Krebs on Security

SEPTEMBER 27, 2019

Earlier this month, employees at more than 1,000 companies saw one or two paycheck’s worth of funds deducted from their bank accounts after the CEO of their cloud payroll provider absconded with $35 million in payroll and tax deposits from customers. On Monday, the CEO was arrested and allegedly confessed that the diversion was the last desperate gasp of a financial shell game that earned him $70 million over several years.

Banking 277

Banking Accountability Financial Services Insurance 277

Schneier on Security

SEPTEMBER 24, 2019

Yahoo News reported that the Russians have successfully targeted an FBI communications system: American officials discovered that the Russians had dramatically improved their ability to decrypt certain types of secure communications and had successfully tracked devices used by elite FBI surveillance teams. Officials also feared that the Russians may have devised other ways to monitor U.S. intelligence communications, including hacking into computers not connected to the internet.

Hacking 254

Hacking Surveillance Encryption Internet 254

The Last Watchdog

SEPTEMBER 24, 2019

Keeping track of badness on the Internet has become a thriving cottage industry unto itself. Related: ‘Cyber Pearl Harbor’ is upon us There are dozens technology giants, cybersecurity vendors, government agencies and industry consortiums that identify and blacklist IP addresses and web page URLs that are obviously being used maliciously; and hundreds more independent white hat hackers are doing much the same.

Firewall 193

Firewall Cybersecurity Internet Internet 193

Tech Republic Security

SEPTEMBER 27, 2019

Recent breaches in Americans smart home systems have raised the level of concern with IoT devices.

IoT 167

IoT 167

Speaker: Erroll Amacker

Automation is transforming finance but without strong financial oversight it can introduce more risk than reward. From missed discrepancies to strained vendor relationships, accounts payable automation needs a human touch to deliver lasting value. This session is your playbook to get automation right. We’ll explore how to balance speed with control, boost decision-making through human-machine collaboration, and unlock ROI with fewer errors, stronger fraud prevention, and smoother operations.

Risk

Troy Hunt

SEPTEMBER 23, 2019

Hungary! And that's about as much intro as I'm going to do on that because this is going out super later and I'm writing this at the end of a very long day. Only other thing I'll mention is the audio - the Instamic failed to record again so it's now going firmly into the e-waste bin. Anyway, on a more positive note, enjoy the beautiful sights of the Hungarian parliament before you jump into this week's update: Budapest!

Banking 163

Banking Passwords Accountability 163

Schneier on Security

SEPTEMBER 26, 2019

The trade war with China has reached a new industry: subway cars. Congress is considering legislation that would prevent the world's largest train maker, the Chinese-owned CRRC Corporation, from competing on new contracts in the United States. Part of the reasoning behind this legislation is economic, and stems from worries about Chinese industries undercutting the competition and dominating key global industries.

Surveillance 247

Surveillance Wireless Government Internet 247

Tech Republic Security

SEPTEMBER 26, 2019

Network attacks more than doubled this past quarter versus the prior quarter, according to a new report from security provider WatchGuard.

Malware 167

Malware Ransomware 167

Adam Levin

SEPTEMBER 23, 2019

A federal appellate court ruled that mining and aggregating user data publicly posted to social media sites is allowable by law. In an opinion released earlier this month, the 9th Circuit U.S.Court of Appeals upheld an injunction against employment-centric social network LinkedIn from blocking access to hiQ, a data mining company that sells aggregated user information. .

Passwords 158

Passwords Media Cybersecurity 158

Schneier on Security

SEPTEMBER 25, 2019

This article discusses an e-commerce fraud technique in the UK. Because the Royal Mail only tracks packages to the postcode -- and not to the address - it's possible to commit a variety of different frauds. Tracking systems that rely on signature are not similarly vulnerable.

223

223

The Last Watchdog

SEPTEMBER 26, 2019

Is mobile technology on a course to become more secure than traditional computing? Seven or eight years ago, that was a far-fetched notion. Today, the answer to that question is, “Yes, it must, and soon.” Related: Securing the Internet of Things I’ve been writing about organizations struggling to solve the productivity vs. security dilemma that’s part and parcel of the BYOD craze for some time now.

Mobile 147

Mobile Encryption Internet Internet 147

Advertisement

Many cybersecurity awareness platforms offer massive content libraries, yet they fail to enhance employees’ cyber resilience. Without structured, engaging, and personalized training, employees struggle to retain and apply key cybersecurity principles. Phished.io explains why organizations should focus on interactive, scenario-based learning rather than overwhelming employees with excessive content.

Cyber threats

Tech Republic Security

SEPTEMBER 24, 2019

Nearly half of office workers said they had their data compromised. Here's why they keep falling for phishing scams.

Phishing 167

Phishing Scams 167

Adam Levin

SEPTEMBER 27, 2019

Fifty attorneys general announced earlier this month that Google is the target of an antitrust probe. Any business owner who has happened to find themselves stuck in the company’s orbit–that would be any company with a digital presence–won’t hesitate to tell you such a move is long overdue. Case in point: I just did a Google search for Basecamp, an online project management tool.

Advertising 115

Advertising Marketing Data collection Accountability 115

Schneier on Security

SEPTEMBER 23, 2019

In a document published earlier this month (in French), France described the legal framework in which it will conduct cyberwar operations. Lukasz Olejnik explains what it means , and it's worth reading.

Cybersecurity 222

Cybersecurity 222

Security Affairs

SEPTEMBER 21, 2019

In the last hours, some western media reported destructive cyber attacks against infrastructures in the Iranian oil sector, but Iran denied it. Last week drone attacks have hit two major oil facilities run by the state-owned company Aramco in Saudi Arabia, one of them is the Abqaiq site. Western Governments and Saudi Arabia blamed Iran for the attacks.

Cyber Attacks 111

Cyber Attacks Media Telecommunications Government 111

Advertisement

The DHS compliance audit clock is ticking on Zero Trust. Government agencies can no longer ignore or delay their Zero Trust initiatives. During this virtual panel discussion—featuring Kelly Fuller Gordon, Founder and CEO of RisX, Chris Wild, Zero Trust subject matter expert at Zermount, Inc., and Principal of Cybersecurity Practice at Eliassen Group, Trey Gannon—you’ll gain a detailed understanding of the Federal Zero Trust mandate, its requirements, milestones, and deadlines.

Cybersecurity

Tech Republic Security

SEPTEMBER 24, 2019

Vulnerabilities originally discovered by US government security services have been used by cybercriminals against municipalities, costing taxpayers an estimated $11.5 billion in 2019.

Ransomware 167

Ransomware Government 167

Dark Reading

SEPTEMBER 24, 2019

'Tortoiseshell' discovered hosting a phony military-hiring website that drops a Trojan backdoor on visitors.

Government 110

Government 110

Schneier on Security

SEPTEMBER 27, 2019

A paper I co-wrote was just published in Security Journal : " Superheroes on screen: real life lessons for security debates ": Abstract: Superhero films and episodic shows have existed since the early days of those media, but since 9/11, they have become one of the most popular and most lucrative forms of popular culture. These fantastic tales are not simple amusements but nuanced explorations of fundamental security questions.

Media 216

Media 216

Security Affairs

SEPTEMBER 27, 2019

A security expert has released a new jailbreak, dubbed Checkm8, that impacts all iOS devices running on A5 to A11 chipsets , it works on iPhone models from 4S to 8 and X. The security expert Axi0mX has released a new jailbreak, dubbed Checkm8 , that works on all iOS devices running on A5 to A11 chipsets. The jailbreak works with all Apple products released between 2011 and 2017, including iPhone models from 4S to 8 and X.

Advertising 110

Advertising Hacking Software Engineering 110

Advertisement

Keeper Security is transforming cybersecurity for people and organizations around the world. Keeper’s affordable and easy-to-use solutions are built on a foundation of zero-trust and zero-knowledge security to protect every user on every device. Our next-generation privileged access management solution deploys in minutes and seamlessly integrates with any tech stack to prevent breaches, reduce help desk costs and ensure compliance.

Passwords

Tech Republic Security

SEPTEMBER 23, 2019

Don't let your Android's MAC address give away your location--use a Randomized MAC address instead.

168

168

WIRED Threat Level

SEPTEMBER 27, 2019

Any iPhone device from 2011 to 2017 could soon be jailbroken, thanks to an underlying flaw that there's no way to patch.

Hacking 103

Hacking 103

Daniel Miessler

SEPTEMBER 23, 2019

[advanced_iframe src=”[link] width=”100%” height=”7000px”] No related posts.

Information Security 100

Information Security 100

Security Affairs

SEPTEMBER 24, 2019

Security experts at ESET have uncovered a new campaign carried out by Russia-linked Fancy Bear APT group aimed at political targets. Security researchers at ESET have uncovered a new campaign carried out by Russia-linked Fancy Bear APT group (i.e. APT28 , Sednit , Sofacy , Zebrocy , and Strontium ) aimed at political targets. In the recent attacks, the hackers used a new set of malicious payloads, including a backdoor written in a new language.

Advertising 111

Advertising Phishing Malware Hacking 111

Speaker: Sierre Lindgren

Fraud is a battle that every organization must face – it’s no longer a question of “if” but “when.” Every organization is a potential target for fraud, and the finance department is often the bullseye. From cleverly disguised emails to fraudulent payment requests, the tactics of cybercriminals are advancing rapidly. Drawing insights from real-world cases and industry expertise, we’ll explore the vulnerabilities in your processes and how to fortify them effectively.

Scams

Tech Republic Security

SEPTEMBER 26, 2019

Training is the key to helping the enterprise avoid cyber threats from phishing or other means.

Phishing 167

Phishing Cyber threats 167

WIRED Threat Level

SEPTEMBER 21, 2019

Opinion: Red Flag laws help prevent suicides and mass shootings, and buy time for people in crisis to get help.

Risk 98

Risk 98

Lenny Zeltser

SEPTEMBER 26, 2019

What malware analysis approaches work well? Which don’t? How are the tools and methodologies evolving? The following discussion–captured as an MP3 audio file –offers friendly advice from 5 malware analysts. These are some of the practitioners who teach the reverse-engineering malware course (FOR610) at SANS Institute: Jim Clausing : Security Architect at AT&T and Internet Storm Center Handler (Panelist) Evan Dygert : Senior Security Engineer for Blue Cross Blue Shield Assoc

Malware 94

Malware InfoSec Engineering Software 94

Security Affairs

SEPTEMBER 23, 2019

Kaspersky experts spotted a new piece of ATM malware, dubbed ATMDtrack, that was developed and used by North Korea-linked hackers. Kaspersky researchers discovered a new piece of ATM malware, tracked as ATMDtrack, that was developed and used by North Korea-linked hackers. Threat actors deployed the malware on ATM systems to steal payment card details of the back customers.

Malware 109

Malware Banking Advertising Encryption 109

Advertisement

Many software teams have migrated their testing and production workloads to the cloud, yet development environments often remain tied to outdated local setups, limiting efficiency and growth. This is where Coder comes in. In our 101 Coder webinar, you’ll explore how cloud-based development environments can unlock new levels of productivity. Discover how to transition from local setups to a secure, cloud-powered ecosystem with ease.

Software

Tech Republic Security

SEPTEMBER 25, 2019

Magecart 5 is targeting Layer 7 routers used in airports, casinos, hotels, and resorts, and others, to steal credit card data on popular US and Chinese shopping sites.

167

167

Dark Reading

SEPTEMBER 21, 2019

VPNs are critical pieces of the security infrastructure, but they can be vulnerable, hackable, and weaponized against you. Here are seven things to be aware of before you ignore your VPN.

VPN 93

VPN 93

Thales Cloud Protection & Licensing

SEPTEMBER 26, 2019

Public key infrastructure (PKI) requires key distribution and has been long criticised for its usability issues [13,14,15]. In an experiment [15] conducted for analysing the usability of Mailvelop, a modern PGP tool rated 4.4 out of 5 stars on Chrome web store, 9 out of 10 pairs of participants failed to complete the assigned task of exchanging encrypted emails, i.e. 90% failure rate.

Encryption 91

Encryption Government Authentication Information Security 91

Security Affairs

SEPTEMBER 23, 2019

Campbell County Memorial Hospital in Gilette, Wyoming is facing service disruptions after a ransomware attack hit its computer systems on Friday. On Friday, the Campbell County Memorial Hospital in Gilette, Wyoming, suffered a ransomware attack that is still causing service disruptions. “Campbell County Health has been the victim of a ransomware attack.

Ransomware 108

Ransomware Advertising Government Hacking 108

Advertisement

After a year of sporadic hiring and uncertain investment areas, tech leaders are scrambling to figure out what’s next. This whitepaper reveals how tech leaders are hiring and investing for the future. Download today to learn more!