You are here
Home > Posts tagged "Dark Reading"

Microsoft Downplays Scope of Email Attack

I subscribe to HackNotice and got an alert about this hack. I've seen conflicting reports about the severity of the breach so keep your eyes peeled if you have a 'public' email service with MS i.e. hotmail, [...] Microsoft on Monday maintained that an incident reported over the weekend about an unknown attacker using a customer support agent's credentials to access email content belonging to users of MSN, Outlook, and Hotmail accounts, affected only a limit

New Details Emerge on Windows Zero Day

Make sure you're patched. These vulnerabilities are being actively exploited...: [...] Kaspersky Lab found CVE-2019-0859 last month when their automatic exploit prevention systems detected an attempt to abuse a Windows vulnerability. Further analysis revealed a zero-day bug in win32k.sys – the fifth exploited local privilege escalation vulnerability in Windows they had discovered since October. They reported the bug to Microsoft on March 17; it was patched along with 73 othe

Guilty Plea in Senate Data Theft

It doesn't take a nation-state with limitless resources, just a disgruntled employee...: Jackson Cosko, a former Senate staff member, has pled guilty to five federal crimes: two counts of making public restricted personal information, one count of computer fraud, one count of witness tampering, and one count of obstruction of justice. According to evidence, federal authorities were alerted to the data theft when the Wikipedia pages of three US senators were edited to incl...

Privacy & Regulatory Considerations in Enterprise Blockchain

I've been an advisor for a few blockchain-based startups. My first question is usually "Does it really need to be on a blockchain?" followed by "What information will be on the chain vs. what do you hold off-chain?". This article details why you need to think about privacy and regulatory risk alongside cyber risk when developing your blockchain apps...: People who understand information governance, privacy, and security should be active participants on the distributed ledger

Major Mobile Financial Apps Harbor Built-in Vulnerabilities

This comes down to "Who do you trust?". I'm unlikely to attempt to reverse engineer every app that I use so I have to put some level of trust in the company that provides it and the location where it's installed from. We've already seen that bad stuff can get into the 'official' app stores, especially Google Play, I'd like to think that the major financial institutions take care with their apps, but that's evidently not the case. I should theoretically reduce my exposure by l

ShadowHammer Dangers Include Update Avoidance

If the upshot of supply chain attacks is that people and organisations don't update, that's very serious...: [...] In a security environment that often brings the requirement for rapid software and firmware updates to deal with zero-day or rapidly evolving threats, a breach in trust may be the most damaging of ShadowHammer's effects. "This can result in end-user skepticism about applying software updates, which often contain critical security updates that, if left unpatched,

Nuanced Approach Needed to Deal With Huawei 5G Security Concerns

In this long running saga the UK idea of establishing an oversight body for strategic vendors has been picked up on by NATO...: [...] The UK's Huawei Cyber Security Evaluation Centre (HCSEC) is the best example of how effective such an oversight body can be in addressing security and intelligence concerns tied to the use of Huawei's technologies, CCDCOE says. HCSEC is controlled by the UK's National Cyber Security Center and, since 2010, has played a fundamental role in a

New Android Trojan Targets 100+ Banking Apps

If you need reminding of the importance of only installing apps from trustworthy sources (though this can lead to trouble as well). the best advice is to only install stuff you really need...: [...] Rustam Mirkasymov, head of dynamic analysis of the malware department at Group-IB, says Gustuff infects Android smartphones via SMS messages containing a link to a malicious Android Package Kit (APK) file. The APK file format is what Android uses to distribute and install mobile

New Shodan Tool Warns Organizations of Their Internet-Exposed Devices

Worth $49 of anyone's money...: [...] Matherly says setting up Shodan Monitor – which is free to all paying Shodan members – takes less than a minute, and Shodan sends an email when it finds an exposed device. It monitors up to 16 IPs for Shodan members (who pay $49 to join) and 300,000 IPs for Shodan Corporate API members. He says many of the existing services and products that offer this type of monitoring are pricey and overly complex, with an overload of dashboard data a

Insurers Collaborate on Cybersecurity Ratings

It's a start but no substitute for a thorough assessment of how threats translate into risk, what security controls are put in place; and their effectiveness. Just buying the newest shiny techno-toy doesn't make your business secure...: According to The Wall Street Journal, Marsh & McLennan, a professional services company specializing in risk and insurance, will evaluate enterprise cybersecurity technology in a program called "Cyber Catalyst." The article states, "Marsh