Cyber Attacks, Threats, and Vulnerabilities
North Korea’s Lazarus targets cryptocurrency vertical (ComputerWeekly) APT group behind the infamous WannaCry incident is targeting cryptocurrency operators, according to new research.
Russian-backed organizations amplifying QAnon conspiracy theories, researchers say (Reuters) Russian government-supported organizations are playing a small but increasing role amplifying conspiracy theories promoted by QAnon, raising concerns of interference in the November U.S. election.
Chinese-Made Smartphones Are Secretly Stealing Money From People Around The World (BuzzFeed News) Preinstalled malware on low-cost Chinese phones has stolen data and money from some of the world's poorest people.
Bridgefy, the messenger promoted for mass protests, is a privacy disaster (Ars Technica) Researchers notified the company in April of serious flaws that have yet to be fixed.
FBI, CISA Echo Warnings on ‘Vishing’ Threat (KrebsOnSecurity) The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) on Thursday issued a joint alert to warn about the growing threat from voice phishing or "vishing" attacks targeting companies. The advisory came less than 24 hours after KrebsOnSecurity published an in-depth look at a crime group offering a service that…
DoppelPaymer Ransomware Resurgence (Avast) The recent resurgance of DoppelPaymer ransomware adds to the larger proliferation of Covid-19 related scams.
Fake Login Pages Spoof Over 200 Brands (IRONSCALES) In the first half of 2020, more than 50,000 fake login pages spoofed over 200 of the world’s most prominent brands in phishing attacks.
What are Deepfakes? - Examples of Deepfakes (Updated 2020) (Tessian) New research shows 74% of IT leaders think deepfakes are a threat to their organization's security. Find out what deepfakes are and how to protect yourself.
Fake Malwarebytes Installation Files Distributing Coinminer (Avast) Monero miner based on XMRig infects PCs via illegitimate software downloads.
Report: Leading Internet Security Company Exposes Customers to Fraud and Attack From Hackers (vpnMentor) Led by Noam Rotem and Ran Locar, vpnMentor’s research team recently discovered a data breach belonging to SSL247, a reseller of internet security products. The breach originated
Malicious Actors Impersonating Bitcoin Platform to Launch Malware Attacks (Infosecurity Magazine) Scammers are attempting to trick users of the online currency
Pandemic Gooses Stolen Credentials Prices on Dark Web (TechNewsWorld) After crashing in 2019, Dark Web markets for stolen credentials rebounded during the first half of 2020, largely due to major shifts in consumer behavior caused by the global pandemic. Hacked accounts for delivery services and physical fitness brands are some of the highest priced items on the market, according to a recent report.
Vulnerability Summary for the Week of August 17, 2020 (CISA) The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week.
Hacker Stole CryptoTrader.Tax’s Customer Information (Finance Magnates) The compromised data are now up for sale on the dark web.
Delhi fashion blogger's Instagram account hacked, hackers seek ransom in bitcoins (India TV News) A South-Delhi based fashion blogger recently woke up to a rude shock when she learnt that her Instagram account had been hacked and that the hackers were based in eastern Europe.
Canadian Pro Kevin McPhee Claims Hacker Emptied His Account While Playing on GGPoker (HighstakesDB) Former WSOP Europe and EPT Main Event double champion Kevin McPhee has claimed that his GGPoker account was emptied by a hacker WHILE he was...
Details about previously undisclosed company targeted by ransomware group come to light (Insurance Business) Malicious actors threatened to leak construction firm's data unless an unspecified amount of money was paid
Eight Million Freepik Users Suffer Data Compromise (Infosecurity Magazine) SQL attack gave individual access to customer database
RailYatri Server Breached, Data Of 7 Lakh Users Exposed (Inc42 Media) Government-sanctioned Indian travel marketplace RailYatri reportedly suffered a data breach on August 9, which exposed sensitive information of more than 7 lakh users on the platform.
Indian train ticketing vendor RailYatri downplays data breach incident (The Daily Swig) Company denies that 700,000 users had their details exposed via public-facing server
Ransomware Attack Impacts Medical Debt Collections Firm R1 RCM (HealthITSecurity) This week's breach roundup is led by a ransomware attack on R1 RCM, one of the largest medical debt collections firms in the US. The vendor took its systems offline in response to the cyberattack.
Haywood County Schools to remain closed Aug. 25 due to ransomware attack (Citizen Times) Haywood County Schools will remain closed Aug. 25 due to a ransomware attack that was identified the previous morning.
Cyber attack on school system shuts down remote learning again for Tuesday (The Mountaineer) Cyber criminals targeting Haywood County Schools with ransomeware have derailed another day of remote learning, with school called off for Tuesday, as well.
Cyber Trends
As Businesses Reopen Physical Locations, New TransUnion Research Shows Fraudsters Decrease Online Schemes Against Companies (TransUnion) Conversely, consumers targeted by digital COVID-19 fraud increased from early in the pandemic
Global pandemic opening up can of security worms (ZDNet) Caught by the sudden onslaught of COVID-19, most businesses lacked or had inadequate security systems in place to support remote work and now have to deal with a new reality that includes a much wider attack surface and less secured user devices.
Microsoft says the pandemic has changed the future of cybersecurity in these five ways (TechRepublic) A new report from Microsoft suggests that cloud-based technologies and Zero Trust architecture will become mainstays of businesses' cybersecurity investments going forward.
Deloitte: Companies turn to cybersecurity, cloud in pandemic response (CIO Dive) Executives care about agility and sustaining operations through disruption. Cloud acts as a backbone, while cybersecurity is a fence.
New Study Finds 75% of Open Source Codebases Have Vulnerabilities (K2io) A new report and study, the 2020 Open Source Security and Risk Analysis report examined audit data from 1,250+ commercial codebases to examine how organizations are using open source code.
Marketplace
Westminster's MAGIC gets federal agriculture department grant to create cyber jobs (Technical.ly Baltimore) The USDA Rural Business Development grant will fund new and existing cybersecurity workforce initiatives from the Carroll County tech nonprofit.
Palo Alto Networks to Acquire Incident Response Firm The Crypsis Group for $265 Million (SecurityWeek) Palo Alto Networks has agreed to acquire incident response and digital forensics consulting firm, The Crypsis Group, for $265 million in cash.
ReliaQuest Raises Over $300 Million in Growth Financing Led by KKR (PR Newswire) ReliaQuest, an advanced cybersecurity managed service and intelligence platform for global enterprises, today announced it has raised over $300...
AffirmLogic Secures $25 Million Equity Financing (BusinessWire) Today, AffirmLogic, the leader in applying mathematical foundations to compute the deep meaning of software, announced the close of a $25 million equi
Investors pour $1.6M into Charlotte cybersecurity startup ThreatSwitch (WRAL TechWire) The Charlotte-based company is still seeking to raise another $99,000, with the minimum investment of $50,000 accepted from any outside investor, according to a recent securities filing.
Telefónica Tech acquires Govertis to boost cybersecurity capabilities (Mobile Europe) European Communications is the leading B2B title for the telecoms industry, exploring operators' technology strategies and providing CTOs and their teams with news, analysis and opinion about the latest developments in the sector.
Telefonica picks up cybersecurity consultancy business (Mobile World Live) Telefonica continued to bolster its cybersecurity credentials, striking a deal to acquire Valencia-based consultancy company ...
ConvergeOne Announces Strategic Acquisition Of Altivon (Southernminn.com) ConvergeOne, a leading global IT services provider of collaboration and digital infrastructure solutions, today announced that it has acquired Altivon, a premier contact
()
Redwood City data analytics unicorn Sumo Logic files IPO plans (Silicon Valley Business Journal) The company has raised a total of about $345 million in funding since it was founded in 2010 and was valued at about $1.2 billion after a round last year.
Could Palantir Be Valued At $30 Billion? (Trefis) Palantir, the big data and analytics software company founded by Peter Thiel, filed a confidential form S-1 with the SEC and is expected to go public sometime this Fall.
Palantir’s S-1 alludes to controversial work with ICE as a risk factor for its business (TechCrunch) Palantir’s mysterious work and its founding origins with Trump ally and anti-press crusader Peter Thiel have inspired a number of controversies in recent years, none as divisive as its ongoing business with ICE. But with a direct listing around the corner, the famously secretive company is in…
Kaspersky calls for cybersecurity startups - My Startup World - Everything About the World of Startups! (My Startup World - Everything About the World of Startups!) Kaspersky Innovation Hub (iHub) recently announced a new call for startups that are developing cybersecurity solutions with a special focus on SMEs
WSJ News Exclusive | General Atlantic, Sequoia Capital Are Key Drivers in Oracle Bid for TikTok (Wall Street Journal) General Atlantic and Sequoia Capital, two top investors in TikTok’s Chinese parent company, are vying to be part of a deal for the U.S. operations of the video-sharing app as it seeks to avoid a ban by the Trump administration, according to people familiar with the talks.
()
CUJO AI Joins the European Telecommunications Standards Institute (ETSI), Strengthening Involvement in Future 5G Infrastructure (PR Newswire) CUJO AI, the global leader in the development and application of artificial intelligence to improve the security, control and privacy of...
EY Canada helping veterans upskill for cybersecurity jobs (Consulting) EY Canada is partnering with WithYouWithMe (WYWM), a veteran-focused training organization, to upskill Canadian Armed Forces veterans for high-demand cybersecurity roles in the Government of Canada.
Australian cybersecurity company launches in NZ, plans for significant investment (Security Brief) CyberCX NZ is committed to lifting the countrys national resilience and is focused on maintaining an independent stance, agile ways of operating and core cyber focus.
Nexusguard Named as a Sample Vendor Under DDoS Defense Category in Two Gartner Hype Cycle Reports (BusinessWire) Nexusguard has been identified as a Sample Vendor in the Gartner Hype Cycle for Network Security, 2020, in the DDoS Defense category.
Aryaka Named to Inc. Magazine’s Annual List of America’s Fastest-Growing Private Companies (ResponseSource Press Release Wire) Debuting at 2778 on the Inc. 5000, Aryaka Recognized for Three-Year Revenue Growth of 144 Percent San Mateo, CA. – August 25, 2020 – Aryaka®, the Cloud-First WAN company delivering the #1 manage...
AlgoSec Celebrates Strong Growth and Profitability in H1 2020 (GlobeNewswire) Leader in network security management solutions reports YoY growth of 26% in product revenues in H1 2020
ESET hires ex-Solista, Kemp exec Luke Holland as Aussie head of sales (CRN Australia) Luke Holland hired as head of sales.
First board member revealed for cyber resilience centre (Insider Media Ltd) An experienced technology entrepreneur has been revealed as the first board member of The West Midlands Cyber Resilience Centre.
BeyondEdge™ CEO, Amir Elbaz, Named to Building Cyber Security Board of Directors (The Daily News) BeyondEdge, Inc., a software-defined, edge compute company focused on advancing the transformation of building and campus-wide networks via open and modular software solutions, today announced its CEO has been named to the Board of Directors for Building Cyber Security (BCS), the leading non-profit organization focused on improving and advancing the physical information and operational technology (OT) systems security, safety, and privacy in both the public and private sector.
Blackpoint Cyber Adds Former Cisco Executive John N. Stewart to Board and Raises Series B Round (PR Newswire) Blackpoint Cyber, a leading technology-focused cyber security company, today announced that it has raised its Series B round of funding and...
Products, Services, and Solutions
Winston & Strawn Launches New Global Privacy & Data Security Practice (PR Newswire) The global law firm of Winston & Strawn LLP today announced the formation of a new, fully integrated Global Privacy & Data Security practice....
Polyverse partners with SUSE to protect against zero-day attacks (Benzinga) Polyverse Corporation has entered into an agreement with SUSE to provide Polymorphing for SUSE Linux Enterprise Server
Bitdefender Adds New Features to Premium VPN (Tech.co) Bitdefender has updated its VPN package with new features that include a kill switch, as well as a redesigned interface
Security Firm Thycotic Ramps Up Professional Services Training For Partners (CRN) Privileged access management solutions provider Thycotic is bringing a new professional services training and certification program to its top channel partners.
Palo Alto Networks aims to scale up automation for the security team (SiliconANGLE) Palo Alto Networks aims to scale up automation for the security team - SiliconANGLE
Huawei and ZTE pass first phase of GSMA/3GPP security accreditation (Telecoms.com) A network security accreditation scheme jointly run by MNO lobby group GSMA and wireless standards body 3GPP has given Chinese vendors the seal of approval.
NIST Certifies Gigamon Inline Decryption Platform (ExecutiveBiz) Gigamon has secured a Level 2 FIPS 140-2 validation status from the National Institute of Standards
ZL Technologies Announces Microsoft Teams Governance and Compliance Capabilities (GlobeNewswire) Management of employee-created data becomes priority as workforces go remote and use of collaboration platforms increases
RangeForce Signs Disti360 as Middle East Distributor for Cloud-based Cybersecurity Training (GlobeNewswire) Partnership to help security teams upskill fast, learn to perform when real attacks strike
PerimeterX Launches Partner Program to Help Providers Extend Their App Security Portfolio and Safely Accelerate Their Customers’ Digital Transformation (PerimeterX) Protect your web apps against account takeover, carding, denial of inventory, scalping, skewed analytics, digital skimming, Magecart, PII harvesting, scraping.
Removing Open Source Visibility Challenges for Security Operations Teams - (Trend Micro) Identifying security threats early can be difficult, especially when you’re running multiple security tools across disparate business units and cloud projects. When it comes to protecting cloud-native applications, separating legitimate risks from noise and distractions is often a real challenge. That’s why forward-thinking organizations look at things a little differently. They want to...
SailPoint Predictive Identity™ Secures Access to Collaboration and Essential COVID-19 Technologies (BusinessWire) SailPoint’s latest updates to the SailPoint Predictive Identity™ platform will be the co-pilot in any organization’s security strategy.
Technologies, Techniques, and Standards
CISA Releases 5G Security Guidelines (Dark Reading) The new document defines lines of effort for developing security for the growing 5G network.
Federal cyber agency releases strategy to secure 5G networks (TheHill) The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) released a strategy Monday to defend U.S. 5G networks against threats.
5G Strategy (CISA) The CISA 5G Strategy details our approach to advance the development and deployment of a secure and resilient fifth generation (5G) infrastructure, one that promotes national security, data integrity, technological innovation, and economic opportunity for the United States and its allied partners.
Hitachi ABB Power Grids joins effort to protect power utilities from cyber threats (AltEnergyMag) Global leader and pioneer in power technologies will share cybersecurity information with utilities through the Fortress Asset to Vendor Network
Blox Tales #14: Credential Phishing Hosted on Box (Armorblox) In this blog, we’ll focus on a credential phishing attempt where attackers hosted the phishing site on Box. The email claimed to come from a legitimate third-party vendor and included a link to a secure document. Clicking the link led readers to a page hosted on Box, followed by a credential phishing page that resembled the Office 365 login portal.
Colleges Weigh Transparency Versus Privacy When It Comes to Covid-19 Data (Wall Street Journal) As college students return to campus, administrators face a tug of war between providing information about Covid-19 cases and protecting the identities of those infected, leading to a patchwork of reporting.
Securing Your Home Network For Distance Learning (Avast) Avast survey breaks down home network concerns, challenges, and solutions during the upcoming school year.
US Army tests network cyber tools under real-world conditions (C4ISRNET) The Army is working to test and mature a couple of defense cyber tools aimed at helping defend tactical networks.
U.S. Army Conducts Final Cyber Blitz (SIGNAL Magazine) The Cyber Blitz experiment has evolved into a multidomain operations exercise that beginning next year will be named Multi-Domain Operations Live.
Three places for early warning of ransomware and breaches that aren't the dark web (Help Net Security) There are three overlooked sources of early warning clues of ransomware and breaches that yield more direct, actionable insights.
Webcast: Pretty Little Python Secrets - Episode 1 - Installing Python Tools and Libraries the Right Way (Black Hills Information Security) Have you ever installed a Python tool / library only to then find out other Python based tools you’ve installed previously are now completely broken? Running Kali? Ever try installing a Python tool with apt-get and another with pip? Notice how some things don’t work anymore? Ever wondered if there was an easier way to […]
Design and Innovation
U.S. military researchers may have found a more productive vulnerability discovery process (CyberScoop) U.S. military researchers think they have found a more efficient and productive way for hackers to find software bugs — and automation is the key.
Marines want tool to identify fake social media accounts posing as senior personnel (C4ISRNET) Fake accounts posing as key personnel are extorting Marines for money and information.
How Natural Language Processing Can Improve Legal Search Results (Kira) Attorneys working smarter and more efficiently positively
impacts their clients, too. AI legal research allows attorneys to provide their clients with work products that are more accurate and completed more quickly, without a corresponding increase in legal costs.
Designers Live in a Hellscape Created by Other Designers (Medium) Veteran product designer explains why this is a good thing
Research and Development
DARPA's new hardware proves tough to crack (FCW) The Defense Department's advanced research arm has early results from its effort to prove that re-engineering hardware makes for fewer cyber vulnerabilities.
Research team looking to patch code in embedded systems, aid in cybersecurity (Purdue University) Three Purdue University researchers and their teammates at the University of California, Santa Barbara and Swiss Federal Institute of Technology Lausanne (EPFL) have received a DARPA (Defense Advanced Research Projects Agency) grant to fund research that will improve the process of patching code in vulnerable embedded systems.
Ben-Gurion University Researchers Propose New Technique to Prevent Medical Imaging Cyberthreats (Global Security Mag Online) Researchers at Ben-Gurion University of the Negev have developed a new artificial intelligence technique that will protect medical devices from malicious operating instructions in a cyberattack as well as other human and system errors.
Academia
Professors integrate cybersecurity, AI curriculum to prepare the next-generation cyber workforce (FIU News) Researchers are looking to study the effectiveness of integrating AI techniques into cybersecurity curricula.
Legislation, Policy, and Regulation
Govt has never considered a bug bounty program, says ASD (iTnews) Despite success overseas.
With Hacks and Cameras, Beijing’s Electronic Dragnet Closes on Hong Kong (New York Times) Under a new national security law, the police are targeting the social media accounts of executives, politicians and activists. American internet giants are struggling to respond.
Taiwan says Alibaba-linked e-commerce site a security risk (AP via Martinsville Bulletin) Taiwan declared an e-commerce platform linked to China's Alibaba Group a potential security risk and told its operator Monday to register as a company from the
BNamericas - China hits back at US pressure on Huawei in ... (BNamericas.com) The Chinese embassy in Brazil reacted to an article written by the US Under Secretary for Economic Growth, Energy, and the Environment, Keith Krach, who desc...
Israel ducks blame for firm with ex-intel officers that bid to ‘shape’ US vote (Times of Israel) Defense Ministry tries to shrug off responsibility as Senate report reveals activities of Psy-Group; Israeli law prohibits unlicensed export of defense tech, knowledge, services
Activists fear increased cyber-surveillance: Will repression in UAE intensify under the Israel deal? (Qantara.de - Dialogue with the Islamic World) Thanks to the recent rapprochement between Israel and the United Arab Emirates, Abu Dhabi should in future be able to access Israeli espionage software even more easily in order to spy on politically unpopular citizens. By Tom Allinson
How to Compete in Cyberspace (Foreign Affairs) Cyber Command’s New Approach
Military's top cyber official defends more aggressive stance (AP NEWS) The U.S. military's top cyber official is defending the government's shift toward a more aggressive strategy in cyberspace, saying the mission has evolved over the last decade...
Brian Harrell, CISA infrastructure security official, steps down (Security Magazine) Brian Harrell, appointed by the President of the United States in December 2018 to serve as the Department of Homeland Security’s Assistant Secretary for Infrastructure Protection, resigned his post last week and is headed to the private sector.
Litigation, Investigation, and Law Enforcement
A Former Uber Exec's Indictment Is a Warning Shot (Wired) Prosecutors allege that former Uber security chief Joseph Sullivan covered up a major breach, in the first high-profile case of its kind.
Texas A&M professor accused of secretly collaborating with China amid NASA work (CNBC) According to the criminal complaint, Zhengdong Cheng, 53, a professor in the College of Engineering at Texas A&M and a NASA researcher, obscured his affiliations with the Chinese government.
TikTok Sues U.S. Government Over Trump Ban (New York Times) The suit escalates a bitter back-and-forth between the popular video app and American officials.
TikTok sues Trump administration to fight impending ban (Washington Post) The service’s legal challenge calls out the president’s executive order, saying it is “not rooted in bona fide national security concerns."
TikTok Sues Over Ban Ordered by Trump (SecurityWeek) Video app TikTok said on Monday it had filed a lawsuit challenging the US government's crackdown on the popular Chinese-owned platform, which Washington accuses of being a national security threat
Why we are suing the Administration (Newsroom | TikTok) Today we are filing a complaint in federal court challenging the Administration's efforts to ban TikTok in the US. As a company we have always focused on transparency, so we want to explain why we are
TOP 10 EU countries with the biggest total GDPR fine in 2020 (Finbold) Finbold.com has studied the GDPR fines and penalties that data protection authorities have imposed in the European Union.
()
Rethinking Snowden (The Blade) President Trump has put Edward Snowden back in the news. Asked if he would consider pardoning the former National Security Agency contractor, Mr. Trump ...
Does the Easyjet cyber attack prove increasing ‘breach fatigue’ in business? (ITProPortal) Will court case ensure cyber insurance is not a ‘Get Out of Jail Free’ card.
South Dakota COVID-19 data breach being investigated by the FBI (KNBN NewsCenter1) PIERRE, S.D. — Those who have tested positive for COVID-19 in South Dakota may have had their personal information compromised. On June 19, 2020, the South Dakota Department of Public Safety’s State Fusion Center received word of a data breach. The breach effected Netsentail.com INC., a web development firm that is used by law enforcement agencies and fusion centers nationwide....
China ‘totally took us down’: former Nortel cyber-security investigator (Global News) Watch China ‘totally took us down’: former Nortel cyber-security investigator Video Online, on GlobalNews.ca
Inside the Chinese military attack on Nortel (Global News) Cybersecurity experts say the fall of Canadian telecom giant Nortel was a direct result of systematic hacking by the Chinese with a direct link to Huawei.
