In the UK, post mortems of the ISIS hack of certain Cabinet emails continue, with the emerging consensus being that the incident was "avoidable."
Russian authorities report, without attribution or further characterization, that the President's website came under a "massive cyber attack" on election day, which Russian defenses successfully parried.
FireEye discloses (evidently with Cisco's approval) that a novel attack, "SYNful Knock," has succeeded in taking control of Cisco-manufactured routers in at least four countries — India, Mexico, the Philippines, and Ukraine. Cisco informed customers of the attack in August and provided mitigation for the malicious implants.
Bitdefender reports that about a third of business and government enterprises in Hungary, Romania, and Ukraine are still running the outdated and notoriously vulnerable Windows XP.
Neustar again warns that denial-of-service campaigns are increasingly likely to serve as misdirection for more serious, sophisticated attacks.
Tor is getting its own top-level domain: [dot]onion.
More evidence appears that insurance markets are increasingly looked to — by both boards and regulators — as the coming source of cyber standards of care.
US President Obama has apparently decided against sanctioning China for cyber espionage. Observers perceive an uncertainty in the Administration over how to deal with this complex issue.
US companies read OMB's proposed cyber guidance; they don't like what they see.
Today's issue includes events affecting China, European Union, Hungary, India, Iraq, Mexico, NATO, Philippines, Romania, Russia, Syria, Ukraine, United Arab Emirates, United Kingdom, United Nations, United States.
This week the CyberWire will cover two events. Today and tomorrow we're at Borderless Cyber (organized by OASIS and the World Bank). Thursday we'll be covering the Sixth Annual Billington Cybersecurity Summit on Thursday. We'll live-tweet from both events (our hashtag today and tomorrow will be #BorderlessCyber), with full coverage published in the CyberWire as the week progresses.
Cisco router attacks duck cyber defenses, hit four countries(Reuters) Security researchers say they have uncovered previously unknown attacks on routers which direct traffic around the Internet, allowing hackers to harvest vast amounts of data while going undetected by existing cyber security defenses
New malware can make ATMs not give users' card back(Help Net Security) A new type of malware that can be used to compromise ATMs independently of who their manufacturer is, and can make the machine steal card data but also the cards themselves, has been spotted by FireEye researchers
Tracking Bluetooth Skimmers in Mexico, Part II(KrebsOnSecurity) I spent four days last week in Mexico, tracking the damage wrought by an organized crime ring that is bribing ATM technicians to place Bluetooth skimmers inside of cash machines in and around the tourist areas of Cancun
Survey: Many agencies suffer frequent insider hacking attempts(Federal Times) In the realm of cybersecurity, insider threats are one of the most potentially dangerous forms of network compromise. As agencies purchase and develop tools to track where their employees go on the network and what they are accessing, a new report shows almost half were targeted by insiders over the last 12 months
Targeted Attacks versus APTs: What's The Difference?(TrendLabs Security Intelligence Blog) A few weeks ago I appeared on the RedZone podcast hosted by Bill Murphy, where I talked about (among other topics) the differences between targeted attacks and what our competitors called Advanced Persistent Threats (APTs)
Security Patches, Mitigations, and Software Updates
New Debian Releases Fix PHP, VirtualBox Bugs (Threatpost) The maintainers of Debian have released new versions of the operating system to fix several vulnerabilities, including a number of bugs in PHP and an unspecified flaw in Oracle's VirtualBox application
The brave new world of cyber insurance(FCW) Perimeter defenses have been penetrated the world over, and the modern cybersecurity conversation is all about how to mitigate the damage once your organization is inevitably breached
Gemalto launches IoT tamper-resistant component(StockMarketWire) Digital security Gemalto is introducing the Cinterion Secure Element, a tamper-resistant component embedded in industrial Internet of Things (IoT) solutions to enable advanced digital security and lifecycle management
Unicon and Duo Security Collaborate to Develop Multifactor Authentication Extension for Shibboleth 3.x IDP(Benzinga) Unicon, Inc., a leading IT consulting, services, and support provider specializing in open source for the education technology market, today announced that it has collaborated with Duo Security, a leading provider of two-factor authentication solutions for higher education institutions, in the development of a multifactor authentication solution for the newly released Shibboleth 3.x IDP. The extension was developed on behalf of Unicon clients, including major universities. It has been donated back to the open source community, making it available for all universities and colleges to implement to add an extra layer of security for protection of applications and resources
Blue Coat enriches support portal and search infrastructure(Knowledge Management World) To improve its search experience and its customer, partner and employee support portal, Blue Coat Systems, an enterprise security company, has enlisted the help of the Google Search Appliance (GSA), and Search Technologies
DeviceLock® Endpoint DLP Software Achieves SC Magazine 5-Star "Recommended" Rating(Digital Journal) DeviceLock, Inc., a worldwide leader in endpoint data leak prevention (DLP) software, today announced that SC Magazine has designated the DeviceLock Endpoint DLP Suite a perfect 5-Star rating across all measured criteria as well as earning their prestigious "Recommended" endorsement for the Endpoint Security category
Darktrace wins major US award(Cambridge News) Darktrace, the Cambridge company set up to keep digital raiders at bay, was presented with a Gold Stevie Award in the New Product and Technology category at the 13th annual American Business Awards ceremony in San Francisco this month
Technologies, Techniques, and Standards
12 Questions About Security That Boards Must Ask(Baseline) With the ever-growing number of data breaches companies face, a corporate board must elevate its presence as a watchdog to ensure enterprisewide accountability in the interest of cyber-security
Obama Won't Sanction China for Cyber Spying… Yet(Daily Beast) The White House is reportedly holding off on sanctions against Chinese companies for cyber spying on American corporations, at least until President Xi Jinping completes his stateside visit
Cyberthreat Posed by China and Iran Confounds White House(New York Times) A question from a member of the Pentagon's new cyberwarfare unit the other day prompted President Obama to voice his frustration about America's seeming inability to deter a growing wave of computer attacks, and to vow to confront the increasingly aggressive adversaries who are perpetrating them
Bad News: Cyber Norms Probably Won't Constrain Cyber Conflict(Council on Foreign Relations) The U.S. government has put the promotion of its cyber norms at the forefront of its cyber diplomacy with the hopes that it will constrain pervasive cyberattacks. Past experience with norm promotion efforts provide insight on whether the United States is likely to be successful. Unfortunately, the future is bleak
Public library shelves plans to become part of Tor(Naked Security) The Kilton Public Library in the US town of West Lebanon, New Hampshire is only 5 years old, and its modern sensibilities show: for one thing, it brags about sustainable technologies such as ground source heat pumps and radiant floor slabs throughout
State looked into hacking software(Des Moines Register) A computer expert with Iowa's executive branch inquired about the cost of Italian-made hacking software used by intelligence and police agencies worldwide to monitor communications, a leaked email shows, but didn't buy the product
For a complete running list of events, please visit the Event Tracker on the CyberWire website.
SANS Institute: Information Security Training(Las Vegas, Nevada, USA, September 12 - 21, 2015) Information security training in Las Vegas from SANS Institute, the global leader in information security training. At SANS Network Security 2015, SANS offers more than 40 hands-on, immersion-style security...
Gulf Cooperation Council Cyber Security Summit(Abu Dhabi, United Arab Emirates, September 13 - 15, 2015) The GCC Cyber Security Summit will bring together regional and international thought leaders and decision-makers to examine one of the most vital threats to the region's future well-being: cyber-attack.
Hacker Halted 2015(Atlanta, Georgia, USA, September 13 - 18, 2015) EC-Council Foundation's flagship information security conference, Hacker Halted, will unite some of the greatest minds in information security, as industry experts address the latest threats and vulnerabilities...
EnergySec 11th Annual Security & Compliance Summit(Washington, DC, USA, September 14 - 16, 2015) For more than 10 years the EnergySec Security Summit has been the premier gathering for stakeholders in the energy sector focused on physical and cyber security. Our summits give each attendee a rare opportunity...
Fraud Summit San Francisco(San Francisco, California, USA, September 15, 2015) ISMG's Fraud Summit is a one-day event focused exclusively on the top fraud trends impacting organizations and the mitigation strategies to overcome those challenges. Among the areas to be discussed are...
Borderless Cyber 2015(Washington, DC, USA, September 15 - 16, 2015) OASIS, in collaboration with The World Bank, will bring together public and private sector security professionals from around the world to evaluate, debate, and collaborate on cyber security best practices...
Detroit Secure World(Detroit, Michigan, USA, September 16 - 17, 2015) Join your fellow security professional for affordable, high-quality cybersecurity training and education at a regional conference near you. Earn CPE credits while learning from nationally recognized industry...
Cyber Security Summit: New York(New York, New York, USA, September 17, 2015) The Cyber Security Summit provides an exclusive business environment to meet with Senior Executives who are seeking innovative solutions to protect their business & critical infrastructure. Delegates at...
6th Annual Billington Cybersecurity Summit(Washington, DC, USA, September 17, 2015) Join key leaders and decision makers from government, military and the private sector at this one-day intensive networking event as participants focus on the next generation of solutions to ensure this...
Hacker Halted(Atlanta, Georgia, USA, September 17 - 18, 2015) Hacker Halted is a global series of computer and information security conferences presented by EC-Council. The objective of the Hacker Halted conferences is to raise international awareness towards increased...
Cyber Security Summit: New York(New York, New York, USA, September 18, 2015) The Cyber Security Summit provides an exclusive business environment to meet with Senior Executives who are seeking innovative solutions to protect their business & critical infrastructure. Delegates...
Data Breach Investigation Summit(Dallas, Texas, USA, September 21 - 26, 2015) Data Breaches are occurring at an alarming rate and increasing in their scope, frequency and impact and they don't discriminate by industry, geography or organization size. When a breach occurs, organizations,...
St. Louis SecureWorld 2015(St. Louis, Missouri, USA, September 22 - 23, 2015) Join your fellow security professional for affordable, high-quality cybersecurity training and education at a regional conference near you. Earn CPE credits while learning from nationally recognized industry...
OWASP APPSECUSA(San Francisco, California, USA, September 22 - 25, 2015) The premier gathering of developers, security experts and technologists to discuss cutting edge approaches to secure web applications
MeriTalk: Cyber Security Brainstorm(Washington, DC, USA, September 23, 2015) Co-locating with the NIST Cloud Security Working Group, this MeriTalk Brainstorm has an excellent program lined up, featuring keynote speakers Allison Tsiumis (Section Chief, Cyber Intelligence Section,...
SPONSOR & SUPPORT
Grow your brand and reach new customers.
Grow your brand and increase your customer base by educating our audience about your products, services, and events by advertising on The CyberWire. We’ve built trust with an influential (and often hard to reach) audience of CISOs, CSOs, and other senior execs in the security space, across a wide array of industry verticals. Learn more.
Be a part of the CyberWire story.
People ask us (a lot) how they can support what we do. We have our sponsorships and services, of course, but those are not always within every supporter's financial reach, or it might just not be the right time for you to do those things. That's why we launched our new Patreon site, where we've created a wider variety of support levels, each with some new benefits. Our patrons are important to our future, and we hope you'll consider becoming one. We invite you to become part of the CyberWire story. Become a patron today.