New York: the latest from the Cyber Investing Summit
Cybersecurity 500 2018: The Official List (PR Newswire) Cybercrime is the greatest threat to every company in the world, and one of...
Cyber Attacks, Threats, and Vulnerabilities
Stealth Mango and Tangelo: Nation state mobile surveillanceware stealing data from military & government officials (Lookout) Lookout Security Intelligence has discovered Android and iOS surveillanceware tools targeting government officials, diplomats, military personnel, and activists, specifically in Pakistan, Afghanistan, India, Iraq, and the UAE. We're calling these surveillanceware families Stealth Mango (Android) and Tangelo (iOS).
Stealth Mango & Tangelo: Selling your fruits to nation state actors (Lookout) Lookout Security Intelligence has discovered a set of custom Android and iOS surveillanceware tools we’re respectively calling Stealth Mango and Tangelo.
Pakistan: Investigation uncovers 'sinister' hacking campaign targeting activists (Amnesty International) Exclusive investigation used digital forensic techniques and malware analysis to uncover hacking methods
An Analysis of Islamic State Propaganda Distribution (Flashpoint) The success of the Islamic State’s (ISIS) information-warfare strategy relies on the group’s ability to distribute propaganda to targeted audiences online. Moreover, to ensure the longevity of its material, ISIS has taken considerable measures to prevent its content from being removed from the internet.
Vietnamese hackers trigger software trap on Cambodian news website (ABC News) A Vietnamese state-linked hacking group has used Cambodia's Phnom Penh Post website to target a local human rights organisation with malicious code.
Rising Nation State Cyber Attacks from…Lebanon and the Netherlands? (BusinessWire) Optiv Security has published its 2018 Cyber Threat Intelligence Estimate (CTIE), which details the current state of the cyber-threat landscape.
New DDoS Attack Method Obfuscates Source Port Data (SecurityWeek) Recent distributed denial of service (DDoS) attacks showed evidence of a new method being used to bypass existing defenses by obfuscating source port data.
UPnP protocol exploit makes it harder for IT to shut down DDoS attacks (TechRepublic) Attackers can use the Universal Plug and Play protocol to hide packet sources during a DDoS attack.
Java Deserialization Vulnerability Found to be Widespread Across SaaS Vendor SDKs (ShiftLeft Blog) Recently, we’ve identified a number of our customers who are susceptible to a deserialization-based remote control execution (RCE)…
Severe DoS Flaw Discovered in Siemens SIMATIC PLCs (SecurityWeek) High severity vulnerability discovered in Siemens SIMATIC S7-400 PLCs can be exploited remotely to cause devices to enter a DoS condition
Serious XSS vulnerability discovered in Signal (Naked Security) Researchers have discovered a serious cross-site scripting (XSS) vulnerability affecting all desktop versions of Edward Snowden’s favourite security application, Signal.
Shadowy Hackers Accidentally Reveal Two Zero-Days to Security Researchers (BleepingComputer) An unidentified hacker group appears to have accidentally exposed two fully-working zero-days when they've uploaded a weaponized PDF file to a public malware scanning engine.
New Bip Dharma Ransomware Variant Released (BleepingComputer) A new variant of the Dharma Ransomware was discovered that appends the .bip extension to encrypted files. It is not known exactly how this variant is being distributed, but in the past Dharma is typically spread by hacking into Remote Desktop Services and manually installing the ransomware.
Indian Cricket Board Exposes Personal Data of Thousands of Players (HackRead) A trove of personal and sensitive data belonging to around 15,000 to 20,000 Indian applicants participating in cricket seasons 2015-2018 have been found online.
Airports are ill-equipped to handle cyber attacks, says report (Computing) Airports could face millions in damages
WannaCry One Year Later: Looking Back at a Milestone (McAfee Blogs) Has it been a year? It seems longer. When the WannaCry ransomware attack hit tens of thousands of individuals and business around the world on May 12, 2017, it wasn’t the first time we had seen ransomware, but its impact was unique and lasting. We’ve all known for decades about hackers, information thefts, computer
An Oral History of WannaCry (Safe and Savvy Blog by F-Secure) WannaCry will go down in history, but what will history remember most? The outbreak that began on May 12, 2017 still the biggest ransomware attack in history and the trojan ended up being responsible for 9 out of 10 ransomware detections by the end of 2017.
Cyber attack delays Atlanta mayor's first budget pitch (Reuters) Atlanta's 2019 budget process has been delayed by a March cyber attack that scrambled a swath of government data, temporarily closing courts, halting bill payments and slowing other key services in the most devastating "ransomware" assault on a major U.S. city, a city spokesperson said on Tuesday.
Goodyear's Online Payment System Repaired After Cyber Attack (US News & World Report) Officials in Goodyear say the city's online payment system is functioning again after a cybersecurity attack affected the software.
Mexico's Banorte does not see cyber attack impact on financial results (Reuters) Mexico's No. 2 bank Banorte on Tuesday said it did not expect "any economic impact" on its financial results following what the central bank has called a cyber attack on connections to the domestic payment system.
From Yahoo to Uber, major hacks of data (The Economic Times) Seventy million might have lost personal data including names, addresses, phone numbers and e-mail accounts, while 40 million bank accounts and credit cards were also put at risk.
Security Patches, Mitigations, and Software Updates
Vulnerability in Signal's desktop app took only five hours to fix - CyberScoop (Cyberscoop) A critical vulnerability found in the desktop version of secure messaging app Signal was patched less than five hours after disclosure to the developers, a rapid response that's earned some plaudits from observers.
The next Android version’s killer feature? Security patches (Naked Security) Not before time, Google is addressing the mess it’s made of Android updates
Companies ditch data as GDPR deadline approaches (Help Net Security) To reduce their exposure, the majority of companies are being more selective in the data they collect and manage, with 70 percent disposing of data ahead of the deadline for compliance.
EfficientIP DNS Threat Report reveals the cost per attack has increased by 57% to $715,000 for organizations globally (Financial IT) EfficientIP, a leading specialist in DNS security to ensure service continuity, user protection and data confidentiality, today announced the results of its 2018 Global DNS Threat Report. It explored the technical causes and behavioral responses towards DNS-based threats and their potential effects on businesses across the world. Over the past year, organizations on average faced seven DNS attacks, which cost some businesses more than $5 million in damages.
25% of companies affected by cloud cryptojacking (Help Net Security) Cryptojacking has unquestionably gone mainstream. Despite heavy media and industry attention, organizations are struggling to meet compliance requirements in public cloud environments, according to RedLock. On the flip side, there’s evidence that companies are becoming more aware of cloud account compromises and
Threat Evolution and the Economics of Cybersecurity (Bricata) Threats change and evolve, and security has to adapt to meet new concerns. John Pirc, Security Expert and currently working for Secureworks sat down with Bricata to explain his view of the challenges in cybersecurity, including the economics and impact on security tools.
Enterprise cyber threat remediation ineffective, study shows (ComputerWeekly) Enterprise cyber threat remediation needs to improve in several key areas according to an analysis of common remediation strategies
Research finds disconnect between belief and reality in Office 365 security (Computing) Microsoft customers believe that they are always protected; the truth is much more varied
APWG Report: Cloud Storage and SaaS Increasingly Targeted by Phishers (BusinessWire) The Anti-Phishing Working Group (APWG) has been tracking notable increases in phishing campaigns that target SaaS/webmail providers
Employees Use Personal Devices to Access Company Email and Shared Documents, Often Without Oversight (PR Newswire) Nearly two-thirds (64%) of employees use a company-approved device for work....
Kaspersky set to leave homeland to alleviate security fears (CRN) Vendor to move a 'good part' of its infrastructure to Switzerland, praising the country's data protection laws and 'two centuries of neutrality'
Kaspersky Lab to Move Core Infrastructure to Switzerland (SecurityWeek) As part of its Global Transparency Initiative, Russia-based Kaspersky Lab today announced that it will adjust its infrastructure to move a number of "core processes" from Russia to Switzerland.
TPG raises Tanium investment, company now valued at $5 bln -sources (Reuters) TPG Capital's growth investment arm has raised its stake in Tanium Inc with a $175 million investment, valuing the U.S. cyber security startup at around $5 billion, people familiar with the matter said on Tuesday.
Darktrace Said to Hit $1.25 Billion Valuation in Stock Sale (Bloomberg.com) Two early investors in Darktrace Ltd. sold some of their shares in a secondary sale, valuing the British cybersecurity company at $1.25 billion, according to a person familiar with the plans.
Raytheon: Think Like An Attacker (Seeking Alpha) Cyber attackers represent an imminent threat to business and government operations. Cybersecurity will become a strategic priority for all organizations.
Symantec moves to allay concerns about accounting investigation, future outlook (ZDNet) Symantec kicked off its week with an analyst conference call outlining its view for the fiscal years ahead and how its enterprise business is shifting.
Barracuda CEO tells partners: 'You should expect us to acquire' (CRN) Vendor announces plan to become a billion-dollar company after recent transition from public to private ownership
Fortinet collects Sunnyvale sites for big expansion of its headquarters (The Mercury News) In 2012, Fortinet paid about $25 million for its current headquarters at 899 Kifer Road in Sunnyvale, but that was just the beginning of the property purchases by the network security software and …
Neustar Appoints Shailesh Shukla to Lead Security Solutions (Odessa American) Neustar®, Inc., a trusted, neutral provider of real-time information services, today announced the appointment of Shailesh Shukla as General Manager (GM) of Security Solutions. Shukla will oversee the company’s industry leading DDoS, DNS and IP Intelligence solutions including its cybersecurity operations. He will report to Neustar Senior Vice President, Chief Data and Analytics Officer Venkat Achanta.
Products, Services, and Solutions
Alphabet's Jigsaw Pledges Free Cyber Shield For All Political Groups As Midterms Loom (Forbes) As the midterm elections near, America is bracing itself for another barrage of cyberattacks, following the alleged Russian onslaught across Democratic and Republican organizations in the lead up to the 2016 presidential race.
Extending Free DDoS Protection for U.S. Political Organizations (Medium) Defending Democratic Institutions from DDoS Attacks
Ampex Partners with OPAL-RT Technologies to Ensure the Security of Critical Infrastructure (Ampex) Ampex Data Systems has partnered with OPAL-RT TECHNOLOGIES, a Canadian company that is the world leader in the development of PC/FPGA-based real-time simulators, Hardware-in-the-Loop (HIL) testing equipment, and Rapid Control Prototyping (RCP) systems that are used to design, test, and optimize control and protection systems for power grids, power electronics, motor drives, automotive, rail, aviation and various critical infrastructure industries.
Leading Canadian Power Company Entegrus Fortifies Security Posture with Pulse Secure (GlobeNewswire News Room) Pulse Secure NAC mitigates endpoint visibility, compliance and IoT security risks
Asigra integrates cyber security to defend against ransomware attack-loops (InsightaaS) Asigra Inc., a leading cloud backup, recovery and restore software provider since 1986 today announced its latest release v14 “Cloud Backup Evolved” to address the growing challenges of modern data…
ThreatConnect Expands Presence in Australia and New Zealand through Exclusive Partnership with emt Distribution (ThreatConnect) ThreatConnect, Inc.®, provider of the industry's only extensible, intelligence-driven security platform, is proud to announce it has entered into an exclusive partnership with emt Distribution to meet the growing demand for security solutions in Australia and New Zealand.
Netwrix stimulates partner success with new channel enablement strategy (Netwrix) Netwrix expands its sales enablement services and makes sales operations processes more transparent and convenient
RunSafe Security Announces Availability of Software Guardian to Cyberharden Vulnerable Embedded Systems and Devices (PRWeb) RunSafe Security, the pioneer of a patented cyberhardening process for vulnerable embedded systems and devices across critical infrastructure, today announced the
Digital Defense, Inc. Named #3 in Cybersecurity Training and #10 in Compliance & Risk Management by Healthcare Specialists, Black Book Market Research (WLNE TV) Digital Defense helps healthcare providers predetermine risk and train employees
Barracuda Introduces New Cloud-Delivered Web Application Firewall (Barracuda Networks) Barracuda Now Offers its Powerful Web Application Firewall Technology as a Cloud-Delivered Service that Simplifies Application Security for Organizations of All Sizes
Proact’s health care team support Revalidatie Friesland to create a high-performance, secure infrastructure (Cision) Revalidatie Friesland has selected data centre and cloud specialist Proact to provide an enterprise-
Winquest Cybersecurity Services Makes Splash at Interop ITX Conference (PR Newswire) Winquest Cybersecurity Services officially unveiled its new...
Minerva Labs and BlueVoyant Team Up To Contain Evasive Cyberattack (PR Newswire) Minerva Labs, a leading provider of anti-evasion technology for...
Exostar Extends Secure Supply Chain Management Collaboration Suite to Support Digitalization Initiatives (BusinessWire) Exostar's Digital Platform supports digital business imperatives and next-gen technologies across global, multi-tier supply chain business networks.
Verizon & Mocana Partner On ThingSpace IoT Security (AndroidHeadlines) Mocana and Verizon have now partnered to bring simplified IoT security to Verizon's ThingSpace platform via the incorporation of Mocana TrustPoint. For those who may not recall, ThingSpace is Verizon's web-based IoT platform first launched in 2015. TrustPoint, on the other hand, is Mocana's premier mission-critical
Napatech in cyber security deal with European government (Reuters) Oslo-listed network computing firm Napatech (NAPAT.OL) said on Tuesday it was selected by a European government agency to boost its cyber security
Gemalto Announces Security Solution for the Smart Grid (Mobile ID World) Gemalto has announced a new solution for what may be an overlooked part of the Internet of Things, smart meters. Comprising 'smart grids', smart meters are designed to process a wealth of data concerning energy usage compared to conventional energy meters.
Design and Innovation
Unpacking the mystery of Satoshi Nakamoto (TechCentral) In 2007, the world entered what has since become known as the Great Recession. Falling housing-related assets contributed to a global financial crisis, which either crippled or toppled many of the world’s largest
Lie-detecting computers equipped with artificial intelligence look like the future of border security (CNBC) A virtual border agent kiosk was developed to interview travelers at airports and border crossings, and researchers claim it does a better job finding deception than human agents.
Research and Development
Uila Announces Issuance of US Patent for Correlating Application and Infrastructure Performance Data (PRWeb) Uila, the Application-centric Infrastructure Monitoring & Analytics company, today announced that the United States Patent and Trademark Office has issued
University of North Georgia to offer cybersecurity degree (Atlanta Journal Constitution) University says enrollment has more than tripled since 2015
Legislation, Policy, and Regulation
Lawmakers Say U.S. Tech Is Being Used in Abusive Chinese Crackdowns (Wall Street Journal) Two members of Congress are urging the Commerce Department to consider toughening export controls on U.S. companies whose technologies they say are being used for state surveillance of citizens in China that enables human rights abuses.
Top intel official says Chinese ZTE cellphones are security risk (NBC News) President Trump wants to help the Chinese firm, but a top intel official told the Senate that ZTE cellphones may be used by the Chinese government to spy.
Why Trump Suddenly Wants to Save Jobs in China (WIRED) In a surprising reversal, the president says he wants to avert planned sanctions on telecommunications company ZTE.
Trump defends pledge to help save ZTE (Computing) Trump says his government will explore other ways to punish ZTE without pushing it out of business
EU Data Protection May Trigger Global Ripple Effect (SecurityWeek) GDPR, which comes into force in May 2018 is having an impact around the world as firms, including in the United States and China, move to comply.
IBM's top brass lobbies US lawmakers to ignore GDPR in favour of 'public-private approach' (Computing) IBM urges US Congressmen to develop a less onerous 'third way' for data privacy
DHS unveils long-stalled cybersecurity strategy (Cyberscoop) The Department of Homeland Security released a long-awaited cybersecurity strategy that looks to protect critical infrastructure from cyberattacks.
White House sheds cyber coordinator role (TechCrunch) The White House has opted to eliminate the cyber coordinator role on the National Security Council, in what some see as a step back in strong cybersecurity policy. The duties formerly performed by the coordinator will be taken up by the other two senior directors of the NSC's cyber team.
Marines Corps strengthens psychological operations with new job field (Marine Corps Times) The Corps plans to create another primary track field for its information warriors.
Litigation, Investigation, and Law Enforcement
Joshua Schulte named as suspect in 'Vault 7' leak of CIA tools to Wikileaks, but charged instead over child porn (Boing Boing) Joshua Schulte named as suspect in 'Vault 7' leak of CIA tools to Wikileaks, but charged instead over child porn
U.S. identifies suspect in major leak of CIA hacking tools (Washington Post) Despite months of investigation, prosecutors have been unable to bring charges against Joshua Adam Schulte, a former CIA employee being held in a Manhattan jail on unrelated charges.
Julian Assange said to have racked up $5m security bill for Ecuador (Register) WikiLeaks vows to take action over libelous claims
Bitten by the Bitcoin Bug: What is the State of Cryptocurrenices in 2018? (Computer Business Review) The world of cryptocurrencies has sent investors & businesses on a rollercoaster journey over the last few years; through the rise & fall of currencies.
Facebook can’t wiggle out of facial recognition lawsuit, judge says (Naked Security) There are too many factual disagreements for a quick judgment, the judge said, including over what a faceprint actually is.
Prison phone service can expose the location of anyone with a phone (Naked Security) In late April, somebody sent a letter containing meth to an inmate at an Arizona jail.
Police dog sniffs out USB drive to snare school hacker (Naked Security) Police traced an “electronic trail” to the suspect’s house where the USB drive was hidden.