Cyber Attacks, Threats, and Vulnerabilities
Eelam faction launches cyber-attack on Govt. websites (Hiru News) Several Sri Lankan websites including the website of the Ministry of Tourism Development and Christian Religious Affairs have been hit by a cyber-attack.
The websites have been hacked by a group... . Most visited website in Sri Lanka.
Bank of Mexico says cyber attack originated at brokerage house (Mexico News Today) The governor of the Bank of Mexico (Banxico), Alejandro Díaz de León , announced that the first incident of the cyber attack that…
Manuel Delia’s Blog Cyber-Attacked By Ukrainian Hackers On A Scale 'Rarely Seen On Other Maltese Websites' (Lovin' Malta) "This is no different and no less harrowing than the arson at the Times of Malta building forty years ago"
Gruesome Jihadi Content Still Flourishes on Facebook and Google+ (WIRED) Despite improvements to algorithmic filtering, Facebook and Google+ still host huge amounts of ISIS and ISIS-related content and accounts that sometimes stay up for months.
Obama cyber chief: Iran may ramp up cyberattacks after Trump ditched nuclear deal (Yahoo Entertainment) “I think we should expect to see an increase in Iranian cyberactivity against us,” said Michael Daniel, the former White House cyber coordinator, in an interview on the Yahoo News podcast "Skullduggery."
Pathology of a soft war with Iran in cyberspace (Modern Diplomacy) The soft -war against Iran is a fact that all the scholars acknowledge. In fact, the main and hidden purpose of the soft -war is to disrupt the information system of the countries and to influence the public opinion of the countries.
RedDawn Espionage Campaign Shows Mobile APTs on the Rise (Threatpost) The Sun Team APT, likely linked to North Korea, uses Google Play and Facebook as attack vectors.
200 Million Sets of Japanese PII Emerge on Underground Forums (SecurityWeek) A dataset allegedly containing 200 million unique sets of personally identifiable information (PII) exfiltrated from several popular Japanese website databases emerged on underground forums
ZipperDown catches 170,000 iOS apps with their pants down (Naked Security) It’s got a name, a logo and some very big numbers, but does it deserve its star billing?
Mirai botnet adds three new attacks to target IoT devices (ZDNet) This new version of the botnet uses exploits instead of brute force attacks to gain control of unpatched devices.
Chrome users warned of new malware that steals passwords and credit card details (Thai Tech by Thaivisa.com) Security researchers have discovered a new strain of malware that can steal passwords and credit card details from Google Chrome.
Ex-Intel security expert: This new Spectre attack can even reveal firmware secrets (ZDNet) A new variant of Spectre can expose the contents of memory that normally can't be accessed by the OS kernel.
New Spectre Attack Recovers Data From a CPU's Protected SMM Mode (BleepingComputer) Security researchers from Eclypsium have detailed yesterday a new variation of the Spectre attack that can recover data stored inside a secure CPU area named the System Management Mode (SMM).
Misconfigured CalAmp Server Enabled Vehicle Takeover (SecurityWeek) A misconfigured server operated by CalAmp, a company offering the backend for a broad range of well-known car alarm systems, provided anyone with access to data and even allowed for account and vehicle takeover.
DrayTek Router Zero-Day Under Attack (BleepingComputer) DrayTek, a Taiwan-based manufacturer of broadband CPE (Customer Premises Equipment) such as routers, switches, firewalls, and VPN devices, announced today that hackers are exploiting a zero-day vulnerability to change DNS settings on some of its routers.
The Facebook Android App Is Asking for Superuser Privileges and Users Are Freaking Out (BleepingComputer) The Facebook Android app is asking for superuser permissions, and a bunch of users are freaking out about granting the Facebook app full access to their device, an understandable reaction following the fallout from the Cambridge Analytica privacy scandal.
Phishing Roundup: Caracal, Stealth Mango, Tangelo, Apple, DHL, eFax & More (BleepingComputer) Phishing threats are currently targeting your credentials for Apple, Facebook, Gmail, and more. In this roundup we detail some of the current Phishing threats active on the Internet.
Siemen’s Denial Of Service Vulnerability (Information Security Buzz) Siemen’s has sent out an alert on a Denial of Service vulnerability that could affect its SIMATIC S7-400, a family of programmable logic controllers (PLCs) designed for process control in industrial environments. Andrew Lloyd, President at Corero Network Security commented below. Andrew Lloyd, President at Corero Network Security: “As we’ve been discussing in relation to …
New Malicious Monero Miner Crashes Computers When Attempting to Remove it (The Merkle) It has been a while since cryptocurrency malware was worth paying much attention to. With cryptocurrency mining having become more common, criminals are once again taking notice. WinstarNssmMiner may
Security: Bad Bots Use Increasingly Sophisticated Techniques to Impersonate Humans (Formtek Blog) Malicious bots are on the prowl on the internet. A report from Distil estimates that more than one-fifth of internet traffic is from “bad bots.” Up nearly 10 percent over last year. “Good bots” also account for another fifth of traffic.
Atlanta’s network almost recovered from cyber attack, cost still unknown (Atlanta Journal Constitution) Cost and damage of City of Atlanta ransomware event still being calculated
Roseburg schools dealing with aftermath of cyber attack (KPIC) The FBI is now investigating a ransomware attack that is affecting the Rosebug Public School's computer system. The cyber attack happened earlier this month, freezing access to the district's email system, website and buisiness and account
A Location-Sharing Disaster Shows How Exposed You Really Are (WIRED) The failures of Securus and LocationSmart to secure location data are the failures of an entire industry.
Someone hacked California's live congressional debate to run gay porn (HackRead) An online forum designated for California's First Congressional District debate was hacked by unknown hackers (or call them pranksters) right after opening statements.
You are not alone; The Pirate Bay is down around the world (HackRead) You are not alone, The Pirate Bay is down for everyone around the world. Those visiting The Pirate Bay right now can see error 502 message powered by Cloudflare.
T-Mobile Employee Made Unauthorized ‘SIM Swap’ to Steal Instagram Account (KrebsOnSecurity) T-Mobile is investigating a retail store employee who allegedly made unauthorized changes to a subscriber’s account in an elaborate scheme to steal the customer’s three-letter Instagram username.
Misconfigured Reverse Proxy Servers Spill Credentials (Threatpost) Researchers created a proof-of-concept attack that allows remote attackers to access protected APIs to extract credentials.
Hacks turn Amazon Alexa and Google Home into secret eavesdroppers (CSO Online) Researchers devise new two new attacks -- voice squatting and voice masquerading -- on Amazon Alexa and Google Home, allowing adversaries to steal personal information or silently eavesdrop.
This CMU researcher hacked cellphone location data in just 15 minutes (TribLIVE.com) A researcher at Carnegie Mellon University and member of its elite hacking team exposed a bug in a cellphone tracking service that allowed him — ...
Aussie businesses lost $22.1 million to email scams last year (ARN) Email scams cost Australian businesses losses of $22.1 million in 2017, according to scams reported to both the ACCC and ACORN.
Believing your data is “probably” secure means it’s not secure at all (CSO) Many companies are being caught out when their “probabilistic” data security measures prove inadequate in the face of a breach, a CSIRO data scientist has noted in arguing for a more concrete, numbers-based method for evaluating the effectiveness of corporate security policies.
58% of Botnet Malware Infections Last Under a Day (BleepingComputer) The vast majority of botnet malware infections last under a day, according to a Fortinet report released last week —the Q1 2018 Threat Landscape Report.
People Are Making Fake Facebook Profiles of the Santa Fe Shooter to Fit Their Political Narratives (Motherboard) People are rushing to push the shooter into the opposite political camp.
Latin American 'Biñeros' Bond Over Fraudulent Purchase Scheme (Threatpost) A type of card-not-present fraud is spreading throughout the Latin American underground, uniting groups of malefactors in a communal effort to perpetrate it as widely as possible.
Security Patches, Mitigations, and Software Updates
Chrome to dynamically point out "Not secure" HTTP sites (Help Net Security) Google expects HTTPS to become the default, and is preparing users for it by slowly moving Chrome towards showing only negative security indicators.
Cyber Trends
Are you ready for the GDPR deadline? (Help Net Security) Are you ready for the ready GDPR deadline? Not only are most unprepared for the deadline, but only around half of the companies surveyed (52 percent) expect to be compliant by end-of-year 2018, and 31 percent do not know when they will be fully compliant.
Cyber Saturday: Would You Buy Cybersecurity from a Witch Doctor? (Fortune) The late scientist Richard Feynman certainly wouldn't.
The risks of over-reliance on quantifiable data (C4ISRNET) The risk for grave errors in decision-making, escalation, and avoidable human suffering and destruction, is embedded in our future use of artificial intelligence if we do not pay attention to the data that feed the algorithms.
The Amish understand a life-changing truth about technology the rest of us don’t (Quartz) The Amish don't always reject a technology, but they have very specific rules about how it is to be used.
Cyber subversives beware: the battle for our democracy starts here (The Telegraph) We have reached a tipping point.
Australian consumers demand trust on data usage (WARC) Trust and transparency play a vital role in determining the strength of any relationship between a brand and its customers, yet it appears only 15% of Australian companies explicitly indicate they share consumer data with third parties.
Marketplace
Blockchain Consolidation Phase Is Imminent, Hyperledger Chief Says (Wall Street Journal) Blockchain technology is enterprise-ready, says Brian Behlendorf, executive director of the Hyperledger project. Governance has a way to go, however. "Getting multiple parties to agree on anything -- like a time of day for a meeting, let alone a common application -- will end up being a bigger challenge," he says.
Syncsort Acquires Townsend's IBM i Encryption Software (IT Jungle) Syncsort has acquired the bulk of Townsend Security’s products in a bid to bolster its burgeoning suite of security software for IBM i. The big get for Syncsort (formerly Vision Solutions) is AES/400, Townsend’s well-respected database encryption software for the IBM i platform. Meanwhile, Townsend Security will continue developing and selling encryption key management software
Microsoft makes inroads with U.S. spy agencies as tech giants face off over cloud contract (Washington Post) The company’s full cloud-computing service has been made available to 17 intelligence agencies for the first time.
ZTE Has to Change Management for U.S. Reprieve, Kudlow Says (Bloomberg.com) Chinese telecom company ZTE will have to change its management to win a reprieve from U.S. sanctions, said the director of the White House National Economic Council.
ThreatQuotient takes on APAC channel with Cisco security talent (ARN) ThreatQuotient is making a play for the local channel landscape after appointing Cisco A/NZ's Anthony Stitt as its new Asia Pacific regional director.
How Queenslander Greg Clark became leader of the world's largest cyber sec firm Symantec (Financial Review) Greg Clark grew up in the Queensland coastal town of Yeppoon, but now he's leading the world's largest cyber security firm.
Products, Services, and Solutions
Sprint Launches Groundbreaking IoT Factory to Make Everyday Business Easier (PR Newswire) Sprint (NYSE: S) today announced the launch of the Sprint IoT...
F-Secure Unveils New Endpoint Detection & Response Solution (SecurityWeek) F-Secure announced on Thursday the launch of a new endpoint detection and response (EDR) solution named Rapid Detection & Response
CrowdStrike Advances Cyber-Security Automation to Aid Forensics (eWEEK) VIDEO: Dmitri Alperovitch, co-founder and CTO of CrowdStrike, discusses his company's latest products and explains why automation is about augmenting humans, not replacing them.
Fast-Growing Startup Cybrary Helps Bring Cybersecurity Training to the Masses (DC Inno) When DC Inno last checked in with online cybersecurity training company Cybrary in 2015, it was just celebrating its debut and unveiling a program to help teach D.C.-based Iraqi refugees cybersecurity techniques.
How Thales Cyber Hub will create a collaborative ecosystem (Tahawul Tech) Gary Miller, vice president, Cyber Security, Middle East, Thales, on strengthening its recently announced Cyber Hub in Dubai.
Technologies, Techniques, and Standards
PCI Security Standards Council publishes PCI DSS 3.2.1 (Help Net Security) The minor changes in PCI DSS 3.2.1 reflect how existing requirements are affected once the effective dates and SSL/TLS migration deadlines have passed so that organizations can accurately report how their implementations meet these existing requirements after 30 June.
How a new cyber cell is protecting DoD networks (Fifth Domain) Officials tout progress one year after standing up a cyber intelligence/operations fusion cell.
Cyber Shield 18 Culminates in Exercise Week (DVIDS) Members of the Army National Guard, Air National Guard, Army Reserve and partner civilian agencies carried out mock cyber attacks in a Red Cell versus Blue Cell exercise as part of Cyber Shield 18 at Camp Atterbury, Ind., May 14-18.
DHS, DoT team up to secure federal vehicle fleets (SC Media US) The DHS and the DoT joined forces to create a cybersecurity implementation and operational primer to secure federal vehicle fleets.
Banks Adopt Military-Style Tactics to Fight Cybercrime (New York Times) Financial institutions are using military tools and techniques, like “fusion centers” and combat drills, to battle cybercrime.
Don't let attackers worm their way in: Increase password security (Help Net Security) Passwords are inherently the weakest form of authentication, yet they remain the most prevalent. Many organizations realize that moving beyond this single point of vulnerability is required but replacing passwords or adding multi-factor authentication (MFA) to all use cases can be daunting if not impossible. As such,
Mattis expected to tighten cellphone restrictions within Pentagon building (CNN) Defense Secretary James Mattis is expected Friday to order a tightening of security policy governing military and civilian personnel bringing cellphones into classified workspaces in the Pentagon, according to two US defense officials.
Seriously, Stop Using Flash (Motherboard) It's day five of our digital security tuneup and it's time to banish this internet relic.
Design and Innovation
Why the Adoption of Edge Computing Demands a New Approach to Data Security (Infosecurity Magazine) Edge computing allows for faster response times and consistent data collection.
Research and Development
As cyber security needs become an overriding concern, China works on an impenetrable shield (Global Times) China is developing an innovative system to strengthen its cyber defence, testing the mechanism by making scores of white-hat hackers launch hundreds of thousands of attacks.
You Can Send Invisible Messages With Subtle Font Tweaks (WIRED) Researchers have developed a new technique called FontCode that hides secrets in plain sight.
Legislation, Policy, and Regulation
What Is GDPR and What Can America Learn From it? (Motherboard) After four years of debate, the General Data Protection Regulation is finally going into effect later this month. Personal privacy is of particular concern, but GDPR effect on consumers and Silicon Valley is still shaking out.
Why Europe's New Privacy Laws Are Causing Some Online Games to Shut Down (Motherboard) The cost to comply with the new GDPR regulations is too much for games like 'Loadout,' 'Super Monday Night Combat,' and 'Ragnarok Online'
Trump pressed to put hacking on North Korean summit agenda (POLITICO) North Korea’s prowess could evolve into one of the more pernicious threats facing the U.S., some national security specialists warn.
NATO To Announce Nearly $1 Billion In New Defense Work, Cyber Agreements At Berlin Conference (Defense Daily Network) NATO is set to preview nearly $1 billion in new contract opportunities and sign four bilateral cyber threat information sharing agreements with internation
Britain warned it must be prepared to launch cyber attacks on enemies or risk 'falling behind' in modern warfare (The Independent) Britain must be prepared to launch cyber attacks on enemies or risk “falling behind” in modern warfare, the head of defence intelligence has warned.
As Britain reveals its first-ever cyberattack against ISIS, experts ask if Canada will be as open (CBC) This spring in Britain the Government Communications Headquarters (GCHQ) revealed that Britain had launched its first-ever military-style cyber campaign against the Islamic State. But will Canada make similar announcements in the days to come?
The Untold Story of Japan’s Secret Spy Agency (The Intercept) Sources reveal a hidden spy center in Tokyo and an internet surveillance program that sweeps up data from satellites.
US anti-ISIS office gets reprieve as Syria pullout accelerates (Military Times) The State Department unit overseeing the fight against the Islamic State group will stay in business for at least six more months, reversing an administration plan for the unit’s imminent downgrade even as President Donald Trump presses ahead with a speedy U.S. exit from Syria.
Progressive advocacy groups call on the FTC to “make Facebook safe for democracy” (TechCrunch) A team of progressive advocacy groups, including MoveOn and Demand Progress, are asking the Federal Trade Commission to “make Facebook safe for democracy.” According to Axios, the campaign, called Freedom From Facebook, is set to launch a six-figure ad campaign on Monday that will run o…
Hurdles Remain After Senate Votes To Restore Net Neutrality (Threatpost) The U.S. Senate gave the nod to restoring the 2015 Open Internet Order, putting net neutrality on the fast track to a House vote.
Net Neutrality Is Just a Gateway to the Real Issue: Internet Freedom (WIRED) The Senate vote wasn't about net neutrality. It was about making world class internet, in all its forms, a powerful political issue—with rippling effects come 2020.
A simple solution to end the encryption debate (TechCrunch) David Gurle Contributor Share on Twitter David Gurle is the founder and chief executive of Symphony Comunication. Bill Harrington Contributor Bill Harrington is a former federal prosecutor and a partner at the law firm Goodwin Procter. Criminals and terrorists, like millions of others, rely on smar…
U.S. Suspends Tariffs on China, Stoking Fears of a Loss of Leverage (New York Times) A temporary cease-fire has calmed fears of a trade war, but the Trump administration now faces criticism it is backing down from striking a tough deal.
ZTE rescue dubious call (Times-Tribune) Even before President Donald Trump had imposed about $150 billion worth of tariffs on Chinese products, the Commerce Department had moved to sanction a major Chinese electronics manufacturer for serious trade and national security violations.
Maj. Gen. Loretta Reynolds Nominated as USMC Deputy Commandant for Information, MARFORSTRAT Commander (Executive Gov) Maj. Gen. Loretta Reynolds, commander of the U.S. Marine Corps Forces Cyber Command, has been nomina
Litigation, Investigation, and Law Enforcement
Trump says he’ll demand the Justice Department probe whether the FBI spied on his campaign (Vox) The president of the United States has had quite a day on Twitter.
U.S. Justice Dept to check for political motivations in FBI Russia probe (Jerusalem Post) The US Justice Department asked its inspector general to expand a review of the National Security Agency's surveillance application process to determine if political motivations affected the FBI's probe of Russian interference in the 2016 presidential election, an agency spokeswoman said on Sunday.
The ethical and legal dilemmas of threat researchers (Help Net Security) What happens when a security researcher uncovers stolen data? Do they have the right to search through it? Analyze it? How much of it should they publish it? What if the data was from a public figure?
More Charges Against 'Syrian Electronic Army' Hackers (SecurityWeek) US Justice Department announces more charges against two Syrians believed to be members of the Syrian Electronic Army hacker group
Man Sentenced to 15 Years in Prison for DDoS Attacks, Firearm Charges (SecurityWeek) A 55-year-old man from New Mexico was sentenced to 15 years in prison for DDoS attacks on dozens of organizations and firearms charges
Our Robocall Hell Is a Result of Inconsistent Enforcement and Carrier Apathy (Motherboard) Despite endless government initiatives, updated regulations and a laundry list of promises from industry, the problem is worse than ever.
Statute expires for pension body cyber-attack (NHK WORLD) Tokyo police have ended their investigation into a massive leak of personal data from a public pension body after the statute of limitations expired before they could identify who was behind the cyber-attack.
