Cyber Attacks, Threats, and Vulnerabilities
UPDATE 1-Germany concerned about possible (Reuters) A growing number of countries can hack into private computer networks and install malicious software to sabotage another country's infrastructure, Germany's domestic spy chief said on Tuesday.
APT10 Under Close Scrutiny as Potentially Linked to Chinese Ministry of State Security (Threatpost) An advanced threat actor has been associated with China’s Ministry of State Security via two individuals and a Chinese firm.
U.S. intel chief sees continued concern on cyber threats to U.S.... (Reuters) The U.S. director of national intelligence said on Tuesday he remained concerned about cyber threats emanating from several countries against the upcoming U.S. elections, without naming any particular countries.
Will Russian Hackers Affect This Year's US Election? (SecurityWeek) Newly reported attempts at infiltration and social media manipulation — which Moscow officially denies — point to Russia's continued interest in meddling in U.S. politics.
Facebook's former security chief: US elections at risk of being 'World Cup of information warfare' (CNNMoney) After three years in the trenches of Facebook's war against disinformation, Alex Stamos brings bad news from the front: US elections are still at great risk.
States want more money, but aren't waiting around to improve election cybersecurity (Washington Examiner) Election officials at the state and local levels are unhappily coming to terms with the idea that more funding probably isn't coming for securing electoral systems from hacks this fall. But with help from the Department of Homeland Security, their confidence appears to be growing about how well…
This Group Posed As Russian Trolls And Bought Political Ads On Google. It Was Easy. (BuzzFeed News) Google says it's securing its ad platform against foreign meddlers, but for just $35 researchers posing as Russian trolls were able to run political ads without any hurdles.
Facebook’s Own Training Materials Fell for Fake News (Motherboard) As the 2 billion user-strong platform grapples with misinformation, a training document for Facebook content moderators incorrectly claimed an image was of violence in Myanmar.
After disinformation campaign, Iran’s embarrassment in cyberspace (Al Arabiya) In an effort to confront fake news and terrorism propaganda fomented by the Iranian regime, social
A Facebook War: Libyans Battle on the Streets and on Screens (New York Times) A new wave of fighting shook Tripoli this past week. For many combatants Facebook, which has huge influence in Libya, is a key weapon.
New Hakai IoT botnet takes aim at D-Link, Huawei, and Realtek routers (ZDNet) Security researchers have spotted a new strain of IoT malware that has been growing in sophistication and silently infecting more and more devices online.
SamSam ransomware keeps striking—victims still unprepared (Security Boulevard) “You can pay (a little) now or you can pay (a lot) later” is a very old line—a pitch for oil filters almost 40 years ago. Unfortunately, it remains relevant in cyber security, especially when it comes to ransomware. And especially when that ransomware is the potent, pernicious SamSam. The “trade-off” is stark: You can The post SamSam ransomware keeps striking—victims still unprepared appeared first on Software Integrity.
Attackers Employ Social Engineering to Distribute New Banking Trojan (Dark Reading) CamuBot malware, which disguises itself as a required security module, is targeting business customers of major Brazilian banks.
I got phished, but I never clicked? (Barracuda) Many of the highest profile social engineering attacks have absolutely nothing to do with links and nothing to do with clicking.
White-Hats Go Rogue, Attack Financial Institutions (BleepingComputer) Hackers rooted in the white-hat part of the business moonlight as bank robbers, pouring their knowledge and skills into creating and modifying malware that allows them to infiltrate financial institutions.
Banking Trojans and Shady Apps Galore In Google Play (BleepingComputer) Despite Google's defenses for the official Android marketplace, cybercriminals still manage to sneak in a banking Trojan, or two, or three, security researchers have discovered.
Google Has Trouble Detecting Fake Tech-Support Ads (BleepingComputer) Fraudulent tech-support services buying advertising space from Google has grown in sophistication to a level that the platform cannot distinguish them from legitimate providers.
Thousands of 3D Printers Exposed to Remote Attacks (SecurityWeek) The OctoPrint web interface of thousands of 3D printers is exposed to remote, unauthenticated attacks from the Internet due to misconfigurations
Credit card gobbling malware found piggybacking on ecommerce sites (Naked Security) Be careful! If crooks can upload malicious JavaScript to your ecommerce server, then you’re helping the them rip off your own customers.
Google's Doors Hacked Wide Open By Own Employee (Forbes) Google employee finds he can hack his own office doors open. Many could remain vulnerable, even if Google has secured its properties.
Android System Broadcasts Expose Device Information (SecurityWeek) Android device details are being exposed (CVE-2018-9489) to running applications via Wi-Fi broadcasts in the mobile operating system.
If an extension goes rogue, everything you do in your browser is compromised (Graham Cluley) The official Chrome browser extension for Mega.nz was compromised with a malicious update, stealing passwords and private keys.Keep your browser extensions to a minimum, and always be wary if they ask for elevated permissions.
Oracle Products Affected by Exploited Apache Struts Flaw (SecurityWeek) Oracle informs customers that some of its products are affected by an actively exploited Apache Struts 2 vulnerability
Almost 400k websites risk hacking, data theft via open .git repos, researcher warns (ZDNet) Your misconfigured website could be exposing sensitive data, including database passwords.
Scammers pose as CNN's Wolf Blitzer, target security professionals (CSO Online) Here's an interesting, if not outright comical, story for those of you just coming back to work after a long Labor Day weekend. Scammers are pretending to be a well-known CNN anchor and offering serious cash to anyone looking to be a security commentator on air.
South Africa: Labour Acknowledges Attempted Cyber-Attack On Website (allAfrica.com) The Department of Labour is aware of media reports over the weekend relating to a cyber-attack on its computer system and contrary to media reports as if the hack was successful, the Department through its Information Technology (IT) unit can confirm that there was an attempted Distributed Denial of Service (DDOS) attack on one of the external facing servers.
C&A Brazil suffers a cyber attack (FashionUnited) The Brazilian subsidiary of fashion chain C&A has confirmed it recently suffered a cyber attack to its gift card platform. Personal information from customers who bought gift cards from this platform have been exposed. As revealed
First Wasaga Beach, now Midland hit by cyber-attack (Barrie CTV News) The town of Midland has confirmed it is dealing with a cyber-attack.
Suspect may have stolen gas from SD gas station by using a remotely-activated hacking device (10News) San Diego police believe a suspect may have used a device to remotely activate a gas pump, in order to steal gas. Police also report that it’s a device that can be purchased on the internet.
Shots fired! Cybersecurity expert calls McAfee a 'technically incompetent schmuck' (Chepicap) Dr. Vesselin Vladimirov Bontchev, a computer security developer and commentator on cryptography and malware issues via his Twitter handle VessOnSecurity has taken aim at John McAfee’s legacy and in particular, his claim to have ‘invented cybersecurity,’ in a Twitter thread full of pointed attacks on McAfee's abilities as a computer developer.
Security Patches, Mitigations, and Software Updates
Multiple Remote Code-Execution Flaws Patched in Opsview Monitor (Threatpost) Five flaws were disclosed Tuesday in monitoring software Opsview Monitor.
Linus Torvalds talks frankly about Intel security bugs (ZDNet) Linus Torvalds thinks Intel has gotten better about keeping the Linux open-source community in the loop with CPU security problems, but it started out really badly. And it's still not fair that Linux has to fix hardware problems.
How Google Chrome Spent a Decade Making the Web More Secure (WIRED) Ten years after Chrome debuted, a look back at how the browser redefined security online.
Cyber Trends
The Rise of the Cyber-Mercenaries (Foreign Policy) What happens when private firms have cyberweapons as powerful as those owned by governments?
Social Media Is a Weapon of War. How We Use It Is Up to Us (Motherboard) "'Win' the internet, [and] you can win silly feuds, elections, and deadly serious battles."
Protecting People: A Quarterly Analysis of Highly Targeted Attacks (Proofpoint) Today's cyber attacks target people, not infrastructure. To protect them, you must understand who is being targeted, how they're being targeted, and what you can do about it. In this report, we reveal our top insights from threat data gathered from April-June 2018. Download it now to learn: What employees and departments receive the most highly-targeted threats What techniques and tools attackers leverage Concrete steps for building a people-centered defense
Survey Results: Consumers Skeptical of Government Backdoors (Venafi) Venafi survey show that members of the security industry greatly distrust government mandated encrypted backdoors.
Marketplace
Analysis | The Cybersecurity 202: Five Eyes demand for encryption workarounds raises stakes for tech companies (Washington Post) The U.S. government is going global in its anti-encryption push.
Information Security Requirements For U.S. Federal Contractors (Forbes) Attaining NIST 800-171 compliance for an organization that has not implemented an adequate information security program may be a significant effort.
Sheryl Sandberg Leans Into a Gale of Bad News at Facebook (Wall Street Journal) Amid questions about her influence at the social network, the high-profile executive has been asked to fix safety and security issues. But can the deliberative Ms. Sandberg ride herd on a free-wheeling engineering culture?
StackRox Announces Strategic Investment and Technology Development Agreement with In‑Q‑Tel · StackRox: Security built in (StackRox) StackRox announces a partnership with In-Q-Tel to provide their container security platform to protect their Intelligence Community against emerging container security threats.
L3 closes deals for tech companies (Jane's 360) L3 Technologies announced on 31 August that it had completed the acquisition of IT companies Azimuth Security and Linchpin Labs.
Atlassian to acquire OpsGenie to help IT teams manage service disruptions (Help Net Security) Atlassian acquires OpsGenie, whose technology routes alerts to the appropriate IT teams, speeding diagnosis and resolution, and reducing downtime.
Resecurity names Ian Cook as strategic adviser (Help Net Security) In his new role, Ian Cook will help Resecurity focus on providing endpoint protection platform (EPP) and intelligence-driven solutions to corporations.
Products, Services, and Solutions
Synack and the US Army Draft A New Generation of Cyber Warriors (PRWeb) In the words of Dan Coats, Director of National Intelligence, “The lights are blinking red.” Nation-state adversaries have waged a cyberwar on trus
BitSight Unveils the Industry’s First Cybersecurity Performance Planning and Analytics Solution (BitSight) BitSight Forecasting is the first analytics offering in the security ratings industry to provide direct visibility into a company’s current & future security program, the efficacy of its investments & initiatives, and helps identify the optimal course of action to improve their overall risk posture.
SecBI Partners With Intelligent Wave Inc. to Bring Autonomous Investigation™ Technology to Japanese Enterprises (PRNewswire) Automates threat detection and investigation for security operation centers in Japan
Proofpoint Launches Closed-Loop Email Analysis and Response Solution to Automate End User-Reported Phishing Remediation (Proofpoint) Proofpoint, Inc. today announced the availability of its Closed-Loop Email Analysis and Response (CLEAR) solution, a complete closed-loop approach to instant end user email reporting, analysis, and remediation to stop potentially malicious emails that pass through perimeter defenses.
Proofpoint Partners with Okta, Boosts Automated Incident Response and Integrated Authentication to Enhance Credential Phishing Defense (Proofpoint) Proofpoint, Inc. today announced a technology partnership with Okta, the leading independent provider of identity for the enterprise, to provide a better way for joint customers to combat email credential phishing attacks by automating incident response with best-of-breed, cloud-based solutions.
Northrop Grumman Looking To Deliver Cyber Command’s First Joint Warfighting Platform (Defense Daily Network) Northrop Grumman is offering a new “weapons system”-like platform for Cyber Command capable of integrating offensive, defensive and command and control mis
Troll-killing internet software Trollteq arrives (ZDNet) Authenteq combines verified online identity with blockchain-based ID storage and end-to-end encryption to create the troll-killing Trollteq.
Cloudera launches an IoT architecture with Red Hat and Eurotech to accelerate IoT deployments (Help Net Security) This modular architecture enables end-to-end analytics pushing machine learning and intelligence to the 'edge' to support real-time decision-making.
Trend Micro teams up with Moxa to secure and accelerate IIoT applications (Help Net Security) Trend Micro partners with Moxa to jointly develop solutions to protect IIoT environments like smart manufacturing and smart energy.
Automation Anywhere launches cloud strategy with global cloud companies (Help Net Security) The Automation Anywhere Enterprise platform can be deployed on-premises, in a hybrid cloud, or on cloud platforms to provide scale and flexibility.
Cloudistics Migration Manager enables workload migrations between platforms (Help Net Security) Cloudistics Migration Manager provides migration for workloads to Cloudistics, enabling users to migrate workloads in hours.
NTT Security launches WSaaS as part of its partnership program with Symantec (Help Net Security) NTT Security will integrate Symantec’s cloud based security service with NTT Security’s threat detection, providing Web Security as a Service (WSaaS).
Technologies, Techniques, and Standards
NIST’s Next Framework Focuses on Protecting Consumers’ Privacy (Nextgov.com) The Commerce Department agency will begin gathering feedback for a privacy framework at a Texas conference in October.
Cyber security training: Is it lacking in the enterprise? (Information Age) As part of Information Age's Cyber Security Month, we are looking at the importance of cyber security training and education in the enterprise
Three reasons organizations should consider network segmentation (Security Brief Asia) ForeScout says that network segmentation splits networks into specific zones, which can then enact barriers against infiltrators.
Authentication Grows Up (Dark Reading) Which forms of multi-factor authentication (MFA) are working, which are not, and where industry watchers think the market is headed.
The Continuing Problem of Aligning Cybersecurity With Business (SecurityWeek) Aligning security policy with business practices is generally considered to be a key imperative for a successful company.
There are no real shortcuts to most security problems (Help Net Security) We try to comprehend all of the possible futures and to prepare for them. There are no real shortcuts. I wish there were, but there aren’t.
Design and Innovation
Serious Fraud Office trialling AI for data-heavy cases (Naked Security) A new tool draws links between people under investigation: emails, who was cc’ed, and those quieter messages where nobody at all was cc’ed.
Academia
UB awarded $2.39 million to train future cybersecurity experts (University at Buffalo) Project aims to attract students from middle school to graduate school
Legislation, Policy, and Regulation
As Germany Moves Toward a More Offensive Posture in Cyberspace, It Will Need a Vulnerability Equities Process (Council on Foreign Relations) The hard choices Germany faces as it seeks to develop an offensive cyber capability.
'Five Eyes' Agencies Demand Reignites Encryption Debate (SecurityWeek) Privacy concerns have been raised after a coalition of intelligence agencies renewed a call for technology companies to allow backdoor access to encrypted content and devices.
4 draft digtal laws ready for Cabinet as govt boosts cybersecurity (The Nation) The Digital Economy and Society ministry (DE ministry) will submit four draft digital laws for Cabinet’s approval this month as a first step towards an official government announcement in the second half of next year.
Keeping up with the Pentagon in the information age (The Strategist) Between March and July 2018, the US Joint Chiefs of Staff issued a raft of new or revised authorised statements of military doctrine. They included a landmark ‘note’ on strategy, a joint concept on integrated ...
NY Cyber Law Hits 3rd Deadline: Toughest Yet to Come (Patterson Belknap Webb & Tyler LLP | Data Security Law Blog) By today, financial institutions are required to meet their next deadline for compliance with New York’s cybersecurity law. The regulation – enacted in March 2017 –includes a series of rolling deadlines that require banks and insurance companies covered by the law to meet varying data security requirements.
Frequently Asked Questions Regarding 23 NYCRR Part 500 (New York State Department of Financial Services) Effective March 1, 2017, the Superintendent of Financial Services promulgated 23 NYCRR Part 500, a regulation establishing cybersecurity requirements for financial services companies.
Implications of the California Consumer Privacy Act of 2018 (Help Net Security) The CCPA provides California consumers with significantly expanded rights as to the collection and use of their personal information by businesses.
Two Cyber Laws Go Into Effect Over US Labor Day Weekend (The National Law Review) On September 1, the Colorado breach notification statute update became effective, the first of two developments that occurred over the weekend. As we wrote about when the modification w
Facebook's Conservative Watchdog Will Take McCain's Senate Seat (WIRED) Jon Kyl spent the summer investigating potential bias at Facebook. Now, he may continue to from his new perch in the Senate.
Litigation, Investigation, and Law Enforcement
Facebook’s Sheryl Sandberg, Twitter’s Jack Dorsey to face questions from Congress about Russia and censorship this week (Washington Post) Facebook and Twitter will dispatch top executives to Capitol Hill this week to try to assuage lawmakers who fear Russian propaganda and political censorship continue to plague the world’s most popular social media sites.
Facebook, Twitter: US intelligence could help us more in fighting election interference (TechCrunch) Facebook’s chief operating officer Sheryl Sandberg has admitted that the social networking giant could have done more to prevent foreign interference on its platforms, but said that the government also needs to step up its intelligence sharing efforts. The remarks are ahead of an open hearing…
Twitter is a Nazi haven for the same reason its CEO claims no bias (TechCrunch) “From a simple business perspective and to serve the public, Twitter is incentivized to keep all voices on the platform”. That’s Twitter CEO Jack Dorsey’s argument for why “Twitter does not use political ideology to make any decisions” according to his prepared statement for his appearance at tomor…
Senate Intelligence Committee Declines Google Chief Legal Officer’s Offer To Testify (Deadline) The Senate Intelligence Committee has declined Google Chief Legal Officer Kent Walker’s offer to testify tomorrow in place of the company’s co-founder, Alphabet CEO Larry Page. The comm…
Google to be empty-chaired in US Senate hearing as Larry Page refuses to attend (The Telegraph) An empty chair with Google’s name on it could take centre stage during a tech company grilling in Washington DC on Wednesday after the company's co-founder Larry Page refused to attend.
Congress' Chief Tech Watchdog Is Not Happy With Google (WIRED) In a Q&A with Mark Warner, vice chair of the Senate Intelligence Committee, the senator talks about the search giant's glaring absence at this week's committee hearings, and the White House's #stopthebias campaign.
Sheryl Sandberg's Senate testimony: 'We know we can't stop interference by ourselves' (CNBC) Sandberg is scheduled to appear before the Senate Intelligence Committee Wednesday to address election-related abuse of Facebook's platform.
Opinion | Mark Zuckerberg: Protecting democracy is an arms race. Here’s how Facebook can help. (Washington Post) Social media companies face sophisticated, well-funded adversaries who are getting smarter over time, too.
Google Notifies People Targeted by Secret FBI Investigation (Motherboard) Dozens of people reported receiving an email from Google revealing a potential FBI investigation into people who purchased malware.
Europe Goes Harder on Money Laundering With Record ING Fine (Wall Street Journal) Banking group ING Groep has agreed to pay a record European fine of $899.8 million to settle an investigation by Dutch prosecutors into money laundering failings, as watchdogs scramble to staunch flows of illicit money after a spate of high profile scandals.
Man who threatened to kill Ajit Pai’s children pleads guilty, faces prison (Ars Technica) "I will find your children and kill them," man wrote after net neutrality repeal.
UK Teen Admits Mass Email Bomb Hoax (Infosecurity Magazine) Nineteen-year-old also grounded United Airlines flight
Investor Sues AT&T for Cryptocurrency Theft Losses (Dark Reading) The victim of cybercurrency theft blames the carrier for failing its security obligations.
