Krebs on Security

AUGUST 21, 2020

The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) on Thursday issued a joint alert to warn about the growing threat from voice phishing or “ vishing ” attacks targeting companies. The advisory came less than 24 hours after KrebsOnSecurity published an in-depth look at a crime group offering a service that people can hire to steal VPN credentials and other sensitive data from employees working remotely during the Coronavirus pand

VPN 362

VPN Social Engineering Authentication Engineering 362

Troy Hunt

AUGUST 21, 2020

Between still feeling a little groggy after hitting the water hard on an early wake boarding session then my camera overheating and shutting down towards the end of the live stream, this wasn't the smoothest of weekly updates, I still got across everything I needed to. I'm especially excited about those Shelly 1 units for cheaply IoT'ing existing lights and I'm hoping to have some of that up and running next week.

Cybersecurity 325

Cybersecurity 325

Schneier on Security

AUGUST 20, 2020

Researchers are using recordings of keys being used in locks to create copies. Once they have a key-insertion audio file, SpiKey's inference software gets to work filtering the signal to reveal the strong, metallic clicks as key ridges hit the lock's pins [and you can hear those filtered clicks online here ]. These clicks are vital to the inference analysis: the time between them allows the SpiKey software to compute the key's inter-ridge distances and what locksmiths call the "bitting depth" of

Software 279

Software 279

Adam Levin

AUGUST 21, 2020

Carnival Corporation, the largest cruise ship company in the world, announced that it had experienced a data breach following a ransomware attack on their systems. In an 8-K filing with the Securities and Exchange Commission (SEC), the company announced that it had “detected a ransomware attack that accessed and encrypted a portion of one [their] brand’s information technology systems,” adding that the hackers responsible downloaded “certain” data files.

Data breaches 263

Data breaches Ransomware Encryption Technology 263

Advertisement

Keeper Security is transforming cybersecurity for people and organizations around the world. Keeper’s affordable and easy-to-use solutions are built on a foundation of zero-trust and zero-knowledge security to protect every user on every device. Our next-generation privileged access management solution deploys in minutes and seamlessly integrates with any tech stack to prevent breaches, reduce help desk costs and ensure compliance.

Passwords

Krebs on Security

AUGUST 19, 2020

The COVID-19 epidemic has brought a wave of email phishing attacks that try to trick work-at-home employees into giving away credentials needed to remotely access their employers’ networks. But one increasingly brazen group of crooks is taking your standard phishing attack to the next level, marketing a voice phishing service that uses a combination of one-on-one phone calls and custom phishing sites to steal VPN credentials from employees.

Phishing 360

Phishing VPN Social Engineering Media 360

Daniel Miessler

AUGUST 19, 2020

I’ve been in security for over 20 years now and have received thousands of emails asking for help or mentorship. And throughout that time I’ve also reached out to hundreds of people asking for something similar. I’ve had a mix of success and failure on both ends of that equation, and I think I might have deciphered what was going wrong. This can still work with some people, if it’s authentic.

Authentication 255

Authentication Information Security 255

Tech Republic Security

AUGUST 19, 2020

Manufactured by Thales, the EHS8 module family has security flaws that could allow attackers to take total control over internet-connected industrial machines.

IoT 218

IoT Manufacturing Internet Internet 218

Krebs on Security

AUGUST 16, 2020

A security flaw in the way Microsoft Windows guards users against malicious files was actively exploited in malware attacks for two years before last week, when Microsoft finally issued a software update to correct the problem. One of the 120 security holes Microsoft fixed on Aug. 11’s Patch Tuesday was CVE-2020-1464 , a problem with the way every supported version of Windows validates digital signatures for computer programs.

Antivirus 358

Antivirus Malware Software 358

Daniel Miessler

AUGUST 17, 2020

I have been following the bug bounty and security creator/influencer scenes since they started. And as someone in security who also creates content, I feel very close to it all. What I’ve seen in the last year has been troubling. I keep seeing friends and associates—both in conversations and in social media—crumble under the relentless pressure to produce.

Media 205

Media Internet Internet Hacking 205

Schneier on Security

AUGUST 21, 2020

Sound waves through the body are unique enough to be a biometric: "Modeling allowed us to infer what structures or material features of the human body actually differentiated people," explains Joo Yong Sim, one of the ETRI researchers who conducted the study. "For example, we could see how the structure, size, and weight of the bones, as well as the stiffness of the joints, affect the bioacoustics spectrum." [.].

Accountability 273

Accountability 273

Advertisement

Many software teams have migrated their testing and production workloads to the cloud, yet development environments often remain tied to outdated local setups, limiting efficiency and growth. This is where Coder comes in. In our 101 Coder webinar, you’ll explore how cloud-based development environments can unlock new levels of productivity. Discover how to transition from local setups to a secure, cloud-powered ecosystem with ease.

Software

Tech Republic Security

AUGUST 20, 2020

Cybercriminals have adapted by exploiting improperly secured VPNs, cloud-based services, and business email, says Malwarebytes.

Cybersecurity 217

Cybersecurity 217

The Last Watchdog

AUGUST 17, 2020

The amazing array of digital services we so blithely access on our smartphones wouldn’t exist without agile software development. Related: ‘Business logic’ hacks on the rise Consider that we began this century relying on the legacy “waterfall” software development process. This method required a linear plan, moving in one direction, that culminated in a beta deliverable by a hard and fast deadline.

Software 189

Software Firewall Penetration Testing Digital transformation 189

Adam Shostack

AUGUST 19, 2020

These are the books that I read in Q2 2020 that I think are worth your time. Sorry it’s late. They’re still worthwhile. Cyber. You’ll See This Message When It Is Too Late , by Josephine Wolff. This is an interesting examination of the effects of finger-pointing and blame avoidance on the cybersecurity landscape, with chapter titles like “How the TJX breach set the sate for a decade of payment card conflict” and “what they aren’t telling you is their rule

Internet 147

Internet Internet Software Government 147

Schneier on Security

AUGUST 18, 2020

Interesting story of a vaccine for the Emotet malware: Through trial and error and thanks to subsequent Emotet updates that refined how the new persistence mechanism worked, Quinn was able to put together a tiny PowerShell script that exploited the registry key mechanism to crash Emotet itself. The script, cleverly named EmoCrash, effectively scanned a user's computer and generated a correct -- but malformed -- Emotet registry key.

Malware 204

Malware Cybersecurity 204

Advertisement

After a year of sporadic hiring and uncertain investment areas, tech leaders are scrambling to figure out what’s next. This whitepaper reveals how tech leaders are hiring and investing for the future. Download today to learn more!

Tech Republic Security

AUGUST 20, 2020

Stanford has replaced logins and passwords with a digital key to improve endpoint security.

CISO 216

CISO Phishing Passwords 216

Security Affairs

AUGUST 21, 2020

Experts at threat intelligence firm Cyble came across a post published by Maze ransomware operators claiming to have breached the steel sheet giant Hoa Sen Group. During the ordinary monitoring of Deepweb and Darkweb , researchers at Cyble came across the leak disclosure post published by the Maze ransomware operators that claim the hack of the Hoa Sen Group.

Ransomware 145

Ransomware Hacking Advertising Backups 145

WIRED Threat Level

AUGUST 15, 2020

Plus: TikTok tracking, Russian SIMs, and more of this week's top security news.

Hacking 145

Hacking 145

Schneier on Security

AUGUST 17, 2020

A group of researchers set up a telephony honeypot and tracked robocall behavior : NCSU researchers said they ran 66,606 telephone lines between March 2019 and January 2020, during which time they said to have received 1,481,201 unsolicited calls -- even if they never made their phone numbers public via any source. The research team said they usually received an unsolicited call every 8.42 days, but most of the robocall traffic came in sudden surges they called "storms" that happened at regular

202

202

Advertisement

How many people would you trust with your house keys? Chances are, you have a handful of trusted friends and family members who have an emergency copy, but you definitely wouldn’t hand those out too freely. You have stuff that’s worth protecting—and the more people that have access to your belongings, the higher the odds that something will go missing.

Cybersecurity

Tech Republic Security

AUGUST 19, 2020

365 ICS vulnerabilities were disclosed in the first half of the year, 75% of them are high or critical on the CVSS scale, and nearly three-quarters can be exploited remotely, according to a report.

Cybersecurity 216

Cybersecurity 216

Security Affairs

AUGUST 21, 2020

The University of Utah admitted to have paid a $457,059 ransom in order to avoid having ransomware operators leak student information online. The University of Utah admitted having paid a $457,059 ransom after the ransomware attack that took place on July 19, 2020, that infected systems on the network of the university’s College of Social and Behavioral Science [CSBS]).

Ransomware 145

Ransomware Cyber Insurance Insurance Advertising 145

WIRED Threat Level

AUGUST 15, 2020

Over the last few years, so-called jackpotting attacks have gotten increasingly sophisticated—while cash machines remain largely the same.

Hacking 145

Hacking 145

Dark Reading

AUGUST 17, 2020

Like their counterparts who run legitimate businesses, cybercriminals need hosting and cybersecurity protection, too.

Cybercrime 144

Cybercrime Cybersecurity 144

Advertiser: Revenera

In a recent study, IDC found that 64% of organizations said they were already using open source in software development with a further 25% planning to in the next year. Most organizations are unaware of just how much open-source code is used and underestimate their dependency on it. As enterprises grow the use of open-source software, they face a new challenge: understanding the scope of open-source software that's being used throughout the organization and the corresponding exposure.

Risk

Tech Republic Security

AUGUST 19, 2020

There are new issues organizations should consider as work from home continues with no end in sight. One expert offers ideas to secure your widening perimeter.

215

215

Security Affairs

AUGUST 19, 2020

Researchers spotted a new sophisticated peer-to-peer (P2P) botnet, dubbed FritzFrog, that has been actively targeting SSH servers since January 2020. FritzFrog is a new sophisticated botnet that has been actively targeting SSH servers worldwide since January 2020. The bot is written in Golang and implements wormable capabilities, experts reported attacks against entities in government, education, and finance sectors.

Cryptocurrency 145

Cryptocurrency Malware Advertising Encryption 145

WIRED Threat Level

AUGUST 18, 2020

“Phone spear phishing” attacks have been on the rise since a bitcoin scam took over the social media platform in July.

Scams 144

Scams Media Phishing Hacking 144

Dark Reading

AUGUST 18, 2020

Security vendor Prevailion says it observed signs of malicious activity on the cruise operator's network between at least February and June.

Ransomware 143

Ransomware 143

Advertisement

Cloud Development Environments (CDEs) are changing how software teams work by moving development to the cloud. Our Cloud Development Environment Adoption Report gathers insights from 223 developers and business leaders, uncovering key trends in CDE adoption. With 66% of large organizations already using CDEs, these platforms are quickly becoming essential to modern development practices.

Software

Tech Republic Security

AUGUST 17, 2020

A study explores the possible range and risk of attacks from military robots and autonomous attack drones to AI-assisted stalking. Here are the top 5.

Risk 213

Risk 213

Security Affairs

AUGUST 17, 2020

The Treasury Board of Canada Secretariat confirmed that thousands of user accounts for online Canadian government services were recently hacked. According to a press release issued by the Treasury Board of Canada Secretariat, thousands of user accounts for online government services were recently hacked. The hackers targeted the GCKey service with credential stuffing attacks, the service is used by some 30 federal departments and Canada Revenue Agency accounts.

Government 145

Government Accountability Hacking Advertising 145

WIRED Threat Level

AUGUST 20, 2020

The scheme involved 7,000 $94 toothbrushes, according to law enforcement.

141

141

Dark Reading

AUGUST 21, 2020

Researchers advise Amazon Web Services users running Community Amazon Machine Images to verify them for potentially malicious code.

141

141

Advertisement

Tech leaders today are facing shrinking budgets and investment concerns. This whitepaper provides insights from over 1,000 tech leaders on how to stay secure and attract top cybersecurity talent, all while doing more with less. Download today to learn more!

Cybersecurity