Cyber Attacks, Threats, and Vulnerabilities
What Really Went on at Russia’s Seattle Consulate? (POLITICO Magazine) The closure of the facility could limit military and tech-industry espionage—and leaves Russia with no diplomatic presence on the West Coast.
Under Armour says 150 million MyFitnessPal accounts compromised in data breach (The Verge) Hackers obtained user names, email addresses, and hashed passwords
Sandiflux: Another Fast Flux infrastructure used in malware distribution emerges (Proofpoint) Proofpoint researchers studied a previously undocumented botnet providing Fast Flux infrastructure for cybercrime.
Boeing says no impact to military aircraft business after WannaCry cyberattack (Fifth Domain) Boeing says the WannaCry virus hit a small number of computers on its commercial side.
Boeing hit by WannaCry, reminding everyone the threat is still there (Naked Security) Is this the return of WannaCry? Or did it simply never go away?
Boeing calls reported cyber attack, "Overstated and inaccurate" (WCIV) Boeing is the latest company to fall victim to a cyber attack. The airplane maker says some of its computers were infected by the wannacry virus, ABC News reports. The company says it affected a limited number of computers at the facility in North Charleston...
Boeing's systems nearly brought down by return of WannaCry ransomware (Computing) Return of the WannaCry malware could have disabled critical Boeing software
Boeing attack shows the fear over WannaCry is still very real (Cyberscoop) An apparent tempest-in-a-teapot intrusion shows how even the biggest organizations to come to a crippling halt at any sign of the notorious ransomware.
Cyber criminals now cryptojacking mobile phones (The Straits Times) Beware. Your mobile phone might actually be helping cyber criminals mine for cryptocurrency like Bitcoin, even if you were diligent enough not to download suspicious, malware-laden apps.. Read more at straitstimes.com.
Crypto mining runs rampant in higher education: Is it students? (Help Net Security) The higher education sector exhibited a startling increase in potentially damaging cryptocurrency mining behaviors, according to Vectra.
Assange and his groupies backed wrong side (Times) Pity the bien-pensants. Only five years ago, life was so simple. Julian Assange and Edward Snowden were heroes, defending individual freedom and privacy against the depredations of overweening...
The psychology behind Cambridge Analytica is massively overhyped (Quartz) The psychological techniques used to influence us are neither as precise nor as powerful as Cambridge Analytica bosses have promised. Yet.
Lazarus Group Targets More Cryptocurrency Exchanges and FinTech Companies (Intezer) Introduction Cyber attacks from the Lazarus Group, a threat actor associated with North Korea, has not slowed down and their malware toolset continues to evolve. A few months ago, we published a general research of the Lazarus Group and the Blockbuster campaign including code reuse and similarities throughout their malware up until the latest news …
Unmasking Monero: stripping the currency’s privacy protection (Naked Security) The features that make blockchains trustworthy may leave them vulnerable to retrospective action.
An in-depth malware analysis of QuantLoader (Security Boulevard) QuantLoader is a Trojan downloader that has been used in campaigns serving a range of malware, including ransomware, Banking Trojans, and RATs. In this post, we'll take a high-level look at the campaign flow, as well as a deep dive into how the malware executes. Categories: Malware Threat analysis Tags: backdoormalware analysisQuantLoaderQuantLoader Trojantrojan (Read more...) The post An in-depth malware analysis of QuantLoader appeared first on Malwarebytes Labs.
City: Cyber attack against Baltimore's 911 computer-aided dispatch system was ransomware (Technical.ly Baltimore) According to Baltimore's CIO, the vulnerability was left open during troubleshooting. Ransomware is among the most common attacks against public safety agencies, said SecuLore's Tim Lorello.
Atlanta has shut down courts and people there can't pay their bills online because of a crippling cyberattack the mayor has called 'a hostage situation' (Business Insider) A ransomware attack against Atlanta has forced the city to shut down municipal courts and has prevented residents from paying certain bills online.
Emails show Atlanta received multiple alerts about cyber threats (Atlanta Journal Constitution) A series of leaked emails dating back to June appear to suggest that software from an outside vendor might have been the source of infection for a ransomware cyber attack on city of Atlanta.
Even in Silicon Valley, government is under constant threat from ransomware, cyberattacks (The Mercury News) Experts troubled that more than a third of local governments don’t know whether their electronic information systems have been breached.
To Pay or Not to Pay Hackers? Ransomware Poses a Potentially Deadly Dilemma (Governing) Baltimore's 911 system and a range of city services in Atlanta were hijacked in the past week.
As Atlanta Seeks To Restore Services, Ransomware Attacks Are On The Rise (NPR.org) The FBI says the practice of locking computer systems in exchange for money has become increasingly common, and that cities, schools and hospitals are especially vulnerable to hackers.
Patient harm from hacked medical devices plausible: security researcher (Digital Health) A leading cyber security analyst at Kaspersky Lab has warned there is a viable danger of death from hacked medical devices if measures aren’t put in place to secure them.
‘I Found A Security Lapse In Aadhaar That Could Allow A Major Chunk Of Information To Be Stolen’ (IndiaSpend) For the second time in the first three months of 2018, the vulnerabilities of the Aadhaar programme--the world’s largest biometric database--were exposed when American business technology website ZDnet reported on March 23, 2018, that the personal data of millions of enrolled Indian...
Aadhaar security and authentication flaw can give access to data without OTP: Ethical hacker (Business Standard) Aadhaar comprises a unique 12-digit number assigned to Indian residents. 1.2 billion Indians or 99.7% of population enrolled in Aadhaar prgramme. Data security expert identifies that Aaadhar can reveal data without OTP.
Security Patches, Mitigations, and Software Updates
Microsoft Issues Out-Of-Band Security Update for Windows 7 & Windows Server 2008 (Bleeping Computer) Microsoft issued today an out-of-band security update for 64-bit versions of Windows 7 and Windows Server 2008 R2.
Apple Releases Security Updates for iOS, watchOS, tvOS, and Xcode (Bleeping Computer) Today Apple has released security updates for iOS, watchOS, tvOS, and Xcode. Many of the resolved vulnerabilities allow for privilege escalation, remote code execution, and information disclosure. Due to the nature of these vulnerabilities, it is strongly advised that all users update their devices as soon as possible.
Stop swearing on Skype! And don’t even think about sending that nude selfie… (Naked Security) Microsoft has banned nudity, swearing and other unsavoury behaviors in Skype, Xbox, email, and Office 365 docs.
Cyber Trends
Healthcare Security Expert: The Top Cyberthreat in Healthcare is Finance (Bricata) Security professionals in healthcare organizations struggle with a range of variables, but none may be so challenging as finance and budget. Emerging threats and new tactics typically require some level of investment to defend and this post turns... #healthcaresecurity #ransomware #securitybudgets
The State of Risk Management in 2018 I LogicManager (ERM Software) We surveyed hundreds of governance, risk, and compliance professionals across industries to learn more about the state of risk management in 2018.
Is it time to unify endpoint management and security? (CSO Online) Modern unified management makes sense, and the industry is reacting by providing solutions. The question is whether enterprise organizations will use them.
Marketplace
Boosting the Cyberworkforce (GovTech) Amid persistent shortages in cybersecurity positions, what can states do to strengthen their numbers?
Mark Zuckerberg won't lose his job any time soon (Engadget) This isn't going to be a Travis Kalanick situation.
Are there too many cybersecurity companies? (Help Net Security) There is too much noise in the market. CISOs don’t want to manage 80 products — they want to have a holistic solution involving fewer vendors.
Palo Alto Networks CEO: Consolidation thwarts innovation (Axios) "No one company can create all the innovation," McLaughlin said.
A big chunk of Israel’s tech scene is actually not based in Israel (Financial Post) When success begets success in America, some find their home country is less a market than an incubator
OPAQ Networks Acquires FourV Systems to Enhance Security Operations Management Automation (BusinessWire) The addition of FourV to the OPAQ Cloud will enable managed service providers to automate security and compliance measurement, monitoring & reporting.
CCA members look for answers amid U.S. crackdown on Huawei (FierceWireless) Some rural operators that have deployed gear from Huawei are wondering what will happen next.
Lenovo responds to U.S. government targeting Chinese equipment firm Huawei (WRAL TechWire) In response to the news that the Federal Communications Commission is joining other government agencies in targeting the giant Chinese network equipment maker, Huawei, Lenovo said in a statement that it is "Evaluating what it means for the industry and our business."
SAIC is 'very comfortable' at its size as competitors scale up (Washington Business Journal) If Science Applications International Corp. is going to make another aggressive bid for scale in a rapidly consolidating government services market, CEO Tony Moraco isn’t tipping his hand.
Tom McAndrew wants to keep entrepreneurial bent as he takes over as Coalfire CEO (FierceCEO) As Tom McAndrew prepares to take over as Coalfire’s CEO this weekend, he wants the cybersecurity advisory services provider to maintain its entrepreneurial way of operating.
The 5 Biggest D.C. Tech Hires to Know About from March (DCInno) Every month we recap the biggest tech hires and departures in the D.C. area.
Cylance Strengthens Executive Team with New CIO, CMO and CPO (Security Boulevard) Cylance is pleased to announce the appointment of Grant Johnson as Chief Marketing Officer (CMO) and Kumud Kalia as Chief Information Officer (CIO). The company also promoted Eric Cornelius to Chief Product Officer (CPO).
Products, Services, and Solutions
Proactive Device Security for Faculties: Wesleyan University (Prey Project) Case Study on Wesleyan University's implementation of Prey as a key part of their mobility program.
Netwrix Auditor Helps Automotive Manufacturer Secure Design Projects and Streamline J-SOX Compliance (CIO Dive) Netwrix Corporation, provider of a visibility platform for user behavior analysis and risk mitigation in hybrid environments, announced today that DENSO Manufacturing Hungary improved data security to ensure smooth business processes and achieve sustainable compliance, thanks to the complete visibility provided by Netwrix Auditor.
‘Cyber bullets’ were once a spy tool but may soon scan Wi-Fi networks for the Army (Fifth Domain) Leidos is working to enable local brigade commanders to use
Microsoft Unveils Project VAST Security Visualization Tool (Redmondmag) Microsoft described Project VAST this week, a new tool that promises to visually surface security problems.
XL Catlin and RedSeal launch risk analysis tool for cyber insurers (ReinsuranceNe.ws) Insurer and reinsurer XL Catlin and RedSeal have launched a risk analysis tool for cyber insurers with a dynamic measure of resilience to gauge risk and improve cybersecurity and insurance terms. The risk analysis objectively measures a network's resilience to help underwriters more thoroughly evaluate their clients’
Major UK e-Commerce Firm Embraces Pindrop Security for the Call Center (FindBiometrics) British e-commerce giant Shop Direct has embraced Pindrop's Phoneprinting technology, the companies have announced. The solution is being used to...
Zscaler Completes SOC 2, Type II Certification (GlobeNewswire News Room) Achievement Demonstrates Continued Commitment To Security and Availability
WISeKey unveils cryptocurrency payment solution for connected objects - Electronic Payments International (Electronic Payments International) WISeKey International, a Swiss cybersecurity and IoT solutions firm, has launched an IoT cryptocurrency smart payment solution that will enable connected objects to pay for …
National Hockey League Players’ Association deploys Darktrace AI (Cambridge Network) Darktrace, the world’s leading AI company for cyber defence, has today announced that the National Hockey League Players’ Association (NHLPA) has deployed the Enterprise Immune System to protect the sensitive personal information of its 750 members across the US and Canada.
Technologies, Techniques, and Standards
Thwarting a Power Grid Control Center Cyberattack (Nozomi Networks) Based on recent reports of Russian involvement in a multistage intrusion of the US power grid, it’s no longer a question of “if” threat actors will gain access to critical infrastructure control systems – it’s when it will happen again, and for what purpose.
What can be done to thwart these potentially disruptive assaults?
The CNN Factor Adds More Complexity to Security Operations (SecurityWeek) Enterprises needed is a single, shared environment that fuses together threat data, evidence and users, so that all team members involved in the investigation process can collaborate.
A More Cyber-Conscious Supply Chain Management (SIGNAL) The Army is strengthening its cybersecurity posture through a system of systems look.
Design and Innovation
Patentability of Blockchain and Distributed Ledger Technology (The Legal Intelligencer) Decentralized data structure management technology (DDSM) such as blockchain and distributed ledger technology is grabbing ever-increasing attention as a result of its potential to revolutionize the way we conduct business run our governments and go about daily life.
Microsoft doubles down on artificial intelligence in engineering reorganization (GeekWire) Two key letters show up throughout Microsoft’s major reorganization announcement this morning: AI. Artificial intelligence will get even more emphasis as part of the company’s reshuffling of…
Research and Development
IBM sees quantum computing going mainstream within five years (CNBC) Within five years, IBM predicts, the tech industry will discover the first mainstream application of quantum computers alongside classical computers.
Academia
NDSU Institute, USMC Work Together to Prepare Next Generation of Cyber Warriors (Digital Journal) The North Dakota State University Institute for Cyber Security Education and Research, the NDSU Department of Computer Science and the United States Marine Corps will be working together this fall to prepare NDSU students to secure America.
Legislation, Policy, and Regulation
Russian Military Chief Lays Out the Kremlin’s High-Tech War Plans (Defense One) Robotics, artificial intelligence, and a willingness to strike the enemy’s non-military targets will figure in the country’s future strategies.
#TrollTracker: Stale Narratives In Response to Expelled Diplomats (Medium) Pro-Kremlin trolls compare the Skripal case to Iraq War and a #falseflag to start a war with Russia.
Coordinated Russian Expulsions a Great Start. What Next? (Atlantic Council) The announcement of the coordinated expulsion of more than 150 Russian diplomats and intelligence officers from the US, Europe, and other global partners showed what the deft hand of diplomacy can accomplish in countering Russian aggression. The...
If we want to stop Putin, we need to go after his sources of money (WTVA News) More than 100 Kremlin diplomats in over 20 countries are in the midst of ...
How Not to Pressure Putin (Foreign Policy) Britain needs strategic patience, not shrill denunciations, to keep Russia in check.
Is US Policy on Russia Changing? (Atlantic Council) The coordinated move by the United States and two dozen other countries on March 26 to expel more than one hundred Russian diplomats, if followed with additional actions targeted at Russian influence and money, could mark a significant turning...
Exclusive: Russian ambassador pleads for help in securing Washington meetings (POLITICO) Anatoly Antonov has been rebuffed by U.S. government officials who are reluctant to be seen as friendly toward the Kremlin.
With Its New 'White Book,' France Looks to Become a World-Class Player in Cyber Space (War on the Rocks) On April 8, 2015, TV5 monde, an international French channel boasting 32 million viewers every week, was suddenly cut off air, with its websites eventually displaying banners advertising a so-called “Cyber Caliphate.” The channel had been the victim of a sophisticated cyber attack, stoking anxiety exactly four months
How Cyber Security Agency is protecting Singapore in the changing cyber landscape (OpenGovAsia) Mar 29, 2018 - by Nicky Lung - CSA Deputy Chief Executive (Development) Mr Teo Chin Hock iterates how CSA is protecting the cyber space of Singapore in the changing cyber landscape. - opengovasia.com
Record number of New Yorkers impacted by data breaches in 2017 (WKBW) New York's Attorney General says his office received a record number of data breach notices in 2017.
New York offers free cyber security tools to public to deter hackers (Reuters) New York City will offer free cyber security tools to the public as part of a new effort to improve online safety, officials said on Thursday, a week after Atlanta was hit with a ransomware attack that knocked some municipal systems offline.
Post WannaCry, NHS Seeks New Cyber-Security Deputy (Silicon UK) Government seeks candidate to lead £200m programme to sharpen cyber security resilience of the NHS
How the Air Force Changed Tune on Cybersecurity (GovTechWorks) Combining development, security and operations into an integrated process -- DevSecOps in industry parlance -- is the new name of the game. The aim: Build security in during devlopment, rather than bolting it on at the end.
Post Mortem Data Protection Laws (Security Boulevard) Once someone passes away, what security protections are in place to prevent their social media accounts from being hijacked, or worse, their online identity being stolen and used by fraudsters?
Litigation, Investigation, and Law Enforcement
Justice watchdog to review potential abuses by FBI in secretive court (Federal Times) The FBI is under review to see if it abused its power in an application submitted through the Foreign Intelligence Surveillance Court.
Minneapolis FBI agent charged with leaking classified information to reporter (MPR News) Terry Albury, who was working on counterterrorism, was charged this week by the Justice Department with one count of "knowingly and willfully" transmitting documents relating to national defense to a reporter.
High Court Allows NYPD to Evade Acknowledging Whether They Have Information About Muslim Surveillance (New York Law Journal) In a 4-3 decision the majority ruled that the NYPD was within its rights to give a nonresponse when it received Freedom of Information Law requests from two Islamic men who wanted records tied to possible police surveillance.
Leaving your job: what you can and can’t take with you (CIO) Outright theft is an obvious no-no, but there are still some gray areas when it comes to what you can take with you when you leave a job and what you could land you in legal hot water.
