Cyber Attacks, Threats, and Vulnerabilities
Sephora in damage control after Aussies' data leaked (SmartCompany) Cosmetics retailer Sephora has become the latest business to fail in its responsibility to safeguard the personal data of its customers.
Q&A: What to Know About the Capital One Data Breach (SecurityWeek) A hacker obtained Social Security and bank account numbers in some instances, as well other information such as names, birthdates, credit scores and self-reported income from Capital One.
Capital One Breach Highlights Dangers of Insider Threats (Wall Street Journal) The breach disclosed by Capital One this week highlights an uncomfortable truth: It’s almost impossible to stop a determined hacker with inside knowledge of a firm’s systems.
Capital One Hacking Suspect Showed Strange Online Behavior (Wall Street Journal) The 33-year-old woman accused of executing one of the largest-ever data thefts at a bank showed strange behavior online in recent months, at times bragging about her exploits and discussing deep struggles in her personal life.
The Alleged Capital One Hacker Didn't Cover Her Tracks (WIRED) In a criminal complaint, the FBI detailed how a hacker allegedly stole data from 100 million people—and how she got caught.
Capital One Hack Hits the Reputation of a Tech-Savvy Bank (Wall Street Journal) Capital One has been known as a bank that plowed into new technology. But a recent hack could shift the lender’s approach from advantage to liability.
Capital One looked to the cloud for security. But its own firewall couldn’t stop a hacker. (Washington Post) On Monday, the company disclosed a data breach affecting 100 million credit card applications.
Capital One Breach Casts Shadow Over Cloud Security (Wall Street Journal) The recent high-profile data breach at a top proponent of cloud computing could reignite debate among financial institutions about using such outside vendors.
AWS says it wasn't breached in Capital One hack (CRN Australia) Former AWS employee obtained personal info of about 100 million Americans.
'I live in constant fear' Bulgaria data breach victim says (Reuters) Mariana Krasteva, a 55-year old engineer, is one of more than four million Bulga...
U.S. Issues Hacking Security Alert for Small Planes (SecurityWeek) The Department of Homeland Security issued a security alert for small planes, warning that modern flight systems are vulnerable to hacking if someone manages to gain physical access to the aircraft.
Hackers can take control of the flight computers on newer small aircraft, according to a Department of Homeland Security alert (Business Insider) The Department of Homeland Security plans to issue a security alert for small planes, warning that modern flight systems are vulnerable to hacking.
CAN Bus Network Implementation in Avionics (CISA) 1 EXECUTIVE SUMMARY
CISA is aware of a public report of insecure implementation of CAN bus networks affecting aircraft. According to this report, the CAN bus networks are exploitable when an attacker has unsupervised physical access to the aircraft. CISA is issuing this alert to provide early notice of the report.
[Security Research] CAN Bus Network Integrity in Avionic Systems (Rapid7 Blog) Rapid7's recently released research report examines the security (or lack thereof) of CAN bus networks in small aircraft.
[Security Research] CAN Bus Network Integrity in Avionics Systems (Rapid7) Modern aircraft use CAN bus systems to communicate, display information, and control systems for pilots. How secure are these avionics systems? Learn more.
New Loader Variant Behind Widespread Malware Attacks (Threatpost) Malware infection technique called TxHollower gets updated with stealthy features.
Windows 10 Warning: 250M Account Takeover Trojan Disables Windows Defender (Forbes) Windows 10 users are fortunate in having pretty good malware protection in the form of Windows Defender, right out of the box. Until, that is, malware figures out a way to not only evade detection but disable Defender altogether.
Cyber attacks pioneered by North Korea now spreading to other threat actors, F-Secure warns (Computing) Financial companies are increasingly being targeted by organised crime and state-sponsored actors
Finance sector: A one-stop shop for attackers (Fintech Finance) Thieves have been stealing money from banks since the 18th century. And while today’s thieves use cyber attacks to steal money from financial institutions, a new report from cyber security provider…
Google Researchers Find Remotely Exploitable Vulnerabilities in iOS (SecurityWeek) Security researchers working with Google’s Project Zero have discovered a series of five vulnerabilities in Apple’s iOS platform, some of which can be exploited without user interaction.
Apple iMessage Flaw Lets Remote Attackers Read Files on iPhones (BleepingComputer) An iMessage vulnerability patched by Apple as part of the 12.4 iOS update allows potential attackers to read contents of files stored on iOS devices remotely with no user interaction, as user mobile with no sandbox.
Wind River VxWorks (CISA) 1. EXECUTIVE SUMMARY
CVSS v3 9.8
ATTENTION: Exploitable remotely/low skill level to exploit
Vendor: Wind River
Equipment: VxWorks
Vulnerabilities: Stack-based Buffer Overflow, Heap-based Buffer Overflow, Integer Underflow, Improper Restriction of Operations within the Bounds of a Memory Buffer, Race Condition, Argument Condition or Modification, Null Pointer Dereference, Argument Injection or Modification
2.
Many control system vulnerabilities are not “new”, they are often just rediscovered (Control Global) New control system vulnerabilities often are not “new”, just rediscovered and not adequately disclosed or addressed. Examples are the VxWorks operating system vulnerabilities and the ABB MicroSCADA.
BlueKeep Exploits Appear as Security Firms Continue to Worry About Cyberattack (Dark Reading) The lack of an attack has puzzled some security experts, but the general advice remains that companies should patch their vulnerable systems more quickly.
Hackers target Telegram accounts through voicemail backdoor (Naked Security) As politicians should know by now, secure messaging apps such as Telegram can quickly become a double-edged sword.
Truecaller bug covertly signs up Indians for UPI account amid hacking fears (ETCIO.com) In a nightmare for thousands of Truecaller users in India, a so-called bug automatecally created their Unified Payments Interface (UPI) accounts with ..
Prima Systems FlexAir (CISA) 1. EXECUTIVE SUMMARY
CVSS v3 10.0
ATTENTION: Exploitable remotely/low skill level to exploit
Vendor: Prima Systems
Equipment: FlexAir
Vulnerabilities: OS Command Injection, Unrestricted Upload of File with Dangerous Type, Cross-site Request Forgery, Small Space of Random Values, Cross-site Scripting, Exposure of Backup file to Unauthorized Control Sphere, Improper Authentication, Use of Hard-coded Credentials
2.
Cyberattackers strike fourth Louisiana school district, Tangipahoa Parish, others taking precautions (The Advocate) Tangipahoa Parish has become the latest victim in a series of cybersecurity attacks on Louisiana schools that prompted an emergency declaration and has officials scrambling to mitigate damage ahead of
Louisiana governor updates cyber summit on threat to his state’s school districts (KSLA) In wake of attacks in 4 parishes, thousands of computers must be re-imaged before classes start
Our View: Luzerne County cyber attack a matter of national security (Times Leader) Making the rounds on social media in recent months has been a quote about national strife widely attributed to President Abraham Lincoln. “America will never be destroyed from the outside,” the Great…
Cyber attack of a historic coast attraction raises awareness of digital security (WLOX) The Instagram account of Beauvoir, the Presidential home of Jefferson Davis, was the target of an online attack Monday morning.
Security Patches, Mitigations, and Software Updates
Telegram rolls out fix for voicemail hack used against Brazilian politicians (ZDNet) Telegram reacts after hackers have hijacked more than 1,000 accounts in Brazil.
Comodo releases hotfix for antivirus security vulnerabilities (The Daily Swig | Web security digest) Update addresses numerous bugs disclosed by Tenable last week
Cyber Trends
Most Security Pros Think Recent GDPR Fines Won’t Affect Policies (The State of Security) Are the GDPR fines high enough to produce meaningful change in organizations’ security policies and procedures? Most security professionals think not.
The State of Digital Lifestyles 2019 (Limelight) Consumers in France, Germany, India, Italy, Japan, Singapore, South Korea, the United Kingdom, and the United States age 18 and older who had downloaded software or streamed online video
or music during the last month were asked questions about how digital technology has impacted their lives, how they
interact with digital media, and the adoption rate of digital assistants and internet-connected devices. Key findings of
this report include:
Ponemon Study: 53% of IT Leaders Don’t Know if Cybersecurity is Working (AttackIQ) Read this new report sponsored by AttackIQ, Inc. which is based on Ponemon Institute research evaluating the efficacy of enterprise security strategies. Ponemon surveyed 577 IT and IT security practitioners in the United States who are knowledgeable about their organization's IT security strategy, tactics and technology investments.
Boxcryptor Customer Survey 2019 - Results (Boxcryptor) We learned: Recommendation plays an increasing role when it comes to encryption and Dropbox still is the most popular cloud drive. Read the full evaluation now.
N.J. cyber firm dials up online security study (ROI-NJ) How many phishing attacks were attempted in 2018? Try 482.5 million. Over twice as many attempts as the prior year. Roseland-based computer security company, Sectigo — formerly Comodo CA — sponsored a study conducted by the Georgia Institute of Technology Cyber Forensics Innovation Laboratory to determine correlation between online crime and sites with extended validation. …
Security trends to follow at Black Hat USA 2019 (Help Net Security) Here's a list of the most engaging content and identify the most compelling cybersecurity trends highlighted in the agenda for Black Hat USA 2019.
Ireland is at international crossroads and in the crosshairs for cyber attack (Irish Examiner) In the real world, our defences are adequate for about as long as we are lucky enough to be left alone, writes Gerard Howlin
Marketplace
Jamie Dimon's worst fears for the banking industry realized with Capital One data hack (CNBC) Bank CEOs including Jamie Dimon have been highlighting the risks of a cyberattack for years.
Capital One sees billions in lost value after hack — and its headaches are likely to continue (Washington Business Journal) Capital One Financial Corp. (NYSE: COF) might expect to pay only up to $150 million as it deals with the fallout of a data hack that exposed the information of 106 million people — but its shareholders collectively paid much more.
More Tech Improvements Ahead, Equifax Says (Wall Street Journal) The credit-reporting firm says it has made substantial improvements in technology under new leadership since revealing its data breach in 2017, and it plans to continue upgrading its cybersecurity defenses.
Jamf Acquires Digita Security, Creators of Enterprise Endpoint Protection Built Exclusively for Mac (Jamf) Jamf announced today its acquisition of Digita Security, creators of enterprise-grade, purpose-built endpoint protection solutions designed to protect Mac users from malicious activities
Confluera Raises $9M, Unveils 'Real-time Attack Interception and Defense' Platform (SecurityWeek) Palo Alto, California-based start-up Confluera has simultaneously announced a Series A funding round of $9 million and the launch of its new Real-time Attack Interception and Defense (RAID) platform.
Multicoin Leads $20 Million Round for Speed-Focused Solana Blockchain (CoinDesk) Claiming it can handle many more transactions per second than existing blockchains, Solana has raised capital to ramp up development.
Truework raises $12 million to verify people’s identity automatically (VentureBeat) Truework, a San Francisco-based developer of cloud-hosted identity verification solutions, has raised $12 million in venture capital.
VMware to acquire AI startup Uhana to boost telco portfolio (CRN Australia) Uhana's platform virtualises network operations for mobile carriers and apps.
CenturyLink is working to increase cybersecurity (AZ Big Media) Black Lotus Labs, the threat research and operations arm of internet service provider (ISP) CenturyLink, is working to combat cyberattacks.
Capgemini hails 'remarkable' UK performance (CRN) French system integrator praised UK region for growth in public sector business
Mocana Expands Executive Team to Lead Rapid Company Growth (West) Internet of Things (IoT) Cyber Protection Leader Names New Chief Marketing Officer, Chief Revenue Officer, VP of Customer Success and Chief Finance Officer, Following Influx of Company Momentum
Products, Services, and Solutions
Perimeter 81 Partners with SentinelOne to Deliver Fully Automated, Zero Trust Network Security and Endpoint Protection (PR Newswire) Perimeter 81, a pioneer in zero trust software-defined network access, has partnered with SentinelOne, the...
Asigra Unveils OpEX Backup Appliance Integrated with Zadara's Enterprise Storage-as-a-Service (Benzinga) New Solution Combines Cybersecurity-Powered Asigra Cloud Backup with the Zadara Enterprise Storage-as-a-Service to Protect Business Data.
Gurucul Behavior Based Network Traffic Analysis Detects Unknown Threats (Yahoo) Network Traffic Analysis Solution Identifies Compromised Devices Using ML/AI on Contextual NetFlow and Packet Inspection Data
Glasswall Solutions’ FileTrust Now Available in the Cloud (BusinessWire) Glasswall Solutions is adding an up-to-date offering of its Glasswall FileTrust, which will be managed 100% in the cloud.
Aqua Security Introduces Native Runtime Protection for Pivotal Cloud Foundry (Aqua) Expansion of the Aqua-Pivotal collaboration delivers comprehensive security for application development and production environments on PCF BOSTON
Attivo Networks Tightens Detection Net on Attacker Lateral Movement (Dark Reading) Innovations in deception technology aim to lock down endpoints so attackers can't advance.
New Net Technologies Adds Vulnerability Management to its Portfolio in New Partnership with Greenbone Networks (PR Newswire) Greenbone Networks, a leading provider of vulnerability management, today announced it is partnering with US and...
Microsoft Makes Azure Security Center for IoT Generally Available (SecurityWeek) Azure Security Center for IoT helps secure IoT projects within corporate environments (such as Azure Sentinel, OPC Twin, OPC Vault, and more).
Meet NordLynx – the new solution for a fast and secure VPN connection (NordVPN) Being forever-curious and imaginative geeks, we at NordVPN are always open to innovation. Today we are excited to announce our latest project: the NordLynx technology built around the WireGuard® protocol.
Technologies, Techniques, and Standards
How the Army is strengthening cyber cities (Fifth Domain) An upcoming exercise will test how cities in South Carolina and Georgia respond to cyber incidents, as well as how those local incidents can affect overseas military deployments.
95% of Pen Test Problems Can Be Easily Resolved (Infosecurity Magazine) Problems found in the majority of penetration tests can be resolved with straight-forward fixes
Breaches Highlight Why Password Protecting Systems Alone Falls Short (Nucleus Cyber) Several recent high profile breaches had a common single point of failure – location based security. Data-centric security is necessary to properly protect sensitive data.
Research and Development
Scientists in Japan claim laser-based quantum internet breakthrough (Computing) Quantum internet technology would make 100 per cent secure internet communications possible
Identity Threat and Assessment Prediction (ITAP) (University of Texas at Austin Center for Identity) Identity Threat Assessment and Prediction (ITAP) is a risk assessment tool that increases fundamental understanding of identity theft processes and patterns of criminal behavior. ITAP aggregates data on identity theft to analyze and describe identity vulnerabilities, the value of identity attributes, and their risk of exposure.
Academia
Brooklyn program aims to hack diversity in cybersecurity (Brooklyn Eagle) NYU Tandon School of Engineering is looking to diversify tech.
Legislation, Policy, and Regulation
Russia Solidifies Grip on its Cyberspace, via the Sovereign Internet Law (International Policy Digest) The Internet created open-ended cyberspace, but recent legislation by the Kremlin brings into question the correlation between citizen freedom and national interest.
'Five Eyes' alliance calls for backdoor access to WhatsApp and other encrypted communications (Computing) GCHQ has suggested that tech firms' communication services should be able to surreptitiously add intelligence agents to conversations or group chats
Netherlands' government: Staff shouldn't use Office due to privacy problems over telemetry (Computing) Report recommends against using Office Online or Office mobile apps over exfiltration of data
Estonia debuts first-ever cyber diplomacy training (CyberScoop) Dozens of NATO and EU diplomats who focus on cybersecurity issues descended upon Estonia last week for their first-ever “summer school” training on cyber diplomacy.
Senate to consider US-Israel Cybersecurity Center (The Jerusalem Post) The act, presented before Senate on Wednesday, is a bipartisan legislation meant to promote joint US-Israeli hi-tech security cooperation.
New bill would ban autoplay videos and endless scrolling (The Verge) Taking aim at "features that are designed to be addictive."
Democrats take another stab at preventing foreign election interference (TheHill) House Democrats introduced legislation Tuesday that would require campaigns to report any foreign contacts to federal authorities, the latest push for election security following last week's warnings from former special counsel Robert Mu
Analysis | The Cybersecurity 202: Liberal and moderate Democratic candidates disagree on election security, too (Washington Post) Here's what candidates could have said.
Analysis | The Cybersecurity 202: Mitch McConnell just made sure election security will be key Senate campaign issue (Washington Post) The dispute over legislation is spreading on the campaign trail.
The next cybersecurity concern for NATO? Space (Fifth Domain) A new report warns that the cybersecurity vulnerabilities related to military space systems, specifically terminals and command-and-control systems, deserves renewed attention from NATO countries.
How Leon Panetta’s ‘Cyber Pearl Harbor’ warning shaped Cyber Command (Fifth Domain) In 2012, then-Defense Secretary Leon Panetta warned that a cyber attack on critical infrastructure could have catastrophic consequences rivaling Pearl Harbor.
Head of SEC Enforcement Dept. for Cryptocurrency, Cyber Security Resigns (Cointelegraph) The chief of the SEC Division of Enforcement's Cyber Unit has resigned, after around two years of leading investigations involving crypto and cyber security.
Robert A. Cohen, Cyber Unit Chief, to Leave SEC After 15 Years of Service (US Securities and Exchange Commission) The Securities and Exchange Commission today announced that Robert A. Cohen, Chief of the Division of Enforcement's Cyber Unit, will be leaving the agency in August after 15 years of service.
Litigation, Investigation, and Law Enforcement
DOJ Says Capital One Mega Breach Suspect Could Face More Charges—Did She Hack Multiple Companies? (Forbes) Accused Capital One hacker appears to have posted Slack references to other breaches. Other victims may include a major international telecoms company and an Ohio government department.
New York Attorney General's Office opens probe into Capital One data breach (Computing) Personal details of more than 100 million people in the US and Canada were compromised in the data breach - linked to a misconfigured firewall
Capital One is sued over data breach in proposed class action (Reuters) Capital One Financial Corp was sued on Tuesday after the bank said a hacker who ...
U.S. judge tosses Democratic Party lawsuit against Trump campaign,... (Reuters) A U.S. judge on Tuesday dismissed a Democratic Party lawsuit arguing that the Ru...
NY Federal Judge Throws Out Democratic National Committee's Suit Over Russian Hacking (New York Law Journal) Koeltl said the Foreign Sovereign Immunities Act shielded the Russian Federation from being sued in federal court, and 'second-level participants' were protected under the First Amendment for their roles in sharing information that had been illegally obtained.
Chinese President’s Cousin Draws Scrutiny of Australian Authorities (Wall Street Journal) Ming Chai, who is a cousin of Chinese President Xi Jinping and has been a high-stakes gambler, is on the radar of Australian authorities investigating organized crime, money laundering and alleged Chinese influence-peddling.
Why did the Pentagon spend $32.8M on risky tech? (Fifth Domain) The Defense Department spent at least $32.8 billion on technology in 2018 that threatens national security, according to an inspector general’s report.
US chases fraudulent bitcoin exchange BTC-e for $100m (Naked Security) Two years ago, the US government fined an international cybercriminal and his fraudulent bitcoin exchange over $100m. Now, it’s going after them for the money.
German prosecutors charge former Audi boss with fraud over 'dieselgate' (France 24) German prosecutors charge former Audi boss with fraud over 'dieselgate'
