Cyber Attacks, Threats, and Vulnerabilities
Huawei denies foreign network hack reports (ZDNet) Huawei has pointed to its 'unblemished record of cybersecurity' following reports over the weekend that it helped the Chinese government gain access codes for a foreign network.
Dozens of Spies Killed Thanks to Flawed CIA Comms (Infosecurity Magazine) Report claims Iranian and Chinese intelligence dismantled US spy networks
Top Senate Intelligence Dem: 'People should vote with confidence' that elections will be secure (TheHill) Sen. Mark Warner (D-Va.) said Sunday that he believes Americans can "vote with confidence," and that this year's midterm elections will be secure from potential foreign threats.
Hackers targeting election networks across country in lead up to midterms (Boston Globe) The recent incidents, ranging from injections of malicious computer code to massive submissions of bogus voter registrations, have not been publicly disclosed until now.
Expert Warns This Common Cyber-Attack Could Hit The Midterms Next Week (Forbes) With just days to go until the midterms, officials and citizens need to be on high alert. Here’s what to look out for
The midterms may be the ‘warm-up’ for Russians seeking to target 2020, officials say (Washington Post) Public- and private-sector defenses have been hardened since the 2016 elections.
Two Russian lawmakers are monitoring integrity of midterm voting in the shadow of 2016 interference (Washington Post) Artyom Turov and Alexei Korniyenko are members of the Organization for Security and Cooperation in Europe's Parliamentary Assembly.
Why it's still in Russia's interest to mess with US politics (AP NEWS) Sweeping accusations that the Kremlin tried to sway the 2016 U.S. election haven't chastened Russian trolls, hackers and spies — and might even have emboldened them. U.S. officials and tech companies say Russians have continued online activity targeted at American voters during the campaign for Tuesday's election, masquerading as U.S. institutions and creating faux-American social media posts to aggravate tensions around issues like migration and gun control.
U.S. EAC Voting System Standards Fail to Protect Systems In Penetration Security Tests (Sys-Con) Coalfire Security Tests Show Vulnerabilities in U.S. Election Assistance Commission (EAC) Standards, Machines and System Infrastructure
The Pentagon has prepared a cyber attack against Russia (Center for Public Integrity) Military hackers have been given the go-ahead to gain access to Russian cyber systems for potential retaliation for any election meddling.
Why DOD is sending cyber teams to DHS before the election (FCW) The Defense Department has loaned personnel to Homeland Security in effort to prevent -- or react to -- election hacking attempts.
How Facebook and Twitter are rushing to stop voter suppression online for the midterm elections (Washington Post) With the 2018 midterms just days away, Facebook and Twitter are scrambling to stop falsehoods about how, when and where to vote from spreading wildly online.
Twitter Is Sorry 'Kill All Jews' Was a Trending Topic (Motherboard) The hateful phrase was trending in New York after a synagogue was vandalized with graffiti ahead of an event featuring Broad City actress Ilana Glazer.
Don’t Be Duped by Voting Misinformation Before the Midterms (WIRED) Elections have long been a battleground for information warfare around individual candidates and the voting process itself.
Homeland Security Fell for YouTube Videos About ‘Antifa Civil War’ (The Daily Beast) Newly released emails show an agent asked for intelligence about a supposed plot to overthrow the government, which was quite obviously a hyped meme.
Intel CPUs impacted by new PortSmash side-channel vulnerability (ZDNet) Vulnerability confirmed on Skylake and Kaby Lake CPU series. Researchers suspect AMD processors are also impacted.
PortSmash attack blasts hole in Intel's Hyper-Threading CPUs, leaves with secret crypto keys (Register) Malware already on machines can exploit SMT using side-channel techniques to snatch private info
Fbot vs Trinity: Two IoT botnets battle for supremacy for control over thousands of vulnerable Android devices | Cyware (Cyware) Two IoT botnets - Fbot and Trinity - have reportedly been spotted engaged in a turf war for control over thousands of vulnerable Android devices. Both botnets aim to gain control of vulnerable Android devices and mine for cryptocurrencies.
CTA Security Playbook: Goblin Panda (Security Boulevard) The FortiGuard SE Team has released a new playbook on the threat actor group known as Goblin Panda as part of its role in the Cyber Threat Alliance (CTA).
CTA Adversary Playbook: Goblin Panda (Security Boulevard) The FortiGuard SE Team has released a new adversary playbook on the threat actor group known as Goblin Panda as part of its role in the Cyber Threat Alliance (CTA).
SMS Phishing + Cardless ATM = Profit (KrebsOnSecurity) Thieves are combining SMS-based phishing attacks with new “cardless” ATMs to rapidly convert phished bank account credentials into cash. Recent arrests in Ohio shed light on how this scam works.
Spam campaign targets Exodus Mac Users (News from the Lab) We’ve seen a small spam campaign that attempts to target Mac users that use Exodus, a multi-cryptocurrency wallet. The theme of the email focuses mainly on Exodus. The attachment was “Exodus-MacOS-…
New Ransomware using DiskCryptor With Custom Ransom Message (BleepingComputer) A new ransomware has been discovered that installs DiskCryptor on the infected computer and reboots your computer. On reboot, victims will be greeted with a custom ransom note that explains that their disk has been encrypted and how to pay the ransom.
Want to Make $100 Million from Hacking? Steal Press Releases (Security Boulevard) Stealing credit card number? Old hat. Ransoming information? Been there, done that. Apparently, if you want to make real money from hacking (not that we’re suggesting this), press releases are the latest and most lucrative piece of valuable information.
Who’s In Your Online Shopping Cart? (KrebsOnSecurity) Crooks who hack online merchants to steal payment card data are constantly coming up with crafty ways to hide their malicious code on Web sites.
SIM Swap Danger as Telco Staff Waive ID Checks (Infosecurity Magazine) Undercover filming shows employees breaking security policy
Did Russian Hackers Just Steal Private Messages From 81,000 Facebook Accounts? (Forbes) Russian hackers claiming to have 120 million Facebook profiles for sale have published details of 257,000 of them online. Intelligence experts confirm that 81,000 of these contain private Facebook messages.
Private Facebook data from 81,000 accounts discovered on crime forum (Naked Security) Stolen data from the 81,000 accounts that appeared to be genuine included intimate exchanges between Facebook users.
FIFA, hacked again, is leaking like a sieve (Naked Security) Football shockers started to flow on Friday, after journalists analyzed more than 70m exfiltrated documents, totaling 3.4 terabytes of data.
Why no cyber 9/11 for 15 years? (Security Boulevard) This The Atlantic article asks why hasn't there been a cyber-terrorist attack for the last 15 years, or as it phrases it:National-security experts have been warning of terrorist cyberattacks for 15 years. Why hasn’t one happened yet?
USB threat vector trends and implications for industrial operators (Help Net Security) Industrial players are limiting network access and increasingly using USB media devices to transfer patches, updates and files to those systems.
Security Patches, Mitigations, and Software Updates
Cisco Adaptive Security Appliance Software and Cisco Firepower Threat Defense Software Denial of Service Vulnerability (Cisco Security) A vulnerability in the Session Initiation Protocol (SIP) inspection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload or trigger high CPU, resulting in a denial of service (DoS) condition.
Cyber Trends
WWIII: Cyber conflicts - war by other means (Engineering & Technology) Global computer networks provide the means to conquer in cyber war without a shot being fired.
How the world’s first cyberattack set the stage for modern cybersecurity challenges (Fifth Domain) Back in November 1988, Robert Tappan Morris, son of the famous cryptographer Robert Morris Sr., was a 20-something graduate student at Cornell who wanted to know how big the internet was – that is, how many devices were connected to it. So he wrote a program that would travel from computer to computer and ask each machine to send a signal back to a control server, which would keep count.
China's next big export? Censorship (NZ Herald) Usually secretive nation has been seducing world leaders with 'techno-dystopian' tools.
What 9 Cybersecurity Research Reports Show About the State of Risk (eSecurity Planet) In October, cybersecurity vendors released a number of research reports highlighting the biggest risks in the threat landscape.
The Top Three Cyber Attack Threats that Cause a Financial CISO to Lose Sleep (Security Boulevard) We recently had the chance to hear a presentation by the chief information security officer of a leading financial services firm, which gave a number of valuable insights into today’s top security challenges. To set the stage, the speaker shared recent cyber attacks that may not have caught an individual’s attention but definitely made financial... Read More The post The Top Three Cyber Attack Threats that Cause a Financial CISO to Lose Sleep appeared first on CSPi.
Marketplace
Updated: Mystery group ‘Protect America’s Wireless’ stokes national security fears in Sprint/T-Mobile merger (FierceWireless) “Protect America’s Wireless” has been formed in what appears to be an attempt to block the proposed merger of Sprint and T-Mobile.
The IBM And Red Hat Tango (Seeking Alpha) IBM, under the leadership of Ginni Rometty, has just announced the biggest acquisition in its history, an acquisition it hopes will bring it into the future of cloud computing.
Proofpoint - a tale of two technical strategies (RealMoney) Lets check the charts.
Carbon Black: No Reason For Pessimism (Seeking ALpha) Shares of endpoint security company Carbon Black have descended to all-time lows, dropping 10% after reporting Q3 results.
Symantec boss unfazed by endpoint security startups (CRN Australia) Greg Clark says Symantec is "a lot, lot better".
Venable Completes Merger With New York’s Fitzpatrick Cella (New York Law Journal) In a year that's been packed with law firm mergers the deal between Venable and 100-lawyer Fitzpatrick Cella Harper & Scinto was one of the largest.
New DreamPort center bringing small business cyber help to federal sector (Baltimore Business Journal) U.S. Cyber Command tracks and confronts some of the most dire cybersecurity threats facing our country. But it needs a little help sometimes, so there is a new facility in Maryland dedicated to seeking private industry input on government cyber problems.
Chalva Tchkotoua named chief marketing officer at Protegrity (Westfair Communications) Protegrity, a Stamford-based enterprise data security software solutions provider, has named Chalva Tchkotoua as chief marketing officer and head of global alliances.
Viewpoint: Cyber Town USA a welcome addition to Maryland's cyber ecosystem (Baltimore Business Journal) The expansion of the state’s cyber community is always a welcome development and is a key indicator that Maryland is a major player in innovation.
Northrop Preps for 2nd DreamPort Rapid Prototyping Event After Previous Win; Ginger Wierzbanowski Quoted - GovCon Wire (GovCon Wire) Northrop Grumman (NYSE: NOC) is planning to join a rapid proto
Northrop Grumman to coordinate U.S. cyber warfare computer tools and software applications (Military & Aerospace Electronics) U.S. Air Force cyber security experts are looking to Northrop Grumman Corp. to coordinate a new computer systems architecture to host cyber tools and applications for U.S. military offensive and defensive cyber warfare
Hotshot Hires Srini Murty as CRO Following Initial Funding of New Time and Location-Based Mobile Security Solution for Business (PR Newswire) Hotshot today announced the addition of Srini Murty as Chief Revenue Officer. Murty is responsible for revenue ...
Products, Services, and Solutions
AOP and The Media Trust to Help UK Digital Media Companies Manage Cookie Deployment and GDPR Requirements (The Media Trust) Cookie Declaration Boosts Transparency and Streamlines Communications Between Digital Partners
Circadence® Joins National Effort to Promote Critical Infrastructure Security and Resilience (AP NEWS) Circadence Corporation, the market leader in cybersecurity readiness solutions, is participating in Critical Infrastructure Security and Resilience Month by educating public and private sectors about modern cybersecurity readiness solutions that emulate networks of entire cities, enabling collaborative preparedness work.
Aujas and Endgame announce partnership to deliver advanced managed endpoint protection services (Endgame) Aujas, a leader in cybersecurity transformation services, and Endgame, the leader in unified protection against targeted attacks, today announced a new strategic partnership.
Keeper Security Unveils New Dark Web Monitoring Product, BreachWatch™ (PR Newswire) Keeper Security, Inc., the leading creator of zero-knowledge security solutions, Keeper® Password Manager and...
ThreatQuotient Integrates Verified Breach Intelligence from Visa to Strengthen Payment Data Defenses (BusinessWire) ThreatQuotient's integration with verified breach intelligence from Visa will enable customers to better detect and prevent payment data attacks.
Raytheon’s GPS OCX passes cybersecurity tests (GPS World) System prevented broadcast of corrupt navigation, timing data. Raytheon Company’s GPS Next-Generation Operational Control System, known as GPS OCX, has completed several cybersecurity vulnera…
Intel Develops Blockchain Product for Ensuring Data Security (Today) iExec startup releases Intel-powered solution for secure cloud computing
Beagle free visual analytics tool helps bring cybercriminals to justice (Help Net Security) Researchers from New York University Tandon School of Engineering with Agari, developed the Beagle free visual analytics tool.
Technologies, Techniques, and Standards
ODNI releases Insider Threat Framework (Intelligence Community News) The National Insider Threat Task Force (NITTF), operating under the joint leadership of the Attorney General and the Director of National Intelligence, announced on November 1 the release of the “I…
Survey Shows GDPR Costs Exceeded Expectations (Versasec) Six Months Post Implementation, New Survey Shows Educating Internal Employees on GDPR Remains a Top Challenge
GDPR compliance: Key steps in the GDPR compliance journey (Computing) Wipro's Murthy Vedula examines some of the lessons learnt from running GDPR compliance projects
NIST Teams Up with IBM’s Watson to Rate How Dangerous Computer Bugs Are (Nextgov.com) The artificial intelligence program will replace tedious work done by human analysts.
Ensuring election integrity: The overlooked last mile of securing voter data (Help Net Security) With 99 percent of America's votes counted by computers, security experts agree that our elections remain extremely vulnerable for a cyberattack. Fourteen
5 Reasons Why You're a Perfect Cyber Attack Target (IEEE Spectrum) While cyber attacks should never happen to anyone, there are certain reasons why targets become victims of these attacks.
Centralize your Data, Achieve Long-Term GDPR Compliance (Infosecurity Magazine) Data storage became so simple and affordable, but what impact does GDPR have on this?
How Dimitry Snezhkov Balances the Yin and Yang of Penetration Testing (Security Intelligence) Dimitry Snezhkov didn't touch a computer until he was 18. Now he spends his days penetration testing to uncover security gaps and his nights meditating on the balance of life.
New DHS Cyber Center Meets with Industry to ID Most Valuable Assets (Nextgov.com) DHS officials met Thursday with officials from the communications, electricity and finance sectors.
Cloud Compliance for Financial Companies Requires a Merger of Three Disciplines - Security Boulevard (Security Boulevard) With weightier compliance penalties, ever-deepening cybercrime, and rapid adoption rates of public or hybrid cloud, financial services companies must pay closer attention to cloud compliance and stop treating it in a vacuum.
Pinpointing risky employee behaviors enables IT leaders to reduce risk (SC Media) By Brian Rutledge, Principal Security Engineer at Spanning In the first half of 2018, more than 4.5 billion digital records were compromised in data
How to Build a Culture of Cyberdefenders (Business.com) For the best cybersecurity, the whole company needs to be actively involved.
Nebraska Secretary of State says election system secure (KETV) Nebraska's top election official said he is confident in the security measures they have implemented to protect the state's election system this upcoming election.
Design and Innovation
How a ‘National Security Help Desk’ Could Secure Critical National Infrastructure (Infosecurity Magazine) The increasingly connected nature of CNI presents an opportunity for cybersecurity skills and knowledge to spread fast and wide.
Research and Development
Hackers will soon be able to manipulate people's memory through brain implants, researchers warn (The Independent) Within five years, scientists expect to be able to build memories and place them in the brain
Academia
Cal Poly Announces $100,000 Grant from Silicon Valley Foundation to Help Fund Research and Training at California Cybersecurity Institute | Cal Poly News (Cal Poly News) A $100,000 grant from the Silicon Valley Foundation will help Cal Poly’s California Cybersecurity Institute (CCI) protect critical infrastructures with multiple initiatives, beginning with a Nov. 4 hackathon focused on the “internet of things.”
Marshall Digital Forensics program partners with Swedish company for Open Source Intelligence (Huntington News) Marshall University’s Digital Forensics and Information Assurance program has partnered with Paliscope, a Swedish software company, in launching the Paliscope Academic Program.
Auburn expert tapped for national security role on cyberspace commission (OANow.com) Auburn University’s newly hired leader for cybersecurity research is one of 13 top experts and government officials named to a special commission to help guide future U.S. defense and policy
SRND Partners With Splunk to Train Students in Cybersecurity (PRWeb) CodeDay, a 24-hour programming event hosted seasonally in 50 cities, is partnering with Splunk to train thousands of high school students in cybersecurity at its
Legislation, Policy, and Regulation
Putin Wants to Restore GRU Name to Military Intelligence (Bloomberg) President Vladimir Putin called for restoring the traditional GRU name to Russia’s military-intelligence agency, which Western governments blame for election meddling, hacking and poison attacks.
Russia’s Military Spies Are a Laughing Stock, But They’re Dangerous as Hell (The Daily Beast) Every failure is another degree of pressure to deliver a win, pressure exacerbated by high levels of infighting among Russia’s security services.
Germany ex-spy chief Maassen may be fired for insults (Deutsche Welle) Maassen reportedly heavily criticized the government to other European security chiefs in his farewell speech. Interior Minister Horst Seehofer, who backed Maassen in other controversies, has declined to do so this time.
Data localisation: A strategic weapon in cyber war (Express Computer) A sovereign has the right to protect its own property in its own jurisdiction and data about its own citizens or entities remains to be adjudicated by Indian laws. No bigger capitalist or profiteering organisations registered in some other jurisdictions can dictate the fate of Indian property i.e. data
Ottawa not ruling out blocking Huawei from 5G supply contracts (The Globe and Mail) Review under way to determine whether Canada should join the U.S. and Australia in banning Chinese telecommunications giant, Goodale says
Spark boss Simon Moutter lays down the law on Huawei (NZ Herald) Simon Moutter also warns broadband price rises are on the way.
Should company bosses face jail for mishandling your privacy? (Naked Security) A proposed bill calls for executives to be jailed for not protecting consumers’ data, or at least for lying about it.
Litigation, Investigation, and Law Enforcement
In a court filing, Edward Snowden says a report critical to an NSA lawsuit is authentic (TechCrunch) An unexpected declaration by whistleblower Edward Snowden filed in court this week adds a new twist in a long-running lawsuit against the National Security Agency’s surveillance programs. The case, filed by the Electronic Frontier Foundation a decade ago, seeks to challenge the governmentR…
FDA isn't doing enough to prevent medical device hacking, HHS report says (MSN) The US Food and Drug Administration is not doing enough to prevent medical devices such as pacemakers and insulin pumps from being hacked, a report from the US Department of Health and Human Services' Office of the Inspector General said Thursday.
Ex-CIA Contractor Says Prison Over Classified Info Unfair (Law360) A Virginia federal judge Friday sentenced a former CIA contractor to 90 days behind bars for illegally obtaining and taking classified material from his former workplace and lying about it to federal investigators, despite his counsel’s arguments that notable government officials have done likewise with lesser consequence.
Ex-Employees Allegedly Steal Micron Trade Secrets Valued At Over $400 Million (Dark Reading) Three individuals who worked for DRAM maker's Taiwan subsidiary stole Micron IP to benefit company controlled by China's government, US says in indictment.
