Washington, DC: the latest from the Intelligence and National Security Summit
Real-World Punch More Effective Than Cyber Punch (SIGNAL Magazine) A cyber strike may not be the most effective deterrent against adversaries, White House adviser Tom Bossert said at INSS.
Trump Administration Looking to 'Real World' Measures Against Cyber Enemies (VOA) Trump homeland security adviser notes 'little reason to believe' an offensive cyberattack is going to deter adversaries
Homeland security adviser: Focus on mission function (C4ISRNET) Speaking Wednesday at the INSA Intelligence and National Security Summit in Washington, Tom Bossert suggested an approach to intel that takes into consideration changes in the way threats proliferate and information is shared.
Trump Homeland Security Advisor: Do We Really Need a Russia Desk? (Foreign Policy) Tom Bossert wants spies to team up to focus on cybersecurity and other functional topics.
NBIB confirms 700,000 security clearance backlog (FCW) The National Background Investigations Bureau is trying to whittle down its massive security clearance backlog, while streamlining and updating its background investigation process.
Individual Growth Key to Military Might (SIGNAL Magazine) The military services offer warfighters extensive professional development; unfortunately, many fail to explore all options.
Cyber Attacks, Threats, and Vulnerabilities
Sabotage Warning Issued on Hackers Hiding Deep Inside Energy Sector (BleepingComputer) US cyber-security firm Symantec has issued a warning today against a group of nation-state hackers that have managed to infiltrate several US and European energy firms, and are now in the dangerous position of sabotaging critical infrastructure if they wished to.
Critical Infrastructure Compromised: New Cyber Attacks Hit Energy Companies in U.S., Turkey, Switzerland (eSecurity Planet) The Dragonfly group now appears to be focused on compromising operational networks.
Someone has been hacking into US power stations (The Verge) An unknown nation state targeted more than 20 utilities since 2015
Hackers infiltrate systems of energy companies (Financial Times) Dragonfly has ability to sabotage computer networks in US and Turkey, warns Symantec.
Dragonfly hackers gained operational access to European, US power companies (Help Net Security) The Dragonfly hacking group is back and is still interested in penetrating the networks of European and US companies in the energy sector.
Security firms pour on evidence of Chinese hacking against Vietnam (Cyberscoop) A hacking group with suspected ties to the Chinese government is engaged in an ongoing and expansive cyber-espionage operation against Vietnamese organizations, according to three different cybersecurity firms.
Facebook uncovers 'Russian-funded' misinformation campaign (BBC News) It said the adverts spread divisive messages about race, immigration and equal rights.
Thousands of Political Ads on Facebook Tied to Bogus Russian Accounts (WIRED) Social network says it found $150,000 in political ads from 'inauthentic accounts' and Pages from Russia between 2015 and May 2017
US officials in Afghanistan apologize for 'highly offensive' leaflets (Military Times) U.S. officials in Afghanistan have issued an apology after dropping leaflets that are deemed to be offensive to Muslims.
Multiple Vulnerabilities Found in NVIDIA, Qualcomm and Huawei’s Bootloaders (Threatpost) Researchers find six previously-unknown memory corruption and unlock-bypass vulnerabilities in major chipset vendors' firmware code.
Apache Struts “serialisation” vulnerability – what you need to know (Naked Security) A bug in Apache Struts, a popular software toolkit for building web services, could let crooks take control of your server.
Fake Chrome & Firefox Font Update Drops RAT and Locky Ransomware (HackRead) Google Chrome with 2 billion active users is the most used web browser in the world. At the same time, Firefox has over 1 billion active users making these
CodeFork Group Uses Fileless Malware to Deploy Monero Miners (BleepingComputer) A group of experienced hackers — tracked under the name of CodeFork — have launched a new malware distribution campaign that uses advanced tools and new techniques to go undetected by security solutions.
IDN Homograph Attack Spreading Betabot Backdoor (Threatpost) An IDN homograph attack leveraging Adobe’s brand has been discovered, with the malicious site spreading the Betabot backdoor
DolphinAttack: Voice Assistant Apps Siri and Alexa Can Be Hacked (HackRead) Mainstream Voice Assistants Including Siri and Alexa Plagued with Serious Vulnerability. Voice assistant apps are not as reliable as we deemed them to be.
How hackers could send secret commands to speech recognition systems with ultrasound (The State of Security) Chinese security researchers have discovered a way to send secret, inaudible commands to speech recognition systems using ultrasound.
Phishing Alert: Police Warn UK Students of Loans Company Scam (Infosecurity Magazine) Phishing Alert: Police Warn UK Students of Loans Company Scam. Identity theft campaign designed to coincide with start of academic year
Why some gift cards are still a gift to hackers (Naked Security) Even when warned about how easy their cards were to beat, some vendors failed to take any steps to prevent it
DDoS explained: How denial of service attacks are evolving (CSO Online) A distributed denial of service (DDoS) attack is when attackers attempt to make it impossible for a service to be delivered, typically by drowning a system with requests for data. They have been part of the criminal toolbox for twenty years, and are only growing more prevalent and stronger.
The hidden history of cyber-crime forums (BBC News) Why modern cyber-crime forums were inspired by a site started by Ukrainian credit card thieves.
Security Patches, Mitigations, and Software Updates
13 Critical Remote Code Execution Bugs Fixed in September Android Update (Threatpost) Google fixed 81 vulnerabilities, including 13 critical remote code execution bugs, in the September edition of its Android Security Bulletin on Tuesday.
Tor Project Brings Security Slider Feature to Android App Orfox (Threatpost) Tor Project developers recently bolstered Orfox, a Tor Browser for Android devices, to help privacy-conscious mobile browsers better customize their security.
Sensitive Data at Risk: The SANS 2017 Data Protection Survey (SANS Institute) Ransomware, insider threat and denial of service are considered the top threats to sensitive data by respondents to the 2017 SANS Data Protection Survey. While the majority of respondents indicate they escaped actual compromise of sensitive data, enough respondents did lose sensitive data to provide valuable lessons from these events.
Are you protecting payment card data well enough? (Verizon 2017 Payment Security Report) Your payment security might be compliant for the assessment, but how long will it stay that way?
Emerging threats fuel public threat intelligence sharing (Help Net Security) This changing threat landscape has fueled a significant increase in the public sharing of threat intelligence over the past two years.
Ransomware & Threat Intel in Las Vegas (AlienVault) It was somewhere near Mandalay Bay that the keynote began. Alex Stamos, Chief Security Officer at Facebook, walked onto the stage for the opening of the 20th annual Black Hat security conference in Las Vegas.
Latest Phishing Trends Report Reveals 90% of IT Executives Worry Most About Email-Related Threats (PhishMe) Findings show that despite having layers of security technologies in place, phishing remains top concern for IT executives.
Survey: 81% of Infosec Pros Say Required Job Skills Have Changed amid Skills Gap (Tripwire: the State of Security) The digital security skills gap poses a challenge to organizations and their defense strategies in every economic sector.
Former FBI Cyber Agent Jason Truppi Talks Government, Private Sector Security (International Business Times) Jason Truppi, a former FBI agent turned tech entrepreneur, talks about the impact the government and private sector have on one another when it comes to security.
New America Chair Says Google Didn't Prompt Critic's Ouster (WIRED) In letter to staff, co-chair Jonathan Soros says attack on foundation was 'result of a targeted communications campaign'
Hopkins tech startup acquired by Annapolis Junction cyber firm (Baltimore Business Journal) Sunayu, a cyber firm based in Annapolis Junction, has acquired Johns Hopkins startup Fractal Technology and is bringing on founders J.R. Charles and Alex Sharata.
ForgeRock Raises $88 Million Ahead of Planned IPO (Fortune) ForgeRock, a San Francisco-based cybersecurity firm that manages people's digital identities, has raised $88 million in funding. The company plans to use the capital to scale its operation ahead of an initial public offering slated for early 2019, CEO Mike Ellis tells Fortune.
Hillhouse Capital Leads $18M Series B Round In Security Threat Intelligence Platform ThreatBook (China Money Network) Hong Kong-based Hillhouse Capital Group, a US$30 billion-under-management Chinese investment firm, has led a RMB120 million (US$18.4 million) series B round of financing in ThreatBook, a security data company that provides security threat intelligence solutions to enterprises in China.
VMware wants security industry to shrink so its ambitions fit into market (Register) Virtzilla's swagger is back as it plans to do to the security industry what it once did to storage industry
IBM Partnership With VMware to Be a Game Changer for Cloud Security (Security Intelligence) At last week’s 2017 VMworld event, IBM Security General Manager Marc van Zadelhoff joined VMware CEO Pat Gelsinger on the main stage to announce a partnership aimed at bridging the gap between IT operations and security teams to respond faster and more effectively to security breaches.
Two Cybersecurity Stocks Most at Risk (null) Palo Alto Networks and Fortinet could suffer as spending is distributed away from the corporate network.
Time to Get Greedy With Check Point Software Technologies Ltd. Stock (The Motley Fool) The Israeli cybersecurity pioneer remains a “best in breed” play on the volatile cybersecurity market.
Navy Taps BAE’s US Arm for $76M Comms, Electronics Devt Support Contract; Mark Keeler Comments (GovCon Wire) BAE Systems’ U.S. subsidiary has received a potential 22-month, $76 million contract from to help th
CACI wins Air Force cyber software contract (C4ISRNET) CACI will provide software development support to the 90th Cyberspace Operations Squadron, part of the 24th Air Force, which is the Air Force component of U.S. Cyber Command.
PKWARE Partners with Kite Distribution to Escalate UK Growth (Business Insider) PKWARE, a global leader in data security, today announces a partnership with Kite Distribution, a leader in technology distribution and channel services. This value-added partnership will serve to extend the scale and reach of PKWARE's enterprise data encryption solutions throughout the UK.
Bricata Sales to Beantown: Expanding Cybersecurity Startup Opens Boston Office (Bricata) Bricata, Inc., a developer of next-generation network intrusion detection and prevention solutions (IDS/IDP), today announced the opening of a sales office in Woburn, Ma., just outside of Boston. The company, which recently announced an $8 million growth round, aims to hire about a dozen new staff by year’s end, and could potentially double headcount to 25, in that new office, over the next 12-18 months.
The DNC’s Technology Chief is Phishing His Staff. Good. (WIRED) Uber's former head of self-driving cars is now driving the DNC's tech team, hoping to help the shattered organization recover from one of the worst tech fails in history.
Skadden Hires Top National Security Lawyer (Bloomberg Law) Michael Leiter, a top national counterterrorism lawyer under George W. Bush and Barack Obama, has joined Skadden, Arps, Slate, Meagher & Flom, the firm announced on Tuesday. Leiter, 48, joins Skadden as a partner in its 13-person Washington, D.C. national security practice, although he will work closely with the firm’s attorneys in its global investigations...
Kenna Security Adds Security Industry Marketing Veteran (Benzinga) Tamir Hardof joins Kenna Security's leadership team
Thycotic Appoints New Chief Financial Officer (Business Insider) Thycotic, a provider of privileged account management (PAM) solutions for more than 7,500 organizations worldwide, today announced Nick Margarites as its new chief financial officer. As CFO, Margarites will be responsible for implementing financial and strategic objectives that enable Thycotic to capitalize on organizations' global demand for PAM solutions.
RedLock Appoints New Executives, Announces Tremendous Company Growth (BusinessWire) Cloud Threat Defense company, RedLock, today appoints new VP of Products and VP of Engineering executives and announces tremendous company growth.
Products, Services, and Solutions
CylancePROTECT Called “Most Advanced of All Tested Solutions” in iT-CUBE Endpoint Protection Solutions Test of Eight Traditional and Next-Generation Products (Cylance) AI driven and AI augmented next-generation anti-malware solutions were dramatically more effective in two test series employing nearly 4,500 malware samples
Oxygen Forensics Industry Leading Ability to Decode Drone Data is now Available (Oxygen Forensics) Oxygen Forensics, a worldwide developer and provider of advanced forensic data examination tools for mobile devices and cloud services, can now parse and decode drone data from Inspire 1, and Phantom 3 drones manufactured by DJI.
iS5 Communications Inc. Releases First RAPTOR Beta Units to Key Customers. (PRNewswire) iS5 Communications Inc. releases RAPTOR™ - A Next-generation...
Blockchain technology is moving into the shipping industry — with Microsoft and Maersk on board (CNBC) EY said Wednesday that it plans to launch the first blockchain platform for marine insurance, alongside Microsoft, Maersk and others.
UPDATE - ManTech Launches Its Advanced Cyber Range Environment - NASDAQ.com (NASDAQ.com) ManTech International Corporation (Nasdaq:MANT) today announced full operational capability of the company's Advanced Cyber Range Environment, enabling customers to test and evaluate the cyber preparedness of their networks and to train users in the latest defensive cyber technologies for preventing cyberattacks.
HEROIC.com Launches EPIC, an Enterprise Cybersecurity Solution to Protect Organizations from Credential Stuffing Attacks (Business Insider) HEROIC.com, provider of enterprise credential stuffing protection, today announced the release of EPIC, an enterprise-focused solution that empowers security professionals to discover, remediate and prevent credential stuffing, the unauthorized use of stolen login credentials in targeted attacks.
Deep packet inspection to identify Bitcoin network activity (eeNews Europe) Rohde & Schwarz Cybersecurity's deep packet inspection (DPI) engine R&S PACE 2 has been enhanced with a new Bitcoin protocol classification functionality that enables enterprises to identify, control and block bitcoin transactions within a network.
GlobalPlatform Publishes On-Device NFC Service Management Specification (Payment Week) September 06 2017 – The GlobalPlatform Managing Entity Specification has been published, completing a ‘stack’ of complementary software standards from ETSI and the NFC Forum that ensures multiple mobile contactless services successfully coexist within a device and will operate as intended, regardless of the hosting environment selected by the service provider. The standardized approach provides much …
MobileIron adds Apple security along with support for iOS 11 (Computerworld) As macOS becomes more popular at work, MobileIron has joined a chorus of EMM vendors focused on the platform as part of their unified endpoint management software offerings.
Next Generation of Kaspersky Private Security Network: Extensive Threat Intelligence Within the Network Walls (BusinessWire) Today, Kaspersky Lab is introducing its next generation of Kaspersky Private Security Network, a private version of Kaspersky Security Network (KSN).
HoneyTek Systems Partners with Behavioral Biometrics Leader BioCatch to Deliver Game-Changing Fraud Prevention Solutions (Benzinga) HoneyTek Systems, a boutique-oriented Systems Integrator, Network Security VAR and MSSP is proud to announce that it has signed a partnership agreement with behavioural biometrics...
Milton Security Announces Partnership With Carbon Black (PRNewswire) Milton Security Group Inc., a cybersecurity company that specializes...
Free Firewall Know The Best Security Vendors Of 2017 (ValueWalk) Free Firewall is a security application that when installed blocks suspicious and unauthorized network traffic from entering the users
The Cipher Brief Launches New Public-Private Cyber Advisory Board (PRNewswire) The Cipher Brief, a premiere source for global security news and analysis,...
Technologies, Techniques, and Standards
Critical Alert: EU Ministers Test Responses in Cyber War Game (US News and World Report) European Union defense ministers will hold a cyber war game for the first time on Thursday to test their ability to respond to a potential attack by computer hackers on one of the bloc's military missions abroad.
Key elements of a secure, sensitive information sharing strategy (Help Net Security) Jonathan Yaron, Chairman and CEO of Accellion shows you how to develop a sensitive information sharing strategy and keep your organization secure.
How to hurricane-proof a Web server for Harvey (Ars Technica) Millions relied on Space City Weather—here’s the configuration that weathered the storm.
Design and Innovation
Periodic Table of Cybercrime Attacks: Curing Cybersecurity’s Tunnel Vision (Computer Business Review) The periodic table like you've never seen before - CBR's Ellie Burns talks to Vanita Pandey from ThreatMetrix about a new way of categorising cyber attacks.
AI Will Soon Identify Protesters With Their Faces Partly Concealed (Motherboard) A new paper has troubling implications.
Research and Development
There Are Now 8,000 Fake Science ‘Journals’ Worldwide, Researchers Say (Motherboard) Researchers from high-profile institutions are falling for these scams.
University receives $4.7 million cybersecurity grant (Plainsman) The University received a $4.7 million grant from the National Science Foundation that will go towards undergraduate and graduate students pursuing computer science, software, computing, wireless and electrical engineering degrees.
Symantec to Hold Cybersecurity Challenge for Higher Ed Sector on Oct. 19 (GovCon Wire) Symantec (Nasdaq: SYMC) will kick off a cyber competition for...
Legislation, Policy, and Regulation
US cautiously welcomes Russia's call for UN force in Ukraine (Military Times) The United States cautiously welcomed a Russian proposal to send U.N. peacekeepers into eastern Ukraine, but insisted Wednesday the force should be deployed throughout embattled eastern Ukraine and not just on the line of conflict.
When do Canadian spies disclose the software flaws they find? There's a policy, but few details (CBC News) A similar process helps U.S. spies decide whether to report flaws to tech companies or keep them secret for future use.
FRANCE : Culture clash at DGSI (Intelligence Online) The word is that Laurent Nunez , the new head...
Trump nominates defense lawyer to lead DOJ cyber crime division (Inside Cybersecurity) President Trump has nominated John Demers, a lawyer for defense contractor Boeing Company, to head the Justice Department's National Security Division, which is responsible for prosecuting cyber crimes.
Reengineering Surveillance Oversight (Lawfare) This piece is part of a series on Tim Edgar's new book, "Beyond Snowden." One of the most important revelations following the disclosures by former National Security Agency contractor Edward Snowden was the inadequate oversight of highly invasive U.S. surveillance programs.
US Coast Guard's unique cyber position (Defense News) U.S. Coast Guard Vice Commandant Adm. Charles Michel explains why its position in relation to the military, federal agencies and the intelligence community gives it unique insight into the governments cybersecurity posture.
House passes law to accelerate adoption of self-driving technology (Ars Technica) The House bill preempts state laws, creates a fast track for self-driving cars.
NY DFS Cybersecurity Requirements: Who Should Be Listening - SecurityScorecard Insights & News (SecurityScorecard Insights & News) For those companies who have been following the New York Department of Financial Services Cybersecurity Requirements and have educated themselves on everything about the regulation, it was easy to jump right into the substance of the requirements. But for those of you who are just catching up and beginning to evaluate this state cybersecurity...
Litigation, Investigation, and Law Enforcement
Key Figure Behind ‘Trump Dossier’ Stonewalled Senate Investigators (Foreign Policy) Glenn Simpson invoked his First Amendment rights to protect sources for salacious claims of collusion.
A Security Clearance Nightmare (Just Security) As President, Donald Trump obviously has the right to hire and fire his top advisors as he sees fit. However, when the President indicates he may
Two history-making Israelis suing New York-based Verint Systems in patent case (Haaretz) Elad Barkan and Eli Biham were the first to show that calls made on secured GSM cellphone networks could be eavesdropped on.
Lenovo settles lawsuits with 32 states over Superfish (Naked Security) Lenovo agrees to pay $3.5m for breaking users’ security by installing Superfish
How Legendary Carder, Hacker Roman Seleznev Was Caught, Sentenced (Dark Reading) Assistant US Attorney Norman Barbosa visits the Dark Reading News Desk to discuss details of the credit card hacking case that led to an unprecedented 27-year prison sentence.
13-year-old Japanese Kid Caught Selling Malware (HackRead) It is no surprise that malware attacks are increasing and cyber criminals are becoming sophisticated in their campaigns but who could imagine that kids wil
Judge dismisses Shiva “I Invented EMAIL” Ayyadurai’s libel lawsuit against Techdirt (Ars Technica) Judge: Techdirt articles were opinionated and hyperbolic, but not libel.
1st Amendment wins in self-proclaimed e-mail inventor’s Techdirt libel suit (Ars Technica) The truth, whatever that may be, is the best defense to defamation.