Cyber Attacks, Threats, and Vulnerabilities
Hy-Vee issues warning to customers after discovering point-of-sale breach (ZDNet) Company doesn't know what locations were impacted, but it's warning customers early so they can keep an eye out for suspicious transactions.
Kaspersky AV injected unique ID that allowed sites to track users, even in incognito mode (Ars Technica) Feature Kaspersky added in 2015 also made it possible to be ID'd across different browsers.
New Android Malware disguised as Fake Adobe Flash Player installation (S4Tips.com) Millions of Android users are at risk because of a new trojan named Cerberus, which infects devices by disguising itself as an Adobe Flash Player installation. After being installed, the imposter requests accessibilities that allow a future attack to take place. How it works The malware overlays login tabs of banking apps, it steals credentials
Privacy researchers devise a noise-exploitation attack that defeats dynamic anonymity (TechCrunch) Privacy researchers in Europe believe they have the first proof that a long-theorised vulnerability in systems designed to protect privacy by aggregating and adding noise to data to mask individual identities is no longer just a theory. The research has implications for the immediate field of diffe…
Steam Accounts Being Stolen Through Elaborate Free Game Scam (BleepingComputer) An elaborate scam is underway that pretends to be a free game giveaway site, but instead hacks a user's Steam account, takes control over it, and then uses it to target other players.
New Attack Exposes Serious Bluetooth Weakness (Decipher) The KNOB attack exploits a weakness in how Bluetooth devices negotiate the encryption key, allowing eavesdropping and decryption of communications.
New Bluetooth KNOB Attack Lets Attackers Manipulate Traffic (BleepingComputer) A new Bluetooth vulnerability named "Key Negotiation Of Bluetooth attack" or "KNOB" has been disclosed that allow attackers to more easily brute force the encryption key used during pairing to monitor or manipulate the data transferred between two paired devices.
Router Network Isolation Broken By Covert Data Exfiltration (BleepingComputer) Software-based network isolation provided by routers is not as efficient as believed, as hackers can smuggle data between the networks for exfiltration.
MiFi 4G hotspots are vulnerable to hacking, use a VPN to protect yourself (Private Internet Access Blog) Many popular MiFi devices used as 4G hotspots are vulnerable to hacking. A DEFCON 27 talk by Pen Test Partners revealed command injection and remote code execution vulnerabilities in popular 4G hotspots and MiFi routers made by ZTE, Netgear, TP-Link, and Huawei. Affected models include the Netgear Nighthawk M1, the ZTE MF910 and the ZTE … Continue reading "MiFi 4G hotspots are vulnerable to hacking, use a VPN to protect yourself"
Are you using home Wi-Fi for online banking? ALERT! Fraudster can steal your money with this trick; know how (India TV News) Online banking or net banking credentials are very confidential that we never share it with anyone. However, we end up doing a big mistake unintentionally. Every now and then we do an online transaction like payment by connecting a smartphone or a laptop to 'secure' home Wi-Fi. However, you will be shocked to know-how with an easy trick fraudster can get authorise access to your bank account and steal your hard-earned money.
Microsoft Confirms Windows 10 1903 Update Error 0x80073701, Working on Fix (BleepingComputer) In an update to the Windows 10 Health Dashboard, Microsoft has confirmed that they are working on a fix for the 0x80073701 error that users are receiving when installing new v1903 updates.
Carmel Clay Schools reports student data breach (13 WTHR Indianapolis) Carmel Clay Schools sent letters to families letting them know if their child was impacted.
Cyber attack hits medical centres (Times Age) A global cyber security attack has forced the websites of four Wairarapa medical practices to be taken down after a Tu Ora Compass Health server fell victim to a hacker. Tu Ora Compass Health’s website and the websites of Kuripuni, Greytown, Featherston, and Carterton medical centres cannot be …
Ransomware Attack Hits Local Governments In Texas (KUT) A coordinated ransomware attack has affected at least 20 local government entities in Texas, the Texas Department of Information Resources said. It would
Hackers breach 20 Texas government agencies in ransomware cyber attack (Dallas News) State officials say they are responding to a coordinated ransomware attack that has affected at least 20 government agencies throughout Texas.The...
Government agencies across the state are under cyber-attack (WBAP) Texas state officials say at least 20 government agencies throughout the state have been attacked by hackers
Here’s how Georgia is responding to a recent wave of cyber-attacks (The Georgia Sun) Georgia Gov. Brian Kemp has stepped in to increase cybersecurity after several state and county agencies took a bruising from cybercriminals in the last six weeks. Kemp signed an executive order this…
Blackout fears over National Grid cables from the Continent (Times) National Grid is routinely restricting the use of its own power cables from the Continent because of the risk of blackouts if they failed. Britain’s electricity system is sufficiently fragile at...
A Major Cyber Attack Could Be Just as Deadly as Nuclear Weapons, Says Scientist (ScienceAlert) People around the world may be worried about nuclear tensions rising, but I think they're missing the fact that a major cyberattack could be just as damaging – and hackers are already laying the groundwork.
Opinion | How an Online Mob Created a Playbook for a Culture War (New York Times) The powerful lesson of a 5-year-old harassment campaign: How to wage a post-truth information war.
Security Patches, Mitigations, and Software Updates
Google removes option to disable Nest cams’ status light (Naked Security) It’s more of a “post-purchase middle finger” to customers than a privacy plus, say some outraged users who use the cams to catch crooks.
Steam Security Saga Continues with Vulnerability Fix Bypass (BleepingComputer) A bypass for a recent Steam vulnerability that could allow malware or a local attacker to gain admin privileges has been disclosed on Twitter. This new method allows an attacker to bypass the fix created by Steam and exploit the vulnerability again.
A Security Bug Has Been Haunting Windows Users for Over 20 Years (Popular Mechanics) PSA: Go install the latest security patch ASAP.
Exclusive: Fearing data privacy issues, Google cuts some Android... (Reuters) Alphabet Inc's Google has shut down a service it provided to wireless carri...
Cyber Trends
Feds never faced a ‘major’ cybersecurity attack in 2018 (Fifth Domain) The federal government was the victim of more than 31,000 cybersecurity incidents in fiscal year 2018, according to an Office of Management and Budget report released Aug. 16.
What’s Trending in Data Breaches and Cyberattacks? (MeriTalk) While “large impactful [cyber] incidents” are on the rise, there are fewer “high-profile public disclosures,” according to a FireEye’s year’s M-Trends 2019 Report, which is based on FireEye Mandiant’s investigations of the most interesting and impactful cyberattacks of 2018.
7 Biggest Cloud Security Blind Spots (Dark Reading) Cloud computing boon is for innovation, yet security organizations find themselves running into obstacles.
Which Countries Are Best-Prepared for Cybercrime Response? (PCMAG) While countries including Singapore, the US, France, Canada, and Japan have among the highest Global Cybersecurity Index (GCI) scores, readiness goes only so far in the ever-evolving cyberattack-threat landscape.
Cyber sports may be added to Olympic program in 15-20 years, says Russian sports minister (TASS) According to Pavel Kolobkov, cyber sports have a serious potential and good perspectives
Marketplace
Closing the talent gap for public sector cybersecurity (Fifth Domain) Federal agencies continue to face increased pressure to recruit, train and retain security professionals that have the necessary skills and expertise to protect their systems against threats.
New Army cyber warfare units seriously undermanned, GAO says (Army Times) The report focused on new cyber and electronic warfare units, and one of those is only 18 percent manned.
"We must leave ‘no stone unturned’ in addressing the skills gap": Symantec's Sunil Varkey (TahawulTech.com) Sunil Varkey, CTO and Strategist, Emerging Region, symantec, sheds light on how the current skills gap is taking its toll on security.
Huawei’s US chief security officer says he’s been called a traitor for defending the Chinese tech giant. But he says his goal is to 'promote a safer cyberspace' (Business Insider) Huawei’s US chief security officer, Andy Purdy, a former DHS official, says he's been called a traitor for his role at the Chinese giant.
CEO of Israeli spyware-maker NSO on fighting terror, Khashoggi murder, and Saudi Arabia (CBS News) An Israeli company licenses software around the world that can crack just about any smartphone, but is its use always on the side of good?
Cloudflare Files S-1 With Healthy Mix Of Accelerating Revenue Growth, Slimming Cash Burn (Crunchbase News) According to Crunchbase, San Francisco-based Cloudflare has raised $332.1 million in known capital since it was founded in 2009.
Barracuda acquires bot mitigation technology provider InfiSecure (CISO MAG | Cyber Security Magazine) The new alliance integrates Barracuda’s Global Threat Intelligence Infrastructure with the InfiSecure technology to detect and prevent advanced bot-attacks.
Online attacks fighter Corero Network Security smashed again on new warning (Shares Magazine) Today’s profit warning from Corero Network Security (CNS:AIM) is another ugly reminder of how tough it is for small, sub-scale cyber security businesses.
A 'big data' firm sells Cambridge Analytica’s methods to global politicians, documents show (Quartz) “This document should sound global alarm bells that there are growing threats to the integrity of our elections... This is 1984 meets the 21st century.”
Unit 42 Named Top Zero-Day Vulnerability Contributor by Microsoft (Palo Alto Networks Blog) Palo Alto Networks is proud that Microsoft has recognized our Unit 42 global threat intelligence team with multiple awards for its contributions to vulnerability research, including first place for discovery of Zero Day vulnerabilities. Microsoft also recognized Unit 42 researchers Gal De Leon and Bar Lahav in its annual list of the Most Valuable Security Researchers.
Cisco Lays Off 488 (Light Reading) The company seems to be making adjustments in the face of a disappointing quarterly projection; in addition to the layoffs it's also hiring, and shut down development in an emerging cable data networking technology.
Rockwell Automation announced as Founding Member of ISA Global Cybersecurity Alliance (Supply Chain Management Review) Global Cybersecurity Alliance created to advance cybersecurity readiness and awareness in manufacturing and critical infrastructure
Tanium Names NetApp Veteran as Chief Sales Officer (Channelnomics) Thomas Stanley will oversee sales, channel, and alliances
Palo Alto Networks Sales Exodus Continues With Exit Of Global Leader: Report (CRN) Dave Peranich will be the third high-ranking sales executive to leave Palo Alto Networks this year following turnover in the executive ranks in 2018, according to media reports.
ShieldX appoints Ken Levine as CEO (Help Net Security) ShieldX announces the appointment of Ken Levine as CEO.Ken joins ShieldX after more than 14 years as a cyber security executive.
Products, Services, and Solutions
Akamai opens Melbourne scrubbing centre in fight against DDoS threats (ITWire) Global cloud security and content delivery network provider Akamai has opened a new scrubbing centre in Melbourne as part of its strategy to “outpace the growing scale” of DDoS threats.
Fidelus Joins the Exabeam Partner Program to Help Customers (EnterpriseTalk) Fidelus Technologies, a New York City Managed & Professional IT Services Provider, and Exabeam, the Smarter SIEM™ company, announced that Fidelus has joined the Exabeam Partner Program.
I installed Verizon's free junk call blocker and it seems to kind of help (ZDNet) There is a way to reduce call spam. It's not perfect, but it helps. And hey, that's a start, right?
New VPN clients from NCP feature IPv4/IPv6 dual stack support and quality of service module (Help Net Security) NCP engineering released version 12.0 of the NCP Secure Enterprise and Entry Clients, and NCP Exclusive Remote Access Client optimized for Juniper
Technologies, Techniques, and Standards
Emsisoft releases a free decryptor for the JSWorm 4.0 ransomware (Emsisoft | Security Blog) Emsisoft has released a new free decryptor for the JSWorm 4.0 ransomware.
How to prepare for the California Consumer Privacy Act (Data Security Blog | Thales eSecurity) On June 28, 2018 the governor of California Jerry Brown signed into law with Assembly Bill No. 375 the California...
4 Steps to a More Secure Higher Education Network (Technology Solutions That Drive Education) Communication and collaboration with all users can help ensure higher education institutions keep their data safe.
DIY Threat Intelligence Gathering If Your Security Solutions Seem Lacking (CircleID) Security solutions are not made equal. Some are better than others when it comes to providing overall protection, but most will require you to buy an entire suite that's enough to break the bank just so you'd feel safe from cyber attacks. So what are you to do if your budget just isn't big enough to afford all-around protection?
Rebuilding Your Brand’s Reputation After A Cyber Attack (The Hack Post) It is estimated that one cyber attack occurs every 39 seconds, with millions of records being stolen daily. According to IT Governance USA, some of the most common attacks include malware, phishing, distributed denial-of-service attacks, SQL injection, and ‘man-in-the-middle’ (MITM). Take an MITM attack, which involves an attacker intercepting and relaying messages between one party and another. …
Deception technology shifts power back to the defender (Help Net Security) A research report commissioned by Attivo Networks explores attitudes and views of deception technology in the enterprise.
Think cyber-safety even when on vacation (KOMO) You're headed off on vacation. You can't wait to relax and unwind, but you want to stay connected, maybe sneak in a little bit of work in between the beach and cocktail hour. So, you plan to take your business laptop with you. Is that really the best idea to bring that work laptop with all of your corporate information with you? Caleb Barlow, vice president of X-Force Threat Intelligence at IBM Security, suggests a more secure way to do it.
Design and Innovation
WebKit’s new anti-tracking policy puts privacy on a par with security (TechCrunch) WebKit, the open source engine that underpins Internet browsers including Apple’s Safari browser, has announced a new tracking prevention policy that takes the strictest line yet on the background and cross-site tracking practices and technologies which are used to creep on Internet users as …
Announcing the WebKit Tracking Prevention Policy (WebKit) Today we are publishing the WebKit Tracking Prevention Policy, covering: What types of tracking WebKit will prevent.
These are the shady tricks shopping sites use to get your money and info (Quartz) Shopping websites have ways of getting you to do what they want.
Academia
Chandler's Basha HS training Arizona's next generation of cybersecurity techs (AZFamily) With thousands of cybersecurity jobs already open in Arizona, students from the Institute of Operations and Networking will be in an enviable position -- ready to work -- when they
Legislation, Policy, and Regulation
Trump: We don't want Afghanistan to be 'laboratory for terror' (CNN) President Donald Trump on Sunday said Afghanistan "can't be a laboratory for terror" as discussions over a potential US withdrawal from the country persist after nearly 20 years at war.
Reliance on e-services has become a security issue in Estonia as it pioneers eGovernment (SC Magazine) Estonia's president calls on state to develop cyber-security, cryptography capabilities after an earlier ID card crisis put half the population at risk of id theft.
Canberra's creeping culture of secrecy (Australian Financial Review) Politicians don't want to re-regulate dodgy industries, but will use complex laws to restrict press freedom, writes Laura Tingle.
Deal or no deal: Brexit could be good for cyber security (Open Access Government) Chris Bush, Head of Security, ObserveIT discusses why Brexit doesn’t actually have to mean a less cyber-secure UK, in this article
Josh Hawley Says Tech Enables 'Some of the Worst of America' (WIRED) From social media addiction to antitrust regulation, the freshman senator from Missouri wants to take on Big Tech in big ways.
Candidates’ cybersecurity positions matter, voters say (POLITICO) Election vendors seek recertification relief — Nonprofit threatens North Carolina over voting equipment
Exclusive: U.S. set to give Huawei another 90 days to buy from American suppliers - sources (Reuters) The U.S. Commerce Department is expected to extend a reprieve given to Huawei Te...
Trump says he doesn't want to do business with Huawei due to national security concerns (CNBC) "I don't want to do business at all because it is a national security threat," Trump told reporters.
Trump Leaves Huawei On A Knife Edge With Brutal Weekend Threat (Forbes) The U.S. president has made it clear he does not want the reported Commerce Department license extension put in place.
Tensions Over Huawei Are About to Hit the U.S.-China Trade War Again (Barron's) The next twist in the U.S.-China trade conflict could come Monday, when the U.S. has to figure out what to do about the restrictions it imposed on the telecommunications equipment giant. Analysts expect the U.S. to delay a hard decision.
White House appoints Uygur-American to top China policy advisory job (South China Morning Post) Appointment is a ‘poke in the eye’ to Beijing and could signal a stronger focus on human rights in Washington, analysts say.
It’s Official: Defense Department Will Use Other Agencies’ Cloud Security Assessments (Nextgov.com) The department’s IT office issued a provisional rule to accept other agencies’ FedRAMP ATOs without the need for written approval.
Litigation, Investigation, and Law Enforcement
Action Fraud investigation: victims misled and mocked as police fail to investigate (Times) Call handlers working for the police insult victims of fraud and have been trained to mislead them into thinking their cases will be investigated when most are never looked at again. An undercover...
Websites Can Discriminate Against You Even If You Don't Use Them, California Supreme Court Rules (Gizmodo) Nearly four years ago, a lone bankruptcy lawyer sued Square, the payment processor run by Twitter CEO Jack Dorsey, challenging the app’s terms of use—despite never signing up. As of yesterday, the case will proceed, thanks to an opinion issued by the California Supreme Court that could have wide-reaching implications for online businesses.
Decade-Long Bank Account Hacking Scheme Gets Fraudster 57 Months (BleepingComputer) Brooklyn man Jason Mickel Elcock was sentenced today to 57 months in prison for a series of account hijacking attacks spanning more than a decade, having used stolen personal and financial information to pilfer over $1.1 million from banks and online retailers.
Brooklyn Man Sentenced To 57 Months In Prison For An Account Takeover And Money Laundering Scheme Affecting Tens Of Thousands Of Victims (U.S. Attorney’s Office Southern District of New York) Geoffrey S. Berman, the United States Attorney for the Southern District of New York, announced today that JASON MICKEL ELCOCK, a/k/a “Prezzi,” was sentenced today in Manhattan federal court to 57 months in prison for engaging in a decade-long scheme to steal personal and financial information from tens of thousands of individuals and businesses and unlawful possession of a firearm, resulting in a loss of more than $1.1 million to banks and online retailers.
A cybercriminal covered all his tracks—and then he verified his PayPal account (Quartz) With just about every aspect of modern life networked together in one way or another, it's hard to carry out a cybercrime without leaving clues.
Roger Stone Tried to Subpoena a Cybersecurity Company for Sensitive DNC Information (Law and Crime) In a bit to gain access to allegedly "privileged and highly sensitive" information, Roger Stone attempted to subpoena CrowdStrike, a cybersecurity company that handles Democratic National Committee (DNC) and Democratic Congressional Campaign Committee (DCCC) documents, as part of his defense in his ongoing case against the U.S. government. More specifically, Stone has asked for "unredacted versions of three reports that were prepared by CrowdStrike" to provide the DNC and DCCC with legal counsel regarding "an unprecedented cyberattack orchestrated by Russian-based hackers during the 2016 presidential election."
RBS hides Natwest data breach from customers (Times) Highly sensitive personal data, including banking details of more than 1,600 Natwest customers, has been left in a former employee’s home for more than a decade because the bank has been unable to...
FCC Forgets About, Then Dismisses, Complaint Detailing Verizon's Long History Of Net Neutrality Violations (Techdirt.) So a few years ago we wrote about Alex Nguyen, one of the only folks to file a formal net neutrality complaint (pdf) with the FCC. Before the rules were killed, users could file a free complaint, of which there were thousands. But if you wanted to...
