Cyber Attacks, Threats, and Vulnerabilities
New cyberattacks targeting U.S. elections (Microsoft on the Issues) In recent weeks, Microsoft has detected cyberattacks targeting people and organizations involved in the upcoming presidential election. This highlights the need for those involved in the political process to take advantage of free and low-cost security tools to protect themselves as we get closer to election day.
Russian Intelligence Hackers Are Back, Microsoft Warns, Aiming at Officials of Both Parties (New York Times) China is also growing more adept at targeting campaign workers. But contrary to Trump administration warnings, Beijing is mostly aiming at Biden campaign officials.
Russian hackers behind Hillary Clinton campaign attack return to target Trump and Biden (The Telegraph) Microsoft reveals that the same hackers who targeted Clinton in 2016 are once again trying to disrupt a US election
Russia, China and Iran launched cyberattacks on presidential campaigns, Microsoft says (NBC News) The announcement comes as the presidential campaigns are pushing into the final two months of the race.
Exclusive: Russian state hackers suspected in targeting Biden campaign firm – sources (Reuters) Microsoft Corp recently alerted one of Democratic presidential candidate Joe Biden's main election campaign advisory firms that it had been targeted by suspected Russian state-backed hackers, according to three people briefed on the matter.
Russian Hackers Have Targeted 200 Groups Tied to U.S. Election, Microsoft Says (Wall Street Journal) Russian government hackers have targeted at least 200 organizations tied to the 2020 U.S. election in recent weeks, according to Microsoft Corp.
()
Microsoft Details Election Hacking Efforts, Says China Targeting Biden (Spectrum News) The tech giant releases findings on election interference.
Russia’s Fancy Bear Hackers Are Hitting US Campaign Targets Again (Wired) Microsoft says the GRU hacking group has attacked hundreds of organizations over the past year, many of them tied to the upcoming election.
Three middle-aged Dutch hackers slipped into Donald Trump's Twitter account days before 2016 US election (Register) The Orange One was using a password breached four years previously
Ransomware Could Be Biggest Threat to Upcoming Elections (Governing) Of all the cyberattacks that affect state and local governments, ransomware is one of the most ubiquitous and costly. Now security researchers fear it could also become a political weapon in the upcoming election.
CISA Warns Election-Related Entities to Be on Watch for Phishing Attacks (The State of Security) The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned election-related entities to be on the lookout for phishing attacks.
Actions to Counter Email-Based Attacks on Election Related Entities (CISA Insights) Malicious cyber actors have been known to use sophisticated phishing operations to target political parties and campaigns, think tanks, civic organizations, and associated individuals.
()
()
Kids' Smartwatches Are a Security Nightmare Despite Years of Warnings (Wired) Five out of six brands tested by researchers would have allowed hackers to track kids—and in some cases eavesdrop on them.
Equinix data center giant hit by Netwalker Ransomware, $4.5M ransom (BleepingComputer) Data center and colocation giant Equinix has been hit with a Netwalker ransomware attack where threat actors are demanding $4.5 million for a decryptor and to prevent the release of stolen data.
Data center giant Equinix discloses ransomware incident (ZDNet) Equinix says ransomware hit internal systems but that data centers are OK.
Equinix Statement on Security Incident (Interconnections - The Equinix Blog) Equinix is currently investigating a security incident we detected that involves ransomware on some of our internal systems.
SoftServe hit by ransomware, Windows customization tool exploited (BleepingComputer) Ukrainian software developer and IT services provider SoftServe suffered a ransomware attack on September 1st that may have led to the theft of customers' source code.
Data about UNR alumni, donors may have been stolen in May (AP NEWS) University of Nevada, Reno alumni and donors may have had their information stolen in a data breach that occurred in May, university officials said. The school was told of...
HMS Networks Ewon Flexy and Cosy (CISA) 1. EXECUTIVE SUMMARY
CVSS v3 2.3
ATTENTION: Low skill level to exploit
Vendor: HMS Networks
Equipment: Ewon Flexy and Cosy
Vulnerability: Permissive Cross-domain Policy with Untrusted Domains
2. RISK EVALUATION
Successful exploitation of this vulnerability could allow attackers to retrieve limited confidential information.
FATEK Automation PLC WinProladder (CISA) 1. EXECUTIVE SUMMARY
CVSS v3 7.8
ATTENTION: Low skill level to exploit
Vendor: FATEK Automation
Equipment: PLC WinProladder
Vulnerability: Stack-based Buffer Overflow
2. RISK EVALUATION
Successful exploitation of this vulnerability could crash the device being accessed; a buffer overflow condition may cause a denial-of-service event and remote code execution.
AVEVA Enterprise Data Management Web (CISA) 1. EXECUTIVE SUMMARY
CVSS v3 9.6
ATTENTION: Exploitable remotely/low skill level to exploit
Vendor: AVEVA
Equipment: Enterprise Data Management Web
Vulnerability: SQL Injection
2. RISK EVALUATION
Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary SQL commands on the affected device.
Philips Patient Monitoring Devices (CISA) 1. EXECUTIVE SUMMARY
CVSS v3 6.8
ATTENTION: Low skill level to exploit
Vendor: Philips
Equipment: Patient Information Center iX (PICiX); PerformanceBridge Focal Point; IntelliVue Patient Monitors MX100, MX400-MX850, and MP2-MP90; and IntelliVue X2, and X3
Vulnerabilities: Improper Neutralization of Formula Elements in a CSV File, Cross-site Scripting, Improper Authentication, Improper Check for Certificate Revocation, Improper Handling of Length Parameter Inconsistency, Improper Validation of Syntactic Correctness of Input, Improper Input Validation, Exposure of Resource to Wrong Sphere
Major cyber attack targeted donors to Atlanta colleges and non-profits (WSBTV) We’ve learned a major cyber attack targeted donors to some major Atlanta schools, colleges and non-profits.
Travel giants accused of failing to secure websites against hackers (WalesOnline) Consumer outfit Which? found sites linked to Marriott, British Airways and easyJet were found to be vulnerable to further breaches
Major travel firms 'fail to learn' data breach lessons as 100s of serious website security risks are exposed (HeraldScotland) Hundreds of serious data security vulnerabilities have been uncovered on the websites of travel firms including Marriott, British Airways and…
Security Patches, Mitigations, and Software Updates
Palo Alto Networks Patches 6 Firewall Vulnerabilities (BankInfo Security) The security firm Positive Technologies discovered six vulnerabilities in Palo Alto Networks' PAN-OS, the software that runs the company’s next-generation
Cyber Trends
Risky Business: How COVID-19 changed user behavior (Netskope) The COVID-19 pandemic caused an abrupt change — a sudden and lasting shift to remote work for the majority of knowledge workers. The number of people working remotely more than doubled in the span of a few weeks. Among the many challenges that security organizations faced during this transition was a change in user behavior. […]
2020 Penetration Risk Report (Coalfire) With three years of cybersecurity data from hundreds of penetration tests, several alarming trends are emerging. Our findings indicate systemic weaknesses in overall security posture, with many organizations exhibiting higher risk exposure than expected.]
New: 2020 Performance Management Benchmark Report (Reflektive) Reflektive’s new Performance Management Benchmark Report has powerful insights on the state of work and performance management. With responses from 445 HR
Edge Computing Seen Transitioning to ‘Intelligent Edge’ (EnterpriseAI) The extension of cloud computing capabilities from datacenters to the somewhat amorphous network edge, variously defined as a connected device, appliance
The Perils of IT Security Hubris (TechNewsWorld) Corporate cybersecurity has been increasingly compromised since organizations began implementing work-from-home policies in March as the pandemic continued its spread. In addition to the risks created by increased stress on personnel and depleted staff, IT leaders might be overconfident about the cybersecurity protocols and procedures they have in place.
After WFH scramble, companies seen refocusing on cybersecurity to ensure business continuity (Business World) CYBERSECURITY is increasingly being viewed by C-level executives as a means of ensuring business continuity during the pandemic, after the initial rush to ensure that systems were robust enough to accommodate work-from-home (WFH) arrangements, Unisys Corp. said.
African executives say cyber threats rise during COVID-19 era (CGTN Africa) The threat of attack on digital infrastructure owned by Africa-based enterprises has increased during the
Estonian companies lose over EUR 1 mln annually to cyber attacks (The Baltic Course) In recent years, Estonian companies have incurred losses exceeding more than a million euros annually due to cyber crime; however, the damages reported to the Information System Authority (RIA) constitute only the tip of the iceberg.
Marketplace
Cybersecurity Market Review for 1H 2020 (Momentum Cyber) We are pleased to provide you with Momentum’s Cybersecurity Market Review for 1H 2020. Strategic activity in the first half of 2020 included 293 transactions completed totaling $14.5B in deal value across M&A (93 transactions, $9.8B) and Financing (200 transactions, $4.7B).
DataTribe's cyber pitch competition offering up to $2 million in investment is going virtual (Baltimore Business Journal) With its third annual pitch challenge, DataTribe promises growing cyber companies the chance to win up to $2 million in venture capital investment.
ThreatConnect Acquires Cyber Risk Quantification Pioneer Nehemiah Security (BusinessWire) ThreatConnect Inc.®, the leader in reducing complexity and enabling better decision making in cybersecurity, today announces the acquisition of Nehemi
Detroit Cybersecurity Startup Releases Platform with Virtual Assistant (DBusiness Magazine) A Detroit cybersecurity startup has closed a $2.7 million seed round and launched a cybersecurity platform designed for small- and medium-sized businesses.
ByteDance may miss U.S. deadline for TikTok deal: Bloomberg (Reuters) ByteDance is likely to miss the deadline imposed by the Trump administration for the sale of TikTok's U.S. assets as new Chinese regulations have complicated deal talks with bidders Microsoft Corp <MSFT.O> and Oracle Corp <ORCL.N>, Bloomberg reported on Thursday.
It’s time to better identify the cost of cybersecurity risks in M&A deals (TechCrunch) Over the past decade, a number of high-profile cybersecurity issues have arisen during mega-M&A deals, heightening concerns among corporate executives.
Redscan appoints Mark Doughty as CFO to maintain high-growth strategy (PR Newswire) Redscan, the Managed Detection and Response and Penetration Testing specialist, today announced the appointment of Mark Doughty as Chief...
Radware Announces Changes to Its Board of Directors (GlobeNewswire) Radware® (NASDAQ: RDWR), a leading provider of cyber security and application delivery solutions, today announced that its board of directors has appointed Mr. Stanley B. Stern and Ms. Naama Zeldis to serve as independent directors of Radware’s Board of Directors.
Products, Services, and Solutions
Securonix Accelerates Global MSSP and MDR Program Traction with Securonix Fuel (BusinessWire) Securonix announced updates to its global MSSP and MDR program with the launch of Securonix Fuel to accelerate record growth and accommodate demand.
ShiftLeft NextGen Static Analysis Now Available on GitHub Marketplace to Support Developer-Centric Security (ShiftLeft) Free GitHub App improves developer productivity by inserting application security directly into the modern software development lifecycle
Zscaler Releases New Data Protection Innovations in Zscaler Zero Trust Exchange (Zscaler) Zscaler announced new data protection innovations in the Zscaler Zero Trust Exchange that protect orgs in the work-from-anywhere era by securely connecting.
ForgeRock Achieves ISO 27001 Compliance, Demonstrates Commitment to Data Privacy (GlobeNewswire) ForgeRock®, the leading provider in digital identity, today announced it achieved certification for meeting the requirements of the BS EN ISO/IEC 27001:2017 standard.
Port53 Teams Up With America's SBDC to Deliver Enterprise-Grade Cybersecurity (AiThority) Port53 Technologies, an industry leader in customer-centric cloud security, announced its support as a sponsor of America's SBDC North Star CMM
Verizon advances 5G network and cybersecurity (eGov Magazine) Verizon’s Network Security engineers recently engaged in a series of successful trials to future-proof its 5G network against security threats and advance security measures to protect the confidentiality, integrity and […]
Comodo Announces Partner Certification Program to Deliver Incentives, Go-to-Market Resources, Training and Marketing Services for Partners (Yahoo) Comodo, a leading provider of next-generation cybersecurity solutions announced a new partner certification program that will deliver incentives, go-to-market resources, training and marketing supp...
ESET Launches Version 6.0 Of Mobile Security (Scoop News) Sydney, September 11, 2020 – ESET, a global leader in cybersecurity, has launched version 6.0 of ESET Mobile Security (EMS), an award-winning solution that provides protection against a multitude of Android mobile security threats such as malware ...
Teradata Expands Data Science Collaboration Capabilities (insideHPC) Cloud data analytics specialist Teradata has released collaborative features to its Vantage platform designed to reduce the friction between data scientists, business analysts, data engineers and business managers – some of whom may use different tools and languages. Enhancements include expanded native support for R and Python, with the ability to call more Vantage-native analytic …
Technologies, Techniques, and Standards
NIST and PCI SSC Find Common Ground in Development of Software Frameworks (PCI) The National Institute of Standards and Technology (NIST) and the PCI Security Standards Council (PCI SSC) have recently announced complementary frameworks for secure software development.
NSA's Cybersecurity Directorate is still figuring out how to measure success (CyberScoop) The NSA's Cybersecurity Directorate has been examining the impact of its Cybersecurity Advisories in a variety of ways.
Cyber Chiefs Calculate Data Breach Costs to Explain Risks to Executives (Wall Street Journal) As corporate cybersecurity leaders gain prominence within companies, new tools are cropping up to help them calculate the cost of potential data breaches in terms they can discuss with chief financial officers and other executives.
NASA Flies Down the Road to Zero-Trust Security (Technology Solutions That Drive Government) The space agency is taking multiple paths toward enhancing its cybersecurity.
What Is the Internet of Things? A WIRED Guide (Wired) What you need to know about the promise (and peril) of networked lightbulbs, ovens, cameras, speakers and, well … everything.
How to Respond to a DDoS Ransom Note (Radware Blog) The damage from a DDoS ransom note can frequently be contained if dealt with in advance. Here are a few tips for handling a DDoS ransom note.
Use ‘productive paranoia’ to build cybersecurity culture at your startup (TechCrunch) Bugcrowd's Casey Ellis talks prioritizing security at your startup.
Cyber readiness depends on more than just technology (Pinsent Masons) Investment in technology alone is not enough to prepare businesses for addressing the cyber risks they face today.
Managers Who Stay Connected to Remote Employees Could Reduce Insider Threats, State Official Says (Nextgov.com) Pandemic-related stress and isolation could push some employees over the edge.
Fraud Prevention During the Pandemic (Dark Reading) When the economy is disrupted, fraud goes up, so let's not ignore the lessons we can learn from previous downturns.
6 Lessons IT Security Can Learn From DevOps (Dark Reading) DevOps has taken over enterprise software development. The discipline has lessons for IT security -- here are a quick half-dozen.
Design and Innovation
Zero trust is widely praised. What's the adoption hangup? (CIO Dive) The framework has a steep learning curve and requires modern technology, a Deloitte expert said.
Google is eliminating political Autocomplete suggestions (TechCrunch) Ahead of the U.S. presidential election, Google says it has taken a number of steps to improve the quality of information that it highlights across its various search and news products. Google executives outlined these changes at an online press event today, as well as in a blog post. The biggest c…
Twitter expands rules against election-related misinformation, teeing up a showdown with Trump as 2020 voting begins (CNN) Twitter announced Thursday that it is expanding its policies against election-related misinformation, setting new rules that will likely force the platform to more aggressively fact-check President Donald Trump during the final months of the 2020 campaign.
How does the Pentagon’s AI center plan to give the military a battlefield advantage? (C4ISRNET) The Pentagon’s artificial intelligence hub is working on tools to help in joint, all-domain operations as department leaders seek to use data to gain an advantage on the battlefield.
Inside Project Convergence: How the US Army is preparing for war in the next decade (Defense News) Project Convergence at Yuma Proving Ground, Arizona, is testing out how a modernized Army can win against near-peer adversaries.
China Is Not Ahead Of US On AI: JAIC Chief & Gen. Hyten (Breaking Defense) While China has invested heavily in “brute force” big data, Nand Mulchandani and aides said, US companies are far more innovative --- but will they work with the Pentagon?
Academia
Double jeopardy: Are universities becoming the new target for cybercriminals and spies? (Computing) David S. Wall, Centre for Criminal Justice Studies, University of Leeds outlines recent trends in cyber attacks across the public sector, and higher education specifically
Legislation, Policy, and Regulation
Why North Korean cyber attacks will get worse -- and US intelligence won’t help (NK News - North Korea News) For years, casual observers of North Korean cyber threats smirked at the country’s lack of Internet access and technical expertise. It took the Sony Pictures hack of 2014 to upend the perception that the DPRK had nothing more than “ragged, self-made technologies, accompanied by bluster and exaggeration,” and simply wasn’t capable of doing something worse. …
U.K. Government Funds Cybersecurity Assessments for Smaller Medical Suppliers (Wall Street Journal) The British government said it would cover the cost of some smaller medical suppliers to improve their cyber defenses amid security threats to health-care supply chains.
Officials Warn Privacy Shield Replacement May Be a Long Way Off (Wall Street Journal) Companies may face a prolonged period of uncertainty before EU and U.S. officials agree on new data-transfer rules.
Health Data After Covid-19: More Laws, Less Privacy (Wall Street Journal) The main legal safeguard for Americans’ health-care information was passed in the era of the fax machine. Here’s a look at what could improve or replace it.
With election cybersecurity experts in short supply, some states call in the National Guard (NBC News) The aid is especially for rural areas or small jurisdictions that may be short-staffed — and which federal authorities say are likely the most vulnerable to hackers.
Russia’s Impact on US National Interests: Ensuring Energy Security (Russia Matters) Energy—and the heat, light and power it provides—is the lifeblood of modern civilization.
How America’s war on Huawei may boost Chinese technology (The Economist) From September 15th the Chinese telecoms giant will no longer be able to buy vital semiconductors
US Embassy puts China equipment off limits (Tribune) A NEW United States regulation prohibits its embassy in Nassau from doing business with local companies that utilise equipment manufactured by certain Chinese manufacturers.
FCC orders 51 TELCO companies to replace Chinese equipment (KTVO) How often do you think of some invading your phone or your computer? Over the past several years, China has been been caught hacking and stealing information from the United States. To combat this, the U. S. government has been trying to move away from Chinese companies who have been making products that are part of our internet infrastructure.
The Cutting Edge of Defense (U.S. Cyber Command) The cyberspace domain is one of the most critical areas of national defense. It is a field that requires the most highly trained, professional, and knowledgeable individuals available.USCYBERCOM has
Could Trump Deploy US Cyber Command Against Protestors? (Defense One) It’s time to set better limits on the U.S. military’s ability to operate against Americans.
Making a U.S. Digital Service Academy Work (War on the Rocks) West Point, America’s oldest service academy, was founded in 1802. Over the next two centuries, the United States established academies for the Navy,
Portland adopts strictest facial recognition ban in nation to date
(Security InfoWatch) Ban prohibits both private and government entities from using the technology
Security Industry Association Says Portland, Ore., Facial Recognition Bans Are Shortsighted (Security Industry Association) SIA statement on decision by the city council of Portland, Ore., to ban facial recognition technology use by businesses in places of public accommodation
Litigation, Investigation, and Law Enforcement
Legal issues could present obstacles to electric utilities' grid security efforts (S&P Global) A Department of Homeland Security official acknowledged that legal squabbles, rather than technical issues, could pose scenarios that force electric utilities to make a choice between national security and their corporate responsibilities.
U.S. Imposes Sanctions Over Russian Election Meddling (Wall Street Journal) The Trump administration sanctioned a Ukrainian lawmaker and three Russians alleged to have interfered in U.S. elections as Moscow’s agents.
Cyber-related Designations; Foreign Interference in U.S. Election Designations (U.S. Department of the Treasury) The following individuals have been added to OFAC's SDN List
New York’s Department of Financial Services Files First Enforcement Action Under New Cybersecurity Regulation (The National Law Review) In July 2020, the New York State Department of Financial Services (NYDFS) filed the first enforcement action under the new NYDFS Cybersecurity Regulation, 23 NYCRR Part 500 (Part 500), against First A
NY-Based Facial Recognition Tech Company Wrangles With Judges in Two States Over Privacy Class Actions (New York Law Journal) Clearview AI, which uses facial recognition technology to provide photographic information to law enforcement, is asking the JPML to coordinate nearly a dozen privacy class actions after lawyers failed to consolidate them before judges in New York and Illinois, home to the strictest biometrics law in the country.
Regulator Finds Rise In Cyber-Lapses At Credit Unions (Law360) The Prudential Regulation Authority has urged credit unions to ensure that their systems are resilient after it identified a rise in cyberbreaches and other lapses in its assessment of the sector.
Edward Snowden was right, the NSA has violated our rights (Orange County Register) Once again, Americans are reminded that government will too often trample over our rights in the name of security when it is neither just nor necessary to do so.
