Cyber Security News

A WordPress SPAMbot Wants You to Bet on the 2018 FIFA World Cup – Blog | Imperva

A Wordpress SPAMbot Wants You to Bet on the 2018 FIFA World Cup – Blog | Imperva A Wordpress SPAMbot

News and Comment: Organizations Leave Backdoors Open to Cheap Remote Desktop Protocol Attacks

NEWS: McAfee has just released its new Advanced Threat Report, which finds that Organizations Leave Backdoors Open to Cheap Remote

News and Comment: Four organizations sold Microsoft Authenticode certificates to anonymous buyers

New research from Masaryk University in the Czech Republic, and Maryland Cybersecurity Center (MCC) in the US, has identified and

Expert: Putin can hack our midterm elections

Expert: Putin can hack our midterm elections Expert: Putin can hack our midterm elections Barbara Simons, a leading expert on

Exfiltration policy deficiency: Engineer stashed Navy drone trade secrets in his personal Dropbox

Engineer stashed Navy drone trade secrets in his personal Dropbox Engineer stashed Navy drone trade secrets in his personal Dropbox

Bomgar Acquires Avecto to Provide a Best-in-Class PAM Solution Suite | BOMGAR

Bomgar Acquires Avecto to Provide a Best-in-Class PAM Solution Suite | BOMGAR Bomgar Acquires Avecto to Provide a Best-in-Class PAM

News and Comment: Stolen digital certificates misused in Plead malware campaign discovered

Stolen digital certificates misused in Plead malware campaign discovered Stolen digital certificates misused in Plead malware campaign discovered NEWS: ESET

News and Comment: Twitter suspends over 70 million accounts in two months: Washington…

Twitter suspends over 70 million accounts in two months: Washington... Twitter suspends over 70 million accounts in two months: Washington...

News and Comment: To crypt, or to mine – that is the question

To crypt, or to mine – that is the question To crypt, or to mine – that is the question

News and Comment: Massive Timehop data breach exposes users’ private information

Massive Timehop data breach exposes users' private information Massive Timehop data breach exposes users' private information NEWS: New York-based firm

« Previous 1 … 149 150 151 152 153 … 161 Next »

Cyber Security News

Why track cyber security news? Cyber security is a world unto itself. It’s a profession, an IT discipline and now a major industry. Companies, consumers and governments are spending billions of dollars a year on cyber security. Security also pervades many areas of life that have little to do, seemingly, with cyberspace. Thus, to keep up with the world in general, it’s helpful to stay aware of news that relates to cyber security.

For example, the dispute between the US government and Huawei is at once about international trade, national security, telecom industry competition… and cybersecurity. Security is a root issue with Huawei, given the suspicions about the company’s connections to the Chinese Communist Party (CCP). However, the company’s size, reach and technological innovation push the matter to the forefront of US-China relations.

Or, take consumer cyber risks. We cover cyber security news that deals with consumers’ exposure to cybercrime and fraud. Consumers are increasingly at risk for identity theft, credit card and other malfeasance at the hands of cyber criminals. The articles we curate on this subject come from law enforcement publications, mainstream media and specialized blogs.

Public policy is now being influenced (or should be) by cyber security news. Policy makers should be aware of how cyber security affect their jobs and constituents’ lives. For instance, the “smart city” is both an innovation and a threat. Using IoT sensors and advanced data analytics to improve municipal services is a great idea. However, the smart city also exposes government data to breach.

This is particularly urgent given the relatively insecure technologies (e.g. Chinese-made sensors) used for the smart city and the wireless connectivity that make it all possible. Add malicious nation-state actors to the mix, such as the ones currently paralyzing American cities with ransomware, and one can see the potential danger.

A WordPress SPAMbot Wants You to Bet on the 2018 FIFA World Cup – Blog | Imperva

Our researchers recently picked up on a spike in SPAM activity directed at sites powered by WordPress, which, naturally, led us to investigate.

A WordPress SPAMbot Wants You to Bet on the 2018 FIFA World Cup – Blog | Imperva

News and Comment: Organizations Leave Backdoors Open to Cheap Remote Desktop Protocol Attacks

NEWS: McAfee has just released its new Advanced Threat Report, which finds that Organizations Leave Backdoors Open to Cheap Remote Desktop Protocol Attacks.

COMMENT: An expert with Corero offers thoughts and perspective.

“If your system is accessible from the Internet then you should expect malicious actors somewhere in the world will try and break in. They do this automatically and continuously with scripts so there is no way to avoid their attempts. In the overwhelming majority of cases they are not specifically targeting you, just any system that is on the Internet.

“There are legitimate needs for systems to be remotely accessible but there is no excuse for trivial or guessable passwords. Password guessing via brute force attempts is the most common method for gaining access to these systems.

“The practice of adding two-factor authentication to Internet accessible systems is a growing trend and can reduce the risk of spontaneous unauthorized access to almost zero.

The overriding message with regard to Internet Security is to be prepared by anticipating the worst attacks but plan your protection for achieving the best defense whether the threat is Breach, Ransomware, or DDoS.”

Ashley Stephenson, CEO, Corero Network Security

News and Comment: Four organizations sold Microsoft Authenticode certificates to anonymous buyers

New research from Masaryk University in the Czech Republic, and Maryland Cybersecurity Center (MCC) in the US, has identified and monitored four organizations that sold Microsoft Authenticode certificates to anonymous buyers. The same research team also collected a corpus of Windows-targeted malware carrying valid digital signatures: http://legacydirs.umiacs.umd.edu/~tdumitra/papers/WEIS-2018.pdf

Cybersecurity experts from STEALTHbits Technologies and Venafi commented on this story. According to Gabriel Gumbs, vice president of product strategy at STEALTHbits Technologies,“Gaining unauthorized access to desktops has traditionally been relatively easier for attackers using attack vectors such as drive-by downloads and phishing. And while endpoint security achieved some increases in efficacy over the last 5 years with the evolution of end point protection platforms, we only ever treated the symptom and the not cause – over permissive access. If an attacker can use a trusted signed certificate to install malware then the malware will use the access rights granted to that user or the access rights left behind in the form of NTLM hashes to further penetrate the network. While this development is a worrying one, applying a least access privilege model would reduce the threat greatly.”

Jonathan Sander, chief technology officer at STEALTHbits Technologies observed, “Malware purveyors seem focused on deep technical things until you see their real focus is actually a core business concept: ROI. Bad guys are more than happy to pay a price for certificates to fool protective measures and hide in plain sight as ‘authorized’ software because the value of any stolen data will more than cover the small cost of a stolen cert. Criminals are in it for the revenue, and they understand you have to spend money to make money.”

“The Stuxnet blueprint continues, we’re seeing a growing cyber criminal underground that has clearly expanded on the original attack’s accomplishments. Everyone, from cyber criminals to nation state actors, is hungry for trusted code signing certificates,” commented Kevin Bocek, vice president of security strategy and threat intelligence at Venafi. He Added, “New research shows that demand for code signing certificates is accelerating; cyber criminals know that these assets make it possible to evade detection, even with targets that are using next generation AV tools. Intel correctly identified this new threat in 2015, predicting it would be the next hot commodity on subversive marketplaces.

This underground economy is growing because many organizations are rapidly expanding their use of code signing certificates. They are foundational components in many applications and DevOps environments. Unfortunately, in many cases, code signing certificates are secured by unsuspecting teams that are focused on delivering code quickly, which allows attackers to intercept them.

Organizations must have full control over every code signing certificate they use, especially during the software development pipeline and signing process.”

Photo Credit: Visual Content Flickr via Compfight cc

Expert: Putin can hack our midterm elections

Barbara Simons, a leading expert on securing voting systems, says the U.S. is not prepared for the threat facing the November elections.

Expert: Putin can hack our midterm elections

Exfiltration policy deficiency: Engineer stashed Navy drone trade secrets in his personal Dropbox

Engineer stashed Navy drone trade secrets in his personal Dropbox

Lack of exfiltration policy: An engineer has been found guilty of swiping trade secrets for an undersea drone.

Engineer stashed Navy drone trade secrets in his personal Dropbox

#exfiltration

Bomgar Acquires Avecto to Provide a Best-in-Class PAM Solution Suite | BOMGAR

With Avectoâs endpoint privileged management technology, Bomgar customers can remove excess admin rights throughout their organizations, and only elevate privileges for approved applications and actions.

Bomgar Acquires Avecto to Provide a Best-in-Class PAM Solution Suite | BOMGAR

News and Comment: Stolen digital certificates misused in Plead malware campaign discovered

Stolen digital certificates misused in Plead malware campaign discovered

NEWS: ESET researchers have discovered stolen digital certificates from Taiwanese tech-companies that have been misused in Plead malware campaign. Read full article at Stolen digital certificates misused in Plead malware campaign discovered

COMMENT:

“These attacks are not new. As ESET points out, the attacker learned from the model established by Stuxnet: if you steal trusted machine identities from global technology companies, you can execute highly effective attacks that don’t raise any alarms.

This is just one more demonstration of how machine identities, in this case code signing certificates, are being abused by malicious actors. There’s no doubt we’re going to see a lot more of these attacks in the future.

Code signing certificates are often a core component of DevOps and cloud infrastructure; and because organizations are using a lot more machine identities, these risks will only grow. In fact, researchers are already seeing a dramatic rise in the trade of stolen code signing certificates on the Dark Web.”

Kevin Bocek, vice president of security strategy and threat intelligence at Venafi

News and Comment: Twitter suspends over 70 million accounts in two months: Washington…

Twitter suspends over 70 million accounts in two months: Washington…

NEWS: Twitter Inc suspended more than one million accounts a day in recent months to reduce the flow of misinformation on the platform, the Washington Post reported. Read full article at Twitter suspends over 70 million accounts in two months: Washington…

COMMENTS:

“When such news emerges, the first question that comes to mind is “how haven’t they done it before?” The answer is simple – it’s always a balance between costs and risk management. The ever-growing sophistication of malicious actors makes bot detection and blocking harder with time. Such protection requires a high-maintenance, comprehensive approach.

It seems that Twitter have finally found the fight against fraud, bots and spam is worth the cost. They do it by both behavioral and technical detection, and a protection mechanism that introduces escalating challenges and enforcements for different scenarios. We hope that more online businesses will take Twitter as an example for the attention that should be paid to fraud, bot and spam threats.”

Avishay Zawoznik, security research team leader at Imperva

“Even though it should probably have tackled the issue many years ago, it’s great to see that Twitter is finally dealing with the issue of fake accounts.

While most of the bot activity is just really annoying, artificially inflating the egos of people prepared to pay for followers, some of it is quite malicious in nature, using topical news stories and the corresponding hashtags to spread malicious links.

Additionally, in recent years, fake accounts have also been linked with fake news, a problem that really can have a great influence on the public conscious, not to mention election results it seems.

Thus, this move from Twitter will go a long way in making the platform both safer and more trustworthy at a time when social networks are coming under increasing media scrutiny.”

Lee Munson, security researcher at Comparitech.com

News and Comment: To crypt, or to mine – that is the question

To crypt, or to mine – that is the question

NEWS: Way back in 2013 our malware analysts spotted the first malicious samples related to the Trojan-Ransom.Win32.Rakhni family. That was the starting point for this long-lived Trojan family, which is still functioning to this day. Now the criminals have decided to add a new feature to their creation – a mining capability.

Read full article at To crypt, or to mine – that is the question

COMMENT:

“We’re often remarking on the typical hackers’ penchant for taking the easy option, where possible, which often includes reuse of old techniques and, in this case, old malware code. The resurgence of the Rakhni malware with an updated ability to choose between ransomware and crypto-mining is a sign of the times, as we are now seeing a huge increase in crypto-jacking as the method of choice for cybercriminal revenue generation. However, with such complexity and now flexibility in the design of this particular malware, we shouldn’t be surprised if it gains other tools in its armoury, such as the ability to create a DDoS-for-hire botnet, as another revenue generator for the cyber community. In this case, your endpoint security won’t help you, as it’s other, less well secured, endpoints that’ll be creating the problem. And, in this case, if your organization relies upon its Internet availability, the only way to preserve that, is to deploy the latest real-time, automatic, DDoS protection solutions.”

Sean Newman, Director Product Management, Corero Network Security

News and Comment: Massive Timehop data breach exposes users’ private information

Massive Timehop data breach exposes users’ private information

NEWS: New York-based firm Timehop said that the details were stolen because it didn’t use two factor authentication (2FA) on its cloud computing login. Read full article at Massive Timehop data breach exposes users’ private information

COMMENT:

“There are 21 million users of Timehop that should be furious right now for two reasons. The first is that there is absolutely no excuse for any business today not to deploy multi-factor authentication to secure access to applications as it’s both effective and inexpensive. The second is the period of time that the breach went undetected and how long it took to sever the hacker’s access. This is one more huge wake-up call for businesses to roll out MFA and take the protection of their user’s data much more seriously.”

David P. Vergara, Head of Security Product Marketing, OneSpan