November 2022 Newsletter

Highlights

What's New

Carlos Seisdedos, National Member of the Working Group: Defense of Democracy in the Information Environment - Foundations and Roles for NATO Defense

The Ministry of Defense has appointed Carlos Seisdedos, Head of Cyber Intelligence, as a national member of the working group: Defense of Democracy in the Information Environment - Foundations and Roles belonging to the NATO Science and Technology Organization.

Internet Security Auditors Mentors for Another Year at the National CyberLeague GC 2022

This year marks the IV edition of the Cyber Challenge League (National CyberLeague GC 2022), organized by the Spanish Civil Guard.

For another year, the event organizers have wanted to count on our participation as mentors, led by Carlos Seisdedos, Head of the Cyber Intelligence Department.
 

Internet Security Auditors Sponsors of the XVI Edition of ENISE, the Most Important International Information Security Meeting in the Sector

This year, at Internet Security Auditors, we have had the great opportunity to participate as sponsors and, in addition, we had our own stand in the exhibition area, alongside other cybersecurity experts.
 

ISecAuditors Selected Again for the PCI SSC GEAR 2022-24

Internet Security Auditors is one of the 14 companies that have been part of GEAR since its creation, renewing its participation in its 3 calls.

LFI, a Vulnerability That Cannot Be Underestimated

Local File Inclusion (LFI) is a web vulnerability that allows a cyberattacker to trick a web application into executing and/or exposing files through a web server.

Attackers try to exploit certain vulnerabilities in the source code to access confidential data or execute malicious scripts on the target server.

Windows Privesc - Unquoted Service Path – The Real Island of Temptation

On this occasion Mario Valiente explains the “Unquoted Service Path” vulnerability, a vulnerability that allows privilege escalation in Windows systems when a service is detected where the binpath or binary path contains spaces (‘ ‘) and is not enclosed in quotes (‘ ” ’).

Auditing Source Code Without Dying in the Attempt

Have you been assigned a code audit and don't know where to start? You're in the right place. But first, do you know what a code audit is and what it involves?

Following the definition of the OWASP Code Review Guide, "code review is a way to help ensure that the application has been developed in such a way that it "defends itself" in its given environment". That is, we must perform the relevant checks to verify that the appropriate logical and security controls are present, that they work as intended, and that they have been invoked in the correct places.

Welcome the 8-Digit IIN (BIN)! What Implications Does It Have, and How Does It Affect PCI DSS 3.2.1 and 4.0 Compliance?

This article discusses the expansion of the IIN value, and the implications this has for compliance with the PCI DSS standard in its v3.2.1 and v4.0 versions. Over the past few months, payment brands have been adjusting their original positioning. In addition, the PCI SSC has published the new version of PCI DSS, 4.0, and has also updated the content of several FAQs used as a reference. For all these reasons, it has been necessary to create a new article that adapts to the current reality.

Most Read

How Your WiFi Filters Data Without You Realizing It

How does WiFi filter our data without us realizing it and even without having to do anything? Mobile phones constantly search for available WiFi networks to facilitate a faster connection. The problem? Many stores use WiFi tracking to track the location and movement of customers (using MAC addresses anonymously to comply with privacy regulations), but what happens if something goes wrong and information is leaked?
 

Warshipping: the cyberattack that arrives by postal mail

A package is sent by postal mail to the “victim” containing a small automated cracking device. While the package enters the building and waits at reception, the courier office, or an employee's desk, its software takes advantage to scan local wireless networks, intercept their traffic, steal data, etc. Transmitting it externally.
 

Phishing attacks with phone calls have increased by 625% since the first quarter of 2021

The use of “hybrid vishing” is experiencing massive growth of 625%. Cybercriminals are increasingly moving towards hybrid forms of phishing attacks that combine social engineering calls by email and voice as a way to breach corporate networks for ransomware attacks and data extortion.
 

Toyota suspects that customer data may have been leaked. And all because of an oversight that lasted 5 years

The automotive company Toyota reports a possible leak of personal customer data after keeping an access key in the Github repository for more than 5 years. The affected customers are those who use the Toyota T-Contnect application in their daily lives, which allows connecting the mobile phone with the car.

Events

Upcoming courses

This message has been sent by virtue of your authorization for the communication of commercial information from Internet Security Auditors. You can consult our Data Privacy Policy here. You have the possibility to exercise the rights of access, rectification, erasure, restriction, objection and portability provided for in the “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the free movement of such data and repealing Directive 95/46/EC” by letter addressed to Internet Security Auditors, Calle Santander, 101. Edificio A-2 08030 Barcelona (Spain), or by email at the following email address: legal@isecauditors.com, accompanying your request with a copy of your ID card or equivalent document proving your identity. If you only wish to unsubscribe from these communications, click the following link and send that email from the email address where you received our communication: marketing@isecauditors.com

This email is send according your previous authorization for sending commercial information from Internet Security Auditors. You can read our Data Privacy Policy here. You have the possibility at all times to exercise the rights of access, rectification, erasure, restriction of process, object and portability according to the “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC” by sending a letter addressed to Internet Security Auditors, Calle Santander, 101. Edificio A-2. 08030 Barcelona (Spain), or through the following email: legal@isecauditors.com, attaching your request with a copy of your ID card or equivalent document proving your identity. If you only wish to request your cancellation of these shipments, click on the following link and send that email from the email address where you received our communication: marketing@isecauditors.com