Schneier on Security

FEBRUARY 26, 2019

A research group at NATO's Strategic Communications Center of Excellence catfished soldiers involved in an European military exercise -- we don't know what country they were from -- to demonstrate the power of the attack technique. Over four weeks, the researchers developed fake pages and closed groups on Facebook that looked like they were associated with the military exercise, as well as profiles impersonating service members both real and imagined.

Media 239

Media Accountability Advertising 239

Krebs on Security

FEBRUARY 23, 2019

Payroll software provider Apex Human Capital Management suffered a ransomware attack this week that severed payroll management services for hundreds of the company’s customers for nearly three days. Faced with the threat of an extended outage, Apex chose to pay the ransom demand and begin the process of restoring service to customers. Roswell, Ga. based Apex HCM is a cloud-based payroll software company that serves some 350 payroll service bureaus that in turn provide payroll services to s

Backups 220

Backups Ransomware Encryption Internet 220

Adam Levin

FEBRUARY 27, 2019

The infrastructure at the core of the internet is vulnerable to attack from state-sponsored hackers, its governing body warned. . The Internet Corporation for Assigned Names and Numbers (ICANN), charged with overseeing Domain Name Systems (DNS), published an announcement that companies have moved too slowly to adopt security standards that would have mitigated several recent large-scale cyberattacks.

DNS 183

DNS Internet Internet Technology 183

The Last Watchdog

MARCH 1, 2019

There’s a frantic scramble going on among those responsible for network security at organizations across all sectors. Related: Why we’re in the Golden Age of cyber espionage. Enterprises have dumped small fortunes into stocking their SOCs (security operations centers) with the best firewalls, anti-malware suites, intrusion detection, data loss prevention and sandbox detonators money can buy.

Threat Detection 141

Threat Detection Digital transformation Marketing Firewall 141

Advertisement

How many people would you trust with your house keys? Chances are, you have a handful of trusted friends and family members who have an emergency copy, but you definitely wouldn’t hand those out too freely. You have stuff that’s worth protecting—and the more people that have access to your belongings, the higher the odds that something will go missing.

Cybersecurity

Schneier on Security

FEBRUARY 28, 2019

After years of claiming that the Terrorist Screening Database is kept secret within the government, we have now learned that the DHS shares it "with more than 1,400 private entities, including hospitals and universities.". Critics say that the watchlist is wildly overbroad and mismanaged, and that large numbers of people wrongly included on the list suffer routine difficulties and indignities because of their inclusion.

Government 210

Government 210

Krebs on Security

FEBRUARY 28, 2019

A 20-year-old Illinois man has pleaded guilty to running multiple DDoS-for-hire services that launched millions of attacks over several years. The plea deal comes almost exactly five years after KrebsOnSecurity interviewed both the admitted felon and his father and urged the latter to take a more active interest in his son’s online activities.

DDOS 173

DDOS Computers and Electronics Internet Internet 173

Troy Hunt

FEBRUARY 23, 2019

It was another travel week so another slightly delayed weekly update, but still plenty of stuff going on all the same. Along with a private Sydney workshop earlier on, I'm talking about some free upcoming NDC meetup events in Brisbane and Melbourne and I'd love to get a great turnout for. I've just ordered 10k more HIBP stickers to last me through upcoming events so they'll be coming with me.

Password Management 135

Password Management Passwords Risk 135

Schneier on Security

MARCH 1, 2019

Matthew Green has a super-interesting blog post about information leakage from encrypted databases. It describes the recent work by Paul Grubbs, Marie-Sarah Lacharité, Brice Minaud, and Kenneth G. Paterson. Even the summary is too much to summarize, so read it.

Encryption 193

Encryption 193

The Last Watchdog

FEBRUARY 27, 2019

Google, Facebook and Amazon have gotten filthy rich doing one thing extremely well: fixating on every move each one of us makes when we use our Internet-connected computing devices. Related: Protecting web gateways. The tech titans have swelled into multi-billion dollar behemoths by myopically focusing on delivering targeted online advertising, in support of online retailing.

Retail 115

Retail Digital transformation Advertising Software 115

Adam Shostack

FEBRUARY 28, 2019

I’m quite happy to say that my next Linkedin Learning course has launched! This one is all about spoofing. It’s titled “ Threat Modeling: Spoofing in Depth.” It’s free until at least a week after RSA. Also, I’m exploring the idea that security professionals lack a shared body of knowledge about attacks, and that an entertaining and engaging presentation of such a BoK could be a useful contribution.

124

124

Advertiser: Revenera

In a recent study, IDC found that 64% of organizations said they were already using open source in software development with a further 25% planning to in the next year. Most organizations are unaware of just how much open-source code is used and underestimate their dependency on it. As enterprises grow the use of open-source software, they face a new challenge: understanding the scope of open-source software that's being used throughout the organization and the corresponding exposure.

Risk

Security Affairs

FEBRUARY 27, 2019

Experts at Exploit detection service EdgeSpot detected several PDF documents that exploit a zero-day flaw in Chrome to harvest user data. Exploit detection service EdgeSpot spotted several PDF documents that exploit a zero-day vulnerability in Chrome to harvest data on users who open the files through the popular web browser. The experts initially detected the specially-crafted PDF files in December 2018.

Advertising 108

Advertising Antivirus Internet Internet 108

Schneier on Security

FEBRUARY 27, 2019

Notice this bit from an article on the arrest of Christopher Hasson: It was only after Hasson's arrest last Friday at his workplace that the chilling plans prosecutors assert he was crafting became apparent, detected by an internal Coast Guard program that watches for any "insider threat." The program identified suspicious computer activity tied to Hasson, prompting the agency's investigative service to launch an investigation last fall, said Lt.

Threat Detection 191

Threat Detection Software 191

WIRED Threat Level

FEBRUARY 27, 2019

The social media app will pay $5.7 million to settle the allegations, and be required to delete videos uploaded by anyone under 13.

Media 101

Media 101

Adam Shostack

FEBRUARY 28, 2019

At RSA, I’ll be speaking 3 times at the conference, and once at a private event for Continuum: “ 2028 Future State: Long Live the Firewall? ” with Jennifer Minella, Harry Sverdlove and Marcus Ranum. March 5 | 1:00 PM – 1:50 PM | Moscone West 3001 Threat modeling brunch with IriusRisk March 6 | 10 – 11 AM | See site for registration How to Measure Ecosystem Impacts with Jay Jacobs.

Firewall 113

Firewall 113

Advertisement

The healthcare industry has massively adopted web tracking tools, including pixels and trackers. Tracking tools on user-authenticated and unauthenticated web pages can access personal health information (PHI) such as IP addresses, medical record numbers, home and email addresses, appointment dates, or other info provided by users on pages and thus can violate HIPAA Rules that govern the Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates.

Healthcare

Security Affairs

FEBRUARY 23, 2019

Cybercriminals are offering over a million dollars per year to skilled professionals like vxers and penetration testers to help them in extortion campaigns. According to a new report published by the security firm Digital Shadows cybercriminal organizations are willing to pay millions to skilled hackers and malware developers. The analysis of posts on Dark Web forums reveals that at least one threat actor is willing to pay more than $64,000 per month ($768,000 per year) to skilled hackers to rec

Cybercrime 93

Cybercrime Penetration Testing Advertising Hacking 93

Dark Reading

FEBRUARY 26, 2019

From WannaCry and phishing to credential stuffing and cryptomining, attackers relied on many oldie-but-goodie attacks in 2018, according to a pair of new security threat reports.

Threat Reports 83

Threat Reports Phishing 83

Threatpost

FEBRUARY 27, 2019

Researchers are urging Ring users to update to the latest version of the smart doorbell after a serious flaw triggered privacy concerns.

IoT 91

IoT 91

WIRED Threat Level

FEBRUARY 27, 2019

Michael Cohen testifies before the House Oversight committee, and brings the receipts.

106

106

Speaker: Blackberry, OSS Consultants, & Revenera

Software is complex, which makes threats to the software supply chain more real every day. 64% of organizations have been impacted by a software supply chain attack and 60% of data breaches are due to unpatched software vulnerabilities. In the U.S. alone, cyber losses totaled $10.3 billion in 2022. All of these stats beg the question, “Do you know what’s in your software?

Cybersecurity

Security Affairs

FEBRUARY 25, 2019

The recently discovered B0r0nt0K ransomware infects both Linux and Windows servers and demands $75,000 ransom to the victims. A new piece of ransomware called B0r0nt0K appeared in the threat landscape, it is targeting web sites and demanding a 20 bitcoin ransom to the victims (roughly $75,000). This B0r0nt0K ransomware infects both Linux and Windows servers.

Ransomware 92

Ransomware Encryption Advertising Malware 92

Dark Reading

FEBRUARY 25, 2019

Officials report an unauthorized party obtained tax return data by using credentials obtained from an outside source.

105

105

Threatpost

FEBRUARY 25, 2019

Google has announced FIDO2 certification for devices running on Android 7 and above - meaning that users can use biometrics, fingerprint login or PINs instead of passwords.

Passwords 78

Passwords Mobile 78

eSecurity Planet

MARCH 1, 2019

Wondering what to see at the 2019 RSA Conference? Our preview of the world's largest cybersecurity conference will point you in the right direction.

Cybersecurity 76

Cybersecurity 76

Advertisement

Within the past few years, ransomware attacks have turned to critical infrastructure, healthcare, and government entities. Attackers have taken advantage of the rapid shift to remote work and new technologies. Add to that hacktivism due to global conflicts and U.S. elections, and an increased focus on AI, and you have the perfect recipe for a knotty and turbulent 2024.

Cybersecurity

Security Affairs

FEBRUARY 24, 2019

The British Airways Entertainment System, as installed on Boeing 777-36N(ER) and possibly other aircraft, is affected by a privilege escalation issue tracked as CVE-2019-9019. Experts discovered a critical vulnerability in the British Airways Entertainment System. The flaw is a privilege escalation issue that resides in the component USB Handler, an attacker could exploit it using an unknown input to escalate privileges.

Advertising 89

Advertising Hacking 89

Dark Reading

FEBRUARY 26, 2019

Because many organizations tend to overlook or underestimate the threat, social media sites, including Facebook, Twitter, and Instagram, are a huge blind spot in enterprise defenses.

Media 75

Media Malware 75

Threatpost

FEBRUARY 26, 2019

How features such as infotainment and driver-assist can give others a leg up on car owners.

Data collection 103

Data collection Hacking Engineering 103

WIRED Threat Level

FEBRUARY 23, 2019

The 2020 disinformation campaigns have started, DrainerBot is coming for your smartphone's battery, and more security news this week.

VPN 78

VPN 78

Speaker: Erika R. Bales, Esq.

When we talk about “compliance and security," most companies want to ensure that steps are being taken to protect what they value most – people, data, real or personal property, intellectual property, digital assets, or any other number of other things - and it’s more important than ever that safeguards are in place. Let’s step back and focus on the idea that no matter how complicated the compliance and security regime, it should be able to be distilled down to a checklist.

Security Affairs

FEBRUARY 27, 2019

Experts found several flaws in popular PDF viewers and online validation services that allow to deceive the digital signature validation process. Several PDF viewers and online validation services contain vulnerabilities that can be exploited to make unauthorized changes to signed PDF documents without invalidating their digital signature. A group of academics from the German Ruhr-University Bochum in Germany analyzed 22 desktop applications and 7 online validation services.

Advertising 87

Advertising Government Hacking Software 87

Dark Reading

FEBRUARY 27, 2019

As in previous years, input validation vulnerabilities accounted for a substantial proportion of total, Risk Based Security report shows.

Accountability 85

Accountability Risk 85

Threatpost

FEBRUARY 26, 2019

A known vulnerability combined with a weakness in bare-metal server reclamation opens the door to powerful, high-impact attacks.

Firmware 85

Firmware Ransomware 85

Thales Cloud Protection & Licensing

FEBRUARY 27, 2019

Amid all of the movement, news and excitement during the past year, it is time again for our industry to gather at RSA. The theme of this year’s conference is “Better” which certainly makes sense. Unfortunately, our industry can do “better” as not all of the security news the past year has been positive. The historic amount of coverage that data breaches have produced in 2018 has exposed executives and consumers to the importance of security, like no year before.

Digital transformation 61

Digital transformation Risk Encryption Technology 61

Speaker: William Hord, Vice President of ERM Services

A well-defined change management process is critical to minimizing the impact that change has on your organization. Leveraging the data that your ERM program already contains is an effective way to help create and manage the overall change management process within your organization. Your ERM program generally assesses and maintains detailed information related to strategy, operations, and the remediation plans needed to mitigate the impact on the organization.

Risk