CTO at NCSC Summary: week ending July 19th

When targeting an organization to steal information, maintaining a low profile is critical for attackers. They typically aim for long-term persistence, which requires avoiding security alerts while preserving access in case they’re detected and the organization initiates incident response or routine password resets. Malware such as infostealers or ostensibly legitimate remote monitoring and management (RMM)…

Microsoft said it has closed off RoguePlanet, a privilege escalation flaw in the Windows Defender scanning engine that could let a local attacker spawn a SYSTEM-level shell, but the researcher who found the zero-day bug has poked new holes in the anti-malware tool. A race condition bug, the vulnerability works on Windows 10 and 11…

The California legislature has stepped back from a plan that would have expanded its age-gating law, removing language that could have compounded serious threats to users’ speech, privacy and security just to browse the internet. A.B. 1856, authored by Assemblymember Buffy Wicks, will now move forward through the legislature without its most problematic pieces. EFF…

On Wednesday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and four allied cyber authorities published a guide telling software vendors how to build a coordinated vulnerability disclosure (CVD) program. Six days earlier, CISA published a blog post explaining how a security researcher had tried and failed, repeatedly, to report a serious problem to CISA…

I’m here today to write about one particularly thorny area of operational technology (OT) and security that I run into somewhat routinely. Given my own particular interests as an incorrigible vulnerability-gazer, and my professional role as vice president of security research at runZero, I deal with OT security issues more often than the average bear….

ZDNET Follow ZDNET: Add us as a preferred source on Google. Sony’s 1000X The Collexion headphones take what Sony has learned in the consumer headphone space over the past decade and pack those lessons into a high-end, luxury-focused body. The Bowers & Wilkins Px8 S2 headphones are luxurious, too — and arguably more so —…