle campagne di smishing rivolte ai clienti di Poste Italiane, finalizzate al furto di dati personali e finanziari.

Tramite SMS fraudolenti, gli utenti vengono avvisati di presunti problemi legati alla consegna di un pacco e indirizzati su una pagina web ingannevole, dove vengono richieste informazioni personali e dati delle carte di credito.

Un altro episodio di rilievo riguarda la diffusione di un presunto breach che ha coinvolto una non precisata suite di soluzioni software specializzata in marketing e comunicazione aziendale.

I dati sottratti e divulgati includono informazioni anagrafiche, indirizzi email e numeri di telefono, con potenziali impatti significativi sulla privacy degli utenti coinvolti.

Malware della settimana

Nel corso della settimana sono state identificate quattro famiglie di malware che hanno colpito il territorio italiano, distinguendosi per modalità di diffusione e tematiche sfruttate.

FormBook ha visto una campagna di portata generica basata sul tema “Pagamenti”, diffusa attraverso email contenenti un allegato in formato RAR.

AsyncRAT è stato impiegato in una campagna specificamente italiana a tema “Booking”, veicolata tramite email con allegati in formato HTML.

Lumma è stato protagonista di un’altra campagna italiana sempre legata al tema “Booking”, anch’essa distribuita tramite email con allegati in formato HTML.

Infine, XWorm è stato usato per una campagna italiana incentrata sul tema “Pagamenti”, diffusa tramite email con allegati ZIP.

Phishing della settimana

Questa settimana sono stati cinque i brand colpiti da campagne di phishing, con un’intensificazione delle attività legate a Poste Italiane e Intesa Sanpaolo.

Le campagne a tema Poste Italiane si sono focalizzate prevalentemente su attacchi di smishing, sfruttando falsi messaggi relativi a presunti problemi con la consegna di pacchi.

Questi tentativi fraudolenti, come abbiamo scritto, miravano a indurre gli utenti a condividere dati sensibili, tra cui credenziali personali e informazioni di pagamento.

Per quanto riguarda Intesa Sanpaolo, le campagne si sono concentrate su email PEC di phishing, spesso sofisticate e apparentemente autentiche, con l’obiettivo di sottrarre informazioni bancarie.

Formati e canali di diffusione

Il rapporto settimanale del CERT-AGID ha evidenziato l’impiego di quattro tipologie di file per la distribuzione di contenuti dannosi.

Tra i formati analizzati, i file HTML si sono rivelati i più utilizzati, con tre diverse campagne che ne hanno sfruttato il potenziale. Seguono i file RAR, ZIP e URL, ciascuno impiegato in una singola campagna.

Le email si confermano il canale preferito dai criminali informatici, con sette campagne individuate che sfruttano questo mezzo per raggiungere le vittime. Gli SMS non sono stati da meno, rappresentando il vettore di attacco per quattro campagne malevole.

Infine, la posta elettronica certificata (PEC) è stata bersaglio di tre campagne, segnalando una crescente diversificazione nelle tecniche di attacco, che mirano a colpire in modo mirato e sofisticato diversi canali di comunicazione.

---

---

---

https://www.securityinfo.it/2025/01/06/cert-agid-28-dicembre-3-gennaio-poste-italiane-e-intesa-sanpaolo-sotto-attacco/?utm_source=rss&utm_medium=rss&utm_campaign=cert-agid-28-dicembre-3-gennaio-poste-italiane-e-intesa-sanpaolo-sotto-attacco

As the world enters 2025, the world is increasingly fragmenting, a theme which cuts through the International SOS annual Risk Outlook report, where security experts have identified the top risks for organizations in the coming year.

Last year’s International SOS Risk Outlook report warned of deepening global instability, which has become regrettably accurate. This year’s report highlights ‘a fragmenting world,’ which is more anarchic, divided and surprising, amidst a breaking down of norms, relationships and taboos. 

New world disorder

There is a global, or geopolitical fragmenting: while the United States-China competition will remain an important dynamic, there is growing multipolarity as relative power is shifting to a wider range of countries which are becoming more active and opportunistic, like Turkey and Saudi Arabia. This reflects longer term trends, like the notion of ‘Bigger Yards and Higher Fences’ — nativism is on the rise in many countries which are turning inwards amidst populism and protectionism. On-shoring, resource nationalism and border control will shape immigration, trade and industrial policies. The world is also becoming ‘blocced up,’ and organizations will need to navigate shifting alliances and new partnerships. NATO’s future is uncertain, the Sahelian countries have withdrawn from ECOWAS, and emerging ‘blocs’ like BRICS+, AUKUS, and the QUAD are gaining relevance. 

In 2025 emerging ‘rogue actors’ will operate with more impunity. The UN Security Council is trapped by the vetoes of the P5 members; sanctioned countries like Iran subvert these through new trade and financial links; and civil wars in Myanmar, Libya and Sudan endure as outsiders support their local proxies. Also, non-state actors like militias and mercenaries have growing freedom of action to disrupt trade, civilian aviation and local security. These actors will increasingly shape the new world disorder, and risk managers with finite sources and capabilities will need to monitor a greater number, range and variety of threat actors. For decision-makers, previously stable locations for investment, trade, and assignments are now more vulnerable in this changing international landscape.

Home fronts

Countries are fragmenting internally, too — geographically, ethnically and ideologically, and this will happen more in 2025. Established political parties on the left and right are in systemic decline and steadily losing primary vote shares — from Australia to the UK, France to Japan — to insurgent candidates and parties across the political spectrum. There is also the ‘blowback,’ where politicians and populations push back against the apparent costs of the energy transition and where foreign policies like on Israel-Palestine blow back home in the form of protests. All politics may be local, but so is all risk management, and acute social and political issues make it more difficult and sensitive for organizations to reduce and avoid risks for their local staff in their own countries. 

Conflict, connections & confusion

‘Conflict, Connections and Confusion’ amplify the friction, uncertainty, chaos and danger of a fragmenting world. Firstly there is ‘conflict’ between and within countries for influence, resources and opportunity. Climate change amplifies the impacts of human conflict by accelerating internal migration and refugee flows, and competition for apparently or actually scarce resources make immigration seem existential. There is generational conflict within countries, especially for opportunities in kleptocracies or autocracies with a combination of ageing leadership and young and educated but unemployed populations as we saw in Kenya and Nigeria.

Secondly, new or changing ‘connections’ are being generated by, or happening during, a fragmenting world. There are new relationships with the opening of Saudi Arabia to major foreign direct investment and the deployment of North Korean troops to Ukraine. There are real commercial opportunities, however nefarious actors exploit new connections, like in the Pacific where Fiji and Tonga are used by drug cartels as pathways.

Lastly, there is ‘confusion’ driven by the rise of synthetic reporting. AI amplifies the apparent authenticity, volume and sophistication of both accidentally and deliberately erroneous misinformation, which amplify other risks as problematic online material is prompting or accelerating real-world violence. At the country level ideological differences are amplified by a fragmented consumption of news. Organizations with staff across different generations, locations and political orientations increasingly have staff living in different information environments. It will be important to understand how your workforce accesses and consumes information — ask, ‘what are the sources and pathways for misinformation and disinformation to spread amongst my people?’

Business resilience

In 2025, organizations will be more vulnerable to the second and third order effects of seemingly esoteric, distant or unrelated phenomena. Those who don’t systematically track local risks and analyze emerging scenarios will miss key signals in an increasingly complex world, making them too slow to detect indicators of risks and less able to capitalize on fleeting opportunities. Intelligence and response capabilities must be better integrated, though this will be harder for risk teams facing budget and staffing constraints.

For security professionals, the message is clear: the landscape is more complex, but with the right tools and strategies, it is possible to treat risks and seize opportunities. Technology will help identify incidents, deliver personalized risk information, and support the fieldwork, local knowledge, and analysis of risk professionals. The most resilient organizations in a fragmenting world in 2025 will combine advanced technology with ‘human-in-the-loop’ strategies for better decision-making.

https://www.securitymagazine.com/articles/101268-an-era-of-conflict-navigating-a-fragmenting-world-in-2025

Gen 03, 2025 Marina Londei Attacchi, In evidenza, News, RSS, Vulnerabilità 0

---

I ricercatori di SafeBreach hanno pubblicato una PoC di un exploit che sfrutta una vulnerabilità di LDAP di Windows per causare un crash di sistema.

La vulnerabilità in questione, la CVE-2024-49113, è un bug di out-of-bound read risolto da Microsoft nel Patch Tuesday di dicembre. “Abbiamo dimostrato la gravità di questa vulnerabilità dimostrando che può essere usata per interrompere le funzionalità di server Windows non patchati” hanno affermato i ricercatori. Secondo l’analisi di Microsoft, il bug può essere sfruttato anche per l’esecuzione remota di codice.

Nella loro analisi i ricercatori confermano che, per sfruttare il bug di LDAP di Windows, un attaccante non ha bisogno di autenticarsi; inoltre, è sufficiente che il server DNS dei Domain Controller di Active Directory della vittima sia connesso a Internet per eseguire l’exploit.

Stando alla descrizione dell’exploit condivida da SafeBreach, l’attacco comincia con l’invio di una richiesta DCE/RPC al server della vittima; in seguito, il server vittima invia una query DNS di tipo SRV, in questo caso diretta per il dominio SafeBreachLabs.pro.

A questo punto il server DNS dell’attaccante risponde con l’hostname della macchina dell’attaccante e una porta LDAP, poi il target invia una richiesta NBNS (NetBIOS Name Service) in modalità broadcast per ottenere l’indirizzo IP associato all’hostname ricevuto. L‘attaccante risponde alla richiesta con il proprio indirizzo IP, convincendo il server target che l’IP è associato all’hostname cercato.

Adesso il server vittima si comporta come un client LDAP e invia una richiesta CLDAP (Connectionless LDAP) alla macchina dell’attaccante, connessione che può essere manipolata. Infine, l’attaccante invia una risposta CLDAP alterata con un valore specifico che sfrutta una vulnerabilità nel processo LSASS (Local Security Authority Subsystem Service) del server vittima. Il risultato è che LSASS va in crash, causando un riavvio forzato del server.

SafeBreach ha verificato l’exploit su Windows Server 2022 e Windows Server 2019, ma è probabile che la PoC funzioni su qualsiasi versione di Windows Server precedente alla patch.

“La vulnerabilità sfruttata dalla PoC di SafeBreach Labs riguarda una tecnologia ampiamente utilizzata nelle reti aziendali e questa falla potrebbe aiutare gli aggressori a propagarsi in modo più semplice ed efficace” avvertono i ricercatori; per questo motivo, è essenziale aggiornare il prima possibile i server vulnerabili con la patch ufficiale. 

---

---

---

https://www.securityinfo.it/2025/01/03/pubblicato-un-exploit-che-sfrutta-una-vulnerabilita-di-ldap-di-windows-per-causare-un-crash-di-sistema/?utm_source=rss&utm_medium=rss&utm_campaign=pubblicato-un-exploit-che-sfrutta-una-vulnerabilita-di-ldap-di-windows-per-causare-un-crash-di-sistema