Cyber Attacks, Threats, and Vulnerabilities
Qasem Soleimani killing: Iran vows 'severe revenge' (BBC News) The latest reaction and analysis after one of the most powerful figures in Iran is killed by US forces in Iraq.
Iran promises to avenge U.S. killing of top Iranian commander Soleimani (Reuters) Iran promised harsh revenge after a U.S. air strike in Baghdad on Friday killed ...
Photos reveal damage to U.S. Embassy in Baghdad following attack by supporters of Iran-backed militia (Military Times) “The game has changed, and we’re prepared to do what is necessary to defend our personnel and our interests and our partners in the region.
Qassem Soleimani: What will revenge look like for Iran in wake of general's killing? (Sky News) Cyber attacks, missiles or further nuclear breaches: Iran will be considering its next actions after the US drone strike.
Qassim Soleimani: What are Iran’s cyber warfare capabilities? (The Telegraph) The assassination of Iranian General Qassim Soleimani by a US airstrike in the early hours of Friday morning is set to cause the greatest escalation of tensions in the Middle East for decades.
FPGA cards can be abused for faster and more reliable Rowhammer attacks (ZDNet) Researchers expand Rowhammer attacks to FPGA-CPU hybrid platforms.
Your smart TV is spying on you. Here are step-by-step instructions to stop it (USA TODAY) Smart TV sets have settings for adjusting your preferences. You can take control and tell the TV manufacturers not to sell your data.
Leveraging Disk Imaging Tools to Deliver RATs (Trustwave) This year we observed a notable uptick in disc imaging software (like .ISO) being used as a container for serving malware via email, with .ISO archives attributing to 6% of all malware attachment archives seen this year.
Travelex suspends services after malware attack (TechCrunch) Travelex, a major international foreign currency exchange, has confirmed it has suspended some services after it was hit by malware on December 31. The London-based company, which operates more than 1,500 stores globally, said it took systems offline “as a precautionary measure in order to pr…
New Year’s Eve malware attack strikes Travelex, services still offline (ZDNet) Customers are being told “planned maintenance" -- as well as malware -- has restricted currency ordering across UK services.
This page is currency unavailable... Travelex scrubs UK homepage, kills services, knackers other sites amid 'software virus' infection (Register) Systems still toast since NYE compromise, manual processing only
Oddly specific 'cyber attack' hits Alaskan airline RavnAir and one plane type (Register) Dash 8? More like dash for the maintenance hangar
Co-creator defends suspected UAE spying app called ToTok (Star Tribune) If the popular ToTok video and voice calling app is a spying tool of the United Arab Emirates, that's news to its co-creator.
Eye on Scams: Phishing Emails Target Shoppers with Post-Holiday Offer (KLFY) Con-artists are sending phony emails and texts that look like messages from major retailers instructing you to redeem reward points accrued during your holiday shopping. Here’s how the scam w…
New Mexico Hospital Finds Malware Infection on Digital Imaging Server (HealthITSecurity) This week's breach roundup is led by a malware infection on the digital imaging server of Roosevelt General Hospital in New Mexico, which potentially exposed the health data of 500 patients.
Pleasantville schools investigating cyber security incident (Press of Atlantic City) The Pleasantville School District is investigating a cyber security incident that occurred over the holiday break, school officials said Thursday.
Ransomware attack shuts down some Michigan schools (CBS News) U.S. faces an epidemic of cyberattacks in which hackers seize computer systems and demand payment.
Ransomware attack forces Richmond Schools to extend holiday break (WDIV) A suspected ransomware attack has forced Richmond Schools to cancel classes Thursday and Friday.
Ransomware attack hits City of Ingleside (KIII) Ransomware is a type of software that requires a victim to pay a ransom to access a file.
Police warn businesses to be vigilant after ransomware attacks (Braintree and Witham Times) Police are reminding companies in Essex to ensure staff are careful while checking their emails following a ransomware attack.
The Heritage Company still closed and fighting cyber attack (KLRT - FOX16.com) We have an update about the Heritage Company that closed just two days before Christmas without any notice to employees. Today, former employees were asked to call a hotline, which wo…
Starbucks Devs Leave API Key in GitHub Public Repo (BleepingComputer) One misstep from developers at Starbucks left exposed an API key that could be used by an attacker to access internal systems and manipulate the list of authorized users.
Cable Bahamas warns users of phishing scams (EyeWitness News) Cable Bahamas has warned of ongoing attempts by cyber criminals to obtain information from its customers in the form of “phishing”, a common online scam that tricks unsuspecting v…
Popular U.S. Restaurant Owner Hit by Credit Card Stealing Malware (BleepingComputer) Landry's, a U.S. restaurant chain and property owner has disclosed that they were infected with a point-of-sale (POS) malware that allowed attackers to steal customer's credit card information.
Poloniex resets customer passwords after alleged data leak that wasn't (SiliconANGLE) Poloniex resets customer passwords after alleged data leak that wasn't
Colorado municipality falls victim to Click2Gov software breach (The Daily Swig | Cybersecurity news and views) Third-party payment platform hit, again
()
Cyberattack update: New Orleans police, court systems to be restored by Monday, officials say (NOLA.com) Three weeks after City Hall computer systems were crippled by a cyberattack, New Orleans officials on Thursday offered their first timeline for restoring the systems, saying the city's Police Department
Ransomware Hackers Have Started Leaking City Of Pensacola Data (Forbes) Ransomware hackers stole multiple gigabytes of data during an attack earlier this month. Now they're publicly posting it.
Before Wawa found data breach exposing customers' credit and debit cards, Visa warned it could happen (Chicago Tribune) About a month before Wawa disclosed a data breach exposing customers' credit and debit card numbers, the nation's largest credit card network warned that
Security Patches, Mitigations, and Software Updates
()
Don't Xiaomi pics of other people's places! Chinese kitmaker fingers dodgy Boxing Day cache update after Google banishes it from Home (Register) Redditor finds security camera capturing stills from strangers' cribs
Cisco critical bugs: Nexus data center switch software needs patching now (ZDNet) Patch your Cisco Data Center Network Manager software now or uninstall it.
Chrome to show error codes, similar to Windows BSOD screens (ZDNet) Devs are working on adding error codes to the Chrome crash page to make debugging crashes easier.
Firefox will let users delete collected data thanks to California's new privacy law (CNET) Mozilla is making changes to its browser, and not just for users in California.
Cyber Trends
Ransomware may have cost the US more than $7.5 billion in 2019 (MIT Technology Review) It was another big year for ransomware, the extremely profitable style of cyberattack in which computer systems and data are taken over by hackers and held hostage until the victim hands over a payoff.In 2019, these attacks wreaked havoc around the globe, earned criminals vast sums, and even occasionally provided a weapon for government hackers.
7 security incidents that cost CISOs their jobs (CSO Online) Whether or not security executives lose their jobs in the wake of a major incident, security failure should be seen as a learning opportunity.
What's next for cybersecurity: five predictions for 2020 (Lexology) Big household names such as British Airways and Marriott have faced record fines from the Information Commissioner's Office (ICO) for data b…
How generations approach cybersecurity: It's not one-size fits all (Verdict) Managing people from different generations is not an easy task and this is particularly the case when you throw cybersecurity into the mix.
Marketplace
Dell puts RSA on the block (Blocks and Files) Dell Technologies has hired Morgan Stanley to sell its RSA security business, according to PE Hub. RSA supplies software to detect cyber-security risks such as fraud and malware. The business has more than 30,000 customers across the globe, generates $170m – $200m EBITDA and could fetch as much as $3bn, according to some estimates. Bloomberg …
A top Google exec pushed the company to commit to human rights. Then Google pushed him out, he says. (Washington Post) Google’s shifting moral calculus around China illustrates the tech giant’s transformation from an organization that portrayed itself as an exception to corporate norms into one driven by business imperatives and market opportunities.
Ousted Google human rights chief says it has lost its 'Don't be evil' mantra (The Telegraph) Google's ousted human rights chief has accused the company of ditching its "Don't be evil" mantra and has slammed it for racism, a poor human rights record and concerning relationships with China and Saudi Arabia.
AI Offers an Edge as Cybersecurity Sector Consolidates (Wall Street Journal) The cybersecurity-vendor sector is set to trim some of its fat in 2020, venture-capital executives say, and companies that weave sophisticated technologies such as AI into their products are the ones likely to succeed.
Products, Services, and Solutions
EXCLUSIVE: Free resource launched to teach infosec researchers a thing or two from the past (SC Magazine) In an exclusive interview with CTO at Octopi Managed Services, Ian Thornton-Trump, SC reports launch of The Octopi Hacking Archive, including1995 BBS files, provided free to aid understading of threat evolution.
CUJO AI to Showcase Lens, AI-powered Network Analytics Solution, and Participate in Privacy and Security Panel at CES 2020 (PR Newswire) CUJO AI, the global leader in the development and application of artificial intelligence to improve the security, control and privacy of...
()
Technologies, Techniques, and Standards
()
The Paper Password Manager (Black Hills Information Security) Michael Allen // Every year around the holidays I end up having a conversation with at least one friend or family member about the importance of choosing unique passwords for each web site or service they use. Usually, it’s after they’ve received a phone or a camera or some other “smart” device for Christmas and …
()
()
Design and Innovation
()
Research and Development
Inside the race to quantum-proof our vital infrastructure (Computing) When quantum computers arrive the Web as we know it will break. We talk to scientists cryptographers and entrepreneurs working to ensure this does not happen.
Academia
Pre-empting cyberattacks: India’s first offensive cybersecurity program is here (News Minute) Bengaluru-based Jigsaw Academy has launched a new course in Cybersecurity in association with HackerU, world leader in Cybersecurity.
D214 teams earn top spots in state cyber security competition (Daily Herald) High School District 214 students continue to lead the way in cyber security competition, with a pair of D214 teams earning first and second place in state finals held Dec. 6.
Legislation, Policy, and Regulation
Iran Loses Its Indispensable Man (The Atlantic) The killing of Qassem Soleimani robs the regime of the central figure for its ambitions in the Middle East.
The Soleimani Assassination Is America’s Most Consequential Strike This Century (The Atlantic) The U.S. attack against the top Iranian general will have far greater repercussions than the killings of al-Qaeda and ISIS leaders.
Israel puts military on heightened alert after U.S. killing of Iranian commander (Reuters) Israel put its military on heightened alert on Friday and Prime Minister Benjami...
Taiwan Turns to Facebook and Viral Memes to Counter China’s Disinformation (Wall Street Journal) Taiwan is toughening laws, fostering memes and partnering with the likes of Facebook to fight back against China’s attempts to influence its coming election, which might be a test bed for a similar campaign aimed at the U.S. presidential election later this year.
Pakistan's ISPR recruits youth for cyber propaganda war on India (The New Indian Express) The ISPR has told these youths that they are fighting a narrative warfare with India and they are as important as soldiers.
U.S. legislation on spread of cyber tools passes after Reuters investigation (Reuters) Newly passed legislation will push the U.S. State Department to disclose how it ...
()
California Adopts Strictest Privacy Law in US (Threatpost) On Wednesday California signed into law the strictest privacy law in the United States.
California's new consumer privacy law comes into effect this week (Computing) The landmark California Consumer Privacy Act offers Californians several basic rights
California's privacy act impacts UK companies as GDPR principles go global (SC Magazine) The California Consumer Privacy Act came into effect on 1 Jan, UK companies under ambit as countries around the world consider privacy rules in the wake of GDPR.
()
Oregon Requires Vendors to Report Data Breaches (Lexology) While much of the New Year attention has been focused on California due to the effective date of the California Consumer Privacy Act, a new Oregon…
Many agencies still not using FedRAMP for cloud providers, GAO says (Federal News Network) After several years, a consortium of agencies has been working on FedRAMP, a program to certify cybersecurity of cloud computing services providers.
Mumbai: State to get separate cyber crime portal (Free Press Journal) This portal will enable the citizens and netizens to have a direct communication when it comes to addressing a suspicious matter like a virus, trojan or malware.
Litigation, Investigation, and Law Enforcement
Cyber incidents at the Labor Dept. were poorly reported (Fifth Domain) An agency inspector general annual review of DoL cybersecurity practices found flaws in reporting personal info breaches.
Another Federal Employee Caught Watching Porn at Work (Nextgov.com) The employee admitted watching adult pornography at work but retired amid a government investigation.
Police Tracked a Terror Suspect—Until His Phone Went Dark After a Facebook Warning (Wall Street Journal) Facebook’s WhatsApp messaging tool in October notified some 1,400 users—among them a suspected terrorist—that their phones had been hacked by an “advanced cyber actor,” just as a surveillance team was using spyware to track the suspect.
()
Microsoft helps shutter domains run by North Korean cybergang Thallium (SC Media) A U.S. district court issued an order enabling Microsoft to take over 50 domains used by a North Korea-based cybercrime gang to conduct spear phishing
TikTok claims zero takedown requests from China in first transparency report (The Verge) The highest number of requests came from India and the US
()
Kalispell hospital faces second lawsuit over data breach (Missoulian) Patients of Kalispell Regional Healthcare have leveled a second lawsuit against the northwest Montana healthcare provider, this time in U.S. District Court in Missoula.
DCH Health Faces Federal Lawsuit After 10-Day Ransomware Attack (HealthITSecurity) Alabama-based DCH Health System was hit with a federal class-action lawsuit, after a ransomware attack in October drove the hospitals to EHR downtime; non-critical patients were redirected.
()
FBI warns U.S. companies about Maze ransomware, appeals for victim data (CyberScoop) The FBI is warning U.S. companies about a series of recent ransomware attacks in which the perpetrator, sometimes posing as a government agency, steals data and then encrypts it to further extort victims.
Southwire Files Lawsuit Against Maze Ransomware For Disclosing Their Data (TechDator) Southwire, which was being hacked last month by Maze Ransomware group, was now sued for publicly disclosing a part of their stolen data on a website.
()
Police Federation gets assurances officers' details in honours list data breach 'not compromised' (The Irish News) Almost 100 people from Northern Ireland were included in the new year’s honours list which is now the subject of an alleged data breach investigation.
()
