Cybersecurity Fabric: The Future of Advanced Threat Response
Today, it is not enough to protect your assets by collecting high quality threat intelligence – organizations need inline detection & mitigation at line-speed to protect themselves from incoming or existing threats on the network. As cyber strategy shifts towards a “Zero Trust” model, your organization needs to ensure that every device, user, workload, or system is being monitored with a Cybersecurity Fabric. Join LookingGlass for our upcoming webinar October 2, 2pm EST to learn more.
September 3, 2019.
By the CyberWire staff
A report in Yahoo News offers details on the Stuxnet attack against Iran’s Natanz uranium enrichment plant. The US CIA and Israel’s Mossad are said to have approached the Netherlands intelligence service AIVD, which had an asset close to Iran’s nuclear program. According to the story that asset (described as a “mole” with training as an engineer) was able over a protracted period of time to deliver the Stuxnet attack code via USB to the air-gapped centrifuge controllers at Natanz.
Reports last week originating with Google’s Project Zero that detailed watering-hole attacks against iOS devices were amplified over the weekend. Forbes reports that the attacks also affected Android and Windows systems. There was speculation at the time of the initial reports that the attacks, while relatively indiscriminate, were intended to target specific groups. It now appears, according to TechCrunch, that the attackers were Chinese security services, and the targets were China’s Uyghur minority.
As unrest continues in Hong Kong and Beijing's reaction continues to escalate, Bloomberg and others report that Hong Kong protest organizers say that the Chinese government has mounted distributed denial-of-service attacks against the principal forum, LIHKG, the protestors have used to coordinate their actions.
Eclypsium has disclosed a family of authentication vulnerabilities it discovered in Supermicro X9-X11 servers’ baseboard management controllers. Eclypsium calls the vulnerabilities “USBAnywhere.” Their exploitation could enable a range of USB-based attacks.
Twitter CEO Jack Dorsey's Twitter account was hijacked Friday afternoon to display racist messages. The Verge says the "Chuckle Squad" claimed responsibility.
Today's issue includes events affecting Australia, Brazil, Canada, China, France, Iran, Israel, Malaysia, Netherlands, Poland, Russia, United Kingdom, United States.
Bring your own context.
Biometrics are attractive as modes of identification, but the storage of biometric information in databases is thought by some to be problematic.
"So you and I can survive the loss of our credit cards, the loss of the Social Security number, we lost a few, but in the end, we're bitching about getting our credential back on ship, and we move on. If you lose your biometric now and in the future of the IOT, your loss is perpetual because if you lose your face or your finger imprint, there is no way this side of the galaxy that you can get a new face or new fingers. So databases are a no-go, for example."
—Martin Zizi, founder and CEO of Aerendir Mobile, on the CyberWire Daily Podcast, 8.29.19.
And cosmetic surgery probably isn't a realistic recovery option.
Conduct secure and anonymous research on the open and dark web.
If you are doing online research, the common web browser can betray you by exposing you and your organization to cyber attacks. Authentic8, the maker of Silo Cloud Browser and Silo Research Toolbox, ends this betrayal. Silo insulates and isolates all web data and code execution from user endpoints, providing powerful, proactive security even if you are gathering data and collections across the deep and dark web. Learn more.
10th Annual Billington CyberSecurity Summit(Washington, DC, United States, September 4 - 5, 2019) The event will be an important Call to Action for the cybersecurity community and is the deepest examination of the cybersecurity and government at the local, state, Federal and International levels found anywhere.
Second Annual DataTribe Challenge(Online, October 1, 2019) Register now for a chance to be DataTribe's next world-class company. Finalists will split a $20,000 prize, and the winner may receive $2m in funding from DataTribe. Contestants have until October 1st to apply at www.datatribe.com/challenge.
Zero Day Con(Washington, DC, USA, October 22, 2019) Zero Day Con hosts a day of expert discussion on security approaches to regain control over your systems, data, and information. Join us to examine insights, security technologies, and key priorities to secure your systems. Get a 30% discount for Labor Day using code LABOR30.
Sources say China used iPhone hacks to target Uyghur Muslims(TechCrunch) A number of malicious websites used to hack into iPhones over a two-year period were targeting Uyghur Muslims, TechCrunch has learned. Sources familiar with the matter said the websites were part of a state-backed attack — likely China — designed to target the Uyghur community in the country’…
Foxit Software Breach Exposes Account Data(BankInfo Security) Foxit Software, the developer of popular PDF and document software, says user accounts were compromised in a breach. The company, which has 560 million users, isn't
Fraudsters Used AI to Mimic CEO’s Voice in Unusual Cybercrime Case(Wall Street Journal) Criminals used artificial intelligence-based software to impersonate a chief executive’s voice and demand a fraudulent transfer of funds in March in what cybercrime experts described as an unusual case of artificial intelligence being used in hacking.
Vulnerability Summary for the Week of August 26, 2019(CISA) The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.
7 Questions to Ask Your Child’s School About Cybersecurity Protocols(McAfee Blogs) Just a few weeks into the new school year and, already, reports of malicious cyberattacks in schools have hit the headlines. While you've made digital Just a few weeks into the school year and already school cybersecurity is a hot topic. With a number of fraud and ransomware cases making headlines, should you be concerned about . your child's data being compromised at school? You may want to ask school leaders these questions.
Nine in 10 parents have not installed cybersecurity on child’s digital device(Education Technology) Children are more vulnerable to cybercriminals because of their personal digital devices, cybersecurity experts have warned. A survey by security firm Kaspersky found that only 13% of parents have installed online security software to the phone, laptop or tablet used by the child. The survey also found that 87% of parents don’t limit the amount …
Don’t turn this whistleblower into a saint(Times) A new heroine of the people has burst into celluloid existence as a fresh focus for cosily predictable outrage. Katharine Gun was a GCHQ translator who, in 2003, leaked classified information about...
For a complete running list of events, please visit the Event Tracker on the CyberWire website.
9th Annual Peak Cyber Symposium(Colorado Springs, Colorado, USA, September 3 - 5, 2019) The Peak Cyber Symposium is designed to further educate Cybersecurity, Information Management, Information Technology and Communications Professionals by providing a platform to explore some of today's...
9th Annual Peak Cyber Symposium(Colorado Springs, Colorado, USA, September 3 - 5, 2019) The Information Systems Security Association (ISSA) - Colorado Springs Chapter will once again host the 9th Annual Peak Cyber Symposium. This year's theme is "Cyber Hygiene: Everyday for Everyone." The...
10th Annual Billington CyberSecurity Summit(Washington, DC, USA, September 4 - 5, 2019) This year's theme is, "Reinventing Cybersecurity: Addressing Tomorrow's Top Cyber Challenges." The summit has become the world's leading summit on government cybersecurity. It will convene again U.S. and...
2019 Intelligence and National Security Summit(National Harbor, Maryland, USA, September 4 - 5, 2019) The Intelligence & National Security Summit, powered by AFCEA International and the Intelligence and National Security Alliance (INSA), is the premier forum for unclassified dialogue between U.S. Government...
Derbycon 2019(Louisville, Kentucky, USA, September 4 - 8, 2019) DerbyCon isn’t just another security conference. We’ve taken the best elements from all the conferences we’ve ever been to and put them into one. DerbyCon is a place you can call home, where you can meet...
SPONSOR & SUPPORT
Grow your brand and reach new customers.
Grow your brand and increase your customer base by educating our audience about your products, services, and events by advertising on The CyberWire. We’ve built trust with an influential (and often hard to reach) audience of CISOs, CSOs, and other senior execs in the security space, across a wide array of industry verticals. Learn more.
Be a part of the CyberWire story.
People ask us (a lot) how they can support what we do. We have our sponsorships and services, of course, but those are not always within every supporter's financial reach, or it might just not be the right time for you to do those things. That's why we launched our new Patreon site, where we've created a wider variety of support levels, each with some new benefits. Our patrons are important to our future, and we hope you'll consider becoming one. We invite you to become part of the CyberWire story. Become a patron today.