Cyber Attacks, Threats, and Vulnerabilities
Cybersecurity strikers target G20: Symantec (Scoop) Symantec has warned the upcoming G20 Summit is an attractive target for the 'Flea attack group' — malicious cybersecurity strikers
Chinese hackers 'breach Australian media organisations' ahead of G20 (Australian Broadcasting Corporation) A Chinese hacking group believed to be affiliated with the Chinese government has penetrated Australian media organisations ahead of this weekend's G20 meeting, a global cyber security expert says
Hackers target pro-Tibet G20 protesters (The Age) Cyber criminals have targeted G20 protesters through a malicious email that hacks into a recipient's computer camera and uses it to spy on the owner
NOAA weather data interruption due to alleged Chinese cyber attack (Ars Technica) NOAA shut down access to systems but failed to report intrusion for a month
Reports: State Department admits intrusion into unclassified email (IDG via CSO) The U.S. State Department's unclassified email system was taken offline over the weekend for security improvements, a scheduled event, but officials conceded suspicious activity had been previously detected, according to media reports
Evidence implicates government-backed hackers in Tor malware attacks (Guardian) OnionDuke malware linked to MiniDuke hacker tools, which are thought to have been used to target Nato and European governments
81 percent of Tor clients can be identified with traffic analysis attack (Security Affairs) The research revealed that more than 81 percent of Tor clients can be de-anonymized by exploiting a new traffic analysis attack based on Netflow technology
Hacker group Anonymous threatens to target Israeli websites (Israel Hayom) Intended cyber attack on banking and defense sites is touted as Anonymous' answer to "the ongoing Israeli attacks on the Al-Aqsa mosque." Security expert: These types of threats are frequently made and in most cases the damage is minor
Anonymous targets Ku Klux Klan during latest operation (CSO) After the Ku Klux Klan (KKK) promised to use lethal force against protestors in Ferguson, Mo., supporters of Anonymous launched OpKKK. On Sunday, the faceless, loosely associative collective hijacked two KKK Twitter accounts, and used DDoS to disable several KKK-related websites
Fake Viber Spam Changes Routines Based on Platform (TrendLabs Security Intelligence Blog) Earlier this week, we noticed that there was a spike in the volume of spammed messages that pretend to come from the messaging service Viber. This app, which also has a desktop version, allows users for free calls and messages. The email informs the recipient that they have one voice message for their account
New Encryption Ransomware Offers File Decryption Trial (Softpedia) Cybercriminals have adapted their ransomware game to a more user-friendly variant of crypto-malware to get the victims pay the unlock fee and even included a trial for the file decryption feature
Trojan Rovnix Infects More Than 130K UK PCs, Finds BitDefender (Spamfighter News) BitDefender has cautioned that more than 130K PCs inside United Kingdom are tainted because of Trojan Rovnix, the info-grabbing malware, within one botnet operation particularly victimizing high-profile entities across the country
'Bashlite' Malware Leverages ShellShock In BusyBox Attack (Dark Reading) A new version of Bashlite aims to get control of devices running on BusyBox, such as routers
A fresh C93 phishing Scam targeting Microsoft's Windows Outlook Users (Security Affairs) Scammers have unleashed a C93 virus scare, targeted at Microsoft's Windows outlook users in a wide phishing campaign aimed at stealing users' login credentials. The scam is similar to earlier phishing campaign targeted at Hotmail users raising suspicions that the same fraudsters could be involved
US Govt. warns Apple iOS Users over "Masque Attack" (The Next Digit) The US Computer Emergency Readiness Team has warned the Apple users about the Masque attack, which is a new bug that enables the hackers to steal important info from iPhones and iPads. If you are very curious about the "Masque Attack," watch the video posted at the end of this post
This is Apple's response to the 'Masque Attack' malware vulnerability (HITC Tech) Apple has issued a response to recent reports that iOS 8 is susceptible to malware attacks. After multiple reports this week discovered malicious software attacks could steal important data from the devices of iOS 8 users, Apple has issued a reply claiming they are unaware of any customers currently affected by the attack
Let the right one in: Apple uses two doors to manage malware (MacWorld) Two recent security incidents, WireLurker and Masque Attack, highlight both the ease and difficulty of slipping malware onto iOS. But they also show the way in which Apple may have infantilized its audience into not knowing the right choice to make when presented with a genuine security flaw
Exploitation of Philips Smart TV (fred's notes) My Philips Smart TV is a Linux box standing there in my living room : that's a sufficient reason to try to get root
Default ATM passcodes still exploited by crooks (Help Net Security) Once again, ATMs have been "hacked" by individuals taking advantage of default, factory-set passcodes
Hacking the Ayatollahs (Wall Street Journal) The Stuxnet virus opened and closed valves on Iranian centrifuges and adjusted their power supply as false readings were fed to operators
Security Patches, Mitigations, and Software Updates
Microsoft Updates MS14-066 (Internet Storm Center) Microsoft updated MS14-066 to warn users about some problems caused by the additional ciphers added with the update. It appears that clients who may not support these ciphers may fail to connect at all. The "quick fix" is to remove the ciphers by editing the respective registry entry (see the KB article link below for more details)
Issues Arise With MS14-066 Schannel Patch (Threatpost) Some users who have installed the MS14-066 patch that fixes a vulnerability in the Schannel technology in Windows are having issues with the fix causing TLS negotiations to fail in some circumstances
HP Ramps Up Mobile Payments Reach (TechWeek Europe) HP has announced a major expansion to its mobile payments capacity as it looks to improve the safety and security of transactions made using mobile devices
Mastercard and Visa to kill off password authentication (Register) Mastercard and Visa are removing the need for users to enter their passwords for identity confirmation as part of a revamp of the existing (oft-criticised) 3-D Secure scheme
Cyber Trends
The top infosec issues of 2014 (CSO) Security experts spot the trends of the year almost past
Privacy is the new killer app (Computerworld) You can't just be good. You have to be secure
3 emerging threats to healthcare privacy and security (FierceHealthIT) New risks have upped the ante for HIPAA security and privacy officers and increased fines have many on edge. Particularly in the aftermath of the Community Health Systems (CHS) breach, which put 4.5 million patient records at risk across 29 states and 206 hospitals, last year's risk assessments look woefully inadequate for many healthcare systems and practices. What's worrying privacy and security officers this year?
Trend Micro: Hackers will increasingly target online banks (The Star) Online banks will become a big target for hackers and the number of attacks are expected to increase next year, according to security company Trend Micro
Survey shows Android attack trends (IT Online) According to the results of the Mobile CyberThreat survey carried out by Kaspersky Lab and Interpol between August 2013 and July 2014, malicious programs targeting Android-based devices in order to steal their owners' money were used in 60% of attacks registered by Kaspersky Lab security products
STUDY: Average Fortune 100 Brand Has 320 Social Media Accounts (AllFacebook) The average Fortune 100 brand has 320 social media accounts, up 80 percent over the past three years, according to a new study from security-as-a-service provider Proofpoint
Majority of Firms Would Hire Ex-Cons as Cyber-Security Pros (Infosecurity Magazine) Over half of senior IT and HR professionals would consider hiring former hackers in a bid to overcome crippling cyber-security skills gaps and shortages, according to new research from consultancy KPMG
A third of Indian companies vulnerable to cyber attacks: Report (Economic Times) Nearly a third of Indian organisations do not possess the knowledge to prevent cyber attacks even as the information technology world is turning increasingly vulnerable, a recent study has found
Marketplace
FireEye CEO: More Firms Looking to Cybersecurity Vendor for Operational Guidance (Wall Street Journal) Companies now reach out to the Silicon Valley security firm for a number of operational issues too, such as whether they have proper liability insurance for directors and officers, or if board members have an appropriate level of cybersecurity experience
Companies spending more on cybersecurity (FierceCFO) Survey shows nearly three quarters of companies are spending more to prevent or mitigate cyberattacks
Will cloud, security hires break the bank in 2015? (FierceCIO) Big data and data analytics have been grabbing much of the headlines this year for top IT job demand. But CIOs are being warned to brace for an extremely competitive market for IT security professionals and virtually any cloud-related jobs in 2015, both of which should push salaries up significantly
Security testing market grow at CAGR of 14.9% to reach $4.96 billion by 2019 (WhaTech) Security testing refers to a set of activities performed to locate and isolate the flaws in the security mechanisms of a software or application to ensure data protection and functionality as intended
KPMG Acquires German Cyber Security Firm (TechWeek Europe) KPMG has completed the acquisition of P3, a privately-owned German cyber-security firm that provides risk management, security assessments, and mobile and fixed network protection to clients across the financial services sector
CyberArk Software shares spike after company beats Q3 revenue, earnings estimates (Boston Business Journal) Shares of CyberArk Software (Nasdaq: CYBR), a Newton-based firm providing IT security from internal threats, were up 18 percent Thursday after the company reported strong-than-expected earnings and revenue for the third quarter
ThetaRay turns to math to detect cyber threats (Haaretz) Israeli start-up aims to provide early detection of threats, enable shutdown of systems before damage can be done
SurfWatch Labs Acquires Cyber Risk Management Technology to Complement its Portfolio of Risk Intelligence Solutions (PRWeb) As part of the acquisition, former Washington Metropolitan Area Transit Authority (WMATA) Chief Information Security Officer, Adam Meyer, joins SurfWatch as Chief Security Strategist
Cyber firm RedOwl Analytics is opening a San Francisco office (Baltimore Business Journal) Baltimore startup RedOwl Analytics is expanding to San Francisco and has hired a new chief operating officer to head up its West Coast business
Canadian security firm expands as cloud demand grows (Computer Dealer News) A Toronto-based data protection company has opened a new office just outside the city as it expands operations to deal with the growing demand for cloud security solutions. Perspecsys Inc., said it new office in Mississauga, Ont. will house a growing team of engineers, sales, product and marketing personnel that will bring its AppProtex Cloud Data Protection Gateway to market
Adobe expands use of Splunk Enterprise (ARN) Adopts Splunk software and Cloud services
Shape Security Appoints Cisco Chief Security Officer John Stewart to Board of Directors (Marketwired) Tech pioneer brings over two decades of expertise in cybersecurity; will support shape in its mission to secure the web
Products, Services, and Solutions
2014 Information Security Readers' Choice Winners (TechTarget) We asked readers to pick the best security products in 22 categories. Find out which products earned top honors in our 2014 Readers' Choice Awards
Android, Windows Phone Withstand Pwn2Own Onslaught (Infosecurity Magazine) Despite headlines about rampant mobile insecurity, both Google Android and Windows Phone have withstood a cyber-battering in the 2014 Mobile Pwn2Own competition
BlackBerry Unveils New Enterprise Security, Mobility Solutions (SecurityWeek) Smartphone maker BlackBerry announced several new offerings targeted to its enterprise customers this week, in order to help organizations securely connect employees and help them access the corporate information and systems required to get their jobs done
New RSA Solution Takes Customers from Hunted to Hunter (Providence Journal) When I meet with customers, I'm always intrigued by how they perceive their organization's cyber risk relative to their security program's maturity. These conversations are invaluable in guiding the development of our product strategy
Cybersecurity Startup Reviews 'App's DNA' to Help CIOs Identify Mobile Malware (CIO Journal) A rise in threats targeting mobile devices, coupled with the fact that people can pick up malware in coffee shops and other connected places, has made managing mobile security more complicated for CIOs. The danger was underscored with the recent discovery of two Apple Inc. iOS vulnerabilities triggered by mobile malware, "Masque Attack" and "Wire Lurker," aimed at iPhones and iPads. New cloud software from startup Lookout Inc. combines machine learning and contextual analytics to protect mobile devices from malicious applications
Sonatype aims to help developers reduce risk from open-source components (PCWorld) Software developers use a large number of open-source components, often oblivious to the security risks they introduce or the vulnerabilities that are later discovered in them
Pompem — Exploit Finder Script & Web Version (Kitploit) Pompem is an open source tool, which is designed to automate the search for exploits in major databases. Developed in Python, has a system of advanced search, thus facilitating the work of pentesters and ethical hackers. In its current version, performs searches in databases
Parrot Security OS - Friendly OS designed for Pentesting, Computer Forensic, Reverse engineering, Hacking, Cloud pentesting, Privacy/Anonimity and Cryptography (Kitploit) Parrot is designed for everyone, from the Pro pentester to the newbie, because it provides the most professional tools combined in a easy to use, fast and lightweight pentesting environment, and it can be used also for an everyday use
Technologies, Techniques, and Standards
Is cyber insurance your last line of defense? (Beta News) The recent spate of payment card breaches that have plagued the retail industry this year has prompted many merchants to consider investing in cybersecurity liability insurance policies to offset the costs associated with a breach recovery. These companies often make this choice based on the belief that the money they've spent to comply with industry security standards has failed to prevent these breaches from occurring, and there seems to be no other alternative. At least one recently filed claim has led to a lawsuit that will put these cybersecurity insurance policies to the test
Cyber-Insurance Now a Necessity (Valley News) More than 3,000 American businesses were hacked last year, many of them small and midsize firms that are often less protected than their multinational counterparts, according to the Center for Strategic and International Studies
After this judge's ruling, do you finally see value in passwords? (CSO) Judge rules authorities can use your fingerprint to unlock your smartphone. What that means for authentication and the future of passwords
Design and Innovation
Carmakers promise they'll protect driver privacy — really (Computerworld) Drivers won't be spammed with ads — unless they agree to it
Research and Development
IBM patents privacy engine for cross-border data sharing (ZDNet) Big Blue says the engine will eventually enable businesses to aggregate international requirements for data transfers and flag any cross-border privacy issues
Socom leaders interested in cloaking technology (Tampa Tribune) In its never-ending search for ways to give commandos an edge in combat, U.S. Special Operations Command is looking to take a page out of the Harry Potter playbook
Academia
Nonprofit Effort Provides Training Programs for Veterans (SIGNAL) Last year, Kade Wolfley held a federal job as an electrician that gave him such little satisfaction he opted to quit and test his luck on an intriguing training program that took him away from his family for 11 weeks and offered no guarantee of employment
Students to Learn Cybersafety With New Program (SIGNAL) National Educator Sweepstakes offers chance for students, parents and educators to win $10,000 grant for their school
Team heads to cyber war competition (Pekin Daily Times) Twelve members of the Limestone Community High School Air Force JROTC invaded Advanced Medical Transport's Peoria headquarters Friday for cyber war games
Changed guidelines lead to more firsts for cybersecurity (Pacific.Scoop) A Vanuatu student has contributed to the ever-increasing list of firsts being achieved by the University of Waikatos cyber security programme. Jeff Garae initially came to the University in 2013 as part of the Ministry of Foreign Affairs and Trade (MFAT)
Legislation, Policy, and Regulation
NATO helps Jordan fend off ISIL cyber threat (NATO/OTAN) Over recent years, cyber attacks have targeted key national security installations in countries around the world, from Estonia's banking system to South Korea's media network. To help counter this growing threat, NATO has been strengthening the cyber defence capabilities of both its member countries and its partners
Russia launches alternative to financial data network Swift after UK proposes ban (ComputerWeekly) Russia is to set up an alternative to the Society for Worldwide Interbank Financial Telecommunication (Swift) to reduce the threat of sanctions on its business from western governments
Why cyber took a back seat in Beijing (FCW) In advance of President Barack Obama's Nov. 11 meeting with Chinese President Xi Jinping, Deputy National Security Adviser Ben Rhodes implied that Obama would be blunt with Xi on what the U.S. sees as China's transgressions in cyberspace, and also try to revive a bilateral working group on the issue. Obama may well have pushed for a breakthrough on cybersecurity in his five-hour meeting with Xi, but one was not forthcoming
Cyber bill's fate hinges on NSA reform (The Hill) The upcoming Senate vote on a bill to reform the National Security Agency (NSA) could make or break legislation on sharing cyber threat information in the lame duck
Cyber bills caught up in turf spat (The Hill) A House jurisdictional fight is holding up cyber legislation, said House Homeland Security Chairman Michael McCaul (R-Texas) in an interview
Facebook, Google and Apple lobby for curb to NSA surveillance (Guardian) A coalition of the biggest names in consumer technology have backed a US bill that would limit surveillance and prevent bulk email collection
U.S. Gov Insists It Doesn't Stockpile Zero-Day Exploits to Hack Enemies (Wired) For years the government has refused to talk about or even acknowledge its secret use of zero-day software vulnerabilities to hack into the computers of adversaries and criminal suspects. This year, however, the Obama administration finally acknowledged in a roundabout way what everyone already knew — that the National Security Agency and law enforcement agencies sometimes keep information about software vulnerabilities secret so the government can exploit them for purposes of surveillance and sabotage
Industry-Government Partnerships Critical To Resiliency Of US Electric Power Grid (HS Today) With the nation's dependence on the electric power grid for support across a number of critical infrastructure sectors — including oil and natural gas, water, transportation, telecommunications and financial sectors — it is becoming increasingly important for government and industry to partner together to strengthen and enhance the resiliency of the US electric power grid
RI Dem: Cybersecurity education should be top priority (The Hill) Cybersecurity education should be policymakers' first priority, a key House Democrat told an industry conference Thursday
Litigation, Investigation, and Law Enforcement
Suspects Tied to WireLurker Malware Arrested in China (Softpedia) The Beijing Municipal Public Security Bureau has arrested three individuals for involvement in the creation and distribution of WireLurker malware that compromises iOS devices and made hundreds of thousands of victims in China
Investigating Federal cyber crime (and why indictments matter) (The CyberWire) Back in December of 2012 at a cyber community event in Baltimore, Special Agent Mularski described his experience breaking up organized cyber criminal gangs. This interview gives us a chance to catch up with him about recent developments in cyber law enforcement
Scotland Yard wages war on 200 cyber crime gangs in London (Standard) Scotland Yard is battling more than 200 organised crime groups engaged in cyber fraud in London, police revealed today
Judges impose rare, stricter requirement for "stingray" use by police (Ars Technica) Washington judges: Locals cops must not collect data from innocent people
DOJ admits its lawyer misled appeals court during oral argument (Ars Technica) Attorney said companies can complain about their NSLs. In reality, they can't
'Microsoft Partner' Claims Fuel Support Scams (KrebsOnSecurity) You can't make this stuff up: A tech support company based in the United States that outsources its work to India says its brand is being unfairly maligned by — wait for it… tech support scammers based in India. In an added twist, the U.S.-based tech support firm acknowledges that the trouble may be related to its admittedly false statements about being a Microsoft Certified Partner — the same false statements made by most telephone-based tech support scams
In Federal crackdown, ex-cop indicted for coaching to beat polygraphs (McClatchy via the Biloxi-Gulfport Sun-Herald) A former Oklahoma City police officer has been indicted on charges of training people to lie about crimes during polygraph tests as part of the Obama administration's unprecedented crackdown on security violators and leakers
