Welcome, fellow travelers of the Cosmos! While we may not be traversing the stars on a spaceship, we are all interconnected through the powerful network of blockchains. Unfortunately, just like any technology, vulnerabilities can be discovered and exploited. In this post, we’ll present a critical vulnerability in a Cosmos-SDK blockchain that is explicitly related to the Inter-Blockchain Communication Protocol (IBC).

Trust is a vital part of any growing business. A part of earning and keeping the trust of your customers is implementing the right security measures to protect their data and your systems from any breaches that could impact them. ‍ By aligning with industry-vetted security frameworks, you’ll be able to build a strong security posture that protects your systems and earns customer trust. There are many security frameworks that could be applied to your infrastructure.

Varonis researchers have recently disclosed that several government agencies and private-sector companies had customized or added features to their Salesforce Apex code that leaked data, allowed data corruption, or allowed an attacker to disrupt business functions. Impacted data included the usual suspects like phone numbers, addresses, social security numbers, and username/password combinations.

The main difference between passwordless authentication and Multi-Factor Authentication (MFA) is that passwordless authentication completely removes the use of passwords, whereas MFA is used in conjunction with passwords. There are also differences in a user’s login experience when using passwordless authentication versus MFA, deploying each of them and their cost. Continue reading to learn more about the differences between passwordless authentication and MFA.

In today's digital world, secure authentication is not just a necessity; it's a cornerstone of trust between services and their users. Navigating the complexities of SAML and implementing robust single sign-on (SSO) solutions can be daunting for many organizations. This document explores the critical role of SAML in enhancing web security, the challenges businesses face in adopting it, and introduces BoxyHQ's streamlined approach to simplifying this process, making advanced security accessible to all.

On February 13, 2024, Microsoft published their February 2024 security update with patches for 73 vulnerabilities. Among these vulnerabilities, Arctic Wolf has highlighted 5 vulnerabilities in this bulletin that were categorized as critical or zero-day vulnerabilities. Two of these vulnerabilities have been reported to be exploited in the wild.

On February 19, 2024, ConnectWise published a security bulletin detailing two critical vulnerabilities within their on-premises ScreenConnect software. At the time of writing, these vulnerabilities do not have CVE numbers assigned to them. ConnectWise has stated that the vulnerabilities have the potential to result in remote code execution (RCE). Vulnerability #1 (CVSS: 10): Allows a threat actor to achieve authentication bypass by leveraging an alternate path/channel.

Analyzing the content and security implications of browser extensions is a complex task! It's almost like trying to piece together a complex jigsaw puzzle (thanks JavaScript). Automation is a key way to reduce this complexity without adding to the workload of security staff. With so many extensions to inspect (we analyzed more than 140,000 of them), automating small portions of that analysis provided a big impact.

A widespread malvertising campaign is attempting to trick users into paying phony utility bills, according to researchers at Malwarebytes. “We discovered a prolific campaign of fraudulent ads shown to users via Google searches,” the researchers write. “To give an idea of scale, the number of ads we found exceeds what we have found in previous malvertising cases....The scam begins when a user searches for keywords related to their energy bill.

With the idea in mind to “audio-jack” a live call-based banking transaction, security researchers were successful in inserting cybercriminal-controlled account details. Deepfake audio is nothing new… but it is getting very advanced. So much so, that security researchers at IBM Threat Intelligence were able to test out a hypothesis as to whether it’s possible to perform an audio-based “Man in the Middle” attack.