— The cybersecurity community during the COVID-19 emergency
Authoritarianism Goes Viral (Avast) The coronavirus crisis, where many rely on their governments for accurate and prompt information, allows insight into authoritarian regimes and the trust that citizens lack in their government.
GDPR penalties deferred as Covid-19 takes hold (SC Magazine) Penalty extensions, understandable in the current unprecedented times, is likely to have a long-term impact on GDPR enforcement
Post-Covid-19 tech reconstruction - will there be a new tech political contract? (Computing) Will Wallace, Partner at Interel, a European public affairs consultancy, asks how the relationship between big tech and government will change in the post-pandemic world
TIC 3.0 Interim Telework Guidance (CISA) The Trusted Internet Connections (TIC) Program Management Office has produced the TIC 3.0 Interim Telework Guidance document to support OMB Memorandum 20-19 and the surge in teleworking. This document provides security capabilities for remote federal employees securely connecting to private agency networks and cloud environments. The guidance is short-term for Calendar Year 2020 and is expected to be incorporated into a Remote User Use Case later.
NASA under 'significantly increasing' hacking, phishing attacks (BleepingComputer) NASA has seen "significantly increasing" malicious activity from both nation-state hackers and cybercriminals targeting the US space agency's systems and personnel working from home during the COVID-19 pandemic.
Peter Cochrane: 5G is bad for our health - not! (Computing) Computing is the leading information resource for UK technology decision makers, providing the latest market news and hard-hitting opinion.
Phishing emails impersonate the White House and VP Mike Pence (BleepingComputer) Phishing scammers have started to impersonate President Trump and Vice President Mike Pence in emails that distribute malware or perform extortion scams.
Coronavirus-themed phishing emails and websites spoof the White House (TechRepublic) The phishing emails led to malicious websites that used the same HTML and CSS found in actual White House sites, says email security provider INKY.
When the Going Gets Tough, Cybercrime Gets Going (RBS) The ongoing “Coronavirus” (COVID-19) pandemic has had a profound impact on the world economy in a short time, especially within the United States where unemployment has risen sharply. While much is still unknown, many analysts are predicting that the market decline will continue before we see any ki
Another COVID-19 Research Firm Targeted by Ransomware Attack (HealthITSecurity) This week's breach roundup is led by a ransomware attack on 10x Genomics, a biotechnology firm currently working on potential COVID-19 treatments; hackers were able to steal some sensitive data.
Phishing Domains Pushing COVID-19 Drugs, Preying on Innocent Consumers (NormShield) As the global death toll rises, unemployment filings reach record highs, and uncertainty skyrockets, everyone is searching for the same thing - relief.
No COVID-19 Respite: Ransomware Keeps Pummeling Healthcare (GovInfo Security) As the COVID-19 outbreak has intensified, so too has cybercrime, including ransomware, Interpol, the international crime-fighting agency, warns. Despite some gangs
Clever Crypto Could Protect Privacy in Covid-19 Contact-Tracing Apps (Wired) Researchers are racing to achieve the benefits of location-tracking without the surveillance.
UW study on app aimed at predicting virus outbreaks seeks volunteers (KING) Researchers at UW Medicine hope to turn smartphones into personal screeners.
Coronavirus turns up the heat on cybersecurity projects (SC Media) Cybersecurity projects – even important ones – often languish, due to budget constraints, scarce resources or simply because they’re just lower priority
Zoom adds new security menu in latest update (Yahoo) The video conferencing platform has promised to improve its security and privacy credentials following concerns over its services.
Zoom removes meeting IDs from app title bar to improve privacy (ZDNet) Zoom app won't show meeting ID in the title bar going forward to avoid accidental leaks and Zoom-bombing disruptions.
Zoom's no good, very rotten week: What's next in its security plans (CIO Dive) It might be tempting to believe Zoom's flaws were intentionally hidden, it's more likely popularity brought scrutiny — something all prominent technologies eventually bear.
Google Has Banned Zoom Software From Employees' Computers, Citing Security Vulnerabilities (BuzzFeed News) Zoom has exploded in popularity during the coronavirus pandemic while also coming under fire over security issues.
U.S. Senate tells members to avoid Zoom over data security concerns: FT (Reuters) The U.S. Senate has told its members to not use Zoom's video conferencing app due to data security concerns, the Financial Times reported on Thursday, even as the company attempts to stem a global backlash against its fast-growing app.
Point of order: Congress weighs how to govern from afar (Washington Post) Congress is considering ways to govern from afar during the coronavirus pandemic
Analysis | The Cybersecurity 202: Mail-in voting surge is already facing time crunch in run-up to November election. (Washington Post) Wisconsin chaos shows the perils of not preparing.
CBS forced to 'clarify' unvetted video of crying nurse; hospital where she quit responds (Conservative News Today) CBS News issued clarifications after questions arose on a viral video of an ICU nurse crying about a lack of face masks in a coronavirus hospital unit.
Corero Network Security keeps operating as essential service during coronavirus crisis (Proactiveinvestors UK) The firm develops software designed to protect against distributed denial of service (DDoS) attacks
COVID-19: Key updates for compliance teams (Lexology) Lexology Pro Compliance takes a look at some of the most informative articles published on Lexology this week for compliance teams to stay up-to-date with some of the biggest challenges brought about by the COVID-19 outbreak, including key guidance from regulators around the world and practical tips to manage business responses to the pandemic.
Free Online Course Helps Remote Workforce Reduce Cybersecurity Risk (Global Learning Systems) With cyberattacks and phishing on the rise amid COVID-19, Global Learning Systems offers free content and online training to help companies educate employees working from home.
ESET gives free antivirus for individual users (Back End News) The new work-from-home setup may not have prepared some companies in terms of internet security. Or some may not be aware of the security risks of conducting corporate tasks online. In the Philippi…
WISeKey reveals WIShelter App for security during the 'stay at home' period (Paypers) WISeKey International Holding has announced the launch of WIShelter, its new app in the WISeID App ecosystem, desined to remediate risks during the COVID-19 lockdown period.
Register your interest for RSAC 2020 APJ, a virtual learning experience. (RSAConference2020 APJ) We’re transforming RSA Conference 2020 Asia Pacific & Japan into a free virtual learning experience, taking place 15 – 17 July. We have many exciting and relevant sessions and keynotes planned, featuring some of the world’s leading cybersecurity experts.
Enhancing Your Teleworkers' Cybersecurity During the COVID-19 Pandemic (Billington Cyber Virtual) What are the best practices and lessons learned in cybersecurity for the tens of millions of teleworkers today?
Cyber Attacks, Threats, and Vulnerabilities
Fake U.S. government documents circulated on the internet came from a Russia-connected disinformation group, researchers say (NBC News) The report comes as election security experts remain on alert for efforts to manipulate the 2020 election from Russia and many other countries and nonstate actors.
Intent to Infekt: ‘Operation Pinball’ Tactics Reminiscent of ‘Operation Secondary Infektion’ (Recorded Future) Insikt Group identified an ongoing information operation that they assess shares significant overlap with “Operation Secondary Infektion."
52k Iranian ID cards with selfies sold on dark web & hacking forum (HackRead) Another day, another data breach – The latest one has the potential to affect Iranians online and offline.
Cisco ‘Critical Update’ Phishing Attack Steals Webex Credentials (Threatpost) Emails purporting to be a Cisco "critical security advisory" are actually part of a phishing campaign trying to steal victims' Webex credentials.
Serious cyber-security flaws uncovered in Ford and Volkswagen cars (Engineering and Technology) Connected vehicles produced by both Ford and Volkswagen have serious security flaws which could allow them to be hacked, according to a Which? investigation.
Fleeceware apps discovered on the iOS App Store (ZDNet) More than 3.5 million iOS users installed 'fleeceware' apps from the Apple App Store.
Data Breach Report: RigUp Exposes More Than 70,000 Private Files (Security) Led by Noam Rotem and Ran Locar, vpnMentor’s research team recently discovered a breached database belonging to American software company RigUp, containing more than 70,000 private files belonging to its US energy sector clients. Read more to learn about this data breach and the cybersecurity implications.
Cybercriminals increasingly using SSL certificates to spread malware (TechRepublic) Enterprises that don't perform adequate SSL inspections are now at a much higher risk to be breached or attacked, according to a Menlo Security report.
Cybercriminals Hide Malware & Phishing Sites Under SSL Certificates (Dark Reading) More than half of the top 1 million websites use HTTPS, researchers report, but not all encrypted traffic is safe.
Phishers and iPhone Thieves Rolling Out Multimillion-Dollar Operations (Security Intelligence) Going down the rabbit hole of a physical iPhone theft followed by a SMiShing campaign, IBM X-Force IRIS researchers found a large-scale operation of phishers with over 600 phishing domains.
Hackers leak personal info of Vianet users (My Republica) In yet another breach of customer data, Vianet Communications – one of the largest internet service providers in Nepal – suffered a 'serious hack' on Wednesday. Data belonging to more than 160,000 consumers was leaked by a hacker through Twitter.
Bisq Bitcoin exchange slams on the brakes after exploit of critical security flaw, crypto theft (ZDNet) Over $250,000 in cryptocurrency has been stolen from users.
Google removes Android VPN with ‘critical vulnerability’ from Play Store (Naked Security) Google has removed the SuperVPN program from the Google Play store after researchers notified it of a critical vulnerability.
Fingerprint cloning: Myth or reality? (Cisco Talos) A blog from the world class Intelligence Group, Talos, Cisco's Intelligence Group
Telehealth: What's at stake from a security standpoint? (ZDNet) Many remote devices lack even basic network security.
Security Patches, Mitigations, and Software Updates
Update Firefox again – more RCEs and an Android “takeover” bug too (Naked Security) Hot on the heels of Firefox’s emergency update over the weekend are the four-weekly fixes that Mozilla had in train already. Get ’em now!
Slack in the security spotlight – lessons for collaboration servers (Naked Security) Interested in WFH collaboration tools right now? Lots of people are – so here’s a history lesson to learn from…
Something something DANE cook: Microsoft pledges to wrap its email systems in secure anti-snooping protocol (Register) Office 365 will finally get DNSSEC-based protection later this year
Cloudflare dumps Google's reCAPTCHA, moves to hCaptcha as free ride ends (and something about privacy) (Register) You want this service at Cloudflare's scale? Then maybe you might want to pay for it
Cloudflare dumps reCAPTCHA as Google intends to charge for its use (ZDNet) Cloudflare says its moving to hCaptcha, an alternative CAPTCHA service, more private than reCAPTCHA.
Customer Personal Information Is the Number One Data Protection Priority – nCipher 2020 Global Encryption Trends Study (AFP.com) As organizations accelerate digital initiatives such as cloud and the internet of things (IoT), and data volumes and types continue to rise, IT professionals cite protection of customer personal information as their number one priority, according to the 2020 Global Encryption Trends Study from the Ponemon Institute.
New DivvyCloud Report Finds 85% of Enterprises Believe Cloud Adoption is Necessary for Innovation, but Less than Half are Equipped to Operate in the Cloud Securely (DivvyCloud) Only 58% of Enterprises Have Clear Guidelines and Policies for Developers Building Applications in the Cloud, and 25% Say These Policies are not Enforced
New year, old threats: Malware peddlers went into overdrive in Q1, says Trend Micro (Register) Jan and Feb contained bumper load of fake invoice emails
The Citizen’s Guide to Spotting Fake News (Avast) Finding the truth when you read the news is tricky. Here are a few tips to become more discerning readers.
Know thy enemy: The evolving behaviors of today's cybercriminals (Help Net Security) In order to understand cybercriminals' motives and gameplay, we need to understand their evolving behaviors. according to VMware Carbon Black.
What do CISOs want from cybersecurity vendors right now? (Help Net Security) As Covid-19 spreads across the globe, what challenges are CISOs dealing with and what things they don't want to be dealing with?
Third-party risk is broken, businesses unprepared for supply chain disruptions (Help Net Security) Significant percentage of organizations are drastically unprepared to address supply chain disruptions, according to Prevalent.
Bugcrowd Announces Record Growth, Secures $30 Million in Series D Funding (PR Newswire) Bugcrowd, the #1 crowdsourced security company, today announced record year-over-year growth, including 100% bookings growth in the North...
Accenture acquires cybersecurity startup Revolutionary Security (ZDNet) Revolutionary Security's portfolio includes services for risk assessment, breach and attack simulation testing, and designing and building security programs
Santa Barbara cybersecurity startup MixMode gets $4M in funding (Pacific Coast Business Times) Santa Barbara cybersecurity startup MixMode secured $4 million in Series A funding April 7, coinciding with the launch of its artificial intelligence-based platform for large enterprise data networ…
Estonia signs contract for development of NATO Cyber Range command platform (ERR) The Estonian Center for Defense Investment (ECDI) has concluded a framework agreement with Guardtime OÜ and GT Cyber Technologies OÜ, the object of which is to develop an automated command and development platform for the NATO Cyber Range over a period of four years.
UK's Spamhaus signs Rivium as first Aussie partner (CRN Australia) Tesserent subsidiary becomes exclusive Australian reseller.
Claroty Deepens Leadership Bench with Appointment of Chief Financial and Chief Product Officers (PR Newswire) Claroty, the global leader in industrial cybersecurity, today announced the appointment of Udi Bar Sela as Chief Financial Officer (CFO) and...
SecureSky Accelerates as it Expands its Board of Directors (The Norfolk Daily News ) SecureSky, a leader in cloud security and compliance solutions, announced that veteran executive William E. Fisher has joined the company's Board of Directors,
Secureworks appoints Baghdadi as Regional Sales Director (Trade Arabia) Secureworks, a leading global cybersecurity company that protects organisations in a digitally connected world, has appointed Nader Baghdadi as its new Middle East Regional Sales Director, focusing on the Gulf Cooperation Council (GCC) markets.
Turturro Brings Space, Cyber Expertise to Parsons Talent Acquisition (PR Newswire) Parsons Corporation (NYSE: PSN) announced today the addition of Dana Turturro as the company's senior vice president of talent acquisition....
Products, Services, and Solutions
Illusive Networks Integrates with Infoblox to Speed Deployment (PR Newswire) Illusive Networks, the leader in distributed deception-based cyber defense solutions, today announced an out-of-the-box integration with...
AttackIQ Added to the Department of Homeland Security’s Continuous Diagnostics and Mitigation Approved Products List (BusinessWire) AttackIQⓇ, the leading independent vendor in the breach and attack simulation market, in conjunction with their GSA Schedule partner, RockITek, today
Box to Reduce Risk of Security Breaches and Cyber-Attacks With New Automated Malware Detection and Controls in Box Shield (MarTech Series) Box Sets New Standard for Mitigating Malware Attacks by Neutralizing Malicious Files
Facebook’s new Tuned chat app lets couples keep their mush private (Naked Security) If you’re OK with Facebook getting your phone number and storing your love notes, photos, shared daily diary and more, then Tune away, baes.
Technologies, Techniques, and Standards
Is your ransomware recovery plan good enough? (Computing) Find out how to improve your recovery from a potential ransomware attack
How To Use Portspoof (Cyber Deception) (Black Hills Information Security) Hello and welcome, and in this video, we’re going to be talking a little bit about Portspoof, a fantastic utility that takes your unused TCP/IP ports and turns them into something different whenever an attacker actually goes about trying to scan them. This video is part of the Active Defense and Cyber Deception class that …
Threat Simulation - Unexpected Protocol on Non-Standard Port (Active Countermeasures) Intro This article is 1 of 7 in a series on testing Threat Hunting software to make sure that it’s configured correctly and …
Threat Simulation - Long Connections (Active Countermeasures) Intro This article is number 2 of 7 in a series on testing Threat Hunting software to make sure that it’s configured correctly …
Threat Simulation - Client Signatures (User Agent) (Active Countermeasures) Intro This article is number 3 of 7 in a series on testing Threat Hunting software to make sure that it’s configured correctly …
Threat Simulation - DNS (Active Countermeasures) Intro This article is number 4 of 7 in a series on testing Threat Hunting software to make sure that it’s configured correctly …
InQL will help developers discover GraphQL vulnerabilities (The Daily Swig) Offensive security tool speeds up the process of exposing hard-to-find security flaws
Design and Innovation
Linux Foundation backs security-oriented seL4 microkernel operating system (ZDNet) Want a truly secure operating system kernel? The Linux Foundation is partnering with Australia's national science agency, CSIRO, to roll out the seL4 microkernel.
Legislation, Policy, and Regulation
U.S. Allows Google Internet Project to Advance Only if Hong Kong Is Cut Out (Wall Street Journal) U.S. officials granted Google permission to turn on a high-speed internet link to Taiwan but not to the Chinese territory of Hong Kong, citing national-security concerns in a ruling that underscores fraying ties between Washington and Beijing.
Barr leads revamped 'Team Telecom' to protect networks from foreign adversaries (Washington Examiner) Attorney General William Barr will lead a revamped national security group dubbed "Team Telecom" as part of the Trump administration’s effort to combat foreign influence in the U.S. telecommunications sector amid concerns about China and other foreign parties.
The Illiterate Mugging of Huawei Will Mug the U.S. Economy (Real Clear Markets) It seems like something from another era at this point, but no doubt some readers remember just how sensitive markets were not too long ago to protectionist trade rhetoric from President Trump.
Separation anxieties: US, China and tech interdependence (Observer Research Foundation) In the near future, we will likely see the United States supplement domestic mechanisms to decouple from China with systematic escalation at key global technology norms-making bodies.
The Inspector Who Never Inspected Anything (American Greatness) ere’s a simple question to ask anyone outraged over the recent firing of Michael Atkinson, the former inspector general for the intelligence community: Can you identify a single instance of a report or letter in which Atkinson exposed intelligence community misconduct to the public? After searching the inspector general’s website, I was unable to do …
Litigation, Investigation, and Law Enforcement
Analysis | Foreign hackers have made it harder for the U.S. to prosecute them (Washington Post) The Justice Department has dropped the charges against these two Russian companies.
French regulator: Google must pay French news and publishing firms for using their content (Reuters) France's competition authority issued a ruling on Thursday that Google would have to pay up to French publishing companies and news agencies for re-using their content.
Apple Beats ID Login Authentication Trespass Suit For Good (Law360) A California federal judge threw out a putative class action over Apple Inc.’s two-factor authentication login, ruling that the users hadn’t sufficiently alleged that the process was enabled without their authorization nor had they shown how the authentication problem directly caused them harm.
Rakoff Mulls Bail For Silk Road Crook Jailed In Brooklyn (Law360) U.S. District Judge Jed S. Rakoff pondered Wednesday whether a toy merchant-turned-drug dealer on the online Silk Road bazaar, who is doing time in Brooklyn for lying about where he got $19 million worth of bitcoins, should be released until the coronavirus abates.
Data breach by disgruntled employee: UK Supreme Court clarifies approach to employer’s liability (Lexology) The UK Supreme Court has issued its decision in Various claimants v Morrisons Supermarkets1 regarding when an employer can be vicariously liable for…
Low-orbit internet banking fraud claim alleged to be a load of space junk (Register) This is what comes of mixing the International Space Station, a relationship breakdown, and banking records
'Football Leaks' Hacker Rui Pinto Placed On House Arrest (Outlook India) In February, English champions Manchester City were handed a two-year ban from European competitions and fined 30 million euros for