Cyber Attacks, Threats, and Vulnerabilities
FBI acts to stop cyber-attack on Ukraine (BBC News) Malware that could 'kill' home routers has been thwarted by the FBI's action against the malicious site.
FBI Takes Control of APT28's VPNFilter Botnet (BleepingComputer) The US Federal Bureau of Investigation (FBI) has obtained court orders and has taken control of the command and control servers of a massive botnet of over 500,000 devices, known as the VPNFilter botnet.
DOJ Sinkholes VPNFilter Control Servers Found in US (Dark Reading) The US Department of Justice said the move aims to thwart the spread of the botnet as part of its investigation into Russian nation-state hacking group APT28 aka Fancy Bear.
Was A Massive Cyberattack Just Prevented? (PYMNTS.com) The Federal Bureau of Investigation (FBI) is dismantling a “large network of hacked routers and storage devices” that could have enabled a “massive cyberattack,” according to a report in The Wall Street Journal. The FBI move came after Cisco Systems Inc. and authorities from the United States and the Ukraine warned about the prospect of the […]
Researchers: Malware Surge 'Could Indicate Imminent Attack' (Silicon UK) Another NotPetya? The rapid spread of VPNFilter malware could mean plans for a fresh attack on the Ukraine - where previous worldwide attacks also began
Hacker Group Targeting Industrial Controllers Expands Its Operations (Security Boulevard) The group behind the Triton malware that triggered an emergency shutdown last year at a critical infrastructure organization in the Middle East is still active and has expanded its operations to industrial controllers in facilities in other regions of the world.
Building A Global Nation State SMB Exploit Honeypot Infrastructure With A £50 Budget #EternalPot (Peerlyst) Worthy of note before beginning to read this beauty - Mr. Beaumont predicted that this would happen back in April 2017:
Intel's 'Virtual Fences' Spectre Fix Won't Protect Against Variant 4 (Threatpost | The first stop for security news) The new hardware-based protections Intel announced earlier in March it was embedding into new chips will only protect against Spectre and Meltdown – but not the newly disclosed Variant 4, sources said.
Spectre continues: Did we all trade speed for security? (Security Boulevard) For anyone in the cybersecurity industry, 2018 began on January 3rd — the day a trio of CPU bugs was announced. What trio? You probably recall Meltdown and Spectre, but from our perspective, the latter bug is really two for the price of one. While Meltdown and Spectre both got plenty of coverage in media outlets and security blogs around the globe (yes, that includes us, too), there’s an important distinction to make and more to say on this matter.
HTML5: A Safe Haven for Malware? (Media Trust) Numerous malware incidents which call into question HTML5’s mantle of security.
Hacker Makes Over $18 Million in Double-Spend Attack on Bitcoin Gold Network (BleepingComputer) An unidentified hacker has mounted several "double spend" attacks on the infrastructure of the Bitcoin Gold cryptocurrency and has managed to amass over $18 million worth of BTG (Bitcoin Gold) coins in the process.
Malware Found in the Firmware of 141 Low-Cost Android Devices (BleepingComputer) Two years after being ousted, a criminal operation that has been inserting malware in the firmware of low-cost Android devices is still up and running, and has even expanded its reach.
"Several hundred" budget Android devices shipped with pre-installed malware: Avast (CRN Australia) Some 18,000 devices affected in more than 100 countries.
Amazon confirms that Echo device secretly shared user’s private audio [Updated] (Ars Technica) The call that started it all: "Unplug your Alexa devices right now."
Don’t Freak Out About That Amazon Alexa Eavesdropping Situation (WIRED) You should certainly understand the risks of having a smart speaker in your home, but there’s a perfectly good explanation for how that rogue message might have gotten sent.
Peter Cochrane: Our devices know more about us than we think (Computing) It's not just Big Brother that is watching you - increasingly, it's every electronic device we use, warns Peter Cochrane.
Password Formulas Don't Fool Hackers (Lifehacker Australia) Every time we write about passwords on Lifehacker, a few readers share their secret formula for creating passwords. According to Ryan Merchant, senior manager at the password manager Dashlane, those formulas are easy to hack....
Security Patches, Mitigations, and Software Updates
BMW Fixes 14 Vulnerabilities in Connected Cars (Infosecurity Magazine) BMW Fixes 14 Vulnerabilities in Connected Cars. Bugs could have allowed remote control of vehicle
Cyber Trends
About $1.2 billion in cryptocurrency stolen since 2017 - cybercrime group (Reuters) Criminals have stolen about $1.2 billion (0.9 billion pounds) in cryptocurrencies since the beginning of 2017, as bitcoin's popularity and the emergence of more than 1,500 digital tokens have put the spotlight on the unregulated sector, according to estimates from the Anti-Phishing Working Group released on Thursday.
Microsoft CEO on the rise of A.I.: 'The future we will invent is a choice we make' (CNBC) Nadella gave a philosophical response to the major challenges that are currently being faced by tech companies.
Eric Schmidt says Elon Musk is ‘exactly wrong’ about AI (TechCrunch) When former Google CEO Eric Schmidt was asked about Elon Musk’s warnings about AI, he had a succinct answer: “I think Elon is exactly wrong.” “He doesn’t understand the benefits that this technology will provide to making every human being smarter,” Schmidt said.…
20 years on, L0pht hackers return to D.C. with dire warnings (The Parallax) Two decades after presenting at the Senate’s first cybersecurity hearing, veteran L0pht hackers Kingpin, Mudge, Weld Pond, and Space Rogue reflect on progress and urge for much more.
Ransomware Attack Worries Healthcare IT Pros the Most (Health IT Security) A ransomware attack is the type of cyberattack that most worries healthcare IT professionals, according to a survey of 102 HIMSS18 attendees by security firm Imperva.
Most Expensive Data Breaches Start with Third Parties: Report (Dark Reading) Data breach costs increased 24% for enterprise victims and 36% for SMBs from 2017 to 2018, researchers found.
Marketplace
Cybersecurity Requires ‘Insatiable’ Problem-Solving Skills; Technical Skills Can Be Taught (Wall Street Journal) Employers on the hunt for excellent cybersecurity analysts don’t necessarily need to look for candidates with technical skills. What’s more important are the problem-solving skills that you can’t learn in a classroom, panelists at WSJ’s Cybersecurity Executive Forum said Thursday.
Ask the Expert: CH Insurance-Cyber Security for Small Businesses (Central New York Business Journal) High-profile cyber attacks on companies such as Target and Sears have raised awareness of the growing threat of cyber crime. Recent surveys conducted by the Small Business Administration, Symantec, Kaspersky Lab and the National Cybersecurity Alliance suggest that many small-business owners are still operating under a false sense of cyber security.
Malwarebytes acquires Romanian start up Binisoft (SC Media US) Malwarebytes has acquired the privately held Romanian-based security firm Binisoft as part of an overall effort to boost Malwarebytes ability to enhance endpoint security.
WISeKey completes the remaining 15% acquisition of Cybersecurity Company QuoVadis and renames the service WISekey QuoVadis with headquarters in St Gallen, Switzerland (GlobeNewswire News Room) WISeKey International Holding Ltd (SIX: WIHN) (OTCQX: WIKYY), a leading Swiss cybersecurity and IoT company, whose Class B Shares are listed on the SIX Swiss Exchange, announced today that it has completed the full acquisition of the remaining 15% of QuoVadis Holdings Ltd ("QuoVadis"), a leading cybersecurity company with strong focus in next generation Public Key Infrastructure ("PKI"), Certification Authority ("CA") and electronic signature services ("eID"), with operating activities in Switzerland, Germany, the Netherlands, Belgium, the United Kingdom and Bermuda.
Symantec Announces New Privacy & Data Protection Lab in Germany (ReadITQuik) The new location's focus is to provide consumers enhanced control over their personal data and their online
Dave DeWalt Bolsters NightDragon Security Investment Firm with Addition of Industry Veteran Ken Gonzalez as Managing Director (BusinessWire) NightDragon Security, a dedicated cybersecurity investment firm, today announced the appointment of Ken Gonzalez as Managing Director. NightDragon Sec
Products, Services, and Solutions
New infosec products of the week: May 25, 2018 (Help Net Security) WhiteSource launched its next-generation Software Composition Analysis solutions – Effective Usage Analysis. The technology provides details beyond simply which components are present in the application, delving deeper with actionable insights on how components are being used, highlighting their impact on the security of the application.
Carbon Black, Fortinet unveil joint solution (IT-Online) Next-generation endpoint security provider Carbon Black and Fortinet, which secures enterprise, service provider, and government organisations around the world, have joined forces to provide clients with automated protection against advanced threats and previously unknown malware.
Microsoft will extend GDPR rights to customers worldwide (Help Net Security) Microsoft has announced it will extend the rights that are at the heart of GDPR to all of their consumer customers worldwide.
European users can request a copy of the data Apple keeps on them (Help Net Secuity) Apple has set up a Data and Privacy portal where users can make a request to download all the data Apple has on them, correct their personal information, deactivate or delete their account.
Instapaper on pause in Europe to fix GDPR compliance “issue” (TechCrunch) Remember Instapaper? The Pinterest-owned, read-it-later bookmarking service is taking a break in Europe — apparently while it works on achieving compliance with the region’s updated privacy framework, GDPR, which will start being applied from tomorrow. Instapaper’s notification do…
Pulse Secure Simplifies and Extends Secure Access to Applications and Services in Cloud and Hybrid IT Environments (GlobeNewswire News Room) Pulse Connect Secure 9.0 simplifies multi-cloud connectivity intelligence and protection, extends Secure Access to Amazon AWS and enhances MacOS and Android support
autoGraph Connect Gives Mobile Operators the Tech they Need to Manage GDPR's Stringent Data Privacy Regulations (PR Newswire) autoGraph Inc., a leading provider of privacy compliance and opt-in technology,...
Layered Insight Protects India's Largest Internet Network (PRNewswire) Times Internet, the largest Indian Internet Network, selects Layered Insight to protect it's container applications
Technologies, Techniques, and Standards
NIST Updates Cyber Framework (MeriTalk) The flagship model for organizational cybersecurity policies just got a new coat of paint. The National Institute of Standards and Technology (NIST) on April 16 released version 1.1 of its Framework for Improving Critical Infrastructure Cybersecurity , which updates the agency’s original voluntary cybersecurity framework for critical infrastructure sectors issued in 2014.
Army leaders need more payoff from cyber (Fifth Domain) As the military seeks to better integrate capabilities across the five domains of warfare more seamlessly, operational vignettes provide concrete examples that progress has been made, but more work is required.
How redefining Army intel can help fight high-end adversaries (C4ISRNET) Many senior leaders admit the Army divested a lot of its electronic warfare capability over the last decade-plus, so the service is currently undergoing efforts aimed at injecting capability back into formations.
AF calling for higher standard with cybersecurity (DVIDS) Airman 1st class Belinda Mykham remembers how worried she was when she received the ominous phone call. Then a high-schooler, she was lazily sitting on her black leather couch watching TV when the phone rang.
Academia
GDPR and Data Privacy - Now a PhD Subject (Infosecurity Magazine) Infosecurity met with some PhD Students, for whom data protection and the GDPR has become a major part of their research.
Legislation, Policy, and Regulation
GDPR: Today is the day (Help Net Security) We sat down with Jerry Caponera, VP Cyber Risk Strategy, Nehemiah Security, to talk about this important regulation and its wide-ranging impact.
Data protection legislation on the eve of change as GDPR is here (WeLiveSecurity) After years of build-up and countless articles on GDPR and the impact it will have on people and businesses globally we find ourselves on the eve of a major change to data protection legislation.
GDPR is now in force! Read the best resources to prepare (Computing) GDPR is now online and firms need to comply or risk heavy fines. Here are the details you need to ensure you're ready.
GDPR is Here, So What’s Next for Cybersecurity Professionals? (Infosecurity Magazine) The deadline for GDPR compliance has arrived, and it marks a new era for data protection in Europe and beyond.
EU’s new data-privacy rule will be felt in the US, too (BostonGlobe.com) Many companies, including those in the US, may find it easier to use European data rules that take effect Friday for all of their customers.
GDPR, WHOIS & the Impact on Merchant Risk Security Monitoring (Dark Reading) The EU's General Data Protection Regulation will make it harder for law enforcement, forensic investigators, and others to track down everything from credit card fraud to child porn rings.
GDPR confusion: it's about direction of travel not hard deadlines (Computing) The 'how to' element is missing from GDPR and this is the cause of much of the angst
'Cyberwarfare is just a reaction’ - Putin 's CHILLING MESSAGE to rest of the world (Express) Vladmir Putin has sent a chilling warning on cyber attacks, telling nations they should set “rules” for international cyberspace behaviour, or face the consequences of their “actions”.
Memo to POTUS: Responding to Cyber Attacks and PPD-20 (The Cipher Brief) Mr. President, as you know the United States has faced cyber attacks of increasing frequency and viciousness from our adversaries. Your NSC is about to bring you both a new cyber strategy and a proposal to modify a previous NSC document called PPD-20 to give US Cyber Command more authority to interfere with these adversary … Continue reading "Memo to POTUS: Responding to Cyber Attacks and PPD-20"
Macron defends the European way of tech regulation (TechCrunch) French President Emmanuel Macron gave a speech at VivaTech in Paris, alternating between French and English. He defended a third way to regulate tech companies, which is different from the U.S. and from China. Macron thinks Europe should have a say when it comes to regulation — and it shouldn’t be …
National ID system infringes on right to privacy – solons (Inquirer) Leftist lawmakers on Thursday again warned that the passage of the national identification system bill would pose threats to the country’s security and infringe on people’s privacy rights.
This administration must lead on cyber (TheHill) The recent departure of Tom Bossert, coupled with the announcement that Rob Joyce would be returning to the NSA, leaves a major void in the White House that cannot go unattended.
Putting pressure on Trump, House passes bill barring government from doing business with ZTE (TheHill) The House on Thursday voted to cut off Chinese telecommunications company ZTE from U.S. business dealings, putting pressure on the firm and President Trump.
Huawei, ZTE Get the Boot in House-Passed Defense Bill (Nextgov.com) The bill gives federal agencies until 2021 to scrub the Chinese telecoms from their networks.
US considering placing compliance officers inside China's ZTE: Commerce Secretary Ross (CNBC) The U.S. is looking at alternatives to the crippling sanctions threatening Chinese telecom giant ZTE, Commerce Secretary Wilbur Ross says.
Congress Passes Bill to Reduce Synthetic Identity Fraud (Infosecurity Magazine) Congress moves to protect the privacy of minors and other vulnerable consumers.
Tech companies to disclose foreign software probes under US Bill: Report (ZDNet) New source code disclosure rules could force US tech companies to reveal whether they allowed Chinese or Russian examination of software sold to the US military, Reuters has reported.
Litigation, Investigation, and Law Enforcement
Gamers involved in December’s “swatting” death just got indicted (Ars Technica) Gamers charged with obstruction for deleting possibly incriminating messages.
3 Charged In Fatal Kansas ‘Swatting’ Attack (KrebsOnSecurity) Federal prosecutors have charged three men with carrying out a deadly hoax known as “swatting,” in which perpetrators call or message a target’s local 911 operators claiming a fake hostage situation or a bomb threat in progress at the target’s address — with the expectation that local police may respond to the scene with deadly force.
Barriss, at center of fatal Wichita 'swatting,' also charged with D.C. bomb threats (Kansas.com) On Thursday, a federal court unsealed an indictment against Tyler Barriss of Los Angeles, accusing him of making threats against government buildings in Washington, D.C.
Facebook, Google face first GDPR complaints over “forced consent” (TechCrunch) After two years coming down the pipe at tech giants, Europe’s new privacy framework, the General Data Protection Regulation (GDPR), is now being applied — and long time Facebook privacy critic, Max Schrems, has wasted no time in filing four complaints relating to (certain) companiesR…
Privacy International Launches GDPR Probe into Data Companies (Infosecurity Magazine) Privacy International Launches GDPR Probe into Data Companies. Group believes behind-the-scenes data hoarders could be breaking the new law
Federal Judge Obliterates Fusion GPS' Attempt To Hide Info (The Federalist) In Fusion GPS' vague telling, they've been nothing but forthright with congressional investigative committees, which came as news to those committees.
Don't Lose Sight of the Russian Threat to American Democracy (The Cipher Brief) It has now been 18 months since the November 2016 presidential election, during which the U.S. intelligence community believes Russia acted not only to interfere with U.S. elections, but with clear preference for one of the candidates. However, Washington and many of America’s leaders are still not on the same page regarding both the facts …
Leaked Documents Show Facebook’s Post-Charlottesville Reckoning with American Nazis (Motherboard) After a white supremacist killed a protester in Charlottesville in 2017, Facebook pushed to re-educate its moderators about hate speech groups in the US, and spell out the distinction from nationalism and separatism, documents obtained by Motherboard show
Twitter unveils new political ad guidelines set to go into effect this summer (TechCrunch) Following the unrelenting wave of controversy around Russian interference in the 2016 presidential election, Twitter announced new guidelines today for political advertisements on the social networking site. The policy, which will go into effect this summer ahead of midterm elections, will look tow…
2 million stolen identities used to make fake net neutrality comments (Naked Security) Most crucially, two of those identities were senators who are now demanding the FCC find out who’s behind the bots and the identity theft.
U.S. Launches Criminal Probe into Bitcoin Price Manipulation (Bloomberg) The Justice Department has opened a criminal probe into whether traders are manipulating the price of Bitcoin and other digital currencies, dramatically ratcheting up U.S. scrutiny of red-hot markets that critics say are rife with misconduct, according to four people familiar with the matter.
The ICO has only collected half of data breach fines since 2010 (Computing) Companies have gone into liquidation to avoid big penalties, and the ICO has no power to stop them
Uber Self-Driving Car That Struck, Killed Pedestrian Wasn’t Set to Stop in an Emergency (Wall Street Journal) An Uber self-driving car involved in a fatal crash in Arizona identified an object on the road six seconds before impact and didn’t determine the need for emergency braking until nearly five seconds later.
FBI Taps Private Industry to Bring Down Hacker Clearinghouse (Voice of America) The takedown of malware scanning service Scan4You shows how the FBI and private cybersecurity firms have started teaming up in major cybercrime investigations
