WIRED Threat Level

JULY 29, 2021

The latest weapons in the global information war are fake vessels behaving badly.

105

105

CyberSecurity Insiders

JULY 26, 2021

United States is interested in seeking an international strategy to tackle AI based cyber attacks that are leading to hybrid warfare. However, Antony Blinken, the State Secretary said that it is not an easy task to deal and warned Russia to mend its ways when it comes to cyber warfare that is being backed by artificial intelligence. Mr. Blinken’s remarks came amid raising concerns about ransomware attacks on critical infrastructure such as the recent Colonial Pipeline Cyber Attack and JBS Meat A

Cyber Attacks 141

Cyber Attacks Artificial Intelligence Government Ransomware 141

CSO Magazine

JULY 27, 2021

There’s no shortage of definitions of zero trust floating around. You’ll hear terms such as principles, pillars, fundamentals, and tenets. While there is no single definition of zero trust, it helps to have a shared understanding of a concept. For that reason, the National Institute of Standards and Technology (NIST) published NIST SP 800-207 Zero Trust Architecture , which describes the following seven tenets of zero trust.

Architecture 144

Architecture Technology 144

Schneier on Security

JULY 30, 2021

New paper: “ Encrypted Cloud Photo Storage Using Google Photos “: Abstract: Cloud photo services are widely used for persistent, convenient, and often free photo storage, which is especially useful for mobile devices. As users store more and more photos in the cloud, significant privacy concerns arise because even a single compromise of a user’s credentials give attackers unfettered access to all of the user’s photos.

Encryption 363

Encryption Architecture Mobile 363

Advertisement

Many software teams have migrated their testing and production workloads to the cloud, yet development environments often remain tied to outdated local setups, limiting efficiency and growth. This is where Coder comes in. In our 101 Coder webinar, you’ll explore how cloud-based development environments can unlock new levels of productivity. Discover how to transition from local setups to a secure, cloud-powered ecosystem with ease.

Software

Krebs on Security

JULY 29, 2021

Every time there is another data breach, we are asked to change our password at the breached entity. But the reality is that in most cases by the time the victim organization discloses an incident publicly the information has already been harvested many times over by profit-seeking cybercriminals. Here’s a closer look at what typically transpires in the weeks or months before an organization notifies its users about a breached database.

Passwords 361

Passwords Password Management Phishing Scams 361

Lohrman on Security

JULY 25, 2021

Vincent Hoang became the CISO in Hawaii in 2016. In this interview, Vince shares his journey and cyber priorities in protecting the Aloha State, particularly among the challenges presented by COVID-19.

CISO 288

CISO Government Cybersecurity 288

Schneier on Security

JULY 30, 2021

The time has come for me to find a new home for my (paper) cryptography library. It’s about 150 linear feet of books, conference proceedings, journals, and monographs — mostly from the 1980s, 1990s, and 2000s. My preference is that it goes to an educational institution, but will consider a corporate or personal home if that’s the only option available.

Education 363

Education 363

Krebs on Security

JULY 26, 2021

Joseph “PlugwalkJoe” O’Connor, in a photo from a paid press release on Sept. 02, 2020, pitching him as a trustworthy cryptocurrency expert and advisor. One day after last summer’s mass-hack of Twitter , KrebsOnSecurity wrote that 22-year-old British citizen Joseph “PlugwalkJoe” O’Connor appeared to have been involved in the incident.

Media 339

Media Hacking Accountability Scams 339

Security Affairs

JULY 29, 2021

A new variant of the LockBit 2.0 ransomware is now able to encrypt Windows domains by using Active Directory group policies. Researchers from MalwareHunterTeam and BleepingComputer, along with the malware expert Vitali Kremez reported spotted a new version of the LockBit 2.0 ransomware that encrypts Windows domains by using Active Directory group policies.

Encryption 145

Encryption Ransomware Malware Hacking 145

Tech Republic Security

JULY 27, 2021

You can catch more flies with honey than vinegar. Learn some tips to establish a positive reinforcement cybersecurity culture rather than a blame-and-shame game.

Cybersecurity 212

Cybersecurity 212

Advertisement

After a year of sporadic hiring and uncertain investment areas, tech leaders are scrambling to figure out what’s next. This whitepaper reveals how tech leaders are hiring and investing for the future. Download today to learn more!

Schneier on Security

JULY 26, 2021

Ransomware isn’t new; the idea dates back to 1986 with the “Brain” computer virus. Now, it’s become the criminal business model of the internet for two reasons. The first is the realization that no one values data more than its original owner, and it makes more sense to ransom it back to them — sometimes with the added extortion of threatening to make it public — than it does to sell it to anyone else.

Ransomware 363

Ransomware Cryptocurrency Banking Accountability 363

CSO Magazine

JULY 29, 2021

Cyberattacks are so sophisticated these days that even with the best education and training, employees inadvertently click links or download documents that look all too real. Furthermore, systems are often configured to allow downloads or macros that contain malicious files because employees use these applications and documents to do their everyday work, from wherever they may be working.

Education 145

Education Ransomware 145

Security Affairs

JULY 30, 2021

Researcher published an exploit code for a high-severity privilege escalation flaw (CVE-2021-3490) in Linux kernel eBPF on Ubuntu machines. The security researcher Manfred Paul of the RedRocket CTF team released the exploit code for a high-severity privilege escalation bug, tracked as CVE-2021-3490, in Linux kernel eBPF (Extended Berkeley Packet Filter).

Hacking 145

Hacking Technology Information Security Cybersecurity 145

Tech Republic Security

JULY 26, 2021

If you want people to trust the photos and videos your business puts out, it might be time to start learning how to prove they haven't been tampered with.

Authentication 217

Authentication 217

Advertisement

How many people would you trust with your house keys? Chances are, you have a handful of trusted friends and family members who have an emergency copy, but you definitely wouldn’t hand those out too freely. You have stuff that’s worth protecting—and the more people that have access to your belongings, the higher the odds that something will go missing.

Cybersecurity

Schneier on Security

JULY 27, 2021

Interesting research: “EvilModel: Hiding Malware Inside of Neural Network Models” Abstract: Delivering malware covertly and detection-evadingly is critical to advanced malware campaigns. In this paper, we present a method that delivers malware covertly and detection-evadingly through neural network models. Neural network models are poorly explainable and have a good generalization ability.

Malware 363

Malware Artificial Intelligence Antivirus Engineering 363

Security Boulevard

JULY 26, 2021

With all of the focus on ransomware attacks, it’s easy to forget about the damage done by email phishing. Yet, new research from Vade shows that phishing has seen a meteoric rise in the first half of 2021, including a 281% increase in May and a 284% increase in June. And what they want is. The post Phishing Used to Get PII, not Just Ransomware appeared first on Security Boulevard.

Phishing 145

Phishing Ransomware Social Engineering Engineering 145

CSO Magazine

JULY 27, 2021

A sophisticated, likely government-sponsored threat actor has been compromising major public and private organizations over the past year by exploiting deserialization flaws in public-facing ASP.NET applications to deploy fileless malware. Dubbed Praying Mantis, or TG1021, by researchers from incident response firm Sygnia, the hacker group puts a strong focus on detection evasion by using a volatile and custom malware toolset built specifically for Internet Information Services (IIS) web servers

Malware 145

Malware CSO Internet Internet 145

Tech Republic Security

JULY 28, 2021

The average cost of a data breach among companies surveyed for IBM Security reached $4.24 million per incident, the highest in 17 years.

Data breaches 215

Data breaches 215

Advertiser: Revenera

In a recent study, IDC found that 64% of organizations said they were already using open source in software development with a further 25% planning to in the next year. Most organizations are unaware of just how much open-source code is used and underestimate their dependency on it. As enterprises grow the use of open-source software, they face a new challenge: understanding the scope of open-source software that's being used throughout the organization and the corresponding exposure.

Risk

Schneier on Security

JULY 28, 2021

This is important : Monsignor Jeffrey Burrill was general secretary of the US Conference of Catholic Bishops (USCCB), effectively the highest-ranking priest in the US who is not a bishop, before records of Grindr usage obtained from data brokers was correlated with his apartment, place of work, vacation home, family members’ addresses, and more. […].

Mobile 361

Mobile Advertising Data collection Surveillance 361

Security Boulevard

JULY 25, 2021

By 2022, API abuses will become the most frequent attack vector, predicts Gartner. We’re already witnessing new API exploits reach the headlines on a near-daily basis. Most infamous was the Equifax breach, an attack that exposed 147 million accounts in 2017. Since then, many more API breaches and major vulnerabilities have been detected at Experian, The post For Hackers, APIs are Low-Hanging Fruit appeared first on Security Boulevard.

Accountability 145

Accountability Malware Cybersecurity 145

CSO Magazine

JULY 30, 2021

Both the Biden administration and the Congress continued their frenetic pace this week to beef up the country's digital infrastructure protections through two highly consequential and unprecedented initiatives. Both efforts aim to prepare the nation for the next significant cybersecurity incidents, making up for lost time due to the previous administration's relative inattention to the topic. [ Learn what you need to know about defending critical infrastructure. | Get the latest from CSO by sign

Cybersecurity 144

Cybersecurity CSO Technology 144

Tech Republic Security

JULY 30, 2021

It's all quiet on the DDoS front, but don't get complacent: The lull is expected, said Kaskersky, and new attack vectors could spell a coming resurgence.

DDOS 203

DDOS 203

Advertisement

Cloud Development Environments (CDEs) are changing how software teams work by moving development to the cloud. Our Cloud Development Environment Adoption Report gathers insights from 223 developers and business leaders, uncovering key trends in CDE adoption. With 66% of large organizations already using CDEs, these platforms are quickly becoming essential to modern development practices.

Software

Schneier on Security

JULY 29, 2021

A teenager on an airplane sent a photo of a replica gun via AirDrop to everyone who had their settings configured to receive unsolicited photos from strangers. This caused a three-hour delay as the plane — still at the gate — was evacuated and searched. The teen was not allowed to reboard. I can’t find any information about whether he was charged with any of those vague “terrorist threat” crimes.

337

337

We Live Security

JULY 30, 2021

Most people are fans of the convenience Amazon brings to online shopping, and that’s precisely what cybercriminals are betting on. The post Watch out for these scams, targeting Amazon’s customers appeared first on WeLiveSecurity.

Scams 144

Scams 144

SecurityTrails

JULY 29, 2021

A while back, SecurityTrails announced that they would be running a contest dubbed "Recon Master". The aim of the game is to find hostnames that resolve to an IPv4 address that are not already found by SecurityTrails.

145

145

Tech Republic Security

JULY 27, 2021

To ward off the attack known as PetitPotam, Microsoft advises you to disable NTLM authentication on your Windows domain controller.

Authentication 218

Authentication 218

Advertisement

Tech leaders today are facing shrinking budgets and investment concerns. This whitepaper provides insights from over 1,000 tech leaders on how to stay secure and attract top cybersecurity talent, all while doing more with less. Download today to learn more!

Cybersecurity

CyberSecurity Insiders

JULY 26, 2021

A new malware dubbed as DevilsTongue has been found circulating on the web these days and it’s said that it is targeting Microsoft Windows Systems, iPhones, Macs, Android based computing devices like smart watches and televisions and several cloud networks across the globe. Microsoft Threat Intelligence Center(MTIC) and security firm Citizenlab jointly investigated the malware whereabouts in the wild and discovered that it was targeting politicians, journalists, embassy workers, human rights act

Software 145

Software Malware Threat Detection Passwords 145

Security Affairs

JULY 24, 2021

Japanese researchers spotted an Olympics-themed wiper targeting Japanese users ahead of the 2021 Tokyo Olympics. Tokyo Olympics could be a great opportunity for cybercriminals and malware authors, the US FBI warned p rivate US companies of cyberattacks that might attempt to disrupt the 2021 Tokyo Olympics. Researchers from the Japanese security firm Mitsui Bussan Secure Directions (MBSD) discovered an Olympics-themed malware that implements wiping capabilities, The Record reported.

Malware 145

Malware Antivirus Cyber Attacks Hacking 145

Bleeping Computer

JULY 29, 2021

The US National Security Agency (NSA) today published guidance on how to properly secure wireless devices against potential attacks targeting them when traveling or working remotely. [.].

Wireless 144

Wireless 144

Tech Republic Security

JULY 29, 2021

DEF CON 29 sold out of virtual passes, so tuning in on Twitch and Discord are the best options for attending online this year.

210

210

Advertisement

Within the past few years, ransomware attacks have turned to critical infrastructure, healthcare, and government entities. Attackers have taken advantage of the rapid shift to remote work and new technologies. Add to that hacktivism due to global conflicts and U.S. elections, and an increased focus on AI, and you have the perfect recipe for a knotty and turbulent 2024.

Cybersecurity