Skid vs. skid, as various online jihadists swat back at Anonymous for #OpCharlieHebdo (and Anonymous attracts a little rare grudging sympathy).
Parties unknown post a fake but convincing BBC site with bogus Charlie Hedbo coverage. The site's now gone, it's purpose unclear, but observers speculate it may have been a dry run for a serious attack elsewhere.
The physical and cyber worlds converge in information operations as IS opens a recruiting drive in Afghanistan and Pakistan. IS and al Qaeda continue their depraved competition in propaganda of the deed.
US CENTCOM is back in social media, embarrassed and resolved to be more vigilant. Its sister commands EUCOM and AFRICOM look to their own accounts. Some sources report a British jihadist as the hack's prime suspect, but such speculation remains tentative. Much scare-mongering about the incident swirls online, but contrast ZeroFOX's measured take: "more smoke than fire." CENTCOM's characterization of the attack as "cybervandalism" seems the consensus (and correct) view.
IOActive finds a hard-coded SSL key in some GE Ethernet switches.
Adobe, Microsoft, and Siemens all patched products yesterday. (Observers goggle a bit at Microsoft's Telnet patch.) Google continues its curiously aggressive disclosure of other company's vulnerabilities: its spats with Microsoft and WhiteHat also continue. Many dislike Google's decision to leave older Android versions unpatched.
France increases online surveillance. US President Obama's cyber policy proposals receive mixed but on balance positive reviews. UK Prime Minister Cameron's thoughts on encryption, however, lay an egg.
Several US court cases with cyber implications proceed.
Today's issue includes events affecting Afghanistan, China, France, Iraq, Kazakhstan, Democratic Peoples Republic of Korea, Netherlands, Pakistan, Russia, Syria, United Kingdom, United States, Uruguay, and Yemen.
Kazakh Child Soldier Executes 'Russian Spies' in Islamic State Video(Foreign Policy) In a video released Tuesday by the Islamic State, two men described as Russian agents testify that they had attempted to spy on the militants, infiltrate their computer networks, and assassinate the group's leaders. Then a long-haired young boy calmly shoots the men in the back of the head with a handgun
Islamic State begins recruiting campaign in Pakistan, Afghanistan(McClatchy) The Islamic State formally has opened for business in the crowded militant markets of Afghanistan and Pakistan, announcing in a video over the weekend that it's established an organizational structure dominated by notoriously anti-Shiite-Muslim former commanders of the Pakistani Taliban
Key US military command's Twitter, YouTube sites back online(Washington Post) The Twitter and YouTube sites for the U.S. military's Central Command are back online after being taken over by hackers claiming to support the Islamic State militant group, and Pentagon officials are reviewing some security protocols in the wake of the breach
EUCOM, AFRICOM keep cyber vigilance after CENTCOM hack(Stars and Stripes) Other combatant commands are closely monitoring their social media platforms after U.S. Central Command's Twitter feed was briefly taken over on Monday by hackers claiming to be affiliated with the Islamic State group
Hack of U.S. military social media accounts prompts embarrassment, review(Washington Post) The high-profile hack of two social media accounts run by the U.S. military's Central Command on Monday was an embarrassment, and has prompted the Office of the Secretary of Defense to direct its own social media managers to make sure their accounts are secure, a military official said Tuesday
Military hack: A new era of cyber vandalism?(The Hill) The Monday takeover of the U.S. Central Command (Centcom) Twitter and YouTube accounts could represent the start of a new era of cyber vandalism targeting the U.S. government, security experts said
ISIS Compromises CENTCOM Social Media: Are You Next?(ZeroFOX Intel Brief) On Monday, January 12, 2015, hackers claiming loyalty to the Islamic State of Iraq and Syria (ISIS) compromised the Twitter account and YouTube channel of the United States Central Command (CENTCOM), whose military "Area of Responsibility" (AOR) includes the Middle East, North Africa, and Central Asia
Recent Crypto-Ransomware Attacks: A Global Threat(TrendLabs Security Intelligence Blog) We noticed a recent influx of crypto-ransomware spreading in Australia. This recent wave rings similar to the hike of infections in the Europe/Middle East/Africa (EMEA) region we wrote about in early December. Upon further research and analysis, we concluded that the attackers behind these incidents could possibly belong to the same cybercriminal gang due to the similarity in their IP addresses
GE Ethernet Switches Have Hard-Coded SSL Key(Threatpost) There is a hard-coded private SSL key present in a number of hardened, managed Ethernet switches made by GE and designed for use in industrial and transportation systems. Researchers discovered that an attacker could extract the key from the firmware remotely
Cyber attack on ASUCR website decreases transparency(University of California Riverside Highlander) As a result of a cyber attack that shut down the ASUCR website, members of ASUCR have decided to switch to an older server under the domain name, ASUCRexchange.ucr.edu, which still holds remnants of its old merchandise store that closed in 2012
Security Patches, Mitigations, and Software Updates
Adobe, Microsoft Push Critical Security Fixes(KrebsOnSecurity) Microsoft on Tuesday posted eight security updates to fix serious security vulnerabilities in computers powered by its Windows operating system. Separately, Adobe pushed out a patch to plug at least nine holes in its Flash Player software
Adobe Patches Nine Vulnerabilities in Flash(Threatpost) Adobe today released the year's first round of security updates for Flash Player, addressing nine vulnerabilities in the software including several critical bugs that could allow an attacker to take control of an affected system
How Secure Is Android if Google Won't Patch?(eSecurity Planet) A security researcher alleges that Google won't patch its older Android software for a new vulnerability. Luckily, users have options to boost security for older versions of the OS
Experts pick the top 5 security threats for 2015(PC World) Massive, high-profile data breaches pockmarked 2014, culminating in the bizarre events surrounding the hack of Sony Pictures — allegedly by North Korea in retaliation for the politically incorrect stoner comedy The Interview. That's a tough act to follow, but I'm sure 2015 will make an effort. I spoke with security experts to find out what we have to look forward to
Endpoint Security Activities Buzzing at Enterprise Organizations(ESG) Endpoint security used to be a quasi "set-it-and-forget-it" category at many enterprise organizations. The IT operations team would provision PCs in an approved, secure configuration and then install AV software on each system. Of course there were periodic security updates (vulnerability scans, patches, signature updates, etc.), but the endpoint security foundation was set and dry by then
Why Healthcare Cybersecurity Cannot Ease Up in 2015(HealthITSecurity) Regardless of an organization's size, it's essential to have comprehensive healthcare cybersecurity protections in place. More facilities are implementing the use of connected devices, such as mobile phones, tablets, and laptops. Moreover, cloud storage is gaining popularity, and more providers are connecting their systems to one another through health information exchanges (HIEs)
Cyber Terrorism: Complexities and Consequences(Infosec Institute) While a terrorist using the Internet to bring down the critical infrastructures the United States relies on makes an outstanding Hollywood plot, there are flaws in the execution of this storyline as an actual terrorist strategy. Conway (2011) calls out three limitations on using cyber-related activities for terrorists: Technological complexity, image, and accident (Against Cyberterrorism, 2011, p. 27)
A10 Networks Inc Analyst Rating Update(Stafford Daily) A10 Networks Inc (NYSE:ATEN) has received a Neutral rating from research analysts at Zacks with a rank of 3. The company has been rated an average of 1.63 by 8 Wall Street Analysts. 5 analysts have added the counter in their list of strong buys. 1 stock experts have also rated a buy. 2 broker firms see some more upside in the counter and have advised hold
Infoblox Inc Analyst Rating Update(Stafford Daily) Infoblox Inc (NYSE:BLOX) has received a Neutral rating, according to the latest recommendation of 3 from research firm, Zacks. The counter could manage an average rating of 2.33 from 9 analysts. 3 market experts have complete faith in the companys business and have marked it as a strong buy. 6 analysts have rated the company at hold
The Free Encryption App That Wants to Replace Gmail, Dropbox, and HipChat(Wired) Cryptographers devote their careers to the science of securing your communications. Twenty-four-year-old Nadim Kobeissi has devoted his to the art of making that security as easy as possible. His software creations like Cryptocat and Minilock encrypt instant messages or shared files with three-letter-agency-level protection, with user interfaces that require Lincoln-Log-level skills. Now he's combining elements of his dead-simple apps into what he's calling his biggest release yet, a single platform designed to encrypt everything you and any group of collaborators do on the desktop
Gitrob Combs GitHub Repositories for Secret Company Data(Threatpost) Free online code repositories such as GitHub provide a valuable collaboration service for enterprise developers. But it's also a trove of potentially sensitive company and project information that's likely to warrant attention from hackers
Gitrob: Putting the Open Source in OSINT(Michael Henriksen) Developers generally like to share their code, and many of them do so by open sourcing it on GitHub, a social code hosting and collaboration service. Many companies also use GitHub as a convenient place to host both private and public code repositories by creating GitHub organizations where employees can be joined
Shodan exposes IoT vulnerabilities(CSO) The Shodan search engine is the Google for the Internet of Things, a playground for hackers and terrorists -- and, maybe, a useful tool for companies looking to lock down their own environment
Open Wi-Fi hotspots — Threats and Mitigations(PacketStorm Security) Users must update to better security measures while connecting to open Wi-Fi hot-spots as they turn out to be more risky than useful. It would come across as a cause of concern to know that 42% of wireless 802.11 access points come with no security mechanisms. By this we mean they are not even protected by WEP (Wired Equivalent Privacy) or WPA (Wi-Fi Protected Access)
Cost of breach vs. cost of deployment(Help Net Security) In security terms, 2014 read like a who's who of data breaches. Huge, global companies like Target, eBay and Coca-Cola have succumbed to data loss. Public services like the US Postal Service have also been left exposed. Others do not want to follow suit in 2015
Cyber Risk: Pre-Loss Planning(Willis Wire) The threat of cyber risk (financial loss, disruption, or reputational damage caused by a failure of an organization's information technology systems) is an increasingly critical issue that almost all organizations are faced with today. The recent data failures suffered have made it apparent that the immediate impact of determining the cause of the failure and the expense to fix the failure are major concerns, but by no means the only concerns
BBB Shares Five Resolutions for a Scam Free New Year(Nebraska TV) The Better Business Bureau wants to help consumers have a scam free year. To help, BBB serving Nebraska, South Dakota, The Kansas Plains and Southwest Iowa is sharing five resolutions to stay scam free in 2015
France to beef up its surveillance powers(The Local (France)) Prime Minister Manuel Valls has said that France is now engaged in a "war on terrorism", announcing plans to ramp up intelligence capabilities, aimed at amending the faults that lead to the country's "clear failings" over the Paris terror attacks
After Charlie, security and intelligence reform in a world of big data(The Hill) The twin terror attacks last week on the satirical magazine Charlie Hebdo and the Hyper Cacher kosher grocery store in Paris are, once again, leading to questions about the efficacy of intelligence operations against terrorist groups. This is not just a French problem; it affects the governments of all civilized nations
Stopping the Next Cyber-Attack(Bloomberg View) Cybervandalism, cyberterrorism, cyberwarfare. No matter what you call the recent attacks against Sony Pictures, we weren't ready. And we won't be ready until our nation — with the government and industry working together — takes action to defend itself
Encryption is not the Enemy(Threatpost) There are few things scarier these days than a politician stepping in front of a microphone, taking a deep breath and opening his mouth to pontificate on security. A long list of American elected officials have reinforced this, and on Monday, UK Prime Minister David Cameron jumped to the head of this undistinguished line with his dangerous statement that encrypted communications shouldn't be allowed
No, the NSA Isn't Like the Stasi — And Comparing Them Is Treacherous(Wired) Ever since Edward Snowden handed thousands of National Security Agency documents over to filmmaker Laura Poitras and writer Glenn Greenwald in a Hong Kong hotel room, the NSA's mass surveillance of domestic phone calls and Internet traffic has been widely compared to the abuses of East Germany's secret police, the Stasi
Toward Better Privacy, Data Breach Laws(KrebsOnSecurity) President Obama on Monday outlined a proposal that would require companies to inform their customers of a data breach within 30 days of discovering their information has been hacked. But depending on what is put in and left out of any implementing legislation, the effort could well lead to more voluminous but less useful disclosure. Here are a few thoughts about how a federal breach law could produce fewer yet more meaningful notice that may actually help prevent future breaches
SEC weighs cybersecurity disclosure rules(The Hill) The Securities and Exchange Commission is advancing measures that would require publicly owned companies to disclose more information about their cybersecurity vulnerabilities, including data breaches
White House: Obama Will Fight Media To Stop Anti-Jihad Articles(Daily Caller) President Barack Obama has a moral responsibility to push back on the nation's journalism community when it is planning to publish anti-jihadi articles that might cause a jihadi attack against the nation's defenses forces, the White House's press secretary said Jan. 12
US Senator Makes a Plea for Chip-and-PIN Cards(Infosecurity Magazine) In the wake of an unprecedented spate of damaging data breaches and point-of-sale (PoS) hacks, Sen. Mark R. Warner (D-Va.), a member of the Senate Banking Committee, has sent a letter to federal banking regulators questioning the lack of follow-up to better protect consumers. He also called for chip-and-PIN technology to be implemented across the board
Meet the Congressman Who Will Watch Our Spies(Bloomberg View) Representative Devin Nunes may not be well known outside of his California congressional district or the Washington beltway, but he is about to become one of the most important figures in the U.S. national security state
DISA To Defend DoD Networks In New Role(DefenseNews) The Pentagon is standing up a new headquarters within the Defense Information Systems Agency (DISA) that will assume responsibility for defending military networks and will reach initial operating capability this week
Court rules NSA doesn't have to divulge what records it has(Washington Times) A federal judge on Tuesday said the National Security Agency is not obligated to confirm nor deny it has someone's specific phone records, shooting down a conservative think tank's effort to try to use the spy agency to reveal secrets that other federal agencies want kept hidden
Russian Hacking Suspect Seeks Block to Extradition to US(AP via ABC News) The lawyer for a Russian accused by U.S. authorities of involvement in a huge computer hack that stole and sold at least 160 million credit and debit-card numbers called on a Dutch judge Tuesday to ban his extradition to the United States
Most Famous Hackers of all Time(Ethical Hacking) The hacking now a days became a very cool career in the eyes of the young generation. With the biggest companies like Sony, JP Morgan, Yahoo, CNN. NewYork Times, Ebay all hacked in the past even with their millions of dollars investment on securing their Websites. The Hackers in the peoples eyes are the most coolest persons on the planet
Apple, Google reach new deal to end U.S. lawsuit over poaching(Reuters) Four Silicon Valley companies including Apple Inc and Google Inc have agreed to a new settlement that would resolve an antitrust class action lawsuit by tech workers, who accused the firms of conspiring to avoid poaching each other's employees
For a complete running list of events, please visit the Event Tracker on the CyberWire website.
Newly Noted Events
Amsterdam 2015 FIRST Technical Colloquium(Amsterdam, the Netherlands, May 5 - 6, 2015) FIRST Technical Colloquia & Symposia provide a discussion forum for FIRST member teams and invited guests to share information about vulnerabilities, incidents, tools and all other issues that affect the...
FloCon 2015(Portland, Oregon, USA, January 12 - 15, 2015) FloCon is an open network security conference organized by Carnegie Mellon University
California Cybersecurity Task Force Quarterly Meeting(Walnut Creek, California, USA, January 20, 2015) The California Cyber Security Task Force serves as an advisory body to California's senior government administration in matters pertaining to Cyber Security. Quarterly Cybersecurity Task Force meetings...
FIC 2015(Lille, France, January 20 - 21, 2015) The International Cybersecurity Forum (FIC) forms part of a thinking and exchange process that aims at promoting a pan-European vision of cybersecurity and strengthening the fight against cybercrime, a...
AppSec California(Santa Monica, California, USA, January 26 - 28, 2015) OWASP's AppSec California goes beyond "security for security?s sake" bringing application security professionals and business experts together with the objective of sharing new information that helps get...
Data Privacy Day San Diego — The Future of IoT and Privacy(San Diego, California, USA, January 28, 2015) Join the Lares Institute, Morrison & Foerster, and the National Cyber Security Alliance for Data Privacy Day in San Diego. DPD San Diego will bring together privacy luminaries to discuss fundamental issues...
SPONSOR & SUPPORT
Grow your brand and reach new customers.
Grow your brand and increase your customer base by educating our audience about your products, services, and events by advertising on The CyberWire. We’ve built trust with an influential (and often hard to reach) audience of CISOs, CSOs, and other senior execs in the security space, across a wide array of industry verticals. Learn more.
Be a part of the CyberWire story.
People ask us (a lot) how they can support what we do. We have our sponsorships and services, of course, but those are not always within every supporter's financial reach, or it might just not be the right time for you to do those things. That's why we launched our new Patreon site, where we've created a wider variety of support levels, each with some new benefits. Our patrons are important to our future, and we hope you'll consider becoming one. We invite you to become part of the CyberWire story. Become a patron today.