skip navigation

More signal. Less noise.

Daily briefing.

The European Commission sustained an hours-long distributed denial-of-service attack yesterday. Authorities say the attack was stopped without data loss. Both the EU's main website and its network gateways were targeted. No attribution yet, or motive, and details on how the attack was accomplished remain obscure.

The US Navy has disclosed that a compromised contractor's laptop has exposed the personal data of some 134,000 current and former Sailors. The information was in a re-enlistment eligibility database.

Kaspersky warns that a zero-day affecting the InPage text editor is being exploited in attacks against banks located for the most part in Asia and Africa.

Symantec is tracking the progress of the Gatak through the healthcare sector. How the unknown criminals behind Gatak are monetizing malware that affects many medical research, development, and device manufacturing sites is unclear.

Locky ransomware—still dangerous and still unbroken—is being heavily distributed in spam campaigns. CrytpoLuck is being served by the RIG exploit kit. In some good news on the ransomware front, the recently discovered TeleCrypt strain has been broken.

In industry news, Palantir has this month raised an additional $20 million. Analysts look at Symantec's acquisition of LifeLock and see two benefits: a near-term positive effect on the topline, and synergies from the identity protection business for Symantec's larger suite of security offerings.

The US Federal hiring event that led some to assert that there's no cyber talent shortage looks like an outlier.

It's Black Friday. Shop with circumspection, and be wary of free mall WiFi.


Today's issue includes events affecting Australia, Bangladesh, Canada, European Union, Ghana, India, Japan, Malaysia, Nigeria, Pakistan, South Africa, Thailand, United Kingdom, United States.

The CyberWire's regular daily Podcast is on holiday hiatus today, but we'll return as usual Monday. In the meantime, feel free to catch up on the episodes you may have missed here. And as always, if you enjoy the podcast, please consider giving it an iTunes review.)

AlienVault USM Webcast (Live Webcast, December 1, 2016) Find threats lurking on your systems with host-based intrusion detection and AlienVault USM.

NCCoE Speaker Series: Understanding, Detecting & Mitigating Insider Threats (Rockville MD, USA, December 6, 2016) Your employees could be your biggest cybersecurity risk. Join us to learn more.

Cyber Attacks, Threats, and Vulnerabilities

The European Commission was the victim of a massive DDoS attack that brought down its internet access for hours on Thursday. (Security Affairs) A massive DDoS attack targeted the European Commission website, fortunately, according to an official statement from the organization the internal security team repelled the attack without damages

European Commission confirms 'large-scale' cyberattack disrupted internet for hours (International Business Times) EU legislative body maintains that no data was stolen in the incident

European Commission Servers Offline After Massive DDoS Attack (HackRead) Commission says there was no data breach

Kaspersky Lab IDs New Activity Among Financial Cybercriminals (PYMNTS) Analysts at Kaspersky Lab have discovered a string of attacks targeting users across Asia and Africa, the company said Wednesday (Nov. 23)

Asian and African banks are attacked using a Zero-day vulnerability (IT News Africa) Kaspersky Lab has discovered attacks which appear to be using a zero-day exploit (a malicious programme allowing additional malware to be silently installed) for the InPage text editor. InPage is a software package used by Urdu- and Arabic-speaking people and organisations around the world. The exploit was used in attacks against banks in several Asian and African countries

InPage Zero Day Used in Attacks Against Banks (Threatpost) A zero-day vulnerability in InPage publishing software used primarily in Urdu, Pashto and Arabic-speaking nations has been publicly exploited in attacks against financial institutions and government agencies in the region

No cyber attack on local ATMs, say police (Free Malaysia Today) Cyber attacks possible only on outdated and vulnerable ATMs, says Selangor Commercial Crime Investigation Department chief

Personal data for more than 130,000 sailors was breached, Navy says (Navy Times) The personal data of more than 130,000 sailors in a re-enlistment approval database was stolen from a contractor’s laptop, the Navy disclosed Wednesday

Navy Reports Data Breach after Hewlett Packard Laptop Compromised (Wall Street Journal) Navy says names and Social Security numbers of 134,000 current and former sailors were accessed by ‘unknown individuals”

Healthcare organizations under threat of Gatak Trojan: Symantec (India Times) Mysterious threat group infects organizations using malicious key generators for pirated software, reveals Symantec research

Cybercriminals use OneDrive for Business to spread malware (IT Pro Portal) Forcepoint Security Labs has revealed that cybercriminals have been exploiting Microsoft's OneDrive for Business

Vicinity of obscurity! Fareit trojan spread via uncommon file type (Graham Cluley) Malicious attackers disguise their attacks via .mht file attachments

Locky Ransomware Distributed Through Massive “Spray & Prey” Spam Campaign (Heimdal Security) The unbreakable Locky is on a rampage. For your safety, don’t open this email!

CryptoLuck Ransomware Spread Through the RIG-E Exploit Kit (Cyware) CryptoLuck ransomware is a new strain of malware discovered by the researcher Kafeine, that is being distributed via the RIG-E exploit kit

TeleCrypt Ransomware Decrypted In Three Weeks (VirusGuides) It took experts only three weeks to break the code of TeleCrypt, the ransomware which exploits the chat app Telegram messenger. The virus uses a simple cryptosystem which was easy to figure out

Uber Portal Leaked Names, Phone Numbers, Email Addresses, Unique Identifiers (Threatpost) A series of vulnerabilities in UberCENTRAL, a portal Uber started during the summer to help businesses facilitate rides for customers, could have leaked the names, phone numbers, email addresses, and unique ID of all Uber users

Non-Casino Rama patron also victim of cyber attack (Toronto Sun) A man who never stepped foot in Casino Rama was stunned to get a letter advising him that his personal information may have been stolen in a cyber attack targeting the gambling operation

I-Team: Cyber attacks have cost Las Vegas businesses billions (CBS 8 Las Vegas Now) Anyone can fall victim to cybercrime, but hackers have zeroed in on some large targets in Las Vegas: hotel and casino establishments

Smartphone App Flaw Leaves Tesla Vehicles Vulnerable To Theft (Infosecurity Magazine) Tesla cars can be tracked, located, unlocked and driven away by compromising the company’s smartphone app

Data Breach - Online Accounting Firm (Wapack Labs) An online Palo Alto headquartered accounting firm has suffered a data breach

Locked PCs No Match for Samy Kamkar's Latest Hacking Tool (InfoRisk Today) PoisonTap sneaks into computers, even if they're locked

Insider Threat Enabled by Disloyal Employees and Organizational Failures (Infosecurity Magzine) Organizations are not in touch with employees, and “misunderstand the strength of someone’s loyalty who doesn’t necessarily want to work 9-5”

Kaspersky Lab warns retailers, consumers of Black Friday heist (Enterprise Innovation) The number of financial phishing attacks is expected to rise again during the holiday season which starts unofficially on Black Friday and continues through Cyber Monday and Christmas, security firm Kaspersky Lab warned

Security Patches, Mitigations, and Software Updates

CERT tells Microsoft to keep EMET alive because it's better than Win 10's own security (Register) Vuln seeker says EMET has 13 protections Win 10 doesn't

Cyber Trends

Internet freedom around the world keeps decreasing (Help Net Security) For the sixth year in a row, Internet freedom is declining

The internet may be doing more harm than good (National) Was the world better off before the internet?

ACI highlights need for ‘more Europe’ on security, during special summit (Travel Daily News) Europe is facing an unprecedented security situation, with the terrorism threat shaped by a toxic mix of geopolitical instability, marginalised communities & social discontent - as well as social media being used as a powerful propaganda machine

The crime that hit almost 700 million in a year (CQ News) Despite widespread publicity about cyber attacks and scams, Australians are still sharing passwords, leaving devices unprotected and engaging in risky online behaviour

UK organisations have a worrying digital security gap (Help Net Security) UK organisations reveals that while 82 percent of C-Suite and senior managers admit they are concerned about the vulnerability of their web sites, mobile applications and social media accounts to cyber attack and impersonation, according to Risk IQ


Firms told ‘get away from the sales guy’ for better security (ChannelBiz) Channel security solutions bod slams vendors for promising the earth and not delivering

Big data company Palantir quietly raised another $20M in November (TechCrunch) Palantir — that $20 billion secretive outfit that provides government, finance, healthcare and other organizations with analytics, security and other data management solutions — has raised another $20 million in funding, according to a new SEC filing

What’s Symantec Getting from Its LifeLock Acquisition? (Market Realist) Symantec (SYMC) is buying identity theft protection company LifeLock (LOCK) for $2.3 billion. The deal values LifeLock at $24 per share, suggesting that Symantec is paying a 16% premium to LOCK’s closing price as of November 18, 2016

A Closer Look At IBM's Future: Mobile, Security, Acquisitions And Accounting (Part 7) (Seeking Alpha) This article is part of a series of interviews with IBM executives. In this article, I ask IBM about its strategy in relation to mobile, security and acquisitions. I also investigate some of the accounting reclassifications

How IBM Is Changing Enterprise Cybersecurity Landscape (CXOtoday) The last couple of weeks have been quite exciting for IBM Security. Ealier in November, the Big Blue announced the initial integration of Watson for Cyber Security with IBM’s QRadar Security Intelligence Platform

DHS hiring puts into question the cybersecurity skills shortage (Search Security) A successful hiring event by the Department of Homeland Security calls into question the existence of the cybersecurity skills shortage but experts wonder if the event was an outlier

Products, Services, and Solutions

New infosec products of the week​: November 25, 2016 (Help Net Security) Anomali STAXX: Easy way to subscribe to any STIX/TAXII feed...Barracuda announces Web Security Gateway updates...Threat Stack unveils Cloud Security Platform support for Windows and hybrid environments...BullGuard updates BullGuard Internet Security...Fujitsu releases PalmSecure BioLock, a biometric security solution for SAP systems

Bitdefender ajoute de nouvelles technologies avancées à sa gamme GravityZone (Global Security Mag) Bitdefender annonce l’amélioration et l’intégration de nouvelles fonctionnalités et technologies de sécurité1 à sa gamme de solutions pour les entreprises, GravityZone

KeepKey adds Ethereum support, offers 20 pct discount on Black Friday (EconoTimes) KeepKey, a Seattle-based hardware wallet provider, has announced integration with Ethereum due to soaring community demand

Technologies, Techniques, and Standards

Telecrypt Decryptor foils ransomware’s simple encryption method (Help Net Security) The recently spotted Telecrypt ransomware can be thwarted: malware analyst Nathan Scott has created a tool that decrypts the encrypted files

Free Software Quick Security Checklist (SANS Internet Storm Center) Free software (open source or not) is interesting for many reasons. It can be adapted to your own needs, it can be easily integrated within complex architectures but the most important remains, of course, the price. Even if they are many hidden costs related to "free" software. In case of issues, a lot of time may be spent in searching for a solution or diving into the source code (and everybody knows that time is money!)

How Retailers Can Create A Cybersecurity-Aware Environment (Information Security Buzz) Last year, more than 40 million retail records were lost or stolen. And the recent Beyond the Phish Report revealed users in the retail industry incorrectly answered nearly 40% of questions about properly securing and disposing of sensitive data

Visa Clarifies Merchants Have EMV Debit Routing Options (BankInfo Security) What are the implications for chip-and-PIN?

What is SQL Injection and how to avoid it in Java? (javaQuery) SQL Injection: It's a technique where attacker try to alter(modify/change) your SQL query using input parameters

Skycure's Tips for Safe Mobile WiFi Networking During the Holidays (eWeek) Some free Mall WiFi connections are more dangerous than others

Cyber Monday: What to watch out for when you hit the web (Naked Security) Cyber Monday happens immediately after the Thanksgiving weekend, and it’s a day of potential online bargains when many people will be flocking to their browsers to look for great deals, just as they flocked to the shopping mall for in-store Black Friday discounts

Design and Innovation

Autistic People Can Solve Our Cybersecurity Crisis (Wired) Vital jobs in online security are going unfilled. And there are people in our midst, ideally suited to the work, who are unemployed. Connect the dots

Blockchain has the potential to revolutionize the supply chain (TechCrunch) At the time of its inception some two centuries ago, the supply chain was a revolutionary idea that would improve visibility and control on goods and products as they moved from point A to point B. But the old concept and technology can no longer support today’s production and supply cycles, which have become extremely fragmented, complicated and geographically dispersed

Every move you make, every click you take, we’ll be watching you (Naked Security) I had to leave the site ClickClickClick. It wasn’t too happy about it

Think Stock Photos of Hackers Are Cheesy? Blame This Guy (Motherboard) Trust me: picking stock photos for an article on hacking is the bane of a security journalist's existence. Either, you've got some abstract illustration of a padlock surrounded by The Matrix typography, or a dark hooded figure leaning menacingly over a laptop; there isn't much in between

Legislation, Policy, and Regulation

Thai Computer Crime Law Raises Rights Concerns (Infosecurity Magazine) Amendments to Thailand’s controversial Computer Crime Act were debated in parliament this week, with rights groups expressing concerns that the law will bolster government efforts to restrict online freedoms and spy on users

Serious cyber attack has potential to cause same damage as terrorist attack, Dan Tehan says (Australian Broadcasting Corporation) Australia's defences against cyber attacks need improving if it is to keep up with the growing threat of online crime and espionage, says the Minister assisting the Prime Minister for Cyber Security Dan Tehan

Microsoft calls for laws on cyber security (Ghana Business News) Microsoft has once again proven that it is a champion of cyber security awareness by joining a growing effort by the government and other agencies to promote Cyber safety and anti-piracy awareness in Ghana

Why Did Team Obama Try to Take Down Its NSA Chief? (Daily Beast) Adm. Michael Rogers’s bosses wanted him to go harder after ISIS. His employees wanted him to take it easier on the group. And that was before the meeting with Donald Trump

Why there's hope for data privacy under Trump (ITProPortal) Donald Trump and his VP, Mike Pence, have yet to clearly define their policy priorities around tech

DoD Opens .Mil to Legal Hacking, Within Limits (KrebsOnSecurity) Hackers of all stripes looking to test their mettle can now legally hone their cyber skills, tools and weaponry against any Web property operated by the U.S. Department of Defense (DoD), according to a new military-wide policy for reporting and fixing security vulnerabilities

DoD to begin piloting replacement for Common Access Card after Christmas (Federal News Radio) The Defense Department expects to begin pilot programs to test out new IT authentication mechanisms shortly after the Christmas holiday, an early step toward the DoD chief information officer’s objective of completely eliminating the Common Access Card within the next two years

OIG: HHS Needs to Push Secure Health Data Exchange (GovInfo Security) Report outlines HHS management, performance challenges

DFS Cyber Regulation: Part II – An Interview with Bay Dynamics’ Steven Grossman (JDSupra) This is the second installment in our interview with Steven Grossman, VP Strategy & Enablement at Bay Dynamics, the cyber risk analytics company. Here, Steven discusses the importance of aligning an institution’s risk profile with its cybersecurity plan and recommendations for bridging the gap between IT and the boardroom

Cybersecurity 2017 – The Year In Preview: The Changing Face of State Law and Enforcement (Security, Privacy, and the Law) In the patchwork of state and federal law regulating the use and maintenance of personal confidential information, states play a significant role and can often be the most important regulator and law enforcement authority

Litigation, Investigation, and Law Enforcement

Census 2016: Government, IBM settle over website crash (Australian Broadcasting Corporation) The Government has reached a confidential settlement with computer giant IBM for costs after the census website crashed earlier this year, leaving millions of Australians unable to lodge their forms

ABS told to end 'cosy' IBM lock-in after Census fail (IT News) Blasted over trusted relationship and poor preparation

European Regulator Probes Yahoo’s 2015 Secret Email Scan (Dark Reading) Dublin-based Data Protection Commissioner trying to ascertain if Yahoo broke Europe's privacy laws

Voting security experts call on Clinton to demand recount (CSO) The results in three battleground states should be re-examined, voting security experts and lawyers tell Clinton

Hacked or Not, Audit This Election (And All Future Ones) (Wired) After an election marred by hacker intrusions that breached the Democratic National Committee and the email account of one of Hillary Clinton’s top staffers, Americans are all too ready to believe that their actual votes have been hacked, too. Now those fears have been stoked by a team of security experts, who argue that voting machine vulnerabilities mean Clinton should demand recounts in key states

UMass Amherst Hit with $650,000 HIPAA Settlement (Healthcare Info Security) Malware-related breach affected a unit that should have been HIPAA compliant

Rancho Cucamonga Verizon Wireless store focus of ID theft ring investigation (Press Enterprise) A domestic violence investigation uncovered a large ID Theft ring working out of the Verizon Wireless store at Victoria Gardens, sheriff’s officials announced Wednesday

Atlanta Attorney’s Office Gets Cybercrime Unit (Dark Reading) New cell created after arrest and extradition of two Nigerians from Malaysia in alleged phishing attacks on US

For a complete running list of events, please visit the Event Tracker on the CyberWire website.

Upcoming Events

4th Ethiopia Banking & ICT Summit (Addis Ababa, Ethiopia, November 25, 2016) The 4th Ethiopia Banking & ICT Summit is the ONLY event in Horn of Africa that focuses on technology innovations and trends in the Banking and ICT sectors. This annual summit brings together Financial...

Insider Threat Program Development Training For NISPOM CC 2 (Aberdeen, Maryland, USA, August 10 - 11, 2016) Insider Threat Defense will hold a two-day training class on Insider Threat Program Development (National Insider Threat Policy-NISPOM Conforming Change 2). For a limited time the training is being offered...

Internet of Things (IoT) (Elkridge, Maryland, USA, November 29, 2016) This cybergamut Technical Tuesday features Dr. Susan Cole, currently the Cybersecurity Lead for a Federal Information Systems Controls Audit Management (FISCAM) preparation team and also provides consulting...

CIFI Security Summit (Toronto, Ontario, Canada, November 30 - December 1, 2016) The Annual CIFI Security Summit takes place all over the world, Asia, Europe, Australia & North America. These summits are essential 2 day conferences and exhibitions bringing together leading security...

AlienVault USM Webcast (Online, December 1, 2016) Host-based intrusion detection systems (HIDS), work by monitoring activity that is occurring internally on a host. HIDS look for unusual or nefarious activity by examining logs created by the operating...

Cyber Threats Master Class (Turin, Italy, December 1 - 2, 2016) The UNICRI Masterclass on Cyber Threats aims to provide media and public relations professionals, as well as those planning a career in public information and communication, with a deeper understanding...

Disrupt London (London, England, UK, December 3 - 6, 2016) TechCrunch Disrupt is the world’s leading authority in debuting revolutionary startups, introducing game-changing technologies, and discussing what’s top of mind for the tech industry’s key innovators.

US Department of Commerce Cyber Security Trade Mission to Turkey ( Ankara and Istanbul, Turkey, December 5 - 8, 2016) Now is the time to expand in Turkey! The growth and frequency of cyber-attacks in recent years has increased the demand to protect critical data and infrastructure of governments and businesses. Turkey...

NCCoE Speaker Series: Understanding, Detecting & Mitigating Insider Threats (Rockville, Maryland, USA, December 6, 2016) Insider threats are growing at an alarming rate, with medium-to-large company losses averaging over $4 million every year. Smaller businesses are at risk too, and it is estimated that in 2014, over half...

Weaponizing Data Science for Social Engineering: Automated E2E Spear Phishing on Twitter (Elkridge, Maryland, USA, December 6, 2016) This cybergamut Technical Tuesday features ZeroFox data scientist John Seymour, who will present a recurrent neural network that learns to tweet phishing posts targeting specific users. Historically, machine...

Practical Privacy Series 2016 (Washingto, DC, USA, December 7 - 8, 2016) This year, the Practical Privacy Series will return to Washington, DC, with its rapid, intensive education that arms you with the knowledge you need to excel on the job. We’re programming some stunningly...

CISO Southern Cal (Los Angeles, California, USA, December 8, 2016) A data breach is not only a PR nightmare, but cause for customers to turn to competitors, exposing sensitive company information and racking up fines from industry regulators. In order for organizations...

SANS Cyber Defense Initiative 2016 (Washington, DC, USA , December 10 - 17, 2016) Make plans to attend SANS Cyber Defense Initiative 2016 (CDI). SANS is the one educational organization known for developing the cybersecurity skills most in need right now. SANS Cyber Defense Initiative...

Privacy, Security and Trust: 14th Annual Conference (Auckland, New Zealand, December 12 - 14, 2016) This year’s international conference focuses on the three themes of Privacy, Security and Trust. It will provide a forum for global researchers to unveil their latest work in these areas and to show how...

Grow your brand and reach new customers.

Grow your brand and increase your customer base by educating our audience about your products, services, and events by advertising on The CyberWire. We’ve built trust with an influential (and often hard to reach) audience of CISOs, CSOs, and other senior execs in the security space, across a wide array of industry verticals. Learn more.

Be a part of the CyberWire story.

People ask us (a lot) how they can support what we do. We have our sponsorships and services, of course, but those are not always within every supporter's financial reach, or it might just not be the right time for you to do those things. That's why we launched our new Patreon site, where we've created a wider variety of support levels, each with some new benefits. Our patrons are important to our future, and we hope you'll consider becoming one. We invite you to become part of the CyberWire story. Become a patron today.