A cybercriminal claims to have stolen 20 gigabytes of sensitive data from the French tech and consulting giant, Capgemini - but the company is refusing to comment so far
The hacker, alias “grep”, posted a new thread on the popular dark web forum, BreachForums, in which they detailed their loot, which allegedly included databases, source code, private keys, credentials, API keys, projects, employee data (including names, email addresses, usernames, and password hashes). The archive also contains backups, and Capgemini clients’ internal configuration details for cloud infrastructure.
"They had more data but I decided to exfiltrate only big files, company confidential, Terraform, and many more," grep wrote in the thread. The crook shared a few samples as well, which included alleged T-Mobile virtual machine logs.
No word from Capgemini yetIf this truly is the case, and the files are confirmed legitimate, then this data breach could hurt Capgemini quite a lot.
However so far the organization is silent, and has yet to confirm, or deny, the hacker’s claims. The company’s website has no statements, and neither do its X or LinkedIn pages. TechRadar Pro has reached out to Capgemini for comment and will update the article if we hear back.
Capgemini provides a range of services including IT consulting, managed services, and software development, helping businesses adopt new technologies to improve efficiency, operarating in over 50 countries and serves clients across various industries, such as finance, healthcare, and manufacturing.
Last year, it generated more than $24 billion in revenue, and this year it won a UK government contract worth up to $750 million. Under the deal, the company will run His Majesty’s Revenue and Customs’ legacy tax management systems until 2029.
Via The Register
More from TechRadar ProMany of us are still waiting for the rollout of Windows 11’s annual major update, version 24H2, which is already available for new Copilot+ PC devices, and with it, Microsoft has introduced smaller “checkpoint cumulative updates” or (‘differential updates’) intended to make monthly updates smaller and faster by only downloading the files your computer is missing - and it looks like it could already be causing problems.
Basically, your PC will grab only the new or changed parts of freshly released updates instead of downloading the whole update every time.
These updates will begin with the September 2024 checkpoint update, KB5043080, which is now available for Copilot+ PCs. Copilot+ PCs are Microsoft’s new generation of Windows 11 computers which are designed to leverage advanced AI capabilities (most of which are still in the pipeline).
(Image credit: Shutterstock/Mojahid Mottakin) A bump in the Windows Update roadUnfortunately, it appears that Microsoft’s efforts are looking a little wobbly, as after installing update KB5043080, some users are reporting issues.
According to Windows Latest, users have taken to Microsoft’s Windows Insider Feedback Hub to express their frustrations, with one user detailing how their update installation would stall at a certain percentage and then begin a rollback procedure. Some users have been met with an ‘Operation not supported’ error, and while Microsoft hasn’t responded to users’ claims about failure to install KB5043080, it has put out a support document about potential issues that users might run into if they’ve installed the recent September 2024 Patch Tuesday update.
It looks like the issue is primarily affecting people using PCs with certain Intel or AMD chips, and users who choose to install the update manually (through the Windows Insider Program or with installation files from the Microsoft Update Catalog).
I imagine Microsoft will acknowledge this issue and release a fix soon enough, but in the meantime, you’ll have to resolve this manually if you’re affected by downloading and reinstalling update KB5043080 or newer.
You’ll be able to do this by finding update KB5043080 in the Microsoft Update Catalog. I would point you to Windows Latest’s advice on how to make sure you download and install the correct version for your PC (based on the kind of hardware it has). You’ll have to carefully follow those instructions step-by-step or by utilizing a special command line Windows tool.
I hope to see Microsoft issue an automatically available fix soon and that the rest of the rollout of 24H2 goes more smoothly. Many of us are still waiting for the update to come to our non-Copilot+ PC devices, and Microsoft doesn't have the best reputation when it comes to problem-free releases of major Windows 11 updates. Here’s hoping that Microsoft continues ironing out issues as they come up so that the transition to Windows 11 24H2 is as painless as possible.
YOU MIGHT ALSO LIKE...New research reveals a staggering 81% of C-suite leaders feel confident in their cybersecurity defenses. That confidence has resulted in only 5% of leaders allocating additional budget to their cyber programs in the past 12 months.
The harsh reality paints a different picture—over 1 billion records were stolen in the first half of 2024 alone. While the C-suite feels protected, the talent on the front line is more attuned to the actual threat, with only 66% of managers saying they were confident in their organization’s cyber posture.
This alarming disconnect between perceived and actual cybersecurity readiness poses significant risks to organizations.
C-Suite overconfidence: A dangerous misstep42% of C-suite executives believe their teams could recognize and respond to a cyberattack in 3 days or less. However, only 18% of frontline managers share this optimism. Similarly, 33% of C-suite said the frequency of cyberattacks against their business has increased in the past 12 months. Frontline managers’ report significantly higher figures, with 55% saying attacks against their organization have increased in frequency. This disparity highlights a critical gap in the C-suite’s understanding of the threat landscape their organizations and managers face.
This overconfidence is concerning, especially considering the growing sophistication of hackers. 55% of companies believe that modern cybercriminals are more advanced than their internal teams. This gap will continue to grow until the corner office comes to grip with their true cybersecurity posture and takes steps to mitigate their risk.
The factors contributing to C-Suite overconfidenceA significant factor contributing to this disconnect is a lack of transparency and trust within organizations. 58% of frontline managers are underreporting cyber incidents out of fear of losing their jobs. What's even more concerning is that, in contrast, only 12% of C-suite respondents claim to underreporting at their organizations—a drastic disconnect.
There are multiple levels to this problem, starting with capacity and fear. Understaffed teams and a lack of technology put a significant strain on front line managers to both establish security parameters and to sort through the potential attack vectors. With the cost of a data breach surging 10% in 2024 to $4.88M on average, the pressure is felt everywhere. Many fear they will be fired when breaches become public.
Cyber alert fatigue also plays a role. Excessive information and false positives are overwhelming security teams, leading to dangerous delays in response times. 63% of cyber teams spend over 4 hours a week dealing with false positives—a vulnerability underestimated by 64% of C-suite respondents.
The disconnect between C-suite executives and managers is not just a minor oversight; it’s a critical flaw in how companies approach cybersecurity. The constant sifting through of alerts and risks has made teams unable to identify genuine threats, resulting in human error, burnout, and in some cases, ignored alerts. In fact, 33% of companies admit to being delayed in responding to cyberattacks because they were dealing with false positives.
This lack of transparency from the C-suite to frontline managers has dire consequences. If incidents are not reported or properly communicated, the C-suite is left in the dark and can’t act. That is why 74% of the C-suite reports their cyber posture is mature compared with 29% of managers.
Bridging the confidence gapTo close the gap between perceived and actual cyber readiness, C-Suite leaders must:
1. Challenge their cybersecurity posture perspective: C-suite leaders must reassess their organization’s actual preparedness for the myriad of new cyber risks emerging every day. This requires a critical look at the tools and processes currently in place and a willingness to make necessary adjustments.
2. Listen and communicate: The disconnect between the C-suite and frontline managers is one of the most significant barriers to effective cybersecurity. By engaging with frontline managers and understanding their day-to-day cyber experiences and priorities, and the resources they need to be effective, C-suite leaders can gain a more accurate picture of their organization’s cybersecurity standing.
3. Prioritize technology that supports teams: Technology should enable cybersecurity teams, not hinder them. Investing in tools that alleviate the talent shortage, provide resources, and reduce cyber alert fatigue is essential. If teams aren’t supported, they can’t do their job effectively.
4. Foster a culture of transparency: Create an environment where employees feel safe reporting cyber incidents without fear of reprisal. It’s impossible to fix what you don’t know, and underreporting only compounds the problem.
Defending your organization against cyberattacks is not easy. And when your executives and team aren’t on the same page, it’s nearly impossible. Closing this gap is an essential step to protect against the ever-evolving threats in today’s cyber landscape.
We've featured the best business VPN.
This article was produced as part of TechRadarPro's Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro
Whether you live in or plan to visit Malaysia anytime soon, you may soon access a very different internet from the rest of the world unless you're using one of the best VPN apps.
As part of an effort to enhance digital security, the government revealed, at the end of July, plans to build an internet kill switch to block harmful online content such as gambling, pornography, copyright infringements, and other illegal activities. Circumvention tools, however, can still be used to bypass potential blocks as Malaysia's telecom regulator made it clear it has no intentions of blocking VPNs.
Last week, September 7, local internet service providers (ISP) got the order to redirect all DNS queries sent to alternative DNS providers back to their own servers starting from September 30. The move attracted harsh criticism, with commentators warning against government-imposed censorship.
The backlash was so strong that, only a day after the announcement, Malaysia's Minister of Communications Fahmi Fadzil tweeted about the decision to suspend the plan – for now.
The VPN loophole"The Malaysian authorities might have sent the decision for review, but they are not back to the drawing board. The idea is still very much on the table, and there is a good chance that it will be implemented. If not next week, then sometime this year," said Andrey Meshkov, CTO at AdGuard.
What Malaysia's government seeks to change is how ISPs manage DNS queries and servers – de facto granting them more power to control the processes. As the MCMC explained in its FAQ: "DNS redirection is the process of redirecting users' internet request to specific DNS servers, in this case, the ISP's local DNS."
While you can think of an IP address as your device's home address, the Domain Name System (DNS) acts as the internet's virtual telephone book. Every time you initiate a web query, it's the DNS that translates domain names into IP addresses so that your web browser can access websites and other internet resources.
Did you know?NordVPN is TechRadar's favorite VPN service right now and offers easy-to-use apps, bulletproof security, loads of advanced features, and some of the fastest connection speeds we've ever recorded. It can be yours starting from as little as $3.09 per month. Check out our full review and try it out risk-free with a 30-day money-back guarantee.
As we mentioned earlier, even if the order is enforced, you will still be able to use a reliable VPN service to keep accessing the uncensored web.
This is because a VPN (virtual private network) is security software that encrypts your internet connections to make sure snoopers cannot access your data in transit. At the same time, it also spoofs your IP address to trick your ISP into thinking you're browsing from a completely different country.
The VPN encryption ensures that your ISP cannot see any of your data – DNS queries included. The only thing the ISP can see is that you're using a VPN and the servers you're connected to. The VPN's own DNS server will handle your DNS queries directly, too. Put simply, using a VPN would undermine the effectiveness of the DNS redirection order.
"By not targeting VPNs, the Malaysian government will be creating a loophole for accessing blocked content," said Meshkov, while adding that the order is still concerning for user privacy and security. "It could give ISPs and the government unfettered access to the list of domain names (like google.com or dailymail.com or pornhub.com) that the user has visited," he added.
Asked about the prospect of Malaysia eventually issuing a ban against VPNs, Meshkov believes it's unlikely to happen considering the country ranks high in terms of democratic freedoms.
"That said, we don't completely rule out the possibility. But even in that case, as the examples of Iran, China, and Russia have shown, VPN providers have found ways to continue operating in those countries," he told me.
Why is Malaysia's DNS policy controversial?While the MCMC ensures that only access to illegal or harmful websites will be blocked, it's not difficult to envisage how the provision could be abused and misused over time.
For Andrey Meshkov, CTO at AdGuard, such an order is not compatible with the idea of a free web nor people's right to freely choose the service they want to use.
"It's our firm belief that it’s up to the individual user to decide which content they want to consume and which content they want to block," he said. "For instance, free public DNS services like AdGuard DNS offer non-filtering, ad-blocking, and family protection modes to help users manage their online experience. The user should have the agency, and not the service provider."
This policy is ill-advised and should be rolled back. 1. It IS censorship.2. It is inefficient and opens up further cybersecurity risks (e.g. DNS poisoning)3. It's counterproductive towards the govt push for tech startups, innovation and data centres. https://t.co/FFmW9J1oVYSeptember 7, 2024
As The Register reported, other commentators were especially critical of censorship grounds and government overreach. Musician turned state legislator Syed Ahmad Syed Abdul Rahman Alhadad, for example, deemed the decision "draconian" and warned against potential negative effects on the country's digital economy.
Similarly, Malaysian politician Lim Yi Wei defined (see tweet above) the "ill-advised" policy as censorship that could open up cybersecurity risks.
However, Meshkov from AdGuard believes the internet freedoms of Malaysian citizens and visitors aren't the only ones on the line here. Other countries could follow suit Malaysia's example and implement a similar filtering system.
He said: "Such policies could give pointers to other countries, especially those with little regard for democratic freedoms, setting a potentially dangerous precedent. The community must unite against these threats to the free web and make its disapproval clear. It might be Malaysia now, but your country could be next."
APIs are the connective tissues of modern digital companies. So much of the applications, software and IT infrastructure we use every day are built on what came before – and APIs (Application Programming Interfaces) allow developers to quickly connect to and use existing data, code, and systems. It has sped up software development cycles, improved compatibility and boosted the functionality and features available to users. A huge amount of innovation, revenue generation and user convenience has come about as a result of these clever pieces of software connective tissue.
But the links that APIs provide to sensitive data and application business logic can also be exploited, providing useful entryways in for threat actors to compromise and breach data, hijack application operations. So many APIs are now in use across the Web, with APIs constituting over 71% of web traffic in 2023, according to Imperva’s State of API Security in 2024 report. Threat actors are keenly aware of the opportunity that poorly secured APIs pose in enabling access to sensitive data.
Almost half (46%) of all Account Takeover (ATO) attacks, for example, were aimed at API endpoints in 2023. Another growing threat is that posed by ‘bad bots’, automated traffic that impersonates normal API traffic to exploit the functionality of APIs to exfiltrate sensitive data. All this points to the importance of businesses to get a firmer grasp on the APIs they’re using every day, as well as the permissions and access they have.
Top API security challengesLike so many other areas of a typical IT estate, a big challenge faced by security administrators around API security is visibility. They might have been created quickly by the developers to help meet a tight deadline and forgotten about – or are no longer in active use. Developers will have visibility of what they’ve used, but security administrators outside of those circles often do not share that visibility. An individual piece of software might have hundreds of different APIs in play, some in use, some not – and these unknown or ‘shadow’ APIs within an organization can be hard to detect.
Flaws within how an API works can make it vulnerable to exploitation, with this risk being particularly challenging to detect because conventional security alerts won’t be triggered by ostensibly ‘normal’ API activity. One way of regaining control here is by using tokens assigned to trusted identities to help manage access, or by placing quotas on how often a particular API can be called, and tracking its use over time. Establishing rules around throttling can help protect APIs from being used excessively.
Access to talent is another significant factor when it comes to API security. According to the Postman 2023 State of the API Report, 38% of developers have less than two years of experience developing APIs. Software developers aren’t necessarily incentivized to prioritize security when working to tight deadlines and delivery dates. Alongside ongoing programs to find and recruit skilled professionals, businesses may find turning to an automated API security solution can help bridge the gap between the scale of the challenge, and the lack of institutional knowledge.
Towards a more secure API estateThe best first step is to prioritize discovering, categorizing, and keeping an inventory of all APIs, endpoints, parameters, and payloads. Software can help here to scan a given organizations' ecosystem – as well as automatically categorizing APIs that are handling Personally Identifiable Information (PII) or Protected Health Information (PHI). Alongside tools to assist with this auditing and categorization, organizations should also consider using API Gateways to route future API calls more effectively. These can also help organizations meter and manage API consumption rates – but must be used alongside a Web Application Firewall to ensure full security of all API endpoints.
As threats from malicious bot traffic and business logic abuse continues to grow, IT leaders must also look at their APIs as a potential threat vector for their organizations – and proactively secure them. By looking at the bigger picture, and integrating elements such as such as a Web Application Firewall (WAF), API Protection, DDoS prevention, and Bot Protection in combination, organizations can better protect data and enhance their resilience.
We've featured the best firewall software.
This article was produced as part of TechRadarPro's Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro
Criminals have been spotted abusing poorly-defended Oracle WebLogic servers to mine cryptocurrency, build a DDoS botnet, and more.
Cybersecurity researchers Aqua saw several attacks in the wild, and decided to run a honeypot. They then saw a threat actor break through the weak password that was set up, and proceed to install a piece of malware called Hadooken.
This malware, used in “a few dozen” attacks over the past couple of weeks, comes with two key functionalities - cryptocurrency mining, and a distributed denial of service (DDoS) botnet. Furthermore, the malware grants the attackers full control over the compromised endpoint.
HadookenOracle WebLogic is a Java-based application server that enables the development, deployment, and management of enterprise-level applications.
A robust, scalable platform for distributed applications, many firms use it for web services, portals, and database connectivity. It is usually used to run large-scale, mission-critical applications in finance, telecommunications, and e-commerce. With all of its popularity, WebLogic is also a major target for cybercriminals since, as The Register reports, it “includes various vulnerabilities.”
So far, the researchers saw the hackers use Hadooken to mine crypto, while other functionalities are yet to be used. It was also said that Hadooken has traces of ransomware functionality. “It could be the threat actor will introduce this attack to a Linux ransomware as well, or it is already introduced if the malware runs on the system longer than a sandbox execution,” they said.
Tracing the IP addresses of the Hadooken malware, the researchers came to two IP addresses, one of which belongs to a UK hosting company, but is registered in Germany. “In the past this IP address was linked to TeamTNT and Gang 8220, but this weak link cannot attribute this attack to any of these threat actors,” the researchers said. The second IP address is registered in Russia, under the same hosting company. It is currently inactive.
Via The Register
More from TechRadar ProWe have officially entered fall/autumn in the northern hemisphere – so, unless you're about enjoy some pleasant spring sunshine below the equator, we imagine you're preparing to spend plenty of nights indoors as cooler weather takes hold.
You won't spend such occasions twiddling your thumbs, however, because the world's best streaming services plan to bring you plenty of movie and TV-based content to consume. There's lots to enjoy this weekend, too – so much so that we had a hard time deciding what seven new movies and TV series to include in this edition's round-up. We think we've done a good job of catering to all kinds of viewers, though, so read on to see what's worth watching right now.
Emily in Paris season 4 part 2 (Netflix)Emily in Paris returned to Netflix in August with the first part of its long-awaited fourth season, and it saw American marketing executive Emily Cooper (Lily Collins) trying to balance her complicated personal and professional life at a marketing agency in Paris. Now, she's saying 'au revoir!' to the City of Love to swap the titular city for Rome in Emily in Paris season 4 part 2.
While it's not one of the best Netflix shows, I'm looking forward to seeing more amusing yet cheesy lost-in-translation moments for Emily in a different setting, as well as more drama when another new love interest comes on the scene in the form of an Italian heartthrob – watch out, Gabriel!
Want more rom-com drama action like Emily in Paris season 4 part 2 after you've streamed it? Check out these three similar drama series with over 80% on Rotten Tomatoes.
Grace Morris, entertainment writer
Star Wars: Rebuild the Galaxy (Disney Plus)It's been nearly 25 years – yes, I was as shocked as you are when I found that out – since the first Lego Star Wars set was released. It's fitting, then, that the Danish toy manufacturer and Lucasfilm's legendary sci-fi franchise have teamed up again to deliver another family-friendly, Lego-based adventure to enjoy in that famous galaxy far, far away.
A *ahem* 'four piece' miniseries, Star Wars: Rebuild the Galaxy stars Sig Greebling (voiced by Stranger Things' Gatan Matarazzo), an unassuming nerf-herder who uncovers a powerful artefact when he stumbles upon a Jedi Temple. Long story short: activating this object completely alters the Star Wars timeline as we know it. Cue Sig embarking on a galaxy-spanning adventure where the good guys are bad, the bad guys are good, and the galaxy needs to be reassembled from the ground up.
I'm still forlornly looking out of my window for Andor season 2 to be released on Disney Plus, but Rebuild the Galaxy – coupled with forthcoming live-action show Star Wars: Skeleton Crew – should have enough to tide me over until one of the best Disney Plus shows returns sometime in 2025.
Tom Power, senior entertainment reporter
Civil War (Max)Strap in because this is a Max road trip like no other. I've been wanting to re-watch Civil War ever since I first saw it in the cinemas and, while those in the UK and Australia can rent or buy it, the US is finally able to stream it on Max. Out of everything that's new this week, Alex Garland's (one of my all-time favorite directors) Civil War is our big blockbuster pick that'll have your heart pumping and your head racing.
From the moment we meet renowned war photographer Lee (Kirsten Dunst), you know you'll want to see her story out until the end. Indeed, in one of September's many new Max movies, she begrudgingly agrees to take a budding photojournalist on a road trip to DC to try to capture a group of rebels planning to storm the White House (yes, this does hit close to home).
It's a story of succession and an unbiased view of the polarising political landscape in America that opens and closes with a bang, but its best part are the photographs throughout. The black and white stills shot on the best camera for pros, the Sony a7RV, are phenomenal and still haunt me. The DJI Ronin 4D was also used to give it an incredibly raw look and feel that's testament to the cinematography skills of the extremely talented Rob Hardy. You can absolutely count on us adding Civil War to our best Max movies list.
Amelia Schwanke, senior entertainment editor
The Circle season 7 (Netflix)I love Catfish and messy competition shows, so The Circle season 7 is a welcome new arrival. There's something fun about watching people lie to each other and try to cheat their way to money, which is possibly why The Traitors has also been an international success. And, in the digital age, it's just as interesting watching people create a social media profile from scratch, choosing whether to be yourself or someone else entirely.
Unlike other popular shows like Big Brother, contestants live in the same apartment complex but never meet, communicating exclusively via profiles instead. They're able to rate each other and send messages, but there can only be one winner in this strangely addicting popularity contest.
Lucy Buglass, senior entertainment writer
The Grand Tour: One for the Road (Prime Video)All good things must come to an end and, honestly, after 22 years of working together, seeing Jeremy Clarkson, James May, and Richard Hammond embark on one final roadtrip feels bittersweet. I remember watching the trio on Top Gear back in the day and, despite jumping ship to Prime Video years prior for a newly named but similar styled car-based series, nothing’s changed. They’re still pranking each other, being hilariously British and, more importantly, filled with a passion for all things motoring. I’m not even an enthusiast, but I grew up in a house of petrolheads, so it was inevitable that I’d have a soft spot for a programme like this, even if it's not one of the best Prime Video shows.
In their final adventure, they drive their dream cars on a trip through Zimbabwe. You can expect some crazy challenges ahead and maybe even shed a tear, if the surprisingly heartfelt trailer is anything to go by.
Lucy Buglass, senior entertainment writer
Uglies (Netflix)Based on the novel of the same name by Scott Westerfeld, one of September's new Netflix movies Uglies is set in a futuristic dystopian society where perfection is everything. Joey King plays Tally, a teen awaiting mandatory cosmetic surgery who goes on a journey to find her missing friend.
Dystopian book-to-screen movie adaptations have proven to be a big hit over the years, with the likes of The Hunger Games, Divergent, and The Maze Runner all becoming a blockbuster success, so it's possible that Uglies could become one of the best Netflix movies. As a fan of sci-fi films, I have high hopes that it can follow the trailblazer's within the dystopian genre by shining a light on important issues all while captivating audiences.
Grace Morris, entertainment writer
The Old Man season 2 (Hulu/Disney Plus)Don't mess with Dan Chase (Jeff Bridges). If there's one thing we all learnt from The Old Man season 1, it's not to underestimate "an old man in a profession where men usually die young" – yes, that's a quote from Kevin Lacz, a real-life Navy SEAL veteran who's platoon inspired the movie American Sniper, but it absolutely sums up one of the best Hulu shows.
The FX series, which airs on Hulu (US) and Disney Plus (internationally), is also an adaptation of Thomas Perry's novel book. It mostly stays true to its source material, too, which tells the story of a former army intelligence officer as he's forced out of his quiet retirement with his two dogs to keep his daughter safe from a hitman.
Now, it's back with a whole new season. Granted, there are some slow scenes of dialogue that stretch out the runtime in season 1 but The Old Man season 2 has the potential to improve on this – maybe you can teach an old dog new tricks?
Amelia Schwanke, senior entertainment editor
For more streaming coverage, read our guides on the best Max shows, best Disney Plus movies, best Apple TV Plus shows, and best Paramount Plus movies.