August 19, 2021

XSS Bug in SEOPress WordPress Plugin Allows Site Takeover

“The permissions_callback for the endpoint only verified if the user had a valid REST-API nonce in the request,” according to the posting. “A valid REST-API nonce can be generated by any authenticated user using the rest-nonce WordPress core AJAX action.” Depending on what an attacker updates the title and description to, it would allow a number of malicious actions, up to and including full site takeover, researchers said. “The payload could include malicious web scripts, like JavaScript, due to a lack of sanitization or escaping on the stored parameters,” they wrote. “These web scripts would then execute any time a user accessed the ‘All Posts’ page. As always, cross-site scripting vulnerabilities such as this one can lead to a variety of malicious actions like new administrative account creation, webshell injection, arbitrary redirects and more. This vulnerability could easily be used by an attacker to take over a WordPress site.” To protect their websites, users should upgrade to version 5.0.4 of SEOPress.?Vulnerabilities in WordPress plugins remain fairly common.?

How building a world class SOC can alleviate security team burnout

In the short term, this alert overload means an increased potential for high-risk threats being missed as analysts attempt to slog through as many alerts as possible alongside their other duties. Aside from the immediate security issues, this kind of environment poses some serious long-term problems. The frustrations of burnt-out teams can build to the point where analysts will decide to quit their job in search of less stressful positions. We have found that around half of security personnel are considering changing roles at any given time. Not only will they be taking their experience and skills with them, but the ongoing cyber shortage means finding a replacement may be a long and costly process. A team that spends most of its time trudging through alerts and running to put out security fires will also have very little time left for any higher-level strategic activity. This might include undertaking in-depth risk analysis and establishing improved security strategies and processes. Without this activity, the organization will struggle to keep up with evolving cyber threats.

Security through obscurity no longer works

You might expect that companies would be better off keeping their cards close to their chest. The less hackers know about how a company guards its data, the safer the data becomes, according to this line of thinking. In fact, the opposite is true. Secrecy in cyber security puts everyone at risk: the company, its customers, and its suppliers. Electric vehicles serve as a good example of the value of openness in cyber security. Many models require extremely sophisticated software that has to be updated frequently. For example, Tesla distributes updates to owners at least once per month. To deliver updates, an electric car maker requires worldwide access privileges to the on-board computers on its cars. Naturally, car owners want certainty that this does not expose them to hacking, remote carjackings and shut downs, or being spied on as they drive. For this reason, makers of electric vehicles need to be extremely open about their cyber security so that owners, or trusted experts, can assess if the company’s systems offer effective protection. Although they do not themselves manage data, telecom equipment makers take their responsibility in supplying network operators just as seriously as makers of electric cars.

Container Best Practices: What They Are and Why You Should Care

One of the common pitfalls organizations make is to succumb in practice to the misperception that minification of containers IS container best practices. Without a doubt, an outsized amount of time and energy is spent thinking about reducing the size of a container image (minification), and with good reason. Smaller images are safer; faster to push, pull, and scan; and just generally less cumbersome in the development lifecycle. That’s why “shrinking a container” has become a common subject for blog posts, video tutorials and Twitter posts. It’s also why the DockerSlim open source project, created and maintained by Kyle Quest, is so popular. It is best known for its ability to automatically create a functionally equivalent but smaller container. Another common tactic for container minification could be described as “The Tale of Two Containers.” In this approach, developers first create a “dev container” comprising all the tools they love to use for development. Then, once development is complete, developers convert their “dev containers” to “prod containers,” typically by replacing the “heavy” underlying base image with something lighter and more secure.

What is Today′s Relevance of an Enterprise Architecture Practice?

It seems that, especially in modern tech companies, the importance of the Enterprise Architecture (EA) practice is decreasing. Some organizations might even consider it an irrelevant practice. In the following, we analyze where such opinions emerge from. In the later parts of this series, we will provide arguments against that reasoning and provide an analysis, which underpins that this is not the end of Enterprise Architecture as a practice. However, Enterprise Architecture will go through a transformation towards an adapted set of activities, new priorities, and new required skills. ... Apart from the arguments above, there is an additional observation, which is common across many different organizations: The more old-world / legacy IT an organization has, the more important the Enterprise Architects in the organization are. Similarly, in organizations with old and new world IT, Enterprise Architects are responsible for managing the architecture of the old world. However, they have only little influence on the development of the new world IT; the digital area.?

How computer vision works — and why it’s plagued by bias

Like machine learning overall, computer vision dates back to the 1950s. Without our current computing power and data access, the technique was originally very manual and prone to error. But it did still resemble computer vision as we know it today; the effectiveness of first processing according to basic properties like lines or edges, for example, was discovered in 1959. That same year also saw the invention of a technology that made it possible to transform images into grids of numbers , which incorporated the binary language machines could understand into images. Throughout the next few decades, more technical breakthroughs helped pave the way for computer vision. First, there was the development of computer scanning technology, which for the first time enabled computers to digitize images. Then came the ability to turn two-dimensional images into three-dimensional forms. Object recognition technology that could recognize text arrived in 1974, and by 1982, computer vision really started to take shape. In that same year, one researcher further developed the processing hierarchy, just as another developed an early neural network.

Read more here ...