Cyber Attacks, Threats, and Vulnerabilities
Spain warns EU of Russian meddling in Catalan separatist movement (Deutsche Welle) Madrid stopped short of blaming the Kremlin of outright interference in Spain's domestic affairs. But there is growing evidence that the Kremlin feels empowered by sowing divisions in Europe and the United States.
Shadow Brokers cyberattack infiltrated heart of US spy agency (Times) An American cyberspecialist who worked at the National Security Agency has revealed how hackers calling themselves the Shadow Brokers infiltrated one of the most secret units inside the...
How the Shadow Brokers Unleashed the NSA's Powerful Cyberweapons on the World (CyberX) Here's a summary of an in-depth article published yesterday by Scott Shane, Nicole Perloth, and David Sanger of the New York Times.
The NSA's Shadow Brokers Quandary Prompts Top Solution Providers To Warn Customers About Mobile Device Patching (CRN) Kudelski Security CTO Andrew Howard said a zero day attack against a major mobile device platform is likely imminent given a recent cyberweapons theft and disclosure.
New IcedID Banking Trojan Discovered (BleepingComputer) Malware experts have spotted a new player on the banking trojan scene that they named IcedID and which is currently in its first stages of development.
New Banking Trojan IcedID Discovered by IBM X-Force Research (Security Intelligence) IBM X-Force identified a new Trojan, dubbed IcedID, that uses advanced browser manipulation tactics to target financial institutions in the U.S. and U.K.
Security researcher uncovers ingenious exploit compromising Trend Micro, Kaspersky, ZoneAlarm and other anti-virus software packages (Computing) Security flaw requires local administrative privileges
'Highly secure' work tool leaks documents (BBC News) Private files belonging to tax adviser KPMG and the BBC are exposed by Huddle's team-sharing tool.
ZeuS Panda Trojan Spreads Through Google Search (Spyware Techie) The ingenuity of cyber criminals does not seem to stop, as every day they find more ways to infect multiple systems worldwide.
Threat Actors Put a Greek Twist on Ransomware with Sigma (PhishMe) When we think of Greek-themed malware, the trojan family generally comes to mind. Not anymore...
No Platform Immune from Ransomware: Sophos (Enterprise Channels MEA) Enterprise Channels MEA, is a South Asia and Middle East-based leading Media house, specialized in ICT publications, events marketing and communications services.
The modern Gold Mine Rush - Office 365 as a crypto miner’s paradise (Netskope) Netskope Threat Research Labs has detected a browser-based coin miner named Coinhive resident in Microsoft Office 365 OneDrive for Business. The Coinhive miner was installed as a plugin in an SSL website. The tutorial webpage hosted on the website was saved to the cloud and then shared within an organization. The presence of browser-based coin...
Cyber experts say threats to satellites are legion (SpaceNews.com) If your company or organization uses a network, there are people who want to hack it. If you haven’t tried to stop them, those hackers are probably already in your network.
Eavesdropper vulnerability exposes sensitive corporate communications data (Help Net Security) Appthority published research on its discovery of the Eavesdropper vulnerability, caused by developers carelessly hard coding their credentials in mobile a
Data exfiltration tool PTP-RAT encodes data in pixel colour values (Help Net Security) How to exfiltrate data from a machine that doesn't have file transfer capabilities or whose RDP connection has been locked down? Use PTP-RAT.
Voice recognition systems easily fooled by impersonators, claims Finnish university study (V3) Cyber crooks can compromise speech recognition systems with ease, claim researchers at the University of Eastern Finland,Security,Mobile Phones,Hardware ,Hacking,hackers,voice recognition,University of Eastern Finland
Simple exploit can be used to disable Brother printers remotely (Naked Security) The only people who should have access to your printer’s web interface are the people who need it
U.S. Grid Narrowly Escapes Apocalyptic Attack (OilPrice) A new study from IT security consulting firm Symantec shows that the U.S. power grid is at extreme risk of a detrimental cyber-attack
How Twitter outrage hatches in tiny fringe groups on 4chan and Reddit (Naked Security) Communities within 4chan and Reddit are veritable hatcheries for Twitter-borne fakery
Security Patches, Mitigations, and Software Updates
Firefox to offer tracking protection for all in its next update (Naked Security) This next major update, Quantum, is expected to include an option to turn on Tracking Protection during normal browsing
Firefox 57 Brings Better Sandboxing on Linux (BleepingComputer) Firefox 57, set to be released tomorrow, will ship with improvements to the browser's sandbox security feature for Linux users.
Google will remove apps that misuse Android Accessibility Services from Google Play (Help Net Security) Android Accessibility Services misuse has led Google to make some developers switch to other methods or risk their apps being removed from Google Play.
Google Addresses Android's Biggest Security Problem: Accessibility Services (BleepingComputer) Google has emailed Android app developers and has informed them of plans to remove all apps that misuse the Accessibility service from the Play Store.
Teledildonics maker Lovense fixes bug to delete recordings of user sessions from phones (Help Net Security) A Reddit user noticed that the app that is used to control remote control sex toys made by Lovense "seems to be recording while the vibrator is on."
YouTube to crack down on inappropriate videos targeting kids (Naked Security) The automatic filters are far from foolproof, so YouTube’s investigating other ways to take down the disturbing content.
Cyber Trends
After Equifax: Security Professionals Expect the Worst and Claim They Are Prepared (Varonis) Nearly 50% of IT pros are bracing for a cyber attack, yet 89% profess confidence in their cybersecurity stance.
Tenable CEO doesn't think much of the Equifax, Yahoo cyber breach explanations (Washington Business Journal) Tenable Network Security Inc. CEO Amit Yoran has a visceral SMH reaction to the recent “WTF moment” of Equifax CEO Richard Smith's congressional testimony about the mind-boggling data breach at his credit reporting company, as well as last week's appearance on Capitol Hill by ex-Yahoo chief Marissa Mayer.
Hiding Behind the APT Helplessness Defense...Really? (Tenable™) Former Equifax CEO Richard Smith’s Congressional Testimony was a real
VIDEO: Why We Need to Stop Calling Cybercriminals 'Hackers' (Carbon Black) (Editor’s Note: This article also appears on Cyberscoop.) Carbon Black’s National Security Strategist Eric O’Neill talks about what needs to change in the cybersecurity community if things are going to get better in 2018.
Organisations Urged to Reconsider How They View and Protect Data (BusinessWire) A new IDC Perspective Report, sponsored by Covata, urges organisations to reconsider how they view and protect data.
Request the 2017 Q3 Data Breach QuickView Report (Risk Based Security) Get your complimentary copy of Risk Based Security's Q3 2017 Data Breach Quick View Report, an executive summary of data breaches in the first 9 months of 2017.
GDPR Compliance and Fines May Affect Almost 80% of Organizations Surveyed (PRWeb) HyTrust survey finds most organizations with cloud infrastructure are unprepared for GDPR deadline with less than a year until enforcement
Marketplace
Could cloud vendors dump big customers to avoid shared liability once GDPR is enacted? (Computing) Fieldfisher GDPR expert Kuan Hon explains the possibilities, with potential fines for large firms set to run into billions when the new law comes into force next year
Barracuda Acquires Sonian Inc. (PRNewswire) Barracuda Networks, Inc. (NYSE: CUDA), a leading provider of...
Medigate Announces $5.35M Seed Round to Protect Connected Medical Devices from Pandemic Cyberattacks Threatening Patient Safety and Privacy (BusinessWire) Israeli startup Medigate announces $5.35 million in seed funding for its mission to secure millions of connected medical devices.
Duo Security is hiring more than 50 people for a variety of jobs throughout the company (WXYZ) If you want to work in cyber security with a human-centered approach to developing solutions, Duo Security is hiring dozens of people across the company and at all locations.
A (smart) cybersecurity firm grows in Portland (Portland Business Journal) Technology Association of Oregon President and CEO Skip Newberry chats with security firm Cylance about why it came to Portland
RedSeal Honored with CRN 2017 Tech Innovator Award in Network Security (MarketWired) RedSeal's network modeling and cyber risk scoring platform takes top honors in the 2017 Network Security Category
Products, Services, and Solutions
SentinelOne Transforms Vulnerability Management By Introducing Virtual Patching and Exploit Shield (SentinelOne) Security teams can now shift from passive vulnerability management to active deflection
Forcepoint Enhances Human Point System with Increased Visibility and Enforcement to Protect Critical Data and IP (Business Insider) Global cybersecurity leader Forcepoint today introduced new features across its human-centric security portfolio that deliver critical visibility, efficacy and enforcement capabilities to enterprises and government agencies.
CYBRIC Announces Expansion of Partner Ecosystem (BusinessWire) CYBRIC, provider of the first continuous application security platform, today announced the expansion of its partner ecosystem, integrating WhiteSource
IBM plan to offer quantum computing in the cloud (Computing) IBM wants to make its quantum computing technology commercially available in the cloud by the end of the year
TruNarrative Partners with Credit Bureau Malaysia to Bring a Unified Approach to Financial Crime Management in Malaysia (Payment Week) TruNarrative, the global provider of fraud and compliance risk solutions has entered a collaborative partnership with Credit Bureau Malaysia...
Spirent Earns Global CREST Accreditation, Assuring Highest Standard of Ethical Penetration Testing for Customers around the World (BusinessWire) Spirent's global CREST accreditation for penetration testing assures customers worldwide of best-in-class security testing services.
Tripwire Boosts Cybercrime Detection Capabilities, Focuses on Techniques, Tactics and Procedures (BusinessWire) Tripwire Enterprise leverages MITRE framework, strengthens defense against cybercrime behavior.
CrowdStrike Expands Endpoint Protection Platform with New Vulnerability Management Module - (CrowdStrike) CrowdStrike® Inc., the leader in cloud-delivered endpoint protection, today announced that it has expanded the capabilities of the CrowdStrike Falcon® platform by introducing a new vulnerability management module, CrowdStrike Falcon Spotlight. CrowdStrike is the…
SlashNext Launches Revolutionary Internet Threat Protection System to Displace Aging Signature and Sandbox Technologies (PRNewswire) SlashNext, provider of third-generation Internet security solutions,...
Darktrace Industrial Uses Machine Learning to Identify Cyber Campaigns Targeting Critical Infrastructure (Darktrace) New business unit and technology updates launched in wake of warnings and requirements issued by U.S. and EU
The 50 Best Information Security Blogs (Top10VPN.com) Stay up to date on industry news, trends and advancements with our list of the top 50 infosec blogs, including independents, news, podcasts and corporate.
Kaspersky Lab Announces Polys, a Blockchain Based, Secure Online Voting System (Irish Tech News) Earlier today, at Kaspersky Lab’s annual Cyber Security Weekend event in Dublin, Kaspersky announced an innovation from its Kaspersky Lab Business Incubator: a customisable online voting platform for non-commercial organisations, businesses and communities, which uses blockchain technology and is secured with transparent crypto algorithms.
NeuVector 1.3 Improves Container Threat Detection Capabilities (eWEEK) Container security startup NeuVector adds new features to help identify privilege escalation attacks and detect risks hidden within tunneled traffic.
Solve Insider Data Breach Risks With Meridian Technologies' Acceletest (Sys-Con Media) Enterprises work hard to protect their customers' data; however, data breaches – like those at Equifax, Target and Home Depot – still happen regularly and leave both customers and the company at risk.
Technologies, Techniques, and Standards
Johns Hopkins APL and FS-ISAC Operationalize the Integrated Adaptive Cyber Defense Framework to Improve Cybersecurity in Critical Sectors (FS-ISAC) Innovative framework improves how critical sectors share, act on cybersecurity information
FASTR Consortium Announces Release of "Automotive Industry Guidelines for Secure over-the-Air Updates" (BusinessWire) FASTR consortium has released comprehensive, objective guidelines by which to analyze automotive software over-the-air (SOTA) update systems
10 Top Talks and Resources About DevSecOps (Aquasec Blog) To get us all more familiarized with DevSecOps principles, we’ve compiled this is of resources to follow.
Defense Department's vulnerability disclosure program racks up 2,837 security flaws (SC Media US) HackerOne, which operates the VDP, called it
Do Young Humans + Artificial Intelligence = Cybersecurity? (Breaking Defense) The Army is recruiting smart young soldiers to wage cyber war. But human talent is not enough.
Cryptomathic Publishes "Digital Signatures for Dummies" (Cryptomathic) New book offers easy-to-digest guidance and advice on digital signature deployment and management
Research and Development
S&T Reveals A Determined Cyber-Posture For National Cyber Security Awareness Month (Electronic Component News) Throughout October 2017, DHS S&T’s Cyber Security Division (CSD) promoted its role in mobilizing cybersecurity innovation as part of National Cyber Security Awareness Month (NCSAM). With a string of...
Academia
7 Tips and Tools to Protect University Campuses from Cyber Attacks (CIOReview) 7 Tips and Tools to Protect University Campuses from Cyber Attacks By James Tagliareni, CIO, Washburn University - If you are like me, data security is a top priority. A recent report by the Identity Theft Resource Center shows that data...
Phishing emails at Syracuse University are becoming more sophisticated and malicious, officials say (The Daily Orange) Since the beginning of the semester, ITS has sent seven phishing alert notifications, an increase from five during the same period last year.
Legislation, Policy, and Regulation
8 ways the GDPR could impact most organizations (Information Management) All companies that operate in the EU are likely to process at least some personal information as data controllers, if only as it relates to their employees.
US Port Cybersecurity Bill Advances (Port Technology) US legislators have progressed an act requiring the federal government to assess maritime sector cybersecurity risks following this summer’s “Petya” hacks interrupting LA port operations
NDAA pushes more oversight of cyber (FCW) With $8 billion dedicated to improving U.S. cyber capabilities, the NDAA has a host of policies geared toward boosting the cyber workforce and streamlining operations.
It’s the Beginning of the End of the Internet's Legal Immunity (Foreign Policy) Congress is starting to chip away at tech companies’ claims that they're just "platforms".
FBI “should not be reluctant” to challenge encryption in court (Security Boulevard) Deputy US Attorney General speaks out to support encryption backdoors
Litigation, Investigation, and Law Enforcement
What Mueller's org chart reveals about his Russia probe (POLITICO) Workload for the special counsel’s team — now 17 prosecutors — shows how he’s conducting the probe and what may come next.
Data Firm’s WikiLeaks Outreach Came as It Joined Trump Campaign (Wall Street Journal) Cambridge Analytica said it reached out to Julian Assange to share Hillary Clinton-related emails in “early June 2016,” when the company had already started working for the campaign.
The Secret Correspondence Between Donald Trump Jr. and WikiLeaks (The Atlantic) The transparency organization asked the president’s son for his cooperation—in sharing its work, in contesting the results of the election, and in arranging for Julian Assange to be Australia’s ambassador to the United States.
Report: NSA Hunts for Moles Amid Crippling Information Leaks (The Daily Beast) Mysterious hacking group is taunting the agency and investigators don’t know who to blame.
Marissa Mayer admits that Yahoo still hasn't any idea exactly how the company got hacked (Computing) All three billion accounts (most of them unused for years) were compromised in cyber attacks in 2013 and 2014,Security ,Security,security,Marissa Mayer,hack,Yahoo,Ymail
Missouri Attorney General Launches Probe Into Google’s Business Practices (Wall Street Journal) Missouri’s attorney general has launched a broad investigation into whether Google is violating the state’s consumer-protection and antitrust laws, a new front in the internet giant’s regulatory battles.
Malwarebytes wins US case over 'potentially unwanted program' classification of vendor's software (Computing) Enigma Software's case against Malwarebytes thrown out
Finjan's $1.5M IP Damages Request Inflated, Jury Told (Law 360) An expert paid by Symantec unit Blue Coat Systems took the stand Monday in a California federal jury trial over claims Blue Coat is infringing Finjan’s online security patents, testifying that Finjan’s $1.5 million damages estimate is inflated, based on “entirely inappropriate metrics,” and should be closer to $663,000.
FNJN: Still Awaiting Blue Coat Appeal Ruling, Which May Not Be Simple (Zacks) FNJN Finjan (NASDAQ:FNJN) reported Q3 results and updated shareholders on current events. More important that the Q3 results was the discussion of the various outcome possibilities of the two trials that have been completed and have not yet been decided. The first and most important is the Blue Coat appeal. Since hearing from the
Erise gets another big victory against patent troll (Kansas City Business Journal) Overland Park-based Erise IP recently won a case that pitted a Canadian network equipment company against Packet Intelligence LLC.
Ex-Partners in Sex Bias Suit Can Review Chadbourne Leaders' Personal Emails (New York Law Journal) Resolving a discovery dispute in a $100 million gender discrimination case against Chadbourne & Parke a magistrate judge allowed review of certain firm leaders' personal email accounts.
'Day Trader' Indicted in Brokerage Account Hack-and-Trade Scheme (New York Law Journal) A self-described day trader was indicted Wednesday on allegations he conspired to hack into online brokers accounts to conduct coordinated trades that…
Divorce in the Digital Age: A Collision Course in Text, Social Media Discovery (New York Law Journal) The explosion of online data and personal devices is redefining how divorce attorneys work creating new opportunities—and burdens—from everything from research to litigation.
Openbazaar Sees a Variety of New Vendors After Privacy Enhancements (Bitcoin.com) This past September the cryptocurrency-based decentralized marketplace, Openbazaar, launched its 2.0 platform with a slew of new features. Now a couple of months later, the marketplace seems to be seeing some significant growth as vendors from Darknet markets are starting to flock to the protocol’s benefits.
The teen who bought a car bomb on the Dark Web (Naked Security) He was arrested after accepting a package delivered to his home address
