{"id":32468,"date":"2022-12-09T08:37:03","date_gmt":"2022-12-09T13:37:03","guid":{"rendered":"https:\/\/www.itworldcanada.com?p=517567"},"modified":"2022-12-12T09:12:37","modified_gmt":"2022-12-12T14:12:37","slug":"cyber-security-today-dec-9-2022-toronto-pwn2own-contest-awards-close-to-us1-million-in-prizes-and-more","status":"publish","type":"post","link":"https:\/\/technewsday.com\/staging\/cyber-security-today-dec-9-2022-toronto-pwn2own-contest-awards-close-to-us1-million-in-prizes-and-more\/","title":{"rendered":"Cyber Security Today, Dec. 9, 2022 \u2013 Toronto Pwn2Own contest awards close to US$1 million in prizes, and more"},"content":{"rendered":"<p data-ar-index=\"0\">Toronto Pwn2Own contest awards close to $1 million in prizes, and more.<\/p>\n<p data-ar-index=\"1\">Welcome to Cyber Security Today. It\u2019s Friday, December 9th, 2022. I\u2019m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com.<\/p>\n<p data-ar-index=\"2\"><iframe style=\"border: none;\" title=\"Libsyn Player\" src=\"https:\/\/html5-player.libsyn.com\/embed\/episode\/id\/25271634\/height\/90\/theme\/custom\/thumbnail\/yes\/direction\/forward\/render-playlist\/no\/custom-color\/000000\/\" width=\"100%\" height=\"90\" scrolling=\"no\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/p>\n<table style=\"width: 100%;\">\n<tbody>\n<tr>\n<td><a href=\"https:\/\/www.amazon.com\/ITWC-Cyber-Security-Today\/dp\/B07BRNG89P\/ref=sr_1_1?s=digital-skills&amp;ie=UTF8&amp;qid=1522688435\" rel=\"noopener noreferrer\"><img decoding=\"async\" class=\"aligncenter wp-image-396718 size-full\" src=\"https:\/\/i.itworldcanada.com\/wp-content\/uploads\/2017\/09\/sub-alexa-200.png\" alt=\"Cyb er Security Today on Amazon Alexa\" width=\"200\" height=\"74\" border=\"none\" \/><\/a><\/td>\n<td><a href=\"https:\/\/www.google.com\/podcasts?feed=aHR0cDovL2N5YmVyc2VjdXJpdHl0b2RheS5saWJzeW4uY29tL3Jzcw%3D%3D\" rel=\"noopener noreferrer\"><img decoding=\"async\" class=\"thumbnail aligncenter wp-image-408712 size-full\" src=\"https:\/\/i.itworldcanada.com\/wp-content\/uploads\/2018\/09\/sub-gp-200.png\" alt=\"Cyber Security Today on Google Podcasts\" width=\"200\" height=\"74\" \/><\/a><\/td>\n<td><a href=\"https:\/\/itunes.apple.com\/ca\/podcast\/cyber-security-today\/id1363182054\" rel=\"noopener noreferrer\"><img decoding=\"async\" class=\"aligncenter wp-image-396720 size-full\" src=\"https:\/\/i.itworldcanada.com\/wp-content\/uploads\/2017\/09\/sub-itunes-200.png\" alt=\"Subscribe to Cyber Security Today on Apple Podcasts\" width=\"200\" height=\"74\" border=\"none\" \/><\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p data-ar-index=\"3\"><strong>The Toronto edition<\/strong> of the<a href=\"https:\/\/www.zerodayinitiative.com\/blog\/2022\/12\/8\/pwn2own-toronto-2022-day-three-results\" rel=\"noopener\"> Pwn2Own hacking contest<\/a> ends today. As of the recording of this podcast on Thursday afternoon, individuals and teams had won almost US$800,000 in cash prizes, with the expectation that more than US$1 million might be awarded by the time the event ends. Organized by Trend Micro, 26 entrants from as far away as South Korea participated. They are trying to show zero-day exploits against home and small office printers, routers and a smartphone. One of the biggest prizes, US$60,000, went to a team that used two bugs against a wireless speaker. Another team earned US$37,500 for using a unique bug to crack a printer connected to a router. Hardware and software manufacturers learn where vulnerabilities are in their products from hacking contests like this. The next Pwn2Own contest will be held in Miami in February.<\/p>\n<p data-ar-index=\"4\"><strong>In October<\/strong> I told you about a cyber attack on a U.S. hospital chain called CommonSpirit. This was a ransomware attack. <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/commonspirit-health-ransomware-attack-exposed-data-of-623-000-patients\/\" rel=\"noopener\">The company has now said<\/a> the personal data of over 623,000 persons was copied by the attackers including names, dates of birth, addresses and phone numbers.<\/p>\n<p data-ar-index=\"5\"><strong>Attention IT administrators<\/strong>: If you haven\u2019t yet moved off Internet Explorer heed <a href=\"https:\/\/blog.google\/threat-analysis-group\/internet-explorer-0-day-exploited-by-north-korean-actor-apt37\/\" rel=\"noopener\">this warning from Google<\/a>: North Korean-based hackers are still exploiting this browser\u2019s holes. The latest example was a zero-day vulnerability found in the browser and launched against Windows systems by hiding in a Microsoft Office document. It was used to target people in South Korea. The lure was an old tactic, claiming the attached document had news about a local tragedy. The attackers hoped victims would be interested and turn off a document warning.<\/p>\n<p data-ar-index=\"6\"><strong>Microsoft 365<\/strong> has email security features, but sometimes they can be defeated by cunning attackers. This week <a href=\"https:\/\/www.armorblox.com\/blog\/malware-attack-bypasses-office-365\/\" rel=\"noopener\">researchers at Armorblox outlined<\/a> an example. The lure was a message with the subject line \u2018Please find invoice attached.\u2019 That, of course, would tempt some employees to open the attachment. It had a message that looked like it came from Microsoft saying the user was being taken to their organization\u2019s login page. Behind the scenes, though, malware was being installed on their computer. Employees need to be warned about opening attachments, especially ones that start: \u2018Dear Sir or Madam.\u2019<\/p>\n<p data-ar-index=\"7\"><strong>Finally,<\/strong> web application firewalls from five major manufacturers including Palo Alto Networks, Amazon Web Services, Cloudflare, F5 and Imperva had a generic vulnerability that could have allowed an attacker to bypass traffic scanning. That\u2019s <a href=\"https:\/\/claroty.com\/team82\/research\/js-on-security-off-abusing-json-based-sql-to-bypass-waf\" rel=\"noopener\">according to researchers at Claroty<\/a>, who developed an attack technique against the firewalls\u2019 SQL database. Briefly, while modern SQL databases support the JSON file and data exchange format, the databases in many web application firewalls don\u2019t. So using JSON syntax the older databases can be fooled. While the five manufacturers have plugged this hole, the worry is products from other companies may be at risk. IT administrators and product manufacturers should made sure they\u2019re running modern versions of security tools.<\/p>\n<p data-ar-index=\"8\">That\u2019s it for now. But later today the Week in Review edition will be available. Guest Terry Cutler of Montreal\u2019s <a href=\"https:\/\/www.cyologylabs.com\/?r_done=1\" rel=\"noopener\">Cyology Labs<\/a> will join me to discuss the hack at Amnesty International Canada, the ransomware attack on Rackspace and how attackers are trying to compromise multifactor authentication.<\/p>\n<p data-ar-index=\"9\">Follow Cyber Security Today on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker.<\/p>\n<p data-ar-index=\"10\">The post <a href=\"https:\/\/www.itworldcanada.com\/article\/cyber-security-today-dec-9-2022-toronto-pwn2own-contest-awards-close-to-us1-million-in-prizes-and-more\/517567\">Cyber Security Today, Dec. 9, 2022 \u2013 Toronto Pwn2Own contest awards close to US$1 million in prizes, and more<\/a> first appeared on <a href=\"https:\/\/www.itworldcanada.com\/\">IT World Canada<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>This episode reports on another vulnerability found in Internet Explorer, a hack gets past Microsoft 365 and a vulnerability in web application<\/p>\n","protected":false},"author":17,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[360,16],"tags":[389],"class_list":["post-32468","post","type-post","status-publish","format-standard","hentry","category-podcasts","category-security","tag-cyber-security-today"],"acf":[],"_links":{"self":[{"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/posts\/32468","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/comments?post=32468"}],"version-history":[{"count":4,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/posts\/32468\/revisions"}],"predecessor-version":[{"id":32587,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/posts\/32468\/revisions\/32587"}],"wp:attachment":[{"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/media?parent=32468"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/categories?post=32468"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/tags?post=32468"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}