Thursday, August 31, 2017

Journalists Generally Do Not Use Secure Communication

This should come as no surprise:

Alas, our findings suggest that secure communications haven't yet attracted mass adoption among journalists. We looked at 2,515 Washington journalists with permanent credentials to cover Congress, and we found only 2.5 percent of them solicit end-to-end encrypted communication via their Twitter bios. That's just 62 out of all the broadcast, newspaper, wire service, and digital reporters. Just 28 list a way to reach them via Signal or another secure messaging app. Only 22 provide a PGP public key, a method that allows sources to send encrypted messages. A paltry seven advertise a secure email address. In an era when anything that can be hacked will be and when the president has declared outright war on the media, this should serve as a frightening wake-up call.

[...]

When journalists don't step up, sources with sensitive information face the burden of using riskier modes of communication to initiate contact­ -- and possibly conduct all of their exchanges­ -- with reporters. It increases their chances of getting caught, putting them in danger of losing their job or facing prosecution. It's burden enough to make them think twice about whistleblowing.

I forgive them for not using secure e-mail. It's hard to use and confusing. But secure messaging is easy.



from Journalists Generally Do Not Use Secure Communication

Wednesday, August 30, 2017

Hospital Stays Can Take Out More Than Your Organs

The Cyber Theft Threat in Healthcare and how Service Providers can Transform Risk to Reward You went to the hospital to get your appendix out and one week later your identity was taken from you as well.  How did this happen? In their 2017 Data Breach survey, Verizon found that ransomware has jumped up from […]

The post Hospital Stays Can Take Out More Than Your Organs appeared first on Radware Blog.



from Hospital Stays Can Take Out More Than Your Organs

711 MILLION email accounts weaponized by Onliner for spam campaigns

The Onliner spambot weaponized a whopping 711 million email accounts to distribute spam emails laden with malware. David Bisson reports.

from 711 MILLION email accounts weaponized by Onliner for spam campaigns

New ESET research uncovers Gazer, the stealthy backdoor that spies on embassies

Researchers uncover the activities of the notorious Turla cyberespionage group, and specifically a previously undocumented backdoor that has been used to spy on consulates and embassies worldwide. Read more in my article on the We Live Security blog.

from New ESET research uncovers Gazer, the stealthy backdoor that spies on embassies

‘House of Cards’ publisher exposes gigabytes of sensitive client files

A backup drive on the publisher's network exposed gigabytes of sensitive client data -- including unpublished books, invoices, details of royalty payments, and contracts.

from ‘House of Cards’ publisher exposes gigabytes of sensitive client files

The NSA’s 2014 Media Engagement and Outreach Plan

Interesting post-Snowden reading, just declassified. (U) External Communication will address at least one of "fresh look" narratives: (U) NSA does not access everything. (U) NSA does not collect indiscriminately on U.S. Persons and foreign nationals. (U) NSA does not weaken encryption. (U) NSA has value to the nation. There's lots more....

from The NSA’s 2014 Media Engagement and Outreach Plan

CeX Notifies Two Million Registered Customers of Online Security Breach

CeX has notified up to two million customers about an online security breach that might have compromised their personal data. On 29 August, the second-hand goods chain that specializes in computer and video games announced it had suffered a security event. As quoted in a statement posted to its website: “We have recently been subject […]… Read More

The post CeX Notifies Two Million Registered Customers of Online Security Breach appeared first on The State of Security.



from CeX Notifies Two Million Registered Customers of Online Security Breach

HBO Hacks Indicate a Company in Cyber Security Crisis

Hacks in the City: Latest in String of HBO Hacks Targets Company’s social media Accounts HBO has had a rough summer, and things are getting progressively worse for the cable titan. The HBO hacks began in late June, when an individual hacker or group calling themselves “Mr. Smith” dumped several episodes of upcoming HBO series […]

The post HBO Hacks Indicate a Company in Cyber Security Crisis appeared first on MichaelPeters.org.



from HBO Hacks Indicate a Company in Cyber Security Crisis

FDA issues recall of 465,000 St. Jude pacemakers to patch security holes

Heart patients will have to visit their doctors to have their pacemakers patched for the "voluntary" recall -- but there are risks.

from FDA issues recall of 465,000 St. Jude pacemakers to patch security holes

WireX botnet offers glimpse of Android DDoS threat

A group of companies has worked together to target a botnet built via Android malware

from WireX botnet offers glimpse of Android DDoS threat

CeX data breach impacts two million UK accounts, customers told to change passwords ASAP

Second-hand electronics dealer CeX is warning that it has suffered a data breach that has exposed the personal information of up to two million customers.

from CeX data breach impacts two million UK accounts, customers told to change passwords ASAP

Tuesday, August 29, 2017

Ross Anderson on the History of the Crypto Wars in the UK

Ross Anderson gave a talk on the history of the Crypto Wars in the UK. I am intimately familiar with the US story, but didn't know as much about Britain's verson.

Hour-long video. Summary.



from Ross Anderson on the History of the Crypto Wars in the UK

SAP Services detection via nmap probes

This article aims at showing how to improve the capability of the nmap network scanner to detect SAP services. This is by no mean a complete and 100% exact way of doing service detection as a lot of corner cases exist that are not covered in this text. If you want a more comprehensive way […]

The post SAP Services detection via nmap probes appeared first on ERPScan.



from SAP Services detection via nmap probes

Confessions of an InfoSec Burnout

Soul-crushing failure. If asked, that is how I would describe the last 10 years of my career, since leaving AOL. I made one mistake, one bad decision, and it's completely and thoroughly derailed my entire career. Worse, it's unclear if...

from Confessions of an InfoSec Burnout

Secure Use Tips for Intelligent Personal Assistants (IPAs)

Intelligent personal assistants (IPAs) are gaining substantial traction among the giants of the tech world. And for good reason: The technology has garnered a reputation for being the poster child... Go on to the site to read the full article

from Secure Use Tips for Intelligent Personal Assistants (IPAs)

SSL Attacks – When Hackers Use Security Against You

In World War II, the Allies had a significant advantage because they were able to compromise the encryption protocols that the Japanese and Germans used to send sensitive messages.  They were able to intercept and decode messages to gain intelligence concerning sensitive military operations. In today’s Internet Age, malicious hackers are using standard encryption standards […]

The post SSL Attacks – When Hackers Use Security Against You appeared first on Radware Blog.



from SSL Attacks – When Hackers Use Security Against You

Deploy an Auto-Scaled BIG-IP VE WAF in AWS

Today let’s look at how to create and deploy an auto-scaled BIG-IP Virtual Edition Web Application Firewall by using a Cloud Formation Template (CFT) in AWS. CFTs are simply a quick way to spin up solutions that otherwise, you may have to create manually. The idea behind this CFT is it is going to create […]

from Deploy an Auto-Scaled BIG-IP VE WAF in AWS

Forcepoint acquires RedOwl to make security all about people

The company says that the security industry needs to ensure clients fully understand risks to enterprise systems.

from Forcepoint acquires RedOwl to make security all about people

Ross Anderson on the History of the Crypto Wars in the UK

Ross Anderson gave a talk on the history of the Crypto Wars in the UK. I am intimately familiar with the US story, but didn't know as much about Britain's verson. Hour-long video. Summary....

from Ross Anderson on the History of the Crypto Wars in the UK

Beware of Hurricane Harvey Phishing Attacks and Charity Scams

The U.S. government is warning people to be on the lookout for charity scams and phishing attacks in the wake of Hurricane Harvey. On 28 August, the United States Computer Emergency Readiness Team (US-CERT) issued an alert warning users about fraudsters who exploit tragedies like Hurricane Harvey for their own personal gain: “Users are advised […]… Read More

The post Beware of Hurricane Harvey Phishing Attacks and Charity Scams appeared first on The State of Security.



from Beware of Hurricane Harvey Phishing Attacks and Charity Scams

Selena Gomez – please tell your 125 million fans to enable two-step verification

Hackers seized control of the American singer and actress's Instagram account and posted revealing snaps of her ex-boyfriend Justin Bieber.

from Selena Gomez – please tell your 125 million fans to enable two-step verification

Don’t expose yourself with your boarding pass

Getting on a plane? Resist the temptation to post a photo of your boarding pass - it reveals too much about you

from Don’t expose yourself with your boarding pass

Monday, August 28, 2017

Hacking a Phone Through a Replacement Touchscreen

Researchers demonstrated a really clever hack: they hid malware in a replacement smart phone screen. The idea is that you would naively bring your smart phone in for repair, and the repair shop would install this malicious screen without your knowledge. The malware is hidden in touchscreen controller software, which is trusted by the phone.

The concern arises from research that shows how replacement screens -- one put into a Huawei Nexus 6P and the other into an LG G Pad 7.0 -- can be used to surreptitiously log keyboard input and patterns, install malicious apps, and take pictures and e-mail them to the attacker. The booby-trapped screens also exploited operating system vulnerabilities that bypassed key security protections built into the phones. The malicious parts cost less than $10 and could easily be mass-produced. Most chilling of all, to most people, the booby-trapped parts could be indistinguishable from legitimate ones, a trait that could leave many service technicians unaware of the maliciousness. There would be no sign of tampering unless someone with a background in hardware disassembled the repaired phone and inspected it.

Academic paper. BoingBoing post.



from Hacking a Phone Through a Replacement Touchscreen

Open Banking APIs under PSD2: What are the security threats and solutions? Download VASCO’s white paper now

Open Banking APIs under PSD2: What are the security threats and solutions? Download VASCO's white paper now

Graham Cluley Security News is sponsored this week by the folks at VASCO. Thanks to the great team there for their support!

More than 10,000 customers in 100 countries rely on VASCO to secure access, manage identities, verify transactions, simplify document signing and protect high value assets and systems.

The Revised Payment Services Directive, also known as PSD2, requires European banks to provide communication interfaces to Third Party Providers (TPPs).

These interfaces, generally referred to as APIs, will allow TPPs to build innovative financial services on top of the services of the banks. The requirements for these interfaces are defined in the Regulatory Technical Standards (RTS) on Strong Customer Authentication (SCA) and Common and Secure Communication (CSC), of which the European Banking Authority (EBA) published a draft version in February 2017.

In this whitepaper VASCO analyzes the requirements for the communication interface as defined in the draft RTS, with a special emphasis on security requirements. VASCO identifies the most important security threats against these interfaces, and discuss various solutions that can help banks to protect against them.

By downloading this free white paper, you’ll discover:

  • the PSD2 requirements for open banking APIs
  • the security and privacy threats against the APIs of banks
  • how to protect APIs against security threats
  • VASCO's solution suite for PSD2 compliance

Interested in learning more? Download VASCO's white paper: Open Banking APIs under PSD2: What are the security threats and solutions?


If you’re interested in sponsoring my site for a week, and reaching an IT-savvy audience that cares about computer security, you can find more information here.



from Open Banking APIs under PSD2: What are the security threats and solutions? Download VASCO’s white paper now

Top 10 Threats from Unprotected Intelligent Personal Assistants (IPAs)

1.   Introduction Intelligence personal assistants (IPA), also known as virtual personal assistant (VPA), is the rising star in the high technology industry. It is an intelligent software application...

Go on to the site to read the full article

from Top 10 Threats from Unprotected Intelligent Personal Assistants (IPAs)

Cyber Chef

Nice site at https://gchq.github.io/CyberChef/ - Allows you to do all sorts of conversions of data format, generate encoding and encryption, parse network data, extract strings, IPs, email addresses, etc., analyze hashes and a lot more.

from Cyber Chef

New York State’s New Financial Services Cybersecurity Policy Relies on Encryption

Starting today, certain financial services companies based in New York will have to comply with the state’s new cybersecurity requirements, known by the (very long) acronym 23 NYCRR 500. On...

The post New York State’s New Financial Services Cybersecurity Policy Relies on Encryption appeared first on Data Security Blog | Thales e-Security.



from New York State’s New Financial Services Cybersecurity Policy Relies on Encryption

VMWare releases AppDefense to protect enterprise virtual environments

The new security solution is designed to protect virtual and cloud systems from cyberattacks.

from VMWare releases AppDefense to protect enterprise virtual environments

VMware expands multi-cloud offerings, adds new intent-based security product

At the VMworld conference in Las Vegas, VMware is demonstrating how its strategy to help hybrid cloud deployments extends to multiple public clouds.

from VMware expands multi-cloud offerings, adds new intent-based security product

Hacking a Phone Through a Replacement Touchscreen

Researchers demonstrated a really clever hack: they hid malware in a replacement smart phone screen. The idea is that you would naively bring your smart phone in for repair, and the repair shop would install this malicious screen without your knowledge. The malware is hidden in touchscreen controller software, which is trusted by the phone. The concern arises from research...

from Hacking a Phone Through a Replacement Touchscreen

Android Trojan Targeting South Korean Users via Smishing Campaign

An Android trojan is using SMS phishing texts (or “smishing” messages) to prey upon unsuspecting South Korean mobile users. In July 2017, users uploaded to South Korean websites screenshots of texts asking them to click on suspicious shortened links. One message warns recipients that someone might have leaked a private picture of them to the […]… Read More

The post Android Trojan Targeting South Korean Users via Smishing Campaign appeared first on The State of Security.



from Android Trojan Targeting South Korean Users via Smishing Campaign

Cybersecurity Risk Model … Implicit or Explicit Consensus?

Whenever you engage with an online vendor or service, you must first click on the “Agree” button to indicate that you will honor the stated terms and conditions mandated by the site owner. Most individuals click the “Agree” button without thinking, knowing that activating the “Don’t Agree” button will result in your not being able […]



from Cybersecurity Risk Model … Implicit or Explicit Consensus?

Why Snapshots Alone Are Not Backups

Having a clear picture of what VM snapshots and backups can do for you is critical when your data is at stake. To dispel any doubts, snapshots are NOT backups. They are two different processes designed to address different needs. Today, I’m going to explain the discrepancy between VM snapshots and backups, and provide you with a few scenarios where each of them best fits.

read more



from Why Snapshots Alone Are Not Backups

Sunday, August 27, 2017

Enterprise News – Enterprise Security Weekly #58

Diving deep into threat intelligence, GeoGuard and Skyhook team up, securing mobile devices, and more enterprise news! Enterprise News Beyond Feeds: A Deep Dive Into Threat Intelligence Sources – Straight away, we saw something interesting. A very high proportion of organizations were already using threat intelligence to block malicious domains and IP addresses, with many also using […]

The post Enterprise News – Enterprise Security Weekly #58 appeared first on Security Weekly.



from Enterprise News – Enterprise Security Weekly #58

Learn How to Become CEH v9 Certified

One of the largest concerns of businesses today, large and small, is securing client and customer data privacy; one way to ensure you know how to do so is by becoming CEH v9 certified! CEH, or Certified Ethical Hacker, is a cybersecurity certification offered by EC-Council. This certification validates that the hacking knowledge and skills […]

The post Learn How to Become CEH v9 Certified appeared first on Phoenix TS.



from Learn How to Become CEH v9 Certified

Saturday, August 26, 2017

PECB, Juris Puce’s ‘Effects of Artificial Intelligence on Information Security’

From Juris' video description: During the PECB Insights Conference, Juris Puce, the co-founder of 4SmartStreets, gave a brief presentation on the effects of Artificial intelligence. His presentation was illustrated with real life case scenarios on the...

from PECB, Juris Puce’s ‘Effects of Artificial Intelligence on Information Security’

Illinois CISO Discusses Their State Cybersecurity Strategy

From Juris' video description: During the PECB Insights Conference, Juris Puce, the co-founder of 4SmartStreets, gave a brief presentation on the effects of Artificial intelligence. His presentation was illustrated with real life case scenarios on the...

from Illinois CISO Discusses Their State Cybersecurity Strategy

Unbottling “.msg” Files in R

There was a discussion on Twitter about the need to read in “.msg” files using R. The “MSG” file format is one of the many binary abominations created by Microsoft to lock folks and users into their platform and tools. Thankfully, they (eventually) provided documentation for the MSG file format which helped me throw together... Continue reading

from Unbottling “.msg” Files in R

XKCD, Drone Training

Via the astute world-view of Randall Munroe at XKCD. Permalink

from XKCD, Drone Training

TCG Guidance for Securing Network Equipment

The TCG Guidance for Securing Network Equipment provides recommendations and detailed advice on how TCG standards should be used to secure network equipment such as routers, switches, and firewalls. Physical network functions are considered in this document; virtualized network functions are not considered in this version. While the TPM’s resistance to physical attack can help … Continue reading "TCG Guidance for Securing Network Equipment"

The post TCG Guidance for Securing Network Equipment appeared first on Trusted Computing Group.



from TCG Guidance for Securing Network Equipment

Oops! Aetna exposed 12,000 customers’ HIV statuses through envelope window

American managed health care company Aetna is in hot water for accidentally exposing the HIV statuses of 12,000 of its patients. David Bisson reports.

from Oops! Aetna exposed 12,000 customers’ HIV statuses through envelope window

Avast is proven to keep phishing scams at bay

Here’s the crazy truth about phishing scams: if you have an email address, you’ve already been targeted. Phishing scams are so prevalent these days that Avast has been focusing on educating users how to identify and avoid them. But what if you accidentally click on the phishing link sent to you? There’s still a way to protect yourself.



from Avast is proven to keep phishing scams at bay

Beyond Digital Mayhem

Be careful what you wish for. This week, a committee within the National Security Council issued a report calling for decisive action by the Trump administration on a set of bold Cybersecurity measures that must be put in place immediately in order to avoid a 9/11-level cyber-attack. The National Infrastructure Advisory Council (NIAC) is a […]

The post Beyond Digital Mayhem appeared first on Netswitch Technology Management.



from Beyond Digital Mayhem

New York’s Cybersecurity Regulation: The Tip of The Iceberg

Like a junkie who can’t turn away from a nickel bag, Financial Services and Insurance companies operating in the state of New York can no longer remain in Cybersecurity denial. The state’s version of the DEA (Denial Enforcement Agency) has put its foot down. Effective March 1st, 2017, the New York State Cyber Security Regulations […]

The post New York’s Cybersecurity Regulation: The Tip of The Iceberg appeared first on Netswitch Technology Management.



from New York’s Cybersecurity Regulation: The Tip of The Iceberg

Doubling Down on Cybersecurity Failure

If anyone doubts China’s intentions around world dominance in cyber space, look no further than their investment in Artificial Intelligence (AI). If their clear leadership in Quantum Computing isn’t enough evidence of their looming authority in what may be the final frontier, they have doubled down on developing the most advanced applications of AI on […]

The post Doubling Down on Cybersecurity Failure appeared first on Netswitch Technology Management.



from Doubling Down on Cybersecurity Failure

Friday, August 25, 2017

Friday Squid Blogging: Prehistoric Dolphins that Ate Squid

Paleontologists have discovered a prehistoric toothless dolphin that fed by vacuuming up squid:

There actually are modern odontocetes that don't really use their teeth either. Male beaked whales, for example, usually have one pair of teeth that is only used to fight for females, whose teeth stay completely hidden in their gums. Beaked whales, along with pilot whales and sperm whales, also catch squid by sucking them into their mouths. But all of these whales evolved recently. Inermorostrum xenops seems to have evolved its toothless suction-feeding independently and much, much earlier than modern suction-feeding whales. "It's a highly specialized species but it's essentially a dead end," says Boessenecker. Evolution, far from being some linear progression, often works this way, hitting dead ends and retrying failed experiments from millions of years earlier.

As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered.

Read my blog posting guidelines here.



from Friday Squid Blogging: Prehistoric Dolphins that Ate Squid

Military Robots as a Nature Analog

This very interesting essay looks at the future of military robotics and finds many analogs in nature:

Imagine a low-cost drone with the range of a Canada goose, a bird that can cover 1,500 miles in a single day at an average speed of 60 miles per hour. Planet Earth profiled a single flock of snow geese, birds that make similar marathon journeys, albeit slower. The flock of six-pound snow geese was so large it formed a sky-darkening cloud 12 miles long. How would an aircraft carrier battlegroup respond to an attack from millions of aerial kamikaze explosive drones that, like geese, can fly hundreds of miles? A single aircraft carrier costs billions of dollars, and the United States relies heavily on its ten aircraft carrier strike groups to project power around the globe. But as military robots match more capabilities found in nature, some of the major systems and strategies upon which U.S. national security currently relies -- perhaps even the fearsome aircraft carrier strike group -- might experience the same sort of technological disruption that the smartphone revolution brought about in the consumer world.



from Military Robots as a Nature Analog

OWASP Top 10 #10: Unprotected APIs

Modern applications are becoming more complex, more critical and more connected. The difficulty of achieving application security has increased exponentially and unprotected APIs are one of the top... Go on to the site to read the full article

from OWASP Top 10 #10: Unprotected APIs

Identity theft at ‘epidemic’ levels, warn experts

It's a crime that's booming - so how can you protect yourself? We take a look at the figures and offer some tips

from Identity theft at ‘epidemic’ levels, warn experts

‘Clever’ TapDance approach to web censorship that works at ISP level

The TapDance approach is just a proof of concept at the moment, but observers have welcomed it as a potentially useful tool

from ‘Clever’ TapDance approach to web censorship that works at ISP level

Windows Server (Version 1709) Will Be Released Next Month at Microsoft Ignite

After beginning an Insider program back in July for Windows Server, we have learned that the next version of Windows Server will be released at Microsoft Ignite in Orlando, Florida next month. read more

from Windows Server (Version 1709) Will Be Released Next Month at Microsoft Ignite

Despite privacy outrage, AccuWeather still shares precise location data with ad firms

New tests reveal that while one privacy-invading feature was removed in an app update, the app still shares precise geolocation coordinates with advertisers.

from Despite privacy outrage, AccuWeather still shares precise location data with ad firms

Despite privacy outrage, AccuWeather still shares precise location data with ad firms

New tests reveal that while one privacy-invading feature was removed in an app update, the app still shares precise geolocation coordinates with advertisers.

from Despite privacy outrage, AccuWeather still shares precise location data with ad firms

Touchscreens ‘at risk from chip in the middle attack’, warn researchers

Researchers call for manufacturers to recognize that compromised hardware is a real possibility

from Touchscreens ‘at risk from chip in the middle attack’, warn researchers

Mentoring: On Blogging

Received the question about blogging. More specifically:How and WhyHow to benefit from bloggingHow to be consistent with postingIn my mind, the key to success and blogging is to be totally selfish in its planning and execution.Blogging is a personal ac...

from Mentoring: On Blogging

Military Robots as a Nature Analog

This very interesting essay looks at the future of military robotics and finds many analogs in nature: Imagine a low-cost drone with the range of a Canada goose, a bird that can cover 1,500 miles in a single day at an average speed of 60 miles per hour. Planet Earth profiled a single flock of snow geese, birds that make...

from Military Robots as a Nature Analog

Android Ransomware Development Made a Cinch by TDK Mobile Apps

Wannabe computer criminals can now easily create Android ransomware thanks to what are known as trojan development kits (TDKs). TDKs automate the process of developing new mobile malware by leveraging a version of the computer-aided software engineering (CASE) tool model. These device-aided malware engineering (DAME) utilities enable an actor to quickly create a ransomware variant […]… Read More

The post Android Ransomware Development Made a Cinch by TDK Mobile Apps appeared first on The State of Security.



from Android Ransomware Development Made a Cinch by TDK Mobile Apps

Thursday, August 24, 2017

Massive Government Data Leak in Sweden

Seems to be incompetence rather than malice, but a good example of the dangers of blindly trusting the cloud.



from Massive Government Data Leak in Sweden

Protecting Oracle E-Business Suite: Encrypt web interface (HTTPS)

After the release of our threat report about a critical vulnerability on “Unauthorized Business Data Exfiltration Vulnerability”, we are continuing our series of blogpost about Oracle E-Business Suite security. To keep our readers informed about security risks and mitigation techniques to Oracle’s biggest ERP, E-Business Suite (EBS), we will continue to publish blogs on a monthly basis.

ResearchCristian Peque
08/24/2017


from Protecting Oracle E-Business Suite: Encrypt web interface (HTTPS)

Malware rains on Google’s Android Oreo parade

It may be summer here in the northern hemisphere, but Android users face a shower of new threats

from Malware rains on Google’s Android Oreo parade

Small and Medium Businesses in the Spotlight for Hackers

The question isn’t big or small business.  It’s valuable or not valuable data. There is a common misconception among both businesses and service providers and it goes something like this: Small and medium businesses are not the focus of hackers these days, this is a large enterprise problem. The myth goes on that hackers must be focused […]

The post Small and Medium Businesses in the Spotlight for Hackers appeared first on Radware Blog.



from Small and Medium Businesses in the Spotlight for Hackers

Solution Corner: Malwarebytes for Mac

Mac users have been told for years: Macs don't get viruses. That's not true! Stay protected with Malwarebytes for Mac.

Categories:

Tags:

(Read more...)

The post Solution Corner: Malwarebytes for Mac appeared first on Malwarebytes Labs.



from Solution Corner: Malwarebytes for Mac

New SecurityIQ Resources, Learner Management Tools

This week’s SecurityIQ update includes several new program features. Clients now have access to a library of additional teaching resources within the SecurityIQ platform to reinforce key lessons, and...

Go on to the site to read the full article

from New SecurityIQ Resources, Learner Management Tools

Most Fortune 500 companies aren’t using this basic email security feature

The email security feature would cut down on the majority of phishing scams and spam email.

from Most Fortune 500 companies aren’t using this basic email security feature

Energy firm slapped with a fine after making 1.5m nuisance calls

Think you've opted out of robocalls from marketers? So did the people who complained - and got the offender hit with a fine

from Energy firm slapped with a fine after making 1.5m nuisance calls

The risk of attack is getting closer – mobile devices in focus

Smartphones are part of everyday life, either for private or professional use. However, while many users have taken basic measures to protect their desktop PC or laptop, this is not the case for mobile devices. A study by Consumerreports.org showed tha...

from The risk of attack is getting closer – mobile devices in focus

How QR Codes are Changing e-Commerce

E-Commerce has long relied on the “Card Not Present” payment method. At this point, online consumers can do the routine with their eyes closed: Enter their credit card number and...

The post How QR Codes are Changing e-Commerce appeared first on Data Security Blog | Thales e-Security.



from How QR Codes are Changing e-Commerce

Are you a student? Your personal data is there for the asking

Your college can - and will - hand over your personal details to anyone who asks, warns a researcher who is calling for better protection for students

from Are you a student? Your personal data is there for the asking

Wednesday, August 23, 2017

Your Personal Bodycam

Shonin is a personal bodycam up on Kickstarter.

There are a lot of complicated issues surrounding bodycams -- for example, it's obvious that police bodycams reduce violence -- but the one thing everyone is certain about is that they will proliferate. I'm not sure society is fully ready for the ramifications of this level of recording.



from Your Personal Bodycam

Silicon Review Accolade for Clearswift!

English
Tags: 
<a href='/blog?tag=Awards'>Awards</a>
10 Fastest Growing Cyber Security Companies

Clearswift is honored to have been named as one of the Top 10 Fastest Growing Cyber Security companies in 2017 by Silicon Review magazine.

The US-based publication was particularly impressed by Clearswift’s technology portfolio in the areas of data loss prevention and deep content inspection. Silicon Review also referenced Clearswift’s collaborative approach to Adaptive Data Loss Prevention (DLP) which ensures a disruption-free approach for businesses, while protecting against the unauthorized loss of critical information.

Dr Guy Bunker, SVP Products and Marketing at Clearswift, said:

“We’re absolutely delighted to see our growth and product development being recognized, and with the backing of RUAG, we expect to see even greater growth going forwards.”

The publication looked back at the history of Clearswift, from the launch of its legacy MIMEsweeper product in 1995, through to the 2006 launch of the SECURE Email Gateway, and highlighted how the product range has expanded up to, and since, the recent acquisition by RUAG at the start of 2017.

Clearswift’s most recent security initiative, SECURITY + which was launched in June, is aimed at organizations who have security solutions in place today and recognize the immediate need for more advanced security, but cannot afford to 'rip and replace’.  Dr Guy Bunker mentioned, “At Clearswift, we are well across the constantly evolving threat landscape and data protection regulations such as the GDPR. Our solutions are designed to support organizations with these information security challenges, without hindering communication flow.”

“Clearswift empowers organizations of all sizes and verticals to enhance their existing security infrastructure with the most advanced protection against today’s cyber-attacks and data loss risks.”

Other recognition for Clearswift in the past year includes:

  • Gartner Magic Quadrant for Enterprise Data Loss Prevention, February 2017 (also featured in Gartner Critical Capabilities for DLP report)
  • Radicati Corporate Web Security Market Quadrant, May 2017
  • Top 25 Compliance Solution Providers, APAC CIO Magazine, 2017
  • Winner of Gold award for Adaptive Data Loss Prevention, Info Security Products Guide, 2017
  • Forrester Wave for Data Loss Prevention, 2016
  • Featured in NATO report on Cyber Defence Situational Awareness Technologies, 2016

About Clearswift

Clearswift is a global cyber security company, headquartered in the United Kingdom with offices in the United States, Germany, Australia, and Japan. The company has over 2,300 customers around the world and an extensive channel partner network. In 2016, it generated sales exceeding £23m.

Read the article in full

Additional Information

Tags: 
Featured: 
0


from Silicon Review Accolade for Clearswift!

The Evolution of the Dark Web

Darknet markets are nothing new but they have grown considerably in popularity since the highly publicized take down of the Silk Road marketplace in October of 2013. Since then users around the world have flocked to these sites in search of drugs and other illicit services. Due to the high demand and availability for these […]

The post The Evolution of the Dark Web appeared first on Radware Blog.



from The Evolution of the Dark Web

Malware Meets the Bottom Line – Again

Maersk, the global shipping company and one impacted by June’s NotPetya malware, revealed last week the cyberattack could end up costing the company as much as 300 million dollars. While...

The post Malware Meets the Bottom Line – Again appeared first on Data Security Blog | Thales e-Security.



from Malware Meets the Bottom Line – Again

A Security Decision – Build or Buy

We are sometimes asked to compare our threat detection and response solutions to those custom assembled by security experts using various open source products. With a wide array of quality point solutions available, it’s natural to consider whether a combination of best-of-breed open source solutions can be a better option for a particular organization, rather…

The post A Security Decision – Build or Buy appeared first on Speaking of Security - The RSA Blog.



from A Security Decision – Build or Buy

Lightboard Lessons: BIG-IP ASM Layered Policies

In this Lightboard Lesson, I light up some use cases for BIG-IP ASM Layered Policies available in BIG-IP v13. With Parent and Child policies, you can: Impose mandatory policy elements on multiple policies; Create multiple policies with baseline pro...

from Lightboard Lessons: BIG-IP ASM Layered Policies

Your Personal Bodycam

Shonin is a personal bodycam up on Kickstarter. There are a lot of complicated issues surrounding bodycams -- for example, it's obvious that police bodycams reduce violence -- but the one thing everyone is certain about is that they will proliferate. I'm not sure society is fully ready for the ramifications of this level of recording....

from Your Personal Bodycam

Marketing Security Solutions: Is There a Better Way?

Security marketing seems to be stuck in a bit of a “spray and pray” rut.  Perhaps the time has come for security vendors to rethink how they invest their marketing budgets?  I discuss in my latest SecurityWeek piece: http://www.securityweek.com/marketing-security-solutions-there-better-way.  Hope you find this piece interesting.


from Marketing Security Solutions: Is There a Better Way?

Google bakes in sweeter security for Android Oreo

The latest version of Android should be coming to a device near you soon - how does it stack up on the security front?

from Google bakes in sweeter security for Android Oreo

California City Stops Online Utility Bill Payment System amid Breach Fears

A California city has temporarily shut down its online utility bill payment system amid fears that the portal suffered a breach. On 22 August 2017, the City Manager’s Office of Oceanside, CA announced a possible security incident affecting its online bill payment system that residents can use to pay their utility (water, sewer, and trash) […]… Read More

The post California City Stops Online Utility Bill Payment System amid Breach Fears appeared first on The State of Security.



from California City Stops Online Utility Bill Payment System amid Breach Fears

Facebook is making its Safety Check feature permanent

Safety Check is here to stay - is it a good thing that reassures loved ones, or a feature that causes unnecessary anxiety?

from Facebook is making its Safety Check feature permanent

Tuesday, August 22, 2017

Insider Attack on Lottery Software

Eddie Tipton, a programmer for the Multi-State Lottery Association, secretly installed software that allowed him to predict jackpots.

What's surprising to me is how many lotteries don't use real random number generators. What happened to picking golf balls out of wind-blown steel cages on television?



from Insider Attack on Lottery Software

Dumping Data from Deep-Insert Skimmers

I recently heard from a police detective who was seeking help identifying some strange devices found on two Romanian men caught maxing out stolen credit cards at local retailers. Further inspection revealed the devices to be semi-flexible data transfer wands that thieves can use to extract stolen ATM card data from "deep-insert skimmers," wafer-thin fraud devices made to be hidden inside of the card acceptance slot on a cash machine.

from Dumping Data from Deep-Insert Skimmers

‘Smart’ solar power inverters raise risk of energy grid attacks

Researcher identifies a weakness in the software layer - and reminds us that we're placing a lot of trust in vendors to implement decent security in formerly passive devices

from ‘Smart’ solar power inverters raise risk of energy grid attacks

Robotics to Replace ACL, Part 2

Previously I wrote Will Robotics (RPA) Replace ACL? The short answer is no, and I describe the reasons in that post. But that doesn’t mean someone won’t try. Shortly after I wrote my original robotics post, I encountered robotics vs. ACL, … Continue reading

from Robotics to Replace ACL, Part 2

AccuWeather caught sending user location data, even when location sharing is off

A security researcher has found that the popular weather app sends private location data without the user's explicit permission to a firm designed to monetize user locations.

from AccuWeather caught sending user location data, even when location sharing is off

Outbound SSL Solutions Protect Assets in the Wild

Businesses need to protect their assets when they are within their protective infrastructure AND when they are actively exposed or placed within the unprotected external world. The tools and procedures needed to protect the internal assets are different from the ones that protect the assets when they leave the confines of the secured network. Walls […]

The post Outbound SSL Solutions Protect Assets in the Wild appeared first on Radware Blog.



from Outbound SSL Solutions Protect Assets in the Wild

Protect Sensitive Data on AWS with Amazon Macie

I’m a few days late on this, but I just read on the AWS blog that they launched a new service called Amazon Macie on August 14. According to the website, Macie is “a security service that uses machine learning to automatically discover, classify, and protect sensitive data in AWS.” Here are a few points …

Read More Read More



from Protect Sensitive Data on AWS with Amazon Macie

Fake news: Mozilla joins the fight to stop it polluting the web

How much responsibility do we bear for our own media literacy, and how much effort should firms like Mozilla, Google, Snopes, Facebook and others put into tackling fake news?

from Fake news: Mozilla joins the fight to stop it polluting the web

Nude photos of Anne Hathaway leaked online by hackers

Hollywood actress Anne Hathaway is just the latest in a long line of celebrities who have found their intimate snaps exposed online by hackers.

from Nude photos of Anne Hathaway leaked online by hackers

Insider Attack on Lottery Software

Eddie Tipton, a programmer for the Multi-State Lottery Association, secretly installed software that allowed him to predict jackpots. What's surprising to me is how many lotteries don't use real random number generators. What happened to picking golf balls out of wind-blown steel cages on television?...

from Insider Attack on Lottery Software

NetworkMiner 2.2 Released

NetworkMiner 2.2 is faster, better and stronger than ever before! The PCAP parsing speed has more than doubled and even more details are now extracted from analyzed packet capture files. The improved parsing speed of NetworkMiner 2.2 can be enjoyed regardless if NetworkMiner is run in Windows or Lin[...]

from NetworkMiner 2.2 Released

Monday, August 21, 2017

iOS 11 Allows Users to Disable Touch ID

A new feature in Apple's new iPhone operating system -- iOS 11 -- will allow users to quickly disable Touch ID.

A new setting, designed to automate emergency services calls, lets iPhone users tap the power button quickly five times to call 911. This doesn't automatically dial the emergency services by default, but it brings up the option to and also temporarily disables Touch ID until you enter a passcode.

This is useful in situations where the police cannot compel you to divulge your password, but can compel you to press your finger on the reader.



from iOS 11 Allows Users to Disable Touch ID

Landing that infosec job: These experts share their best career advice

ZDNet asked four security experts for their top advice for getting into the infosec world.

from Landing that infosec job: These experts share their best career advice

Landing that infosec job: These experts share their best career advice

ZDNet asked four security experts for their top advice for getting into the infosec world.

from Landing that infosec job: These experts share their best career advice

How we found that hidden Apple job listing

Sometimes a job opportunity can pop up where you least expect it.

from How we found that hidden Apple job listing

How we found that hidden Apple job listing

Sometimes a job opportunity can pop up where you least expect it.

from How we found that hidden Apple job listing

Sony social media accounts hijacked as hackers claims to have stolen PSN database

The OurMine hacking group claimed yet another corporate scalp this weekend - seizing control over the Twitter and Facebook accounts of Sony's PlayStation Network (PSN). Read more in my article on the Hot for Security blog.

from Sony social media accounts hijacked as hackers claims to have stolen PSN database

Bad Poetry Day Highlights – The Security Edition

Friday, August 18th was Bad Poetry Day. To celebrate, Tripwire decided to ask some of it’s employees and friends in the community to share some of their security poems with us. Some folks tweeted theirs out using the hashtag #tripwirebadpoetryday. Others sent them in. Here are some of our favorites: Roses are red, Violets are […]… Read More

The post Bad Poetry Day Highlights – The Security Edition appeared first on The State of Security.



from Bad Poetry Day Highlights – The Security Edition

GCHQ knew FBI was planning to arrest WannaCry’s ‘accidental hero’ before he travelled to the USA

The US authorities saved themselves an awful lot of paperwork and legal expense arresting their suspect on their own soil rather than trying to extradite him from the UK.

from GCHQ knew FBI was planning to arrest WannaCry’s ‘accidental hero’ before he travelled to the USA

Concerns ignored as Home Office pushes ahead with facial recognition

Picking faces out of a crowd using software is unreliable and fraught with problems - whichever side of the pond you're on

from Concerns ignored as Home Office pushes ahead with facial recognition

Certutil for delivery of files

Quick post putting together some twitter awesomenessreferences:https://twitter.com/subtee/status/888125678872399873https://twitter.com/subTee/status/888071631528235010https://twitter.com/malwaretechblog/status/733651527827623936Let's do it1. Create you...

from Certutil for delivery of files

iOS 11 Allows Users to Disable Touch ID

A new feature in Apple's new iPhone operating system -- iOS 11 -- will allow users to quickly disable Touch ID. A new setting, designed to automate emergency services calls, lets iPhone users tap the power button quickly five times to call 911. This doesn't automatically dial the emergency services by default, but it brings up the option to and...

from iOS 11 Allows Users to Disable Touch ID

Sunday, August 20, 2017

SSD Advisory – Polycom Memory Disclosure

Vulnerability Summary The following advisory describe a Memory Disclosure vulnerability found in Polycom SoundPoint IP Telephone HTTPd server. Polycom is the leader in HD video conferencing, voice conferencing & telepresence enabling open, standards-based video collaboration. Increase the productivity of your phone calls and conference calls by making sure everyone can hear each other clearly and … Continue reading SSD Advisory – Polycom Memory Disclosure

from SSD Advisory – Polycom Memory Disclosure

Weekly Cyber Risk Roundup: Charlottesville Sparks Hacktivism and Controversy

The politics surrounding the “Unite the Right” rally and its counter-protests in Charlottesville spilled over into the cyber world this week as hacktivists took action against websites and a debate emerged around the ethics of hosting white nationalist websites as well as doxing individuals who attended the rally. Under the hashtag #OpDomesticTerrorism, hacktivists have urged… Read More

from Weekly Cyber Risk Roundup: Charlottesville Sparks Hacktivism and Controversy

Mike Nichols, Endgame – Enterprise Security Weekly #57

Mike Nichols, Director of Products at Endgame, joins us to discuss EDR, threat detection, and customer relations! Full Show NotesVisit http://securityweekly.com/esw for all the latest episodes!

The post Mike Nichols, Endgame – Enterprise Security Weekly #57 appeared first on Security Weekly.



from Mike Nichols, Endgame – Enterprise Security Weekly #57

Sonar-based attack could help hackers infer when you’re having sex

Hackers could use a sonar-based attack to infer information about what a target is doing, including when they might be engaging in sexual activity. David Bisson reports.

from Sonar-based attack could help hackers infer when you’re having sex

On ISO standardization of blockchains

So ISO, the primary international standards organization, is seeking to standardize blockchain technologies. On the surface, this seems a reasonable idea, creating a common standard that everyone can interoperate with.But it can be silly idea in practi...

from On ISO standardization of blockchains

On ISO standardization of blockchains

So ISO, the primary international standards organization, is seeking to standardize blockchain technologies. On the surface, this seems a reasonable idea, creating a common standard that everyone can interoperate with.But it can be silly idea in practi...

from On ISO standardization of blockchains

DEF CON 24, Robert Anderson’s ‘US Interrogation Techniques and Social Interrogation’

So ISO, the primary international standards organization, is seeking to standardize blockchain technologies. On the surface, this seems a reasonable idea, creating a common standard that everyone can interoperate with.But it can be silly idea in practi...

from DEF CON 24, Robert Anderson’s ‘US Interrogation Techniques and Social Interrogation’

DEF CON 24, Robert Anderson’s ‘US Interrogation Techniques and Social Interrogation’

So ISO, the primary international standards organization, is seeking to standardize blockchain technologies. On the surface, this seems a reasonable idea, creating a common standard that everyone can interoperate with.But it can be silly idea in practi...

from DEF CON 24, Robert Anderson’s ‘US Interrogation Techniques and Social Interrogation’

Enterprise News – Enterprise Security Weekly #57

Security in the public cloud, the pitfalls of formal education, advanced security for AWS, and more enterprise news! Enterprise News STIX and TAXII: Sharing cyber threat intelligence | LookingGlass – . STIX makes it possible to explicitly characterize a cyber adversary’s motivations, capabilities, and activities, and in doing so, determine how to best defend against them. uhh. really? […]

The post Enterprise News – Enterprise Security Weekly #57 appeared first on Security Weekly.



from Enterprise News – Enterprise Security Weekly #57

Saturday, August 19, 2017

SyncCrypt: Getting the Ransomware Picture?

Lawrence Abrams, for Bleeping Computer, describes how the SyncCrypt Ransomware Hides Inside JPG Files, Appends .KK Extension. The article describes ransomware discovered by EmsiSoft’s xXToffeeXx, distributed as spam attachments containing WSF (Windows Script File) objects. The WSF script pulls down images containing embedded Zip files. Abrams reports that the ‘WSF attachments are pretending to be court orders […]

from SyncCrypt: Getting the Ransomware Picture?

On Metrics: Responding to Failing Security Grades

Lawrence Abrams, for Bleeping Computer, describes how the SyncCrypt Ransomware Hides Inside JPG Files, Appends .KK Extension. The article describes ransomware discovered by EmsiSoft’s xXToffeeXx, distributed as spam attachments containing WSF (Windows Script File) objects. The WSF script pulls down images containing embedded Zip files. Abrams reports that the ‘WSF attachments are pretending to be court orders […]

from On Metrics: Responding to Failing Security Grades

Back to School Tips: The ABCs of Online Security

It’s time once again for backpacks, busses, and school bells. Here are a few good lessons to share with your kids so they can get through the school year with an A+ in online safety.



from Back to School Tips: The ABCs of Online Security

XKCD, Eclipse Science

Via the comic stylings of Randall Munroe at XKCD. Permalink

from XKCD, Eclipse Science

XKCD, Eclipse Science

Via the comic stylings of Randall Munroe at XKCD. Permalink

from XKCD, Eclipse Science

Friday Squid Blogging: Brittle Star Catches a Squid

Watch a brittle star catch a squid, and then lose it to another brittle star. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here....

from Friday Squid Blogging: Brittle Star Catches a Squid

Announcement: IPS code

So after 20 years, IBM is killing off my BlackICE code created in April 1998. So it's time that I rewrite it.BlackICE was the first "inline" intrusion-detection system, aka. an "intrusion prevention system" or IPS. ISS purchased my company in 2001 and ...

from Announcement: IPS code

More on My LinkedIn Account

I have successfully gotten the fake LinkedIn account in my name deleted. To prevent someone from doing this again, I signed up for LinkedIn. This is my first -- and only -- post on that account: My Only LinkedIn Post (Yes, Really) Welcome to my LinkedIn page. It looks empty because I'm never here. I don't log in, I never...

from More on My LinkedIn Account

USENIX Enigma 2017, Ian Haken’s ‘Secrets at Scale: Automated Bootstrapping of Secrets & Identity in the Cloud’

Permalink

from USENIX Enigma 2017, Ian Haken’s ‘Secrets at Scale: Automated Bootstrapping of Secrets & Identity in the Cloud’

USENIX Enigma 2017, Ian Haken’s ‘Secrets at Scale: Automated Bootstrapping of Secrets & Identity in the Cloud’

Permalink

from USENIX Enigma 2017, Ian Haken’s ‘Secrets at Scale: Automated Bootstrapping of Secrets & Identity in the Cloud’

Friday, August 18, 2017

Unfixable Automobile Computer Security Vulnerability

There is an unpatchable vulnerability that affects most modern cars. It's buried in the Controller Area Network (CAN):

Researchers say this flaw is not a vulnerability in the classic meaning of the word. This is because the flaw is more of a CAN standard design choice that makes it unpatchable.

Patching the issue means changing how the CAN standard works at its lowest levels. Researchers say car manufacturers can only mitigate the vulnerability via specific network countermeasures, but cannot eliminate it entirely.

Details on how the attack works are here:

The CAN messages, including errors, are called "frames." Our attack focuses on how CAN handles errors. Errors arise when a device reads values that do not correspond to the original expected value on a frame. When a device detects such an event, it writes an error message onto the CAN bus in order to "recall" the errant frame and notify the other devices to entirely ignore the recalled frame. This mishap is very common and is usually due to natural causes, a transient malfunction, or simply by too many systems and modules trying to send frames through the CAN at the same time.

If a device sends out too many errors, then­ -- as CAN standards dictate -- ­it goes into a so-called Bus Off state, where it is cut off from the CAN and prevented from reading and/or writing any data onto the CAN. This feature is helpful in isolating clearly malfunctioning devices and stops them from triggering the other modules/systems on the CAN.

This is the exact feature that our attack abuses. Our attack triggers this particular feature by inducing enough errors such that a targeted device or system on the CAN is made to go into the Bus Off state, and thus rendered inert/inoperable. This, in turn, can drastically affect the car's performance to the point that it becomes dangerous and even fatal, especially when essential systems like the airbag system or the antilock braking system are deactivated. All it takes is a specially-crafted attack device, introduced to the car's CAN through local access, and the reuse of frames already circulating in the CAN rather than injecting new ones (as previous attacks in this manner have done).

Slashdot thread.



from Unfixable Automobile Computer Security Vulnerability

Ransomware targeting WordPress sites

WordFence, which offers a security plugin for WordPress sites, reports on Ransomware Targeting WordPress – An Emerging Threat, claiming to have ‘captured several attempts to upload ransomware that provides an attacker with the ability to encrypt a WordPress website’s files and then extort money from the site owner.’ I hope the company won’t mind my quoting this […]

from Ransomware targeting WordPress sites

How likely is a ‘digital Pearl Harbor’ attack on critical infrastructure?

The metaphor might be hyperbole, but there's real concern about the potential for attacks, warn two experts

from How likely is a ‘digital Pearl Harbor’ attack on critical infrastructure?

The Key to Encryption: Simple for Government Leaders; Difficult for Attackers

Over the last few decades, the U.S. government created more than 100,000 custom digital applications. These apps continue to serve different purposes and live at different levels within the government — spanning teams, departments, organizations and even entire agencies. At a federal level, the government manages terabytes of both anonymized and personally identifiable information (PII). […]

The post The Key to Encryption: Simple for Government Leaders; Difficult for Attackers appeared first on HPE Security - Data Security.



from The Key to Encryption: Simple for Government Leaders; Difficult for Attackers

TMSADM user with Default Password: another risk in your SAP system

As our readers know, we continuously share details to raise awareness and enable organizations to further secure their SAP infrastructure. In this specific blog, we will focus on one of the well-known SAP default users: TMSADM. What the security implications are of having it enabled with default passwords, and how to properly protect it? As you can imagine, it is not as simple as it sounds, so that’s why we created this blogpost for you.

SAP Security, SAP TMSADMResearchDaniel Antonieli
08/18/2017


from TMSADM user with Default Password: another risk in your SAP system

Announcing the RSA Conference 2018 Theme: Now Matters

Although some of you may be recovering from our APJ event and others may be gearing up for this fall’s Abu Dhabi conference, we are already underway in our efforts to plan U.S. 2018. As many of our veteran attendees know, every year RSA Conference is built around a different theme, which highlights a significant aspect of information security. This year’s theme is “Now Matters.” There is an urgency and pressure being felt now more than at any time over the last few years. Whether you are looking at national or local politics or the pressures of your company’s board room – there has been a…

from Announcing the RSA Conference 2018 Theme: Now Matters

How to Navigate PCI DSS Requirements in the Contact Center – QSA Q&A with Bill Franklin QSA, CISA, CISSP, CISM, CGEIT of Coalfire

Navigating the Payment Card Industry Data Security Standard (DSS) requirements in the contact center can be daunting, but it can be much more manageable with the guidance of an outside expert. To help share some useful insights on PCI DSS compliance, we spoke with Bill Franklin, Director Payments at Coalfire, for the next installment of […]

The post How to Navigate PCI DSS Requirements in the Contact Center – QSA Q&A with Bill Franklin QSA, CISA, CISSP, CISM, CGEIT of Coalfire appeared first on Semafone.



from How to Navigate PCI DSS Requirements in the Contact Center – QSA Q&A with Bill Franklin QSA, CISA, CISSP, CISM, CGEIT of Coalfire

Inside the Kronos malware – part 1

The first part of this research looks at the tricks used by the Kronos banking malware.

Categories:

Tags:

(Read more...)

The post Inside the Kronos malware – part 1 appeared first on Malwarebytes Labs.



from Inside the Kronos malware – part 1

OWASP Top 10 #4: Broken Access Control

Recently, OWASP (the Open Web Application Security Project) announced an update of their “Ten Most Critical Web Application Security Risks.” OWASP is a nonprofit organization devoted to helping...

Go on to the site to read the full article

from OWASP Top 10 #4: Broken Access Control

Drone firm says it’s stepping up security after US army ban

DJI security patch should ease military fears - but throws up further issues for pilots

from Drone firm says it’s stepping up security after US army ban

Lenovo Posts Surprise Loss as PC Sales Crater, Costs Climb

Bloomberg
Lenovo lost its position as the world’s top PC maker as HP Inc. and Dell Inc. win back customers with new models.

read more



from Lenovo Posts Surprise Loss as PC Sales Crater, Costs Climb

Do the Police Need a Search Warrant to Access Cell Phone Location Data?

The US Supreme Court is deciding a case that will establish whether the police need a warrant to access cell phone location data. This week I signed on to an amicus brief from a wide array of security technologists outlining the technical arguments as why the answer should be yes. Susan Landau summarized our arguments.

A bunch of tech companies also submitted a brief.



from Do the Police Need a Search Warrant to Access Cell Phone Location Data?

Thursday, August 17, 2017

Google Begins Tracking Credit Card Activity

Wait... What? Google, Inc. (NasdaqGS: GOOG) has announced the company will commence tracking credit card purc...

from Google Begins Tracking Credit Card Activity

News in brief: new Bitcoin fork; HBO hacked; China cracks down

Your daily round-up of some of the other stories in the news

from News in brief: new Bitcoin fork; HBO hacked; China cracks down

Book Review: Understanding the Digital World: What You Need to Know about Computers, the Internet, Privacy, and Security

Anyone who has taken a computer science or programming class will likely know of Brian Kernighan. He had significant contributions to the development of Unix, and also wrote the AWK and AMPL programming languages. For the last 20 years, he’s been a professor of computer at Princeton University. He is the author of many technical books. When I got his latest book Understanding the Digital World: What You Need to Know about Computers, the Internet, Privacy, and Security (Princeton University Press 978-0691176543), I did a double-take at first, as this is more of an introductory text. …

from Book Review: Understanding the Digital World: What You Need to Know about Computers, the Internet, Privacy, and Security

Woman targeted with 120 images on public transport via AirDrop

Bluejacking is back, this time via Apple's AirDrop technology, allowing strangers to bombard women with 'dick pics'

from Woman targeted with 120 images on public transport via AirDrop

EAS-SEC. Oracle PeopleSoft Security Configuration. Part 6: Insecure settings

A typical PeopleSoft system is quite large and complex, so there are a lot of settings, which affect its security. Some of them we have already described. This part of the guideline is focused on specific insecure configurations, which can’t be tied to any other group. There are 4 important areas that should be covered; […]

The post EAS-SEC. Oracle PeopleSoft Security Configuration. Part 6: Insecure settings appeared first on ERPScan.



from EAS-SEC. Oracle PeopleSoft Security Configuration. Part 6: Insecure settings

Could Your Local Car Dealer, Bank or Doctor’s Office be Next?

What do local car dealers, hospitals and banks all have in common? At first glance, not much. However, all of them have become recent hacker targets. Why now when other, much larger corporate entities have traditionally been targets? One word – resources. Their resources, both network and personnel, are stretched thin. With the increased complexity and […]

The post Could Your Local Car Dealer, Bank or Doctor’s Office be Next? appeared first on Radware Blog.



from Could Your Local Car Dealer, Bank or Doctor’s Office be Next?

Vendor-neutral smart car bug has ‘dangerous’ and ‘even fatal’ consequences

"You could disable the air bags, the anti-lock brakes, or the door locks, and steal the car," says researcher. David Bisson reports.

from Vendor-neutral smart car bug has ‘dangerous’ and ‘even fatal’ consequences

Top 5 Strategies to Avoid Getting Hacked Online

While we are becoming increasingly more reliant on technology and storing our information online, this trend increases the quantity and desire of hackers to try and acquire your sensitive information... Go on to the site to read the full article

from Top 5 Strategies to Avoid Getting Hacked Online

Uber faces privacy audits every two years until 2037, rules FTC

Uber 'failed consumers in two key ways' says FTC after probe into catalogue of privacy concerns

from Uber faces privacy audits every two years until 2037, rules FTC

Infographic: Statistics About the Security State of 104 Open Source Web Applications

Every year we publish a number of statistics about the vulnerabilities which the Netsparker web application security scanner automatically identified in open source web applications. Netsparker is a heuristic web application security scanner, so all th...

from Infographic: Statistics About the Security State of 104 Open Source Web Applications

Wednesday, August 16, 2017

Wire, Barbed

The telecom of the 19th century North American West. via Kottke. In-built physical security, easy propagation...

from Wire, Barbed

Who will own the data from your autonomous car?

If you're hoping that Congress to lock in protection for your privacy, you should probably lower your expectations

from Who will own the data from your autonomous car?

Mobile data theft a risk from shared app libraries

Matthew Rose, ‎global director of application security strategy at Checkmarx, an application security software vendor headquartered in Israel, said there […]

The post Mobile data theft a risk from shared app libraries appeared first on Checkmarx.



from Mobile data theft a risk from shared app libraries

Cyber and Securities – Financial Institutions Attack Landscape

Recently Italian bank Unicredit suffered two security breaches. Data of 400,000 customers was stolen, including loan account numbers and Personally Identifiable Information (PII). There is a suspicion the breach had to do with interaction with a 3rd party. This incident is the latest reported in a long history of cyber-attacks against financial institutions. Every hack […]

The post Cyber and Securities – Financial Institutions Attack Landscape appeared first on Radware Blog.



from Cyber and Securities – Financial Institutions Attack Landscape

Bot armies of fake followers are the footsoldiers of fake news

Actual humans are left in the dust by the army of bots who pick up and amplify fake news - but how should they be stopped?

from Bot armies of fake followers are the footsoldiers of fake news

PHP Lab: Analyze the code and spot the vulnerability

Introduction and background: A penetration test has been conducted on the following URL, and a SQL Injection vulnerability was identified. http://192.168.56.101/webapps/sqli/sqli.php The developers... Go on to the site to read the full article

from PHP Lab: Analyze the code and spot the vulnerability

Preparedness & Cyber Risk Reduction Part Five C: Operations-Based Exercises

As we continue in our series on Preparedness, and concluding this mini-series on exercises, in the section that follows, we’ll look at different types of operations-based exercises as we continue to explore some of the ways our fictional character, Johnny, and his colleagues at Acme Innovations can take a progressively challenging approach to exercise design… Read More

from Preparedness & Cyber Risk Reduction Part Five C: Operations-Based Exercises

Scottish Parliament Targeted by Brute Force Attackers

Bad actors have targeted the Scottish Parliament with a brute force attack designed to crack weak passwords used by MSPs and staff. In a message sent to MSPs and staff members with parliamentary email addresses, chief executive Sir Paul Grice compared the attack to an assault that targeted the British Parliament in June. It’s unclear […]… Read More

The post Scottish Parliament Targeted by Brute Force Attackers appeared first on The State of Security.



from Scottish Parliament Targeted by Brute Force Attackers

Toronto woman leads the fight against creepshot image sites

There are tools that can help track down and take down stolen and creepshot images of women - but the challenge is a tough one

from Toronto woman leads the fight against creepshot image sites

ShadowPad: Backdoor in enterprise server software exposed

The NetSarang server software is used by hundreds of companies worldwide.

from ShadowPad: Backdoor in enterprise server software exposed

Tuesday, August 15, 2017

Hacking a Gene Sequencer by Encoding Malware in a DNA Strand

One of the common ways to hack a computer is to mess with its input data. That is, if you can feed the computer data that it interprets -- or misinterprets -- in a particular way, you can trick the computer into doing things that it wasn't intended to do. This is basically what a buffer overflow attack is: the data input overflows a buffer and ends up being executed by the computer process.

Well, some researchers did this with a computer that processes DNA, and they encoded their malware in the DNA strands themselves:

To make the malware, the team translated a simple computer command into a short stretch of 176 DNA letters, denoted as A, G, C, and T. After ordering copies of the DNA from a vendor for $89, they fed the strands to a sequencing machine, which read off the gene letters, storing them as binary digits, 0s and 1s.

Erlich says the attack took advantage of a spill-over effect, when data that exceeds a storage buffer can be interpreted as a computer command. In this case, the command contacted a server controlled by Kohno's team, from which they took control of a computer in their lab they were using to analyze the DNA file.

News articles. Research paper.



from Hacking a Gene Sequencer by Encoding Malware in a DNA Strand

XKCD, Computers vs Humans

Via the demiurgic grey matter of Randall Munroe at XKCD. Permalink

from XKCD, Computers vs Humans

C-Suite Priorities: Privacy or Profit?

Privacy or profit, that is the question. For C-suite executives around the world, striking a balance between safeguarding their organization’s data and meeting government regulations without adversely affecting day-to-day operations has always been a careful balancing act. In light of recent high-profile cyber-attacks in 2016 and 2017 and changing government policies regarding data privacy and […]

The post C-Suite Priorities: Privacy or Profit? appeared first on Radware Blog.



from C-Suite Priorities: Privacy or Profit?

Too many big online brands allow terrible passwords

Some of the biggest online names are the among the worst when it comes to password policies

from Too many big online brands allow terrible passwords

Microsoft Azure Adding Two Data Centers Down Under in Australia

Microsoft has now announced 42 Azure regions globally easily surpassing other cloud providers. read more

from Microsoft Azure Adding Two Data Centers Down Under in Australia

Privacy and Data Protection: A Priority, and now a Product

The threat to data is real. According to our 2017 Global Data Threat Report, 68 percent of respondents have experienced a breach in the past, with 26 percent experiencing a...

The post Privacy and Data Protection: A Priority, and now a Product appeared first on Data Security Blog | Thales e-Security.



from Privacy and Data Protection: A Priority, and now a Product

How shared Android libraries could be weaponized for data theft

When you're installing an Android app, pause before you approve one that asks for a lot of permissions - do you really need that app on your device?

from How shared Android libraries could be weaponized for data theft

Google Hires Former Star Apple Engineer for Its AI Team

Bloomberg
Chris Lattner, a legend in the world of Apple software, has joined another rival of the iPhone maker: Alphabet Inc.’s Google, where he will work on artificial intelligence.

read more



from Google Hires Former Star Apple Engineer for Its AI Team

Friendly neighborhood hacker helps family regain access to locked car

A benevolent hacker has helped a family regain access to their car after they misplaced its corresponding one-of-a-kind key. David Bisson reports.

from Friendly neighborhood hacker helps family regain access to locked car

Require Analytic Skills to Hire and Promote 

Unless your department is still in the early stages of your analytics journey, analytic skills should be one of your hiring and promotion criteria. In an earlier post I outlined 10 Signs Mgmt Doesn’t Really Support Analytics. One of the … Continue reading

from Require Analytic Skills to Hire and Promote 

How much HBO hackers have is hazy; what they want is clear – cash

'Mr Smith', apparently the HBO hackers' spokesman, is making extravagant claims and increasingly hostile demands

from How much HBO hackers have is hazy; what they want is clear – cash

Monday, August 14, 2017

Deoxyribonucleic Acid, Malware Edition

via the illustrative writing of John Timmer at ArsTechnica, we learn of the latest malware infect vector - en...

from Deoxyribonucleic Acid, Malware Edition

Ditching Textbooks and Teaching Cybersecurity Via News Headlines: Modern Times Call for Modern Measures

In a constantly changing field like cybersecurity, nothing stays the same for long. And as Jim Lewis, a senior VP at the Center for Strategic and International Studies, has learned first hand, this makes teaching about cybersecurity a challenge. Lewis this spring started teaching a section of a social engineering course to cybersecurity majors at the U.S. Naval Academy. Once it became apparent that the textbooks available to support the course were all several years old, Lewis opted to ditch the traditional approach and adopt a different source of reading materials: daily newspapers. And why…

from Ditching Textbooks and Teaching Cybersecurity Via News Headlines: Modern Times Call for Modern Measures

Resource: Automating Windows as a Service

This is one of the most comprehensive break downs of Windows as a Service I have ever come across and it should be on your reading list. read more

from Resource: Automating Windows as a Service

What do you see as the biggest security challenge your organization faces right now?

Phishing Attacks Patch Management Insider Threats Denial of Service Ransomware

from What do you see as the biggest security challenge your organization faces right now?

Those ‘stingray’ detector apps are basically useless, say researchers

Researchers found at least one major flaw in the five leading stingray surveillance trackers for Android.

from Those ‘stingray’ detector apps are basically useless, say researchers

Court records system has been open to hackers for decades

The easily exploitable and long-standing hole has finally been patched, said the Free Law Project, which set out a series of recommendations to improve the security of the system

from Court records system has been open to hackers for decades

Thousands of Android-spying apps in the wild: what to do about SonicSpy

Google has done a good job of removing infected apps from the Play store, but victims are being hit from other sources

from Thousands of Android-spying apps in the wild: what to do about SonicSpy

Ep. 096 – TKO Your Amygdala with Tim Larkin

In a society where we are on our cell phones and other devices non-stop, situational awareness is not something we hear too much about.  Our guest, Tim Larkin, talks about how important situational awareness is in staying safe. August 14, 2017 Contents Download Get Involved Download Ep. 096 – TKO Your Amygdala with Tim Larkin […]

The post Ep. 096 – TKO Your Amygdala with Tim Larkin appeared first on Security Through Education.



from Ep. 096 – TKO Your Amygdala with Tim Larkin

Gmail now warns iOS users about suspicious links, in fight against phishing threats

Gmail now warns iOS users about suspicious links, in fight against phishing threats

Stop! Should you really be clicking on that link you just received in your email?

Gmail’s iOS app is now offering some additional safety nets for the unwary.

Read more in my article on the We Live Security blog.



from Gmail now warns iOS users about suspicious links, in fight against phishing threats

Report: IT Leaders Feel Overwhelmed by Pace of Cloud Development

Eighty-one percent of IT leaders report to be either extremely concerned or very concerned about missing out on cloud advancements. read more

from Report: IT Leaders Feel Overwhelmed by Pace of Cloud Development

Sunday, August 13, 2017

2017 DerbyCon Hiring List

Created the 2017 UNOFFICIAL DerbyCon Hiring List. To get on the list is even easier now! Just complete the following form: https://goo.gl/forms/vyqVHjZkxE4WhA9X2 (One small tip, first come first serve, so if you want to be on the top of the list it&rsq...

from 2017 DerbyCon Hiring List

Over a thousand spyware-infected Android apps discovered

A family of Android spyware has infected more than 1,000 apps, including some which infiltrated Google's Play Store. David Bisson reports.

from Over a thousand spyware-infected Android apps discovered

On Metrics: Responding to Failing Security Grades

A family of Android spyware has infected more than 1,000 apps, including some which infiltrated Google's Play Store. David Bisson reports.

from On Metrics: Responding to Failing Security Grades

R⁶ — Exploring macOS Applications with codesign, Gatekeeper & R

(General reminder abt “R⁶” posts in that they are heavy on code-examples, minimal on expository. I try to design them with 2-3 “nuggets” embedded for those who take the time to walk through the code examples on their systems. I’ll always provide further expository if requested in a comment, so don’t hesitate to ask if... Continue reading

from R⁶ — Exploring macOS Applications with codesign, Gatekeeper & R