skip navigation

More signal. Less noise.

What if your security solution could provide zero doubt?

A foundation of artificial intelligence delivers smart, simple, and secure solutions that change how organizations approach endpoint security. Cylance provides full-spectrum, predictive threat prevention and visibility across the enterprise to combat the everyday - as well as the most notorious and advanced - cyberattacks. Let Cylance help you understand how you can create real confidence in your organization’s security posture and zero in on what really matters.

Daily briefing.

Proofpoint researchers describe two hitherto undocumented strains of malware, ServHelper (a backdoor) and FlawedGrace (a remote access Trojan) now being used in the wild by TA505. 

WIRED has an account of how ISIS is turning from social networks to chat apps.

Reddit, which locked down a large number of accounts over security suspicions aroused by unusual activity in those accounts, is systematically restoring users' access.

The "shelf life, three weeks" tweets said to have aroused such suspicion at NSA in 2016 were apparently turned over to NSA by Kaspersky, say anonymous sources not authorized to discuss what they know. The tweet was addressed to "Yevgeni," presumably Eugene Kaspersky himself, by @HAL999999999 as Ars Techica reports. Thus it was Kaspersky, the Washington Post notes, and not US counterintelligence officers, who first twigged to the possibility that someone may have been getting ready to leak classified information, and that warning is being connected to Hal Martin's arrest.

Two points are worth making. First, Mr. Martin, who's entitled to the presumption of innocence, is charged with mishandling and unlawful retention of classified material, not with passing it to anyone. So the ShadowBrokers' leaks that soon followed the tweets may be coincidental (if one believes in such things). Second, as interesting as we find reading and writing about this developing story, the fact that anonymous sources not authorized to speak are speaking as much as they are suggests that US Federal insider threat programs remain more loosey-goosey than the Intelligence Community would probably hope.

Notes.

Today's issue includes events affecting Canada, China, Estonia, India, Iraq, Israel, Japan, Latvia, Lithuania, Norway, Russia, Syria, United States.

Visualize Your Network Like the Most Infamous Hackers

Cyber threats are becoming more frequent and targeted. Bad actors are more adept at social engineering and investigating your network and infrastructure to understand your organization’s cyber strengths and weaknesses. This webinar delves into a robust threat model capable of repelling the world's most sophisticated hackers and nation-state actors. Join us for an introduction to ScoutThreat™, a threat management platform that helps analysts streamline threat analysis work and extract the maximum value from threat intelligence.

In today's podcast, out later this afternoon, we speak with our partners at the University of Maryland, as Jonathan Katz discusses updated WiFi security. Our guest is Ameesh Divatia from Baffle on the growing frustration with how companies handle our private information.

And Hacking Humans is up. This episode, "Trained humans are your strongest link," features a warning about scammers gaining access to homes by pretending to be workers from the local utility company. Joe shares a story of a sophisticated bank transfer scam in the UK. Our catch of the day outlines an attempted email scam targeting an architectural firm. Carole Theriault is back with the second part of her interview with the pen tester who goes by the name freaky clown.

Rapid Prototyping Event: The Wolf in Sheep's Clothing (Columbia, Maryland, United States, January 29 - 31, 2019) DreamPort, in conjunction with the Maryland Innovation & Security Institute and USCYBERCOM, is hosting a Rapid Protoyping Event which is interested in identifying UAM solutions that employ advanced real-time analysis of multiple data sources for detecting unauthorized activities.

Cyber Attacks, Threats, and Vulnerabilities

A Growing Frontier for Terrorist Groups: Unsuspecting Chat Apps (WIRED) While major messaging and social media platforms like Facebook, Twitter, YouTube, and Telegram are becoming increasingly inhospitable to ISIS, the group's reach is growing on lesser-known messenger apps designed for businesses and gamers.

ServHelper and FlawedGrace - New malware introduced by TA505 (Proofpoint) Proofpoint researchers detail two undocumented pieces of malware being used by TA505.

The D in SystemD stands for Dammmit... Security holes found in much-adored Linux toolkit (Register) Patches pending for distros to deal with threat of local privilege escalation to root

r/help - Recently locked out of your account? Help is on the way (Reddit) If you are here because you’ve been locked out of your account in the last day or so, you’re in the right place and we want to help you get your account back in working order.

Malvertising Campaign Delivers Info-Stealer + Ransomware (Infosecurity Magazine) Malwarebytes warns users of double whammy

Rogue iOS Apps Sent Data to Malicious Server (Security Boulevard) Researchers have come across several games in the iOS app store that sent information to and communicated with a known malicious server.

New Side-Channel Attack Targets OS Page Cache (SecurityWeek) Researchers who disclosed Meltdown, Spectre and other similar attacks are now back with a new type of side-channel attack, one that is hardware agnostic and targets the operating system page cache.

A year of data infection over protection - the rise of Magecart (IT Pro Portal) Considering the alarming rate at which digital credit card skimmers are found to be compromising e-commerce sites, what do businesses need to know about Magecart?

ONWASA: $277K spent on recovery, defense after cyber attack (The Daily News) ONWASA spent approximately $277,000 on recovery and on changing the types of defenses they employ following a cyber hack in October.

Swindler Dupes Georgia Health System Finance Director Into $1.2M Wire Payment (HealthLeaders Media) Police are investigating after the executive reportedly sent organization funds to someone posing as a representative of a construction company doing work for the health system.

Phishing emails only going to get smarter, warns security firm (IT Brief) Phishing emails typically mimic the look and feel of an email written by someone in authority, such as a bank, or even a colleague.

Security Patches, Mitigations, and Software Updates

Adobe Releases January 2019 Security Updates. None for Flash Player! (BleepingComputer) Adobe released their January 2019 Patch Tuesday updates today for Adobe Connect and Adobe Digital Editions. Updates were also released for Flash Player, but none of them are for security fixes!

Microsoft pulls buggy Office 2010 January updates (ZDNet) Microsoft's preparations for a new Japanese era coming later this year break Excel.

It’s raining RCE flaws (The Daily Swig | Web security digest) Seven critical updates in Microsoft’s new year Patch Tuesday

Snapchat adds end-to-end encryption to protect users' messages (The Telegraph) The messaging app Snapchat has introduced end-to-end encryption, protecting the disappearing photos shared between its users from being intercepted.

SAP Releases 'Hot News' Security Notes on First Patch Day of 2019 (SecurityWeek) SAP released its first Security Patch Day for 2019, which includes a total of 11 Security Notes, two of which are rated as Hot News.

Google Patches Critical Vulnerability in Android (SecurityWeek) Google has released its first set of monthly security patches for Android in 2019, with fixes for more than two dozen vulnerabilities.

Cyber Trends

Web Vulnerabilities Up, IoT Flaws Down (Dark Reading) The number of flaws found in WordPress and its associated plugins have tripled since 2017, while Internet of Things vulnerabilities dropped significantly, according to data collected by Imperva.

The State of Web Application Vulnerabilities in 2018 (Imperva) This blog provides an analysis of all web application vulnerabilities throughout the year, view trends, and notice significant changes in the security landscape. This look back at 2018 helps readers to understand the changes and trends in web application security over the past year.

WordPress-Related Vulnerabilities Tripled in 2018 (BleepingComputer) WordPress-related vulnerabilities have seen a 300% increase in 2018 compared to the previous year, a recent study has found. Most of the bugs were in the plugins that extend the functionality of WordPress websites.

Email security predictions: What we can expect in 2019 (Help Net Security) 2018 shed a lot of light on how expensive successful phishing attacks can be, with the FBI reporting in July well over $12B in financial losses due to

Most Israelis confident nation ready for major cyber-attack (The Jerusalem Post) Israelis are far more trusting than others that their country is safe from cyber-attacks, are they right?

Analysis | The Cybersecurity 202: Democrats are more concerned about election security than Republicans, survey finds (Washington Post) Cybersecurity’s a partisan topic now. Get used to it.

Marketplace

Parsons acquires geospatial intelligence provider OGSystems (C4ISRNET) OGSystems will bolster Parsons' intelligence and artificial intelligence offerings.

Hui Huliau Acquires AC4S (PR Newswire) Hui Huliau announced today the acquisition of Advanced C4 Solutions Inc. (AC4S), a leader in C4, professional...

Sophos snaps up cloud infrastructure specialist Avid Secure (ZDNet) The small company bounces between California and India.

Why FireEye Stock Dropped 19% in December -- The Motley Fool (The Motley Fool) A Wall Street firm sees limited upside for the cybersecurity company's shares.

Symantec Appoints Sue Barsamian To Its Board of Directors (AP NEWS) Symantec Corp. (NASDAQ: SYMC) today announced that its Board of Directors (the “Board”) appointed Sue Barsamian and Richard S. “Rick” Hill as members of the Board, effective January 7, 2019.

Check Point Taps VMware’s Frank Rauch to Lead Global Channels (Channelnomics) VMware, HP veteran to oversee worldwide channel sales for security vendor

Logikcull, Leader in Corporate Data Governance, Announces Appointment of Technology Executive Bill Welch to Board of Directors (PR Newswire) Amid rising scrutiny paid to corporate data governance, including legal discovery where the risks and costs are...

Products, Services, and Solutions

Respond Software and Norwich University Defend NCAA College Football Playoff Championship (PR Newswire) On Monday, January 7, 2019, the Clemson Tigers and Alabama Crimson Tide faced off for one of the largest...

Intelity Partners with Acuant to Further Streamline Guest Check-in and Mobile Key Delivery (Acuant) Intelity and Acuant partner to offer secure ID verification for hotels including mobile check-in remote identity check to streamline guest experience.

Hyatt launches public bug bounty program with HackerOne (Hyatt Newsroom) Adds an additional layer to Hyatt’s cyber security strategy

Microsoft spins off security, compliance bits from Microsoft 365's priciest plan for E3 customers (Computerworld) Microsoft is adding two new M365 add-on plans for corporate customers already subscribing to the Enterprise E3 version.

Microsoft Adding Office 365 Threat Auto-Investigation to GCC Offering (BleepingComputer) The auto-Investigation with threat playbooks feature was included in the roadmap in October and was now also added to Microsoft's future Office 365 Government GCC offering

A10 Networks Thunder® Convergent Firewall Selected for 5G Network Deployment by Major Japanese Mobile Carrier (BusinessWire) A10 Networks (NYSE: ATEN), a leading provider of intelligent and automated cybersecurity solutions, today announced a major Japanese mobile carrier ha

Graphus Integrates with Phishing Awareness Training Solutions (PRWeb) In the latest release of Graphus® they have implemented several new features and enhancements to their platform and one in particular that is very exciting is

Bromium Secure Browsing Isolates Intelligently and Maximizes Browser Choice (Security Boulevard) Web browsing is intensely personal, even at work. Users develop strong preferences, tend to lock in a browser early, and are fiercely loyal to their favored choice.

UNITED STATES : Looking Glass, Darkmatter's cyber-intelligence broker (Intelligence Online) The US cyber-security firm LookingGlass Cyber Solutions (LGC), which will be at the Gulf Information Security Expo and Conference (GISEC)

Rohde & Schwarz Unveils New DPI Features for vEPC (Fast Mode) ipoque, a Rohde & Schwarz company providing market-leading deep packet inspection (DPI) software, announced new R&S PACE 2 capabilities for the virtualized evolved packet core (vEPC) market.

Rackspace authorised to host Aussie government data (CRN Australia) Approved up to the unclassified level.

FireEye updates Email Security with new threat detection and evasion defenses (Help Net Security) FireEye Email Security enhancements include executive impersonation protection, URL protection, password-protected image analysis.

Gemalto helps simplify and secure IoT connectivity to the AT&T network with eSIM and IoT module (Help Net Security) Gemalto is helping simplify and secure IoT connectivity for AT&T customers by integrating its embedded SIM (eSIM) inside the Cinterion LTE-M IoT module.

Xerox enhances AltaLink Workplace Assistants (Help Net Security) New software enhancements to these Workplace Assistants, allow companies to monitor critical security settings and automatically reset unauthorized changes.

Polyverse announces technology partnership with Red Hat (Help Net Security) Polyverse’s Polymorphic Linux has been tested and certified for use on the platform, ensuring performance and compatibility for enterprise customers.

Deception for proactive defense (Help Net Security) This article is fourth in a five-part series being developed by Dr. Edward Amoroso in conjunction with the deception technology team from Attivo Networks.

Technologies, Techniques, and Standards

Countering Russian disinformation the Baltic nations' way (The Conversation) European countries, especially the Baltic states of Estonia, Latvia and Lithuania, have confronted Russian disinformation campaigns for decades. The US can learn from their experience.

What will it take to monitor and secure mobile military networks? (C4ISRNET) Soldiers in combat require immediate access to information, which requires a dependable and secure network. Army leaders must have a system in place that allows them to quickly address problems and bottlenecks as they occur.

SingHealth COI makes 16 recommendations to strengthen cyber defence (The New Paper) A senior manager at Integrated Health Information Systems (IHiS) did not report the cyber attack as he feared added pressure and more work. With no clarity on how such incidents should be reported, a junior staff member who discovered the breach left it to her direct...

Buyer Beware: Autonomous Security is a Myth (SC Media) Cybersecurity artificial intelligence (AI) needs to exist before it can save us. The excessive use of AI in marketing materials has left those looking for

Understanding how data becomes intelligence is central for any successful security program (Help Net Security) Threat intelligence is one of the hottest terms in information security at the moment. But, as with so many buzzwords, it is often overused and misused.

5 Key Features Your Security Risk Assessment Should Have (Panorays) Security risk assessments are critical for measuring supplier security posture, but they can be cumbersome and time-consuming. Here are top 5 features for an effective security risk assessment.

GDPR: Five tips for organizations to remain compliant (Help Net Security) For the majority of UK businesses, a huge amount of time and resource was invested to become GDPR compliant in time for the May 2018 deadline. The cost of

Research and Development

CyberX Receives U.S. Technology Patent for ICS Threat Monitoring Analytics (POWER Magazine) CyberX Receives U.S. Technology Patent for ICS Threat Monitoring Analytics

Academia

Cybersecurity a must in curriculum in increasingly digital classrooms (Education Dive) An ability to responsibly navigate online threats is as critical as grasping life skills taught in home economics — and educators must learn, too.

Legislation, Policy, and Regulation

Norway considering whether to exclude Huawei from building 5G network (Reuters) Norway is considering whether to join other western nations in excluding China...

Japan and India to discuss space and cyberspace at upgraded 'two-plus-two' security talks (The Japan Times) The two nations will aim to launch ministerial security talks early this year to deepen security cooperation, Foreign Minister Taro Kono said.

Senate Bill Demonstrates Continued Interest in the Federal Acquisition Supply Chain (JD Supra) For years, United States security agencies have recognized a threat to government information technology systems posed by contractor supply chains....

INSIDE THE RING: Foreign hacker threat grows for private sector (The Washington Times) The National Counterintelligence and Security Center this week launched a campaign to alert the public to growing threats posed by hackers from China, Russia and other foreign adversaries.

Shutdown delays TSA data-security efforts (FCW) The standoff over a controversial border wall is holding up activity on a planned overhaul of key transportation security systems.

Litigation, Investigation, and Law Enforcement

Kaspersky blew whistle on NSA hacking tool hoarder (Ars Technica) Kaspersky passed suspicious Twitter messages from Martin to US government.

Russian firm that was barred from U.S. networks as a spy threat helped NSA nab suspect in massive breach (Washington Post) Kaspersky Lab alerted the NSA it had received strange Twitter messages from an agency worker who was subsequently arrested.

Hal Martin's defense says prosecutors have yet to provide essential evidence (CyberScoop) Attorneys for Harold T. Martin III, the former U.S. National Security Agency contractor accused of perhaps the largest theft of government secrets in American history, said in a court filing that government prosecutors have not allowed access to evidence necessary to mount a sufficient defense.

Further Investigations Show Ties of China's Huawei To Iran (Forbes) A Reuters report says Huawei looks to have done business with Iran and Syria.

New documents link Huawei to suspected front companies in Iran, Syria (CNBC) U.S. authorities allege CFO Meng Wanzhou deceived international banks into clearing transactions with Iran by claiming the two companies were independent of Huawei, when in fact Huawei controlled them.

Canadians support Ottawa’s decision to arrest Huawei executive, poll shows (The Globe and Mail) Canada’s arrest of Meng Wanzhou has severely strained relations with Beijing, sparking angry demands for her to be returned home and the imprisonment of two Canadians

Chinese envoy accuses Canada of ‘white supremacy’ for demanding release of Canadians (The Globe and Mail) Canadian authorities arrested Meng Wanzhou in December at the request of the United States

Lieberman's ZTE Work Makes Him a Foreign Agent: Complaint (Bloomberg) Former Senator Joe Lieberman should register as a foreign agent for his work on behalf of embattled Chinese telecommunications company ZTE Corp., according to a complaint filed with the Justice Department today by the Campaign Legal Center.

Senators Call on FCC To Investigate T-Mobile, AT&T, and Sprint Selling Location Data to Bounty Hunters (Motherboard) After Motherboard’s article, Senators Kamala Harris, Mark Warner, and Ron Wyden are coming out against telcos who are selling their customers' location data.

For a complete running list of events, please visit the Event Tracker on the CyberWire website.

Newly Noted Events

PCI Security Standards Council 2019 India Forum (New Delhi, India, March 13, 2019) You’re invited to a day of networking opportunities and educational sessions as the PCI Security Standards Council holds its first ever India Forum in New Delhi, India. You won’t want to miss our engaging...

InfoSec World 2019 (Lake Buena Vista, Florida, USA, April 1 - 3, 2019) Cybersecurity has come a long way in 25 years, and InfoSec World has been there through it all. That's right, InfoSec World 2019 Conference & Expo is returning to Disney's Contemporary Resort on April...

2019 Industrial Control Systems (ICS) Cyber Security Conference (Singapore, April 16 - 18, 2019) As the largest and longest-running cyber security-focused conference for the industrial control systems sector, the event caters to the energy, utility, chemical, transportation, manufacturing, and other...

Upcoming Events

SINET Global Institute CISO Series (Scottsdale, Arizona, USA, January 15 - 16, 2019) By invitation only. These intimate CISO workshops address the challenges that Board of Directors are placing on security and risk executives, and how to successfully manage and communicate today’s enterprise...

CPX Asia 360 2019 (Bangkok, Thailand, January 21 - 23, 2019) CPX 360 - the industry’s premier cyber security summit and expo - brings together the world’s leading cyber security experts to one venue. Gain a deep understanding of current challenges cyber security...

CPX Americas 360 2019 (Las Vegas, Nevada, USA, February 4 - 6, 2019) CPX 360 promises to be the premier cyber security summit. CPX 360 is where you’ll receive up-to-the-minute intelligence about global threats and other vital topics from the world’s leading cyber security...

QuBit Conference Belgrade 2019 (Belgrade, Romania, February 7, 2019) QuBit is a Cybersecurity Community Event connecting the East and West. We create a unique way to meet the best and the brightest minds in the information security fields across multiple industries, and...

NITSIG Meeting: Insider Threat Detection & Mitigation Using External Data Sources (Laurel, Maryland, USA, February 12, 2019) Gathering and analyzing Internal data sources is very important for Insider Threat Detection. Equally important is knowing what External data sources are also available to create the "Big Picture" of potential...

Grow your brand and reach new customers.

Grow your brand and increase your customer base by educating our audience about your products, services, and events by advertising on The CyberWire. We’ve built trust with an influential (and often hard to reach) audience of CISOs, CSOs, and other senior execs in the security space, across a wide array of industry verticals. Learn more.

Be a part of the CyberWire story.

People ask us (a lot) how they can support what we do. We have our sponsorships and services, of course, but those are not always within every supporter's financial reach, or it might just not be the right time for you to do those things. That's why we launched our new Patreon site, where we've created a wider variety of support levels, each with some new benefits. Our patrons are important to our future, and we hope you'll consider becoming one. We invite you to become part of the CyberWire story. Become a patron today.