Cyber Attacks, Threats, and Vulnerabilities
Iranian state hackers reload their domains, release off-the-shelf RAT malware (Ars Technica) As CISA warns of sharp rise in Iran hack attempts on US, researchers see same elsewhere.
Spies targeting Saudi Arabia switched tactics after Symantec exposed them, report says (CyberScoop) Recorded Future determined that APT33 or “a closely aligned threat actor” has used more than 1,200 web domains to conduct attacks since March 28.
Iranian Threat Actor Amasses Large Cyber Operations Infrastructure Network to Target Saudi Organizations (Recorded Future) Insikt Group profiled an Iranian threat actor's domain and hosting infrastructure to identify recent activity and better understand the group’s TTPs.
Companies on Watch After US, Iran Claim Cyberattacks (Dark Reading) With the cyber conflict between the United States and Iran ramping up, companies traditionally targeted by the countries - such as those in the oil and gas and financial industries - need to bolster their security efforts, experts say.
Analysis | The Cybersecurity 202: Here's how Iran disrupted U.S. businesses the last time it launched major cyberattacks (Washington Post) Including Sheldon Adelson's casino.
Stealing Clouds (Reuters) Reuters shows how Chinese hackers invaded myriad global companies, exposing entrenched weaknesses in Western cyber defenses.
US-Israeli cyber firm uncovers huge global telecom hack, apparently by China (Times of Israel) Cybereason says hackers focused on people working in government, law enforcement and politics, gathering private data over a number of years
Cyberespionage Collective Platinum Targets South Asian Governments (IEEE Spectrum) Kaspersky says the group used an HTML-based exploit that's almost impossible to detect
Huawei security: Half its kit has 'at least one potential backdoor' (ZDNet) Huawei's networking firmware is riddled with holes, according to a US security company.
Huawei products riddled with backdoors, zero days and critical vulnerabilities (SC Media) Huawei’s problems keep piling up as a security firm specializing in IoT devices found numerous vulnerabilities across the company’s entire product line.
User Security and Privacy Report Finds Vulnerabilities in Web Trackers and the Rise in Cross-border Data Transfers and Access to User Login Credentials (BusinessWire) Security and Privacy Report finds rise in cross-border data transfers, access to user login credentials across global industry websites
2019 User Security and Privacy Report (Feroot) Find out where unseen threats from third- and fourth party tools may jeopardize your business, security and compliance posture. Download the report now.
New Silex Malware Trashes IoT Devices Using Default Passwords (BleepingComputer) A teen coder and his team developed a new malware named Silex that bricked poorly protected IoT devices by the thousands in a short period of time.
Report: Code Responsible for Equifax Breach Downloaded 21 Million Times Last Year (Nextgov.com) The situation highlights the challenge of securing open source software, which underlies virtually every IT system in government.
State of Software Supply Chain 2019 Report (Sonatype) 2019 State of the Software Supply Chain Report reveals best practices from over 36,000 open source software development teams.
Google’s security efforts are falling short on mobile (Wandera) Google has enjoyed a long history of providing software that is aimed at protecting customers online. Google’s program for eradicating online threats involves the use of both manual and automatic scanners to trawl the internet to locate websites involved in phishing or malware activities.Part
How the U.S. Emergency Alert System Can Be Hijacked and Weaponized (Vice) With a pirate cell tower, it's easy to send fake emergency alerts warning of a terrorist attack, nuclear bomb, or other disaster.
Social engineering forum hacked, user data dumped on rival site (Naked Security) Social Engineered, dedicated to the “Art of Human Hacking,” was gutted, with 55,121 users’ details leaked on the same day as the hack.
The Rise of Silence and the Fall of Coinhive (Dark Reading) Cryptomining will exist as long as it remains profitable. One of the most effective ways to disrupt that activity is to make it too expensive to run cryptomining malware in your network.
Medicare Supplement Data Breach: 5 million personal records exposed (Comparitech) MedicareSupplement.com exposed 5 million records containing personal information, including some medical details, to anyone with an internet connection.
Every year, millions of web domains are registered to defraud businesses (Help Net Security) The growth of fraudulent domains corresponds to the growth of the overall domain landscape, according the Proofpoint 2019 Domain Fraud Report.
Two US cities opt to pay $1m to ransomware operators (Posilan Ltd) A few days apart, two cities in Florida cave in to extortionists’ demands in hopes of restoring access to municipal computer systems To pay or not to pay ransomware attackers? And if I do pay up, will I get my data back? These have been some truly pressing questions not only for ransomware victims and, …
A third of companies would rather pay a hacker’s ransom, research reveals (PrivSec Report) The Risk:Value Report 2019, by NTT Security, examined the attitudes of more than 2,200 non-IT decision makers to risk and value of cybersecurity to the business across 20 countries. The findings revealed cybersecurity threats are at the top of the agenda for business leaders, with cyber attacks (43%) on the top, followed by data loss …
Security Patches, Mitigations, and Software Updates
VLC media player gets biggest security update ever (Naked Security) Maintainers of the world’s most popular open source media player, VLC, has issued the biggest single set of security fixes in the program’s history.
Use Gmail at work? Now you get security sandbox to fight 0-day threats, ransomware (ZDNet) G Suite gains more phishing protections, including security sandbox and 'confidential mode' self-destructing email.
Google delivers new G Suite security tools (Help Net Security) Google has announced several new security tools for G Suite admins and users, as well as a new 2FA option: one-time security codes based on security keys.
Microsoft OneDrive users get an even more secure Personal Vault (Help Net Security) By the end of the year all users of Microsoft's OneDrive service will get a Personal Vault, with added protection for especially sensitive files.
Cyber Trends
Unitrends’ Fifth Annual Cloud and Disaster Recovery Survey Reveals Data Loss Remains Stubbornly High | Kaseya (Kaseya) Findings detail challenges and opportunities organizations face in protecting data in the cloud, on-premises, and in SaaS applications such as Office365
Data Protection, Cloud, and Proof DRaaS Delivers – Unitrends 2019 Survey Results (Unitrends) For the fifth year in a row, Unitrends conducted a survey on the state of data backup, recovery, DRaaS, and the increasing use of the cloud for data protection. More than 400 respondents from organizations of all sizes and industries took part.
Construction SMEs most at risk from phishing attacks (TechHQ) Relying chiefly on human naivety, phishing scams are becoming more sophisticated and difficult to detect by the day. Regardless of how many security tools
Employees Within Hospitality Industry Are The Most Prone To Phishing Attacks (Information Security Buzz) Today, KnowBe4, the provider of the world’s largest security awareness training and simulated phishing platform, has released its Phishing By Industry Benchmarking Report 2019 which found, amongst large organisations, those within the Hospitality industry have the highest Phish-Prone Percentage (PPP) of 48 percent and were the most likely to fall victim to a phishing scam. In comparison, employees …
Marketplace
Huawei says it doesn't cooperate with Chinese military — after report says its employees did (CNBC) Huawei's legal chief told CNBC that the company makes "solutions for civil use."
The State of Cybersecurity Hiring (Burning Glass Technologies) The number of cybersecurity job postings has grown 94% since 2013, three times faster than IT jobs overall. But a talent gap persists.
Extreme Networks to Acquire Aerohive Networks (PR Newswire) Extreme Networks, Inc. (Nasdaq: EXTR), a software-driven networking company, and Aerohive ...
Accenture to acquire Australian cyber firm BCT Solutions (Which-50) Accenture has signed a deal to acquire local cybersecurity and technology company BCT Solutions. The company specialises in command and control,
EZShield unveils new name as combined company with IdentityForce (Maryland Daily Record) EZShield and IdentityForce will be combined under a new name -- Sontiq -- the two cybersecurity companies announced Wednesday. Maryland-based EZShield acquired the Massachusetts-based Identity Force last year. The new combined company will be based in Nottingham, Maryland.
CRN Australia - Connecting the Australian Channel (CRN Australia) CRN Australia provides technology news, channel news and tools for VARs, technology integrators, computer consulants and resellers.
Christopher Bailey appointed CEO of NuData Security (MasterCard Social Newsroom) NuData Security today announced that Christopher Bailey, senior vice president and chief technology officer, has been appointed CEO of NuData and executive vice president of EMV/Digital Devices at Mastercard. Christopher’s appointment follows the retirement of Michel Giasson, who served as CEO of NuData for the last 12
Products, Services, and Solutions
Veristor and OneLogin Partner to Build Secure, Seamless Experiences for Customer Enterprises (Veristor) #Veristor and #OneLogin will Deliver a Unified Access Management Platform for Simple and Secure Access to Applications and Data, Anytime and Everywhere.
Acuant Incorporates Machine Authentication of KINEGRAM® Security Features in Travel Documents (Acuant) Acuant announced its partnership with OVD Kinegram to incorporate the Kinegram Optical Machine Authentication in AssureID™ document authentication services.
Moody's, Israel's Team8 to create cyber risk standard for businesses (Reuters) Ratings agency Moody's Corp and Israeli cyber group Team8 launched on Thurs...
Anonymous VPS Hosting Provider BitLaunch Releases DDoS Protection and Privacy Product (PR Newswire) BitLaunch announces release of a new remote DDoS protection product for customer servers, providing 500gbit+/s...
Technologies, Techniques, and Standards
The Cloud Risk Surface Report (RiskRecon) The Cloud Risk Surface Report: sign up to be the first to receive a copy of this new report.
CIS Controls Internet of Things Companion Guide (Yahoo) New Resource Helps Organizations Apply the CIS Controls to the loT EAST GREENBUSH, N.Y. , June 27, 2019 /PRNewswire/ -- Internet of Things (IoT) devices aren't just invading our homes; these smart, connected ...
Unisys Security Experts Offer "Top 10 Safety Tips for Big Events" in Advance of Summer Events Season (Unisys) Unisys Corporation (NYSE: UIS) today announced its Top 10 "Tips to be Security Savvy at Big Events" in the wake of a new survey showing Americans are fearful of both physical and cyber attacks at large-scale events just as the summer event season gets underway.
Design and Innovation
Buried in Facebook's Libra White Paper, a Digital Identity Bombshell (CoinDesk) Buried in Facebook’s Libra white paper are two sentences hinting the project's ambitions go even further than minting a global currency.
Google creates educational tools to help kids spot fake news (Naked Security) Google has expanded its internet safety guide for children with techniques and games to help them be more info-literate online.
Humans are 'better than AI' at discovering vulnerabilities - say humans (SC Magazine) A new research survey claims that humans are still in the driving seat of vulnerability research when compared to ML/AI tools - AI yet to claim a bug-bounty.
Academia
Get the Lowdown on the Logos! (Wicked6 Cyber Games) Now that June has arrived, the Wicked6 team has shifted into high gear. This month marks the start of the Wicked6 tournament, and we’ve already passed many milestones.
Legislation, Policy, and Regulation
Top cybersecurity official: U.S. should employ "range of tools" against active adversaries (CBS News) The U.S. government should leverage a diverse array of retaliatory and response measures as cyberattacks become more pervasive, according to Chris Krebs
Use Of Cyber War As Force Multiplier In US-Iran Escalation – OpEd (Eurasia Review) The US-Iran relations have escalated since the withdrawal of the United States of America from the Iran nuclear deal. This resulted in harsh sanctions exacerbating the sharp decline of Iran’s econo…
UAE data protection law, similar to GDPR, likely landing this year (TechRadar) National Cybersecurity Strategy to be executed in a three-year timeframe with 60 initiatives
OPINIONISTA: South Africa takes a quantum leap and joins the race (Daily Maverick) Quantum technologies are exploding and no longer the purview of laboratory experiments only. The race is on for governments and private industries to adopt its most promising and robust ideas into applications. Already a billion-pound (R18-billion) industry in the UK, most developed countries and a few BRICS states have already invested millions of euros in quantum technologies. Should South Africa follow suit?
Huawei Gets New Pressure From Congress as Trump Prepares to Meet Xi (Bloomberg) Senate resolution designates Huawei a risk to U.S. security. Measure calls for more pressure on allies, including Germany.
China to Insist U.S. Lifts Huawei Ban as Part of Trade Truce (Wall Street Journal) Chinese President Xi Jinping plans to present President Trump with a set of terms the U.S. should meet before Beijing is ready to settle a market-rattling trade confrontation, raising questions of whether the two leaders will agree to relaunch talks.
Mark Zuckerberg: We can't stop Russian election interference by ourselves, US government must help (CNBC) "As a private company we don't have the tools to make the Russian government stop," Facebook CEO Mark Zuckerberg said at the Aspen Ideas Conference on Wednesday. "We can defend as best as we can, but our government is the one that has the tools to apply pressure to Russia, not us."
Facebook CEO Mark Zuckerberg on election interference: Feds have 'tools to apply pressure to Russia, not us' (USA TODAY) Breaking up Facebook, Mark Zuckerberg said Wednesday, wouldn't solve issues of misinformation, privacy or election interference.
Mark Zuckerberg says Facebook is 'evaluating' deepfake policy (Mashable) Facebook may soon have new rules for "deepfakes."
Senators spar with Google exec over use of 'persuasive technology' (TheHill) Lawmakers expressed disbelief on Tuesday when a Google executive told a Senate panel that the company does not use persuasive techniques targeted at its users.
Pelosi: Congress will receive election security briefing in July (TheHill) Speaker Nancy Pelosi (D-Calif.) announced Wednesday that Congress will receive an election security briefing from administration officials next month, as Democrats put pressure on Senate Majority Leader Mitch McConne
CIOs See End of ‘AI Gone Wild’ in Congressional Hearings (Wall Street Journal) Chief information officers this week are keeping a close eye on federal hearings concerning misinformation and malicious activity in social media—fearing a broader regulatory clampdown on the use of artificial intelligence.
INSA Paper Examines Impediments to Security Reciprocity, Offers 14 Policy and Process Improvements (INSA) Delays caused by inefficiencies in security reciprocity, the process of “passing” a worker’s clearance from one agency to another, result in the estimated loss of 1,000 contractor labor-years at a cost of approximately $2 billion to the Intelligence Community and upwards of $8 billion across the Federal Government each year, according to a new INSA white paper.
Should states band together to buy cybersecurity services? (Fifth Domain) State governments face the same cybersecurity threats that menace the federal government and the private sector. But when it comes to defending against those threats, state resources are comparatively scarce.
State, local governments urged to toughen cyber defenses (Maryland Daily Record) The city of Baltimore website on June 4 reflected the damage done by malware attack discovered a month earlier.
Paying a Hacker’s Ransom Shouldn’t Be a Crime (Bloomberg) A federal law outlawing the practice would be a very bad idea.
Litigation, Investigation, and Law Enforcement
'Decade of negligence': Feds fail to protect Americans' info, report says (ABC11 Raleigh-Durham) Several major federal agencies that collect vast amounts of personal data about American citizens routinely failed to adequately protect it, a congressional report says.
The Daily 202: Five things to watch when Bob Mueller testifies (Washington Post) The next fight will be whether the former special counsel’s deputies also testify.
Hacker threw Molotov cocktail, dropped USB drive of his DDoS deeds (Naked Security) Those things drop out of pockets at the worst times. Like, say, when you’re hurling a bomb at a brick-and-mortar that you’ve also DDoSed.
Black Market T-Mobile Location Data Tied to Spot of a Triple Murder (Vice) In 2017, two bounty hunters and a fugitive died in a chaotic shoot-out. Shortly after their deaths, someone started tracking one of the bounty hunter's phones.
Google and the University of Chicago Are Sued Over Data Sharing (New York Times) The lawsuit demonstrates the tension between building A.I. systems and protecting the privacy of patients.
McAfee sues ship-jumping sales staff over trade secret theft allegations (Register) Complaint claims rival Tanium's hires took deal data with them
