Schneier on Security

FEBRUARY 26, 2019

A research group at NATO's Strategic Communications Center of Excellence catfished soldiers involved in an European military exercise -- we don't know what country they were from -- to demonstrate the power of the attack technique. Over four weeks, the researchers developed fake pages and closed groups on Facebook that looked like they were associated with the military exercise, as well as profiles impersonating service members both real and imagined.

Media 258

Media Accountability Advertising 258

Krebs on Security

FEBRUARY 23, 2019

Payroll software provider Apex Human Capital Management suffered a ransomware attack this week that severed payroll management services for hundreds of the company’s customers for nearly three days. Faced with the threat of an extended outage, Apex chose to pay the ransom demand and begin the process of restoring service to customers. Roswell, Ga. based Apex HCM is a cloud-based payroll software company that serves some 350 payroll service bureaus that in turn provide payroll services to s

Ransomware 238

Ransomware Backups Encryption Internet 238

The Last Watchdog

MARCH 1, 2019

There’s a frantic scramble going on among those responsible for network security at organizations across all sectors. Related: Why we’re in the Golden Age of cyber espionage. Enterprises have dumped small fortunes into stocking their SOCs (security operations centers) with the best firewalls, anti-malware suites, intrusion detection, data loss prevention and sandbox detonators money can buy.

Threat Detection 193

Threat Detection Digital transformation Marketing Firewall 193

Adam Levin

FEBRUARY 27, 2019

The infrastructure at the core of the internet is vulnerable to attack from state-sponsored hackers, its governing body warned. . The Internet Corporation for Assigned Names and Numbers (ICANN), charged with overseeing Domain Name Systems (DNS), published an announcement that companies have moved too slowly to adopt security standards that would have mitigated several recent large-scale cyberattacks.

DNS 183

DNS Internet Internet Technology 183

Advertisement

Keeper Security is transforming cybersecurity for people and organizations around the world. Keeper’s affordable and easy-to-use solutions are built on a foundation of zero-trust and zero-knowledge security to protect every user on every device. Our next-generation privileged access management solution deploys in minutes and seamlessly integrates with any tech stack to prevent breaches, reduce help desk costs and ensure compliance.

Passwords

Schneier on Security

FEBRUARY 28, 2019

After years of claiming that the Terrorist Screening Database is kept secret within the government, we have now learned that the DHS shares it "with more than 1,400 private entities, including hospitals and universities.". Critics say that the watchlist is wildly overbroad and mismanaged, and that large numbers of people wrongly included on the list suffer routine difficulties and indignities because of their inclusion.

Government 224

Government 224

Krebs on Security

FEBRUARY 27, 2019

Roughly one year ago, KrebsOnSecurity published a lengthy investigation into the individuals behind Coinhive[.]com , a cryptocurrency mining service that has been heavily abused to force hacked Web sites to mine virtual currency. On Tuesday, Coinhive announced plans to pull the plug on the project early next month. A message posted to the Coinhive blog on Tuesday, Feb. 26, 2019.

Cryptocurrency 207

Cryptocurrency Hacking Accountability Internet 207

Troy Hunt

FEBRUARY 23, 2019

It was another travel week so another slightly delayed weekly update, but still plenty of stuff going on all the same. Along with a private Sydney workshop earlier on, I'm talking about some free upcoming NDC meetup events in Brisbane and Melbourne and I'd love to get a great turnout for. I've just ordered 10k more HIBP stickers to last me through upcoming events so they'll be coming with me.

Password Management 151

Password Management Passwords Risk 151

Schneier on Security

FEBRUARY 25, 2019

There's new research on the security of password managers, speficially 1Password, Dashlane, KeePass, and Lastpass. This work specifically looks at password leakage on the host computer. That is, does the password manager accidentally leave plaintext copies of password lying around memory? All password managers we examined sufficiently secured user secrets while in a 'not running' state.

Password Management 215

Password Management Passwords Software 215

Krebs on Security

FEBRUARY 28, 2019

A 20-year-old Illinois man has pleaded guilty to running multiple DDoS-for-hire services that launched millions of attacks over several years. The plea deal comes almost exactly five years after KrebsOnSecurity interviewed both the admitted felon and his father and urged the latter to take a more active interest in his son’s online activities.

DDOS 199

DDOS Computers and Electronics Internet Internet 199

The Last Watchdog

FEBRUARY 27, 2019

Google, Facebook and Amazon have gotten filthy rich doing one thing extremely well: fixating on every move each one of us makes when we use our Internet-connected computing devices. Related: Protecting web gateways. The tech titans have swelled into multi-billion dollar behemoths by myopically focusing on delivering targeted online advertising, in support of online retailing.

Retail 138

Retail Digital transformation Advertising Software 138

Advertisement

Many software teams have migrated their testing and production workloads to the cloud, yet development environments often remain tied to outdated local setups, limiting efficiency and growth. This is where Coder comes in. In our 101 Coder webinar, you’ll explore how cloud-based development environments can unlock new levels of productivity. Discover how to transition from local setups to a secure, cloud-powered ecosystem with ease.

Software

Adam Shostack

FEBRUARY 24, 2019

Chris Eng said “ Someone should set up a GoFundMe to send whoever wrote the hit piece on password managers to a threat modeling class. ” And while it’s pretty amusing, you know, I teach threat modeling classes. I spend a lot of time crafting explicit learning goals, considering and refining instructional methods, and so when a smart fellow like Chris says this, my question is why?

Password Management 138

Password Management Passwords Engineering Accountability 138

Schneier on Security

FEBRUARY 27, 2019

Notice this bit from an article on the arrest of Christopher Hasson: It was only after Hasson's arrest last Friday at his workplace that the chilling plans prosecutors assert he was crafting became apparent, detected by an internal Coast Guard program that watches for any "insider threat." The program identified suspicious computer activity tied to Hasson, prompting the agency's investigative service to launch an investigation last fall, said Lt.

Threat Detection 203

Threat Detection Software 203

Security Affairs

FEBRUARY 27, 2019

Experts at Exploit detection service EdgeSpot detected several PDF documents that exploit a zero-day flaw in Chrome to harvest user data. Exploit detection service EdgeSpot spotted several PDF documents that exploit a zero-day vulnerability in Chrome to harvest data on users who open the files through the popular web browser. The experts initially detected the specially-crafted PDF files in December 2018.

Advertising 112

Advertising Antivirus Internet Internet 112

The Last Watchdog

FEBRUARY 26, 2019

Social Engineering 113

Social Engineering Engineering 113

Advertisement

After a year of sporadic hiring and uncertain investment areas, tech leaders are scrambling to figure out what’s next. This whitepaper reveals how tech leaders are hiring and investing for the future. Download today to learn more!

Adam Shostack

FEBRUARY 28, 2019

I’m quite happy to say that my next Linkedin Learning course has launched! This one is all about spoofing. It’s titled “ Threat Modeling: Spoofing in Depth.” It’s free until at least a week after RSA. Also, I’m exploring the idea that security professionals lack a shared body of knowledge about attacks, and that an entertaining and engaging presentation of such a BoK could be a useful contribution.

124

124

Schneier on Security

MARCH 1, 2019

Matthew Green has a super-interesting blog post about information leakage from encrypted databases. It describes the recent work by Paul Grubbs, Marie-Sarah Lacharité, Brice Minaud, and Kenneth G. Paterson. Even the summary is too much to summarize, so read it.

Encryption 196

Encryption 196

WIRED Threat Level

FEBRUARY 27, 2019

Michael Cohen testifies before the House Oversight committee, and brings the receipts.

111

111

Security Affairs

FEBRUARY 24, 2019

Group-IB experts discovered new databases with a total of 69,189 Pakistani banks’ cards that have shown up for sale on the dark web. Group-IB , an international company that specializes in preventing cyberattacks, has discovered new databases with a total of 69,189 Pakistani banks’ cards that have shown up for sale on the dark web. The total market value of the databases is estimated at nearly 3.5 million USD.

Banking 112

Banking Advertising Marketing Accountability 112

Advertisement

How many people would you trust with your house keys? Chances are, you have a handful of trusted friends and family members who have an emergency copy, but you definitely wouldn’t hand those out too freely. You have stuff that’s worth protecting—and the more people that have access to your belongings, the higher the odds that something will go missing.

Cybersecurity

Dark Reading

FEBRUARY 25, 2019

Officials report an unauthorized party obtained tax return data by using credentials obtained from an outside source.

105

105

Threatpost

FEBRUARY 26, 2019

How features such as infotainment and driver-assist can give others a leg up on car owners.

Data collection 103

Data collection Hacking Engineering 103

WIRED Threat Level

FEBRUARY 27, 2019

The social media app will pay $5.7 million to settle the allegations, and be required to delete videos uploaded by anyone under 13.

Media 111

Media 111

Security Affairs

FEBRUARY 24, 2019

Large-scale attacks are threatening the global Internet infrastructure, the alarm was launched by the Internet Corporation for Assigned Names and Numbers (ICANN). After an emergency meeting, the Internet Corporation for Assigned Names and Numbers (ICANN) confirmed that the global Internet infrastructure is facing large-scale attacks. ICANN warns of “an ongoing and significant risk” to key components of the Internet infrastructure. “The Internet Corporation for Assigned Names an

Internet 111

Internet Internet DNS Telecommunications 111

Advertiser: Revenera

In a recent study, IDC found that 64% of organizations said they were already using open source in software development with a further 25% planning to in the next year. Most organizations are unaware of just how much open-source code is used and underestimate their dependency on it. As enterprises grow the use of open-source software, they face a new challenge: understanding the scope of open-source software that's being used throughout the organization and the corresponding exposure.

Risk

Dark Reading

MARCH 1, 2019

CISOs: Stop abdicating responsibility for problems with users - it's part of your job.

CISO 99

CISO 99

Threatpost

FEBRUARY 27, 2019

Researchers are urging Ring users to update to the latest version of the smart doorbell after a serious flaw triggered privacy concerns.

IoT 91

IoT 91

WIRED Threat Level

FEBRUARY 26, 2019

Researchers point a tough-to-fix in some cloud computing setups: hackable firmware.

Firmware 110

Firmware Malware 110

Security Affairs

FEBRUARY 25, 2019

The recently discovered B0r0nt0K ransomware infects both Linux and Windows servers and demands $75,000 ransom to the victims. A new piece of ransomware called B0r0nt0K appeared in the threat landscape, it is targeting web sites and demanding a 20 bitcoin ransom to the victims (roughly $75,000). This B0r0nt0K ransomware infects both Linux and Windows servers.

Ransomware 111

Ransomware Encryption Advertising Malware 111

Advertisement

Cloud Development Environments (CDEs) are changing how software teams work by moving development to the cloud. Our Cloud Development Environment Adoption Report gathers insights from 223 developers and business leaders, uncovering key trends in CDE adoption. With 66% of large organizations already using CDEs, these platforms are quickly becoming essential to modern development practices.

Software

Dark Reading

MARCH 1, 2019

Oftentimes, responsibility for securing the cloud falls to IT instead of the security organization, researchers report.

90

90

Threatpost

FEBRUARY 26, 2019

A known vulnerability combined with a weakness in bare-metal server reclamation opens the door to powerful, high-impact attacks.

Firmware 85

Firmware Ransomware 85

WIRED Threat Level

FEBRUARY 23, 2019

The 2020 disinformation campaigns have started, DrainerBot is coming for your smartphone's battery, and more security news this week.

VPN 106

VPN 106

Security Affairs

FEBRUARY 23, 2019

Cybercriminals are offering over a million dollars per year to skilled professionals like vxers and penetration testers to help them in extortion campaigns. According to a new report published by the security firm Digital Shadows cybercriminal organizations are willing to pay millions to skilled hackers and malware developers. The analysis of posts on Dark Web forums reveals that at least one threat actor is willing to pay more than $64,000 per month ($768,000 per year) to skilled hackers to rec

Cybercrime 111

Cybercrime Penetration Testing Advertising Hacking 111

Advertisement

Tech leaders today are facing shrinking budgets and investment concerns. This whitepaper provides insights from over 1,000 tech leaders on how to stay secure and attract top cybersecurity talent, all while doing more with less. Download today to learn more!

Cybersecurity