Cyber Attacks, Threats, and Vulnerabilities
Equifax hack the work of Chinese intelligence with links to US Office of Personnel Management hack of 2015, claim reports (Computing) Dispute between Equifax and Mandiant widened attackers' window of opportunity
Here’s What to Ask the Former Equifax CEO (KrebsOnSecurity) Richard Smith — who resigned as chief executive of big-three credit bureau Equifax this week in the wake of a data breach that exposed 143 million Social Security numbers — is slated to testify in front of no fewer than four committees on Capitol Hill next week.
The Inside Story of Equifax’s Massive Data Breach (Bloomberg) The intruders broke in and then handed off to a more sophisticated team of hackers, the hallmarks of a state-sponsored operation.
Online thieves may be exploiting the Equifax panic, researchers say (Houston Chronicle) The Equifax breach may have you watching your financial records closely for evidence of fraudulent new accounts or suspicious transactions. But you may also want to keep a close eye on your incoming email, researchers say.
Is North Korea hacking bitcoin to bypass sanctions? (Nikkei Asian Review) Researchers link recent attacks with Pyongyang-based hackers
Russia Provides New Internet Connection to North Korea (38 North) A major Russian telecommunications company appears to have begun providing an Internet connection to North Korea. The new link supplements…
Saudi entertainment authority says hit by cyber attack (Reuters) Saudi Arabia's General Entertainment Authority (GEA), which has begun sponsoring concerts and shows said on Friday its website had been the target of cyber attacks from outside the kingdom.
ISIS propaganda showcases US weapons, including an AT-4 rocket (Military Times) ISIS released its latest propaganda video about the defense of its de facto capital of Raqqa, which showcases several American weapon systems to include an AT-4 anti-tank rocket.
ISIS warns Muslims to avoid public places in Europe, America, and Russia (Military Times) The message warns Muslims to avoid these public places because “these places are targets of the soldiers of the caliphate,” the message reads.
'Doublethink required?' Twitterati mock CIA’s Russian-speaker recruitment drive (RT International) With the anti-Russia hysteria in the US reaching unprecedented proportions, the CIA has announced it’s looking for US nationals with a perfect command of Russian to work as linguist analysts to protect the US national security and “unveil the truth,” whatever that means.
#BotSpot: Bots Boost NFL Divides – DFRLab (Medium) Identifying botnets amplifying #TakeAKnee and #BoycottNFL
Facebook will share Russian-bought election interference ads with congress tomorrow (TechCrunch) Facebook will release over 3000 ads bought by a Russian entity to interfere in U.S. politics and the 2016 presidential election with congressional..
Zuckerberg asks forgiveness, but Facebook needs change (TechCrunch) "For the ways my work was used to divide people rather than bring us together, I ask forgiveness and I will work to do better" Mark Zuckerberg posted to..
Who Will Take Responsibility for Facebook? (WIRED) The reckoning is upon Mark Zuckerberg.
Faceliker Trojan leads the malware race in Q2 (Security Brief) "By making apps or news articles appear more popular, accepted and legitimate, unknown actors can covertly influence the way we perceive value."
Spot a Bot: Identifying Automation and Disinformation on Social Media (Medium) There are bots everywhere, or so it seems.
'Phish for the Future' spearphishing campaign set digital civil liberty activists in its sights (Graham Cluley) A spear-phishing campaign known as "Phish for the Future" targeted activists who have a history of championing users' digital civil liberties.
Hacker Hides Backdoor Inside Fake WordPress Security Plugin (BleepingComputer) A cyber-criminal has hidden the code for a PHP backdoor inside the source code of a WordPress plugin masquerading as a security tool named "X-WP-SPAM-SHIELD-PRO."
Android malware ZNIU exploits DirtyCOW vulnerability (Naked Security) DirtyCOW can be used to compromise phones and tablets
Estonian Blockchain-Based ID Card Security Flaw Raises Issues About Identity (Lexology) On August 30, 2017, an international team of security researchers notified the Estonian government of a security vulnerability affecting the digital…
Banking trojan campaign uses commercial packers to target Brazilian users (Graham Cluley) A banking trojan campaign is using commercial packing platforms to evade analysis and thereby successfully infect unsuspecting users.
Crowdstrike CTO: Theft and destruction are ‘just a few keystrokes’ apart (Computer Business Review) Highly advanced weaponry is not the only means of delivering a crippling blow to a nation, cyberattacks can too. We gained insight from the Crowdstrike CTO.
As CCleaner illustrates, software security has a 'systemic problem' (The Parallax) The CCleaner hack shows any app can be used to attack unsuspecting targets. Software makers need to verify their products are secure before distribution.
What Is a 'Supply Chain Attack?' (Motherboard) A dangerous threat that takes advantage of the inherent trust between users and their software providers is a growing trend.
How attackers can take advantage of encrypted tunnels (Help Net Security) 23% of security professionals don’t know how much of their encrypted traffic is decrypted and inspected, according to Venafi.
Hikvision Security Cams Compromised to Display "HACKED" (HackRead) If you own Hikvision security cameras you would have noticed the sudden change in the live feed display where the normal footages were replaced with the te
Roughted remains the top malware in Africa to watch out for (IT News Africa) Check Point Software has revealed that banking Trojans were extensively used by cyber-criminals during August 2017, with three variants appearing in the company’s latest Global Threat Impact Index.
Cyber-attack threatening Splendora ISD personal info (ABC13 Houston) The school district said it was first notified of the threat early Wednesday that is targeting confidential information such as phone numbers and addresses.
iPhone X Face ID baffled by kids, twins, siblings, doppelgängers (Naked Security) Get the lowdown on Apple’s newly released Face ID Security Overview
Business Process Compromise and the Underground’s Economy of Coupon Fraud (TrendLabs Security Intelligence Blog) The fraudulent redemption of freebies, discounts, and rebates in the form of coupons is reportedly costing U.S. businesses $300–600 million every year.
The 9 Easiest Ways For Strangers To Access Your Kids Online, According To An Expert (Romper) As the internet becomes an increasingly large part of our social lives, benefits and opportunities abound.
Security Patches, Mitigations, and Software Updates
Siemens Patches Improper Access Vulnerability in Ruggedcom Protocol (Threatpost) Industrial manufacturer Siemens is encouraging users running devices that use its Ruggedcom protocol to apply firmware updates this week.
Marketplace
Are Vets the Solution to the Cyberstaffing Gap? (Government Technology) As need grows for a strong government cybersecurity workforce, veterans offer a blend of discipline and technical experience.
Relentless Cyber Attacks Make These A Screaming Buy (Forbes) President Donald Trump’s bed-ridden, 400-pound hacker and his friends have been relentless in making 2017 a banner year for digital disruption of the worst kind.
Colorado Springs cybersecurity firm root9B acquired by New York private equity firm (Colorado Springs Gazette) Tracker Capital Management LLC, a New York-based private venture investment firm, announced Thursday that it has acquired root9B LLC...
Palo Alto May Actually Be Underrated For Once (Seeking Alpha) Palo Alto Networks shares have recovered more than 30% off of their early 2017 lows, but the shares may yet be undervalued if the company can maintain low-to-mi
Motley Fool: Cisco’s transition bodes well for the future (Spokesman) Cisco Systems’ business-model transformation should position it well for the future.
Angst vor Kaspersky und Co? Diese Antiviren-Scanner kommen aus Deutschland (Trendblog) Sie kommen aus Russland, Rumänien, Finnland, Japan, Tschechien oder Spanien – die hierzulande beliebtesten Antiviren- und Internet-Security-Programme stammen gar nicht aus Deutschland.
Deloitte: This veteran company is bringing artificial intelligence to the federal government (Washington Business Journal) What could you accomplish if mundane tasks were removed from your workload?
SAIC offers buyouts to senior managers, consolidates organizations (Washington Business Journal) Reston-based Science Applications International Corp. announced Monday that it has offered voluntary buyouts to 100 senior managers while consolidating several organizations.
Mike Rogers Joins 4iQ Board of Directors (via Passle) (Passle) We are so honored to have Congressman Mike Rogers on our board.
Noblis Welcomes the Honorable Deborah Lee James, Former Secretary of the Air Force, to Board of Trustees (PR Web) Noblis Board of Trustees gains seasoned national and homeland security expertise
Avecto appoints Chief Marketing Officer (Prolific North) Manchester global security software firm, Avecto, has named Robin Saitz as its new chief marketing officer.
Deloitte appoints Andrew Pimlott as partner (The Peninsula Qatar) Deloitte has appointed Andrew Pimlott as Partner to lead its Forensic Technology practice, and promoted two new partners in a further expansion of its Financial Advisory business in the Middle East.
Products, Services, and Solutions
ZeroFOX Expands Enterprise Security Product Suite with Employee and Executive VIP Protection Solutions (BusinessWire) ZeroFOX, the innovator of social media and digital security, today unveiled ZeroFOX Employee Protection and Executive & VIP Protection, the la
EclecticIQ Platform 2.0 Redefines Threat Analysis with Intelligence Reporting, New UI, and More (EclecticIQ) EclecticIQ, the cyber threat intelligence technology provider and fusion center operator, achieved another breakthrough for threat analysts with today’s launch of EclecticIQ Platform 2.0.
Oracle announces a new automated database that can patch cybersecurity flaws itself (Business Insider) "It will be less than one half of what Amazon charges you. We will write that in your contract," Oracle chairman Larry Ellison said on Sunday.
Technologies, Techniques, and Standards
DNSSEC key signing key rollover: Are you ready? (CSO Online) ICANN has postponed the deadline for updating name servers with the new root zone key signing key to early 2018 because too many ISPs and network operators are not ready, and that would cause DNSSEC validations to fail.
Effective Ransomware Responses: Understanding Ransomware and How to Successfully Combat It (FireEye) At FireEye, we’ve been observing an increased use of ransomware for a while now.
Effective Patch Management Requires a Well-Defined Strategy (MSP Mentor) Effective patch management requires a proactive approach. If businesses and solution providers don’t have a clearly defined policy, chances are they’ll miss some patches.
Back to Filing Cabinets? Simplifying the Complex Task of Data Security (Security Intelligence) Without visibility into all data stored on the network, the complex task of data security can have IT teams pining for the bygone days of filing cabinets.
Investigating Security Incidents with Passive DNS (SANS Internet Storm Center) Sometimes when you need to investigate a security incident or to check for suspicious activity, you become frustrated because the online resource that you’re trying to reach has already been cleaned.
Protecting networks from DNS exfiltration (Help Net Security) Everyone around the globe has heard about the colossal Equifax breach last month. Its implications haven’t yet been fully calculated except now that the CE
Five Steps to Simplify NIST Cybersecurity Framework Adoption (Infosecurity Magazine) How to simplify NIST Cybersecurity Framework adoption and gain the cyber resilience benefits.
How US and UK companies address GDPR data protection requirements (Help Net Security) Companies all over the world are determining how to best adjust their internal systems and processes in order to address GDPR data protection requirements.
Best and Worst Security Functions to Outsource (Dark Reading) Which security functions are best handled by third parties, and which should be kept in-house? Experts weigh in.
How to secure the Industrial IoT: A Q&A with GE's CISO (CSO Online) Manufacturing giant GE takes a holistic approach to industrial internet of things (IIoT) security that integrates enterprise and product security. CISO Nasrin Rezai explains why this is important and how it works.
Design and Innovation
It's "up to us" whether AI works for us, or turns against humanity, warns Satya Nadella (Computing) Better set of design principles are critical to correctly create the first AI, says Microsoft CEO
Beyond Bitcoin: The power struggle over trust-based technology (The Conversation) The development of distributed trust technologies is making traditional institutions like banks, corporations and governments nervous. Those who have power like to hold onto it. What's next?
Radical Leftists Built Their Own Reddit After It Banned Them (Motherboard) "I decided to delete my Reddit account and make a site where socialists and anarchists wouldn’t get punished for talking out against fascism.”
EFF: Stupid patents are dragging down AI and machine learning (Ars Technica) "The patent reads like the table of contents of an intro to AI textbook."
My lousy Super Bowl-betting AI shows how humans are indispensable in cybersecurity (The Next Web) Artificial intelligence and machine learning have never been more prominent in the public forum…
Where human intelligence outperforms AI (TechCrunch) With every new trend comes a counter-trend. And so despite the current excitement over the wonders of artificial intelligence, one company is betting that..
Research and Development
New research details the privacy implications of email tracking (CSO Online) Princeton University researchers have a new paper for PETS 2018: “I never signed up for this! Privacy implications of email tracking.”
DHS cyberinsurance research producing insights about security trends (TechRepublic) The US Department of Homeland Security says it's starting to see interesting security trends based on a long-term research project into cyberinsurance markets.
The Science of Cybersecurity (SIGNAL Magazine) A group of DHS researchers focused on fortifying homeland security has cybersecurity technology development down to a science.
Air Force Extends the Development of its Cyber Mission Platform (Defense Systems) The service continues developing its first unified platform to operate and deploy offensive cyber tools.
Legislation, Policy, and Regulation
Social Media is ‘First Tool’ of 21st-Century Warfare, US Lawmaker Says (Defense One) And buying Facebook ads is much cheaper than an F-35 fighter jet, said Sen. Mark Warner.
UN’s failure to frame cyberspace norms leaves officials split over cyber warfare (Jane's 360) The UN’s recent failure to proscribe cyber warfare has left government officials and legal experts in Europe divided over whether existing laws are sufficient or new ones are needed to contain the threat.
Taoiseach meeting fellow EU leaders to discuss cyber security (Breaking News) The Taoiseach Leo Varadkar is in Estonia at a Digital Summit looking at cyber security.
PM May calls for European cyber-cooperation; Norway joins Nato CCD COE (SC Media UK) UK Prime Minster Theresa May urges European cooperation to combat cyber threats; Norway joins Nato CCD COE
NSA says it would need to scale down spying program ahead of expiration (Reuters) The U.S. National Security Agency would need to begin winding down what it considers its most valuable intelligence program before its expiration at year-end if the U.S. Congress leaves its reauthorization in limbo, the agency's deputy director said on Friday.
Cyber Command Is Growing Up. Now For the Real Issue. (The Cipher Brief) Elevating Cyber Command now may be akin to if the U.S. created a Battleship Command in 1935; the wrong force for the wrong kind of conflict.
Cybersecurity threats demand modernizing federal technology (TheHill) Cyberattacks are on the rise, and it's imperative that the federal government take action.
Montgomery County doesn't plan to reveal its blueprint to prevent new cyber attacks, citing security (Montgomery Advertiser) The county worries that hackers will use the information to mount future attacks against their systems
Litigation, Investigation, and Law Enforcement
Iran Attends Europol-Interpol Cybercrime Conference (Financial Tribune) The fifth edition of Europol-Interpol...
Twitter’s Disclosure of Russian Activity Sparks Criticism From Lawmakers (Wall Street Journal) Twitter offered its first public information on Russian use of its platform during the U.S. presidential election, but its limited disclosure only fueled criticism from lawmakers who are pushing for greater transparency from internet companies over how their platforms are manipulated.
Padilla Faults DHS on Russian Cyberwarning; CDT Says Safeguards Worked (Government Technology) California's Secretary of State, Alex Padilla, claims that DHS confirmed Russian scanning in California's statewide network.
Judge Delays Decision In Motion To Release Reality Winner On Bail (The Intercept) The arguments on Friday dealt less with questions of Winner's culpability than with her character and political views.
Tony Blair institute finds that non-violent Islamist groups serve as recruitment pool for jihadists (Times) More than three quarters of British jihadists have been involved with non-violent Islamist groups before turning to foreign fighting and carrying out terrorist attacks, a report has indicated.
Apple sees sharp increase in U.S. national security requests (Reuters) Apple Inc has received more than four times as many national-security related requests from the U.S. government in the first half of this year versus a year ago, according to a company report on Thursday.
The NSA Warned Jared Kushner Not to Do the Dumb Email Thing That He Then Did (Gizmodo) Donald Trump’s son in law Jared Kushner and a number of other senior White House officials who used their personal emails for work purposes were expressly warned by the National Security Agency not to do so, Politico reported on Friday.
Greece opens Russian cybercrime suspect's extradition case (Fifth Domain) Complicating matters, Russia is also seeking his extradition on separate fraud charges.
Court Rules FBI Can Keep Names of, Payments Made to iPhone 5C Hackers Secret (Gizmodo) The FBI does not have to disclose the name of or how much it paid a private firm to crack Apple’s iPhone security, U.S. District Court Judge Tanya Chutkan ruled on Saturday.
Release of FISA Title IV and V Documents (IC on the Record) Today, the ODNI, in consultation with the Department of Justice, is releasing additional FISA Title IV and V documents.
Agency to take legal action against Wanna One's Bae Jin-young cyberbullying (The Jakarta Post) C9 Entertainment, the South Korean agency that handles Bae Jin-young, one of the members of K-pop group Wanna One, has announced on Sept. 27 that it will be taking legal action following the cyber harassment toward the 17-year-old Bae.
The State of the Law on Data Scraping (Galkin Law) Data scraping is common, but may violate numerous law, and poses a risk of litigation. A recent case against LinkedIn may pave the way for data scrapers.
Inmates Need Social Media. Take It From a Former Prisoner (WIRED) Opinion: Banning prisoners from Facebook and Twitter doesn't help their rehabilitation.
