Cyber Attacks, Threats, and Vulnerabilities
Sears Holdings, Delta and others leak credit cards in “multibreach” (Naked Security) If a third party leaks credit card numbers they were holding on your behalf… it’s still your neck on the block.
Best Buy hit by [24]7.ai data breach, too (CNET) It's not just Delta, Sears and Kmart -- other companies were affected too.
[24]7.ai Issues Statement on Information Security (PR Newswire) [24]7.ai discovered and contained an incident potentially affecting...
Statement on Data Security Incident (Sears Holding) [24]7.ai, a company that provides online support services to Sears and Kmart, notified us, as well as a number of other companies, that they experienced a security incident last fall.
Information on [24]7.ai Cyber Incident (Delta Air Lines) Last week, on March 28, Delta was notified by [24]7.ai, a company that provides online chat services for Delta and many other companies, that [24]7.ai had been involved in a cyber incident.
Cybercriminals are increasingly targeting online retailers. Here's how to protect yourself. (Chicago Tribune) The theft of consumers' payment information at store checkouts is declining. But cybercriminals are going online to steal credit card information.
Cyber-Attacks on US Critical Infrastructure Linked to Cisco Switch Flaw (BleepingComputer) Cisco Talos, the cyber-security division of US IT conglomerate Cisco, said today that hackers are abusing misconfigured Cisco switches to gain a point of entry into organizations across the world.
New MacOS backdoor connected to OceanLotus threat group (ZDNet) OceanLotus has been linked to attacks against human rights organizations, researchers, and more.
US business warned about new chip-based card fraud (Computing) Fraudsters intercepting corporate debit cards in the post in order to replace their chips,Security ,Financial Services,security,Brian Krebs,bank
Secret Service Warns of Chip Card Scheme (KrebsOnSecurity) The U.S. Secret Service is warning financial institutions about a new scam involving the temporary theft of chip-based debit cards issued to large corporations.
Digital Shadows Finds 1.5 Billion Business and Consumer Files Exposed Online – Just One Month Before Businesses Face €20m Fines Under GDPR Legislation (BusinessWire) Digital Shadows outlines the sheer scale of sensitive business and consumer files exposed online putting organizations and their customers at risk.
Mirai-Variant IoT Botnet Used to Target Financial Sector in January 2018 (Recorded Future) Insikt Group assesses that a Mirai botnet variant, possibly linked to the IoTroop or Reaper botnet, was utilized in attacks on at least one company, and probably more, in the financial sector in January 2018.
Microsoft investigates causes of Europe-wide Office 365 outage (Computing) Friday email outage for Microsoft Office 365 users
Beware ad slingers thinly disguised as security apps (WeLiveSecurity) ESET researchers have analyzed a newly discovered set of apps on Google Play, Google's official Android app store, that pose as security applications. Instead of security, all they provide is unwanted ads and ineffective pseudo-security.
IBM: Human error is biggest reason for data breaches as ransomware attacks surge (WRAL TechWire) Human error is by far the biggest reason why cybercriminals are able to breach corporate data systems, according to a new report from IBM.
Why hackers are targeting your office gossip (MarketWatch) The scary message from cybersecurity experts: Ransomware is on the rise.
Rarog Trojan 'Easy Entry' For New Cryptomining Crooks, Report Warns (Threatpost) A malware family called Rarog is becoming an appealing and affordable entry point for hackers to run cryptocurrency mining campaigns, researchers say.
Cryptocurrency mining attacks mainly target universities (University World News) The global higher education sector has seen a sharp increase in potentially damaging cryptocurrency mining behaviours with universities the target of more than half of known attacks.
Cryptojacking Enjoys Boom, New Symantec Report Shows (Cryptovest) Symantec has found an increase of 8,500% in coin mining software on systems, making cryptojacking the top malware trend of 2017.
Facebook retracted Zuckerberg’s messages from recipients’ inboxes (TechCrunch) You can’t remove Facebook messages from the inboxes of people you sent them to, but Facebook did that for Mark Zuckerberg and other executives.
Security Patches, Mitigations, and Software Updates
Researchers Hijack Over 2,000 Subdomains From Legitimate Sites in CloudFront Experiment (BleepingComputer) Security experts from MindPoint Group, an information security firm, have hijacked over 2,000 subdomains from legitimate websites while researching possible security flaws in Amazon's CloudFront CDN service.
Microsoft Confronts Ransomware, Cyber-Crime in New Office 365 Updates (eWEEK) New security capabilities in Office 365 and OneDrive help home users avoid losing their data to ransomware and cyber-attackers.
Cyber Trends
Q2 - Q3 2017 DDoS Attack Trends Report (Corero) Take an inside look at the growing complexity of DDoS attacks in our new Trends Report. Learn about what it means for protecting the integrity of your business.
‘Pre-planned cyber attacks on the rise amid improvement in threat detection’ (UKTN (UK Tech News)) Trustwave's global security report has revealed that vulnerabilities are on the rise – but email malware is becoming less common.
Cyber attacks are becoming more organized and structured (Help Net Security) Trustwave released the 2018 Trustwave Global Security Report which reveals the top security threats, breaches by industry, and cybercrime trends from 2017.
Cyberattacks to grow as hackers target greater financial returns – Trend Micro (Engineering News) The increase in ransomware, cryptocurrency mining and business email compromise attempts throughout 2017 will continue this year as cybercriminals refine and target their attacks for greater financial return, says cybersecurity multinational Trend Micro.
Multi-cloud use and compliance requirements shape encryption strategy (Cambridge Network) Encryption with public cloud services has experienced double digit growth, says a new report from Thales e-Security.
Retail sector top cyber attack target (ComputerWeekly.com) The retail sector was the top cyber attack target in 2017, as cyber attacks evolved to become more organised and structured, a report reveals.
Cybersecurity may be beating cyber fear (The Christian Science Monitor) Despite the drumbeat of data breaches, such as Facebook’s, the good news is that companies and governments are putting security first, according to a new survey.
Marketplace
In Plain Sight: Why Military Veterans Are a Great Fit for Cybersecurity Careers (Security Intelligence) To help close the skills gap, IBM supported the launch of TechVets, a nonprofit organization dedicated to helping veterans and service leavers transition into cybersecurity careers.
McAfee report suggests gamers could thrive in a cybersecurity career (PC Gamer) Security managers think highly of gamers and the fresh perspective they bring to cybersecurity issues.
Cyberinsurance Tackles the Wildly Unpredictable World of Hacks (WIRED) Insuring against hacks and breaches can be a lucrative business—but also presents unique challenges.
Cybersecurity Vendors and Law Firms Partner Up, But Caution Still Advised (The American Lawyer) While partnerships between cybersecurity companies and law firms are on the rise “there is a lot of potential for conflicts of interest” said one partner at an Am Law 100 firm.
Huawei Pushes Back On FCC Efforts to Bar It From U.S. Networks (Nextgov.com) FCC’s concerns Huawei is a Chinese spying tool are unfounded and based in rumor, the company said.
Compassion, communication and clued-in execs make these places special (Tampa Bay Times)
The doctors had prepared Letha Imboden for the worst.Her husband, Robert, diagnosed with a brain tumor, would need a delicate surgery. The outcome was uncertain. If he survived, he would require a lo
Akamai names LogMeIn CEO to board of directors (Boston Business Journal) Cambridge-based Akamai Technologies Inc. is adding Bill Wagner, the CEO of Boston-based LogMeIn Inc., to its board of directors, the latest in a series of changes at the tech giant since activist investor Elliott Management took a stake in Akamai in late 2017.
Cavirin Accelerates Company Growth With Key Executive Hires (BusinessWire) Cavirin Systems, Inc., the only company providing cybersecurity risk posture and compliance for the enterprise hybrid cloud, today announced the expan
Gigamon Names Michelle Hodges as its New Vice President of Worldwide Partner Sales (ReadITQuik) Michelle Hodges has previously worked with companies like Riverbed Technologies, Apptio, Microsoft, VMware, SAP, APJ
Products, Services, and Solutions
Arctic Wolf Achieves SOC 2 Type II Compliance Certification (BusinessWire) Arctic Wolf Networks, a leading security operations center-as-a-service company, has achieved the Service Organization Control (SOC) 2 compliance cert
Thycotic Releases Free Least Privilege Discovery Tool (Security Boulevard) Thycotic, provider of privileged account management (PAM) solutions for more than 7,500 organizations worldwide, today announced the release of its Least Privilege Discovery Tool …
VirusTotal Launches Droidy, Its New Android Sandbox Technology (BleepingComputer) VirusTotal, the aggregated antivirus scanning engine owned by Google, announced today a new Android sandbox technology named Droidy.
Cofense Makes it Easier to Boost Resiliency Against Phishing Attacks with Enhancements to its Security Awareness and Conditioning Solutions | Markets Insider (Business Insider) Cofense™, the leading provider of human-driven phishing defense solutions worldwide, today announced industry-first...
This change can make your online browsing faster and more private (Popular Science) There is a small, simple step you can take right now that promises to make your online browsing faster and more private.
Mimecast rolls out new API developer portal to extend business and cyber resilience (Developer Tech) Email and data security provider Mimecast has rolled out a new application programming interface (API) developer portal to extend business and cyber resilience for email with a constant, scalable and uniform API.
SafeZone secure web browser rebrands as Avast, adds new features (MobileSyrup) Online security company Avast has released a new web browser that promises both faster browsing speeds and more privacy online.
Nessus Turns 20! (Security Boulevard) Twenty years ago this week, I released the first public version of Nessus.
Amazon rolls out remote access to its FreeTime parental controls (TechCrunch) Amazon is making it easier for parents to manage their child’s device usage from their own phone, tablet, or PC with an update to the Parent Dashboard in Amazon FreeTime. Since its launch in 2012, Amazon’s FreeTime Unlimited has been one of the better implementations of combining kid-fr…
Technologies, Techniques, and Standards
In Army’s newest unit, everyone learns cyber skills (Fifth Domain) The Army's newest unit received cyber and electronic warfare prep from members of Army Cyber Command before their deployment to Afghanistan in March.
What hackers do: their motivations and their malware (CSO Online) Whether a hacker uses a computer exploit or malware, their motivations are the same. Understanding why and how hackers hack is key to your defense.
In Cyber-Defense, Good Enough is Far Better Than Perfect (InformationWeek) Agile and DevOps concepts help businesses get the basics of applications to market quickly, and those same concepts can help prepare the military for its challenges.
How to keep apps from tracking you on Facebook (KUSA) Tips on preventing an app from lying dormant and collecting your information.
Re-Thinking ‘Patch and Pray’ (Security Boulevard) When WannaCry ransomware spread throughout the world last year by exploiting vulnerabilities for which there were patches, we security “pundits” stepped up the call to patch, as we always do.
IT audit best practices: Technological changes give rise to new risks (Help Net Security) ISACA and Protiviti paint a picture of the ways IT audit leaders and professionals are succeeding, as well as where they need to step up their games, and they offer IT audit best practices.
As “air gap” cyber solutions evolve, consider alternative approaches says U.S. critical infrastructure security expert from OPSWAT Inc. (CSO) Organisations seeking ultimate defence against cyber attacks can benefit from evolving security practices and automated security technologies
Why hiring more cybersecurity pros may not lead to better security (TechRepublic) Adding more security teams staffers for vulnerability response won't improve an enterprise's posture if they don't fix broken patching processes first, according to a ServiceNow report.
Find out who is leaking your secrets with help from invisible zero-width characters (The State of Security) The use of zero-width characters like a zero-width non-joiner makes it possible to embed fingerprints into text that survive the cut-and-paste process.
Design and Innovation
A 200-Year-Old Idea Offers a New Way to Trace Stolen Bitcoins (WIRED) Cambridge researchers point to an 1816 precedent that could fundamentally change how "dirty" Bitcoins are tracked.
Facebook’s new fake news strategy is… decide for yourself! (Naked Security) Facebook is getting rid of fact-checkers and leaving it up to readers to decide what’s real
Facebook can’t catch a break: Medical data-sharing plan halted (Ars Technica) “This work has not progressed past the planning phase,” Facebook says.
Research and Development
Academics boycott university amid fears it is making killer robots (The Independent) Leading artificial intelligence researchers have boycotted South Korea’s top university after it teamed up with a defence company to develop “killer robots” for military use.
Should AI researchers kill people? (TechCrunch) AI research is increasingly being used by militaries around the world for offensive and defensive applications. This past week, groups of AI researchers began to fight back against two separate programs located halfway around the world from each other, generating tough questions about just how much…
In AI, Russia Is Hustling to Catch Up (Defense One) Putin is spurring frenetic efforts to marshal the country’s academic and industrial resources for breakthroughs in the field — and just might achieve them.
Legislation, Policy, and Regulation
NATO could invoke collective defence if attacked in cyberspace, Stoltenberg warns (RCI | English) NATO could trigger its collective defence mechanism if faced with a devastating cyberattack, the alliance's Secretary General Jens Stoltenberg said Wednesday.
“NATO takes cyberthreats very seriously because we have seen more and more cyberattacks,” Stoltenberg told reporters in Ottawa during a jo
Estonian President, Eyeing Bigger U.N. Role, Urges Government Action on Cybersecurity (Wall Street Journal) International community failing to establish cyber norms, monitor threats, leader of tiny nation on digital frontline says.
From AI to Russia, Here’s How Estonia’s President Is Planning for the Future (WIRED) Kersti Kaljulaid, Estonia’s youngest and first female president, lays out her plans for moving the country from a traditional state to a digital society.
A rare insight into cyber espionage: Dutch intelligence and two Russian bears (The Strategist) In the European summer of 2014, cyber operators from the Dutch Joint Cyber SIGINT Unit—operated by Dutch intelligence and security services—gained access to APT29, better known as Cozy Bear. This well-known Russian hacker group targets ...
Fix U.S. cyber security strategy (Post and Courier) Cold War history seems to be repeating itself in the ongoing confrontations between the United States and Russia and China. But among the most valid concerns is the vulnerability of
Marines cyber forces to grow (Fifth Domain) The Marine Corps is building up its proficiency and talent in the cyber career field to be better postured to fight and win in an increasingly modern battlefield.
Army Cyber Command gets limited acquisition authority (Fifth Domain) The deputy to the commander of ARCYBER now has the ability to get capability into the hands of operators faster.
Gina Haspel’s agenda for the CIA (TheHill) Expect Haspel to guide the CIA back to basics, realign its workforce, emphasize foreign language fluency, and bring new energy to partnerships.
Pentagon names former J.P. Morgan official as its new CIO (FederalNewsRadio.com) Dana Deasy, who most recently had been the chief information officer at J.P. Morgan Chase, will join DoD as its new CIO sometime in early May.
Analysis | Outgoing Trump administration officials keep sending distress signals (Washington Post) A fast-rising number of top advisers are departing by settling scores or sending warning signals.
Litigation, Investigation, and Law Enforcement
YouTube Shooting Casts Light on Video Makers’ Complaints (Wall Street Journal) Some independent video makers complain YouTube has limited viewership and shortchanged them on ad payments
'You'll be sorry,' Russia tells Britain at U.N. nerve agent attack... (Reuters) Russia told Britain at the United Nations Security Council on Thursday that "you're playing with fire and you'll be sorry" over its accusations that Moscow was to blame for poisoning a former Russian spy and his daughter.
Salisbury poison ‘made at Russia’s Porton Down’ (Times) A Russian military research base has been identified as the source of the nerve agent used at Salisbury in a British intelligence briefing for its allies, The Times has learnt. It was used to...
A Hard Transparency Choice: What is WikiLeaks? (Lawfare) There are a number of competing interests weighing on the question of whether the intelligence community should provide more information about what WikiLeaks is and how it operates.
Ex-CIA Chief Brennan’s Broadsides Against Trump Only Help Putin (The Cipher Brief) Brennan's tweets excoriating Trump's character played right into the hands of an adversary trying to widen the partisan divide.
Zuckerberg will also testify before the Senate (TechCrunch) Earlier this week, the House Energy and Commerce Committee announced that Facebook CEO Mark Zuckerberg is slated to testify on the use and protection of user data in Washington D.C. on April 11. Turns out, Zuckerberg will have a busier week in D.C. than expected, with the Senate Judiciary and Senat…
The Question Only Mark Zuckerberg Can Answer Before Congress (WIRED) Facebook CEO Mark Zuckerberg has finally agreed to appear before Congress—which means he might finally get at the real issue behind Facebook's woes.
Mt. Gox ex-CEO, who may profit from site’s fall, says he “doesn’t want this” (Ars Technica) "I do not want to become instantly rich. I do not ask for forgiveness."
