Monday, August 22, 2016

Cyber Security News of the Week, August 21, 2016


CYBERSECURITY NEWS

FROM OUR FRIENDS AT CITADEL INFORMATION GROUP


Individuals at Risk

Identity Theft

SocialSecurity Admin backtracks on txt msg requirement for e-acct: The U.S. Social Security Administration says it is reversing a newly enacted policy that required a cell phone number from all Americans who wished to manage their retirement benefits at ssa.gov. The move comes after a policy rollout marred by technical difficulties and criticism that the new requirement did little to prevent identity thieves from siphoning benefits from Americans who hadn’t yet created accounts at ssa.gov for themselves. KrebsOnSecurity, August 16, 2016

Cyber Danger

Hackers Trick Facial-Recognition Logins With Photos From Facebook (What Else?): FACIAL RECOGNITION MAKES sense as a method for your computer to recognize you. After all, humans already use a powerful version of it to tell each other apart. But people can be fooled (disguises! twins!), so it’s no surprise that even as computer vision evolves, new attacks will trick facial recognition systems, too. Now researchers have demonstrated a particularly disturbing new method of stealing a face: one that’s based on 3-D rendering and some light Internet stalking. Wired, August 19, 2016
WikiLeaks hosts hundreds of malware files in email dumps: WikiLeaks is reportedly hosting over 300 malware samples among the website’s cache of leaked emails. ZDNet, August 19, 2016

Information Security Management in the Organization

Information Security Governance

Can Cloud Security Decrease Breach Containment Costs?: Are cloud security tools worth the investment? Determining if any security tool is worth the cost can be tough because proving return on security investments isn’t easy. While time-saving efficiencies, such as single sign-on tools, are relatively simple to quantify, it is far more challenging to calculate the amount of money saved by a preventative measure. SecurityIntellegence, August 18, 2016
Security Staff Shortages Incur Higher Breach Recovery Costs: The shortage of skilled IT security professionals is not a new topic. Multiple reports have shed light on the talent shortage and the type of security risks associated with an IT department that is short on security skills. But a report released this week by Kaspersky Lab and partner B2B International shows the potential financial impact of being short-staffed in the security department. DarkReading, August 18, 2016

Cyber Warning

Malwarebytes Researcher Finds New Scam Mac Malware: Although the Mac platform might once have been touted as one that’s devoid of all viruses and malware, that’s certainly not the case any more. While it never was 100 percent true, today Mac users face many more threats than they once did, and a new one doing the rounds is looking to trick you into installing Advanced Mac Cleaner. DigiTrends, August 19, 2016
Retooled Locky Ransomware Pummels Healthcare Sector: Cybercriminals wielding Locky crypto-locking ransomware are continuing to ramp up their assaults, especially in the healthcare sector, with attackers distributing less banking malware and more ransomware, according to new research. BankInfoSecurity, August 18, 2016
3 Takeaways From The HEI Hotels And Oracle MICROS Breaches: The recent data breach at HEI Hotels & Resorts and reports of malicious intrusions at Oracle MICROS and several other point-of-sale system makers are another reminder of the fragility of the US payment system to cyberattacks. DarkReading, August 16, 2016
Visa Alert and Update on the Oracle Breach: Credit card industry giant Visa on Friday issued a security alert warning companies using point-of-sale devices made by Oracle‘s MICROS retail unit to double-check the machines for malicious software or unusual network activity, and to change passwords on the devices. Visa also published a list of Internet addresses that may have been involved in the Oracle breach and are thought to be closely tied to an Eastern European organized cybercrime gang. KrebsOnSecurity, August 13, 2016
IRS Warns Tax Pros On Targeted Scams, Advises Regular PTIN Monitoring: We already know that tax professionals aren’t immune from those Internal Revenue Service (IRS) scams. Now, IRS is alerting tax professionals that they are a specific target in a new kind of phishing email scam. Forbes, August 12, 2016

Cyber Defense

Attacker’s Playbook Top 5 Is High On Passwords, Low On Malware: Report: Penetration testers’ five most reliable methods of compromising targets include four different ways to use stolen credentials, but zero ways to exploit software. DarkReading, August 18, 2016
NIST’s new password rules – what you need to know: It’s no secret. We’re really bad at passwords. Nevertheless, they aren’t going away any time soon. NakedSecurity, August 18, 2016
5 Strategies For Enhancing Targeted Security Monitoring: Crime scenes — in both the physical and digital sense — exist where investigators must work quickly to gather and process evidence before it is no longer available or has been modified. In both cases, investigators set up a large perimeter around the crime scene and work to narrow it down by establishing credible, evidence-based conclusions. DarkReading, August 18, 2016

Information Security Professional

UNSECURED DNSSEC EASILY WEAPONIZED, RESEARCHERS WARN: Researchers this week described how a DNSSEC-based flood attack could easily knock a website offline and allow for the insertion of malware or exfiltration of sensitive data. Threatpost, August 18, 2016
How do you securely exchange encrypted-decrypted-recrypted data? Ask Microsoft: Microsoft researchers are working to enable secure data exchange in the cloud for applications. TheRegister, August 12, 2016

Cyber Security in Society

Cyber Privacy

Russian sports doping whistleblower fears for safety after hack: Former Russian runner turned whistleblower in-hiding Yuliya Stepanova has had her World Anti-Doping Agency (WADA) account hacked, possibly revealing her physical location to attackers. TheRegister, August 15, 2016

Cyber Crime

Sage employee arrested at airport following data breach: A Sage employee has been arrested following a data breach which may have exposed information belonging to hundreds of business customers. ZDNet, August 18, 2016
Malware Infected All Eddie Bauer Stores in U.S., Canada: Clothing store chain Eddie Bauer said today it has detected and removed malicious software from point-of-sale systems at all of its 350+ stores in North America, and that credit and debit cards used at those stores during the first six months of 2016 may have been compromised in the breach. The acknowledgement comes nearly six weeks after KrebsOnSecurity first notified the clothier about a possible intrusion at stores nationwide. KrebsOnSecurity, August 18, 2016

Cyber Attack

Cybersecurity firm FireEye reportedly probing Clinton Foundation cyberattack by DNC hackers: The Clinton Foundation, a multi-million dollar charity group that receives hefty donations from governments, corporations and wealthy elites, has reportedly hired a top cybersecurity firm to investigate its computer systems amid mounting fears it was targeted by hackers. IBTimes, August 18, 2016
Massive Email Bombs Target .Gov Addresses: Over the weekend, unknown assailants launched a massive cyber attack aimed at flooding targeted dot-gov (.gov) email inboxes with subscription requests to thousands of email lists. According to experts, the attack — designed to render the targeted inboxes useless for a period of time — was successful largely thanks to the staggering number of email newsletters that don’t take the basic step of validating new signup requests. KrebsOnSecurity, August 18, 2016

National Cyber Security

Confirmed: Leaked Equation Group Hacking Tools Are Real: The release of spying code authored by one of the most sophisticated hacking groups in the world has prompted questions about whether Russia may be taunting the United States in an unprecedented, public cyber stunt. BankInfoSecuriy, August 18, 2016
Cisco And Fortinet Confirm Flaws Exposed By Self-Proclaimed NSA Hackers: American firewall providers Cisco and Fortinet have issued warnings and fixes for bugs exposed by the Shadow Brokers, who claimed this weekend to have breached the Equation Group, believed to be an NSA operation. Forbes, August 17, 2016
NSA’s use of sw flaws to hack foreign targets posed cybersecurity risks : To penetrate the computers of foreign targets, the National Security Agency relies on software flaws that have gone undetected in the pipes of the Internet. For years, security experts have pressed the agency to disclose these bugs so they can be fixed, but the agency hackers have often been reluctant. The Washington Post, August 17, 2016
Confirmed: hacking tool leak came from “omnipotent” NSA-tied group: The leak over the weekend of advanced hacking tools contains digital signatures that are almost identical to those in software used by the state-sponsored Equation Group, according to a just-published report from security firm Kaspersky Lab. ars technica, August 16, 2016
‘Shadow Brokers’ Leak Raises Alarming Question: Was the N.S.A. Hacked?: The release on websites this week of what appears to be top-secret computer code that the National Security Agency has used to break into the networks of foreign governments and other espionage targets has caused deep concern inside American intelligence agencies, raising the question of whether America’s own elite operatives have been hacked and their methods revealed. The New York Times, August 16, 2016
Powerful NSA hacking tools have been revealed online: Some of the most powerful espionage tools created by the National Security Agency’s elite group of hackers have been revealed in recent days, a development that could pose severe consequences for the spy agency’s operations and the security of government and corporate computers. The Washington Post, August 16, 2016

Cyber Politics

Experts compare Trump’s and Clinton’s cybersecurity policies: Cybersecurity is now a top national security problem — some officials even call it a bigger threat than terrorism. But both major presidential candidates have hit hurdles on the campaign trail that raised questions about how they would try to keep U.S. computers safe if elected. The Washington Post, August 17, 2016
Suspected Russian DNC hackers also hit GOP, researchers say: Hackers linked to Russian intelligence services may have targeted some prominent Republican lawmakers, in addition to their well-publicized spying on Democrats, based on research into leaked emails published on a little-noticed website. Politico, August 13, 2016
The Election Won’t Be Rigged. But It Could Be Hacked: In my old workplace, right next to the comfortable couches where we would take breaks, we kept a voting machine. Instead of using the screen to pick our preferred candidate, we played Pac-Man. We sent Pac-Man’s familiar yellow chomping face after digital ghosts with the same kind of machine that had been used in 2008 in more than 160 jurisdictions with about nine million registered voters. The New York Times, August 12, 2016

Financial Cyber Security

Banking system SWIFT was anything but on security, ex-boss claims: You’d think, with the amount of money the SWIFT inter-bank payment system transfers every day, that the group would be strong on security. Not so, says a former head of the organization. TheRegister, August 18, 2016
New FFIEC Mobile Financial Services Guidelines Services Put a Stake in the Ground: According to data from IDC, the worldwide smartphone market is in excess of 2 billion units. By 2017, the smartphone market share will reach 70.5 percent, up more than 10 percent compared to 2013. SecurityIntellegence, August 17, 2016
Wall Street’s Biggest Banks Are Banding Together Against Cybercrime: A team of eight banks, including J.P. Morgan, Goldman Sachs, and Bank of America, are reportedly forming a team to tackle the growing threat of cybersecurity. The group, currently in its early stages, will trade information about digital threats and potentially play out model hacking scenarios, the Wall Street Journal reported. Fortune, August 10, 2016

Critical Infrastructure

Feds to share supply chain threat reports with industry: The U.S. National Counterintelligence and Security Center will soon provide classified supply chain threat reports to critical U.S. telecommunications, energy and financial businesses. ComputerWorld, August 15, 2016

Internet of Things

Vulnerable smart home IoT sockets let hackers access your email account: Researchers have discovered critical security flaws in connected smart plugs which can give attackers access to a full home network — as well as your email account. ZDNet, August 18, 2016

Jeff Snyder’s, SecurityRecruiter.comJeff Snyder CoachingSecurity Recruiter Blog, 719.686.8810



SecurityRecruiter.com's Security Recruiter Blog