Cyber Attacks, Threats, and Vulnerabilities
A Growing Frontier for Terrorist Groups: Unsuspecting Chat Apps (WIRED) While major messaging and social media platforms like Facebook, Twitter, YouTube, and Telegram are becoming increasingly inhospitable to ISIS, the group's reach is growing on lesser-known messenger apps designed for businesses and gamers.
ServHelper and FlawedGrace - New malware introduced by TA505 (Proofpoint) Proofpoint researchers detail two undocumented pieces of malware being used by TA505.
The D in SystemD stands for Dammmit... Security holes found in much-adored Linux toolkit (Register) Patches pending for distros to deal with threat of local privilege escalation to root
r/help - Recently locked out of your account? Help is on the way (Reddit) If you are here because you’ve been locked out of your account in the last day or so, you’re in the right place and we want to help you get your account back in working order.
Malvertising Campaign Delivers Info-Stealer + Ransomware (Infosecurity Magazine) Malwarebytes warns users of double whammy
Rogue iOS Apps Sent Data to Malicious Server (Security Boulevard) Researchers have come across several games in the iOS app store that sent information to and communicated with a known malicious server.
New Side-Channel Attack Targets OS Page Cache (SecurityWeek) Researchers who disclosed Meltdown, Spectre and other similar attacks are now back with a new type of side-channel attack, one that is hardware agnostic and targets the operating system page cache.
A year of data infection over protection - the rise of Magecart (IT Pro Portal) Considering the alarming rate at which digital credit card skimmers are found to be compromising e-commerce sites, what do businesses need to know about Magecart?
ONWASA: $277K spent on recovery, defense after cyber attack (The Daily News) ONWASA spent approximately $277,000 on recovery and on changing the types of defenses they employ following a cyber hack in October.
Swindler Dupes Georgia Health System Finance Director Into $1.2M Wire Payment (HealthLeaders Media) Police are investigating after the executive reportedly sent organization funds to someone posing as a representative of a construction company doing work for the health system.
Phishing emails only going to get smarter, warns security firm (IT Brief) Phishing emails typically mimic the look and feel of an email written by someone in authority, such as a bank, or even a colleague.
Security Patches, Mitigations, and Software Updates
Adobe Releases January 2019 Security Updates. None for Flash Player! (BleepingComputer) Adobe released their January 2019 Patch Tuesday updates today for Adobe Connect and Adobe Digital Editions. Updates were also released for Flash Player, but none of them are for security fixes!
Microsoft pulls buggy Office 2010 January updates (ZDNet) Microsoft's preparations for a new Japanese era coming later this year break Excel.
It’s raining RCE flaws (The Daily Swig | Web security digest) Seven critical updates in Microsoft’s new year Patch Tuesday
Snapchat adds end-to-end encryption to protect users' messages (The Telegraph) The messaging app Snapchat has introduced end-to-end encryption, protecting the disappearing photos shared between its users from being intercepted.
SAP Releases 'Hot News' Security Notes on First Patch Day of 2019 (SecurityWeek) SAP released its first Security Patch Day for 2019, which includes a total of 11 Security Notes, two of which are rated as Hot News.
Google Patches Critical Vulnerability in Android (SecurityWeek) Google has released its first set of monthly security patches for Android in 2019, with fixes for more than two dozen vulnerabilities.
Web Vulnerabilities Up, IoT Flaws Down (Dark Reading) The number of flaws found in WordPress and its associated plugins have tripled since 2017, while Internet of Things vulnerabilities dropped significantly, according to data collected by Imperva.
The State of Web Application Vulnerabilities in 2018 (Imperva) This blog provides an analysis of all web application vulnerabilities throughout the year, view trends, and notice significant changes in the security landscape. This look back at 2018 helps readers to understand the changes and trends in web application security over the past year.
WordPress-Related Vulnerabilities Tripled in 2018 (BleepingComputer) WordPress-related vulnerabilities have seen a 300% increase in 2018 compared to the previous year, a recent study has found. Most of the bugs were in the plugins that extend the functionality of WordPress websites.
Email security predictions: What we can expect in 2019 (Help Net Security) 2018 shed a lot of light on how expensive successful phishing attacks can be, with the FBI reporting in July well over $12B in financial losses due to
Most Israelis confident nation ready for major cyber-attack (The Jerusalem Post) Israelis are far more trusting than others that their country is safe from cyber-attacks, are they right?
Analysis | The Cybersecurity 202: Democrats are more concerned about election security than Republicans, survey finds (Washington Post) Cybersecurity’s a partisan topic now. Get used to it.
Parsons acquires geospatial intelligence provider OGSystems (C4ISRNET) OGSystems will bolster Parsons' intelligence and artificial intelligence offerings.
Hui Huliau Acquires AC4S (PR Newswire) Hui Huliau announced today the acquisition of Advanced C4 Solutions Inc. (AC4S), a leader in C4, professional...
Sophos snaps up cloud infrastructure specialist Avid Secure (ZDNet) The small company bounces between California and India.
Why FireEye Stock Dropped 19% in December -- The Motley Fool (The Motley Fool) A Wall Street firm sees limited upside for the cybersecurity company's shares.
Symantec Appoints Sue Barsamian To Its Board of Directors (AP NEWS) Symantec Corp. (NASDAQ: SYMC) today announced that its Board of Directors (the “Board”) appointed Sue Barsamian and Richard S. “Rick” Hill as members of the Board, effective January 7, 2019.
Check Point Taps VMware’s Frank Rauch to Lead Global Channels (Channelnomics) VMware, HP veteran to oversee worldwide channel sales for security vendor
Logikcull, Leader in Corporate Data Governance, Announces Appointment of Technology Executive Bill Welch to Board of Directors (PR Newswire) Amid rising scrutiny paid to corporate data governance, including legal discovery where the risks and costs are...
Products, Services, and Solutions
Respond Software and Norwich University Defend NCAA College Football Playoff Championship (PR Newswire) On Monday, January 7, 2019, the Clemson Tigers and Alabama Crimson Tide faced off for one of the largest...
Intelity Partners with Acuant to Further Streamline Guest Check-in and Mobile Key Delivery (Acuant) Intelity and Acuant partner to offer secure ID verification for hotels including mobile check-in remote identity check to streamline guest experience.
Hyatt launches public bug bounty program with HackerOne (Hyatt Newsroom) Adds an additional layer to Hyatt’s cyber security strategy
Microsoft spins off security, compliance bits from Microsoft 365's priciest plan for E3 customers (Computerworld) Microsoft is adding two new M365 add-on plans for corporate customers already subscribing to the Enterprise E3 version.
Microsoft Adding Office 365 Threat Auto-Investigation to GCC Offering (BleepingComputer) The auto-Investigation with threat playbooks feature was included in the roadmap in October and was now also added to Microsoft's future Office 365 Government GCC offering
A10 Networks Thunder® Convergent Firewall Selected for 5G Network Deployment by Major Japanese Mobile Carrier (BusinessWire) A10 Networks (NYSE: ATEN), a leading provider of intelligent and automated cybersecurity solutions, today announced a major Japanese mobile carrier ha
Graphus Integrates with Phishing Awareness Training Solutions (PRWeb) In the latest release of Graphus® they have implemented several new features and enhancements to their platform and one in particular that is very exciting is
Bromium Secure Browsing Isolates Intelligently and Maximizes Browser Choice (Security Boulevard) Web browsing is intensely personal, even at work. Users develop strong preferences, tend to lock in a browser early, and are fiercely loyal to their favored choice.
UNITED STATES : Looking Glass, Darkmatter's cyber-intelligence broker (Intelligence Online) The US cyber-security firm LookingGlass Cyber Solutions (LGC), which will be at the Gulf Information Security Expo and Conference (GISEC)
Rohde & Schwarz Unveils New DPI Features for vEPC (Fast Mode) ipoque, a Rohde & Schwarz company providing market-leading deep packet inspection (DPI) software, announced new R&S PACE 2 capabilities for the virtualized evolved packet core (vEPC) market.
Rackspace authorised to host Aussie government data (CRN Australia) Approved up to the unclassified level.
FireEye updates Email Security with new threat detection and evasion defenses (Help Net Security) FireEye Email Security enhancements include executive impersonation protection, URL protection, password-protected image analysis.
Gemalto helps simplify and secure IoT connectivity to the AT&T network with eSIM and IoT module (Help Net Security) Gemalto is helping simplify and secure IoT connectivity for AT&T customers by integrating its embedded SIM (eSIM) inside the Cinterion LTE-M IoT module.
Xerox enhances AltaLink Workplace Assistants (Help Net Security) New software enhancements to these Workplace Assistants, allow companies to monitor critical security settings and automatically reset unauthorized changes.
Polyverse announces technology partnership with Red Hat (Help Net Security) Polyverse’s Polymorphic Linux has been tested and certified for use on the platform, ensuring performance and compatibility for enterprise customers.
Deception for proactive defense (Help Net Security) This article is fourth in a five-part series being developed by Dr. Edward Amoroso in conjunction with the deception technology team from Attivo Networks.
Technologies, Techniques, and Standards
Countering Russian disinformation the Baltic nations' way (The Conversation) European countries, especially the Baltic states of Estonia, Latvia and Lithuania, have confronted Russian disinformation campaigns for decades. The US can learn from their experience.
What will it take to monitor and secure mobile military networks? (C4ISRNET) Soldiers in combat require immediate access to information, which requires a dependable and secure network. Army leaders must have a system in place that allows them to quickly address problems and bottlenecks as they occur.
SingHealth COI makes 16 recommendations to strengthen cyber defence (The New Paper) A senior manager at Integrated Health Information Systems (IHiS) did not report the cyber attack as he feared added pressure and more work. With no clarity on how such incidents should be reported, a junior staff member who discovered the breach left it to her direct...
Buyer Beware: Autonomous Security is a Myth (SC Media) Cybersecurity artificial intelligence (AI) needs to exist before it can save us. The excessive use of AI in marketing materials has left those looking for
Understanding how data becomes intelligence is central for any successful security program (Help Net Security) Threat intelligence is one of the hottest terms in information security at the moment. But, as with so many buzzwords, it is often overused and misused.
5 Key Features Your Security Risk Assessment Should Have (Panorays) Security risk assessments are critical for measuring supplier security posture, but they can be cumbersome and time-consuming. Here are top 5 features for an effective security risk assessment.
GDPR: Five tips for organizations to remain compliant (Help Net Security) For the majority of UK businesses, a huge amount of time and resource was invested to become GDPR compliant in time for the May 2018 deadline. The cost of
Research and Development
CyberX Receives U.S. Technology Patent for ICS Threat Monitoring Analytics (POWER Magazine) CyberX Receives U.S. Technology Patent for ICS Threat Monitoring Analytics
Cybersecurity a must in curriculum in increasingly digital classrooms (Education Dive) An ability to responsibly navigate online threats is as critical as grasping life skills taught in home economics — and educators must learn, too.
Legislation, Policy, and Regulation
Norway considering whether to exclude Huawei from building 5G network (Reuters) Norway is considering whether to join other western nations in excluding China...
Japan and India to discuss space and cyberspace at upgraded 'two-plus-two' security talks (The Japan Times) The two nations will aim to launch ministerial security talks early this year to deepen security cooperation, Foreign Minister Taro Kono said.
Senate Bill Demonstrates Continued Interest in the Federal Acquisition Supply Chain (JD Supra) For years, United States security agencies have recognized a threat to government information technology systems posed by contractor supply chains....
INSIDE THE RING: Foreign hacker threat grows for private sector (The Washington Times) The National Counterintelligence and Security Center this week launched a campaign to alert the public to growing threats posed by hackers from China, Russia and other foreign adversaries.
Shutdown delays TSA data-security efforts (FCW) The standoff over a controversial border wall is holding up activity on a planned overhaul of key transportation security systems.
Litigation, Investigation, and Law Enforcement
Kaspersky blew whistle on NSA hacking tool hoarder (Ars Technica) Kaspersky passed suspicious Twitter messages from Martin to US government.
Russian firm that was barred from U.S. networks as a spy threat helped NSA nab suspect in massive breach (Washington Post) Kaspersky Lab alerted the NSA it had received strange Twitter messages from an agency worker who was subsequently arrested.
Hal Martin's defense says prosecutors have yet to provide essential evidence (CyberScoop) Attorneys for Harold T. Martin III, the former U.S. National Security Agency contractor accused of perhaps the largest theft of government secrets in American history, said in a court filing that government prosecutors have not allowed access to evidence necessary to mount a sufficient defense.
Further Investigations Show Ties of China's Huawei To Iran (Forbes) A Reuters report says Huawei looks to have done business with Iran and Syria.
New documents link Huawei to suspected front companies in Iran, Syria (CNBC) U.S. authorities allege CFO Meng Wanzhou deceived international banks into clearing transactions with Iran by claiming the two companies were independent of Huawei, when in fact Huawei controlled them.
Canadians support Ottawa’s decision to arrest Huawei executive, poll shows (The Globe and Mail) Canada’s arrest of Meng Wanzhou has severely strained relations with Beijing, sparking angry demands for her to be returned home and the imprisonment of two Canadians
Chinese envoy accuses Canada of ‘white supremacy’ for demanding release of Canadians (The Globe and Mail) Canadian authorities arrested Meng Wanzhou in December at the request of the United States
Lieberman's ZTE Work Makes Him a Foreign Agent: Complaint (Bloomberg) Former Senator Joe Lieberman should register as a foreign agent for his work on behalf of embattled Chinese telecommunications company ZTE Corp., according to a complaint filed with the Justice Department today by the Campaign Legal Center.
Senators Call on FCC To Investigate T-Mobile, AT&T, and Sprint Selling Location Data to Bounty Hunters (Motherboard) After Motherboard’s article, Senators Kamala Harris, Mark Warner, and Ron Wyden are coming out against telcos who are selling their customers' location data.