Sunday, April 16, 2017

Cyber Security News of the Week, April 16, 2017


CYBERSECURITY NEWS

FROM OUR FRIENDS AT CITADEL INFORMATION GROUP


Individuals at Risk

Identity Theft

9 Ways To Protect Your Aging Parent From Identity Theft: When Peter’s father became too infirm to live independently, Peter took on the job of moving him into an assisted living facility. Using his power of attorney, Peter then began to dig into his father’s financial records. What he found shocked him. His father had become an unsuspecting victim of identity theft. Forbes, April 14, 2017
Your Electronic Medical Records Could Be Worth $1000 To Hackers. Your Social? About a dime: How much is your life worth to hackers? On the black market, the going rate for your social security number is 10 cents. Your credit card number is worth 25 cents. But your electronic medical health record (EHR) could be worth hundreds or even thousands of dollars. FOrbes, April 14, 2017

Cyber Privacy

Think About It: Messenger’s Live Location, and Other Privacy Issues on Facebook: The recent announcement of the new location sharing functionality within Facebook Messenger has spurred controversy regarding potential impacts on consumer privacy and security. Announced on March 27th, the new “Live Location” Facebook Messenger feature allows users to share near-real-time updates of their whereabouts with selected message recipients, for up to 60 minutes at a time. ITSP Magazine, April 13, 2017
How to Protect Your Privacy From Your Internet Service Provider:  We pay our monthly Internet bill to be able to access the Internet. We don’t pay it to give our Internet service provider (ISP) a chance to collect and sell our private data to make more money. This was apparently lost on congressional Republicans as they voted to strip their constituents of their privacy. Even though our elected representatives have failed us, there are technical measures we can take to protect our privacy from ISPs. Electronic Frontier Foundation, April 3, 2017

Cyber Warning

Consumers Targeted for Ransomware as Nearly 40% Pay Up: Ransomware is targeting more consumers, and many of them are paying hundreds to attackers. DarkReading, April 14, 2017
Running Old Windows on New Processor? Don’t Expect Security Updates as Microsoft Won’t Install Them: We knew Microsoft was planning to block installation of Windows 7 and 8.1 updates on systems with Intel 7th Generation Core processors (more memorably known as Kaby Lake) and AMD Ryzen systems; we just weren’t sure when. Now, the answer appears to be “this month.” Users of new processors running old versions of Windows are reporting that their updates are being blocked. The block means that systems using these processors are no longer receiving security updates. ars technica, April 13, 2017

Cyber Update

Critical Security Updates from Adobe, Microsoft: Adobe and Microsoft separately issued updates on Tuesday to fix a slew of security flaws in their products. Adobe patched dozens of holes in its Flash Player, Acrobat and Reader products. Microsoft pushed fixes to address dozens of vulnerabilities in Windows and related software. KrebsOnSecurity, April 12, 2017
Microsoft fixes ‘critical’ Office Word security flaw under active attack: Researchers have seen the exploit being used in a large-scale email campaign to distribute the Dridex malware. ZDNet, April 11, 2017

Cyber Defense

GOOGLE MAKING LIFE DIFFICULT FOR RANSOMWARE TO THRIVE ON ANDROID: SINT MAARTEN—Google has never been shy about sharing security enhancements and victories in Android. The mobile operating system is tweaked at every iteration to fend off threats posed by potentially harmful apps and attacks against devices. ThreatPost, April 14, 2017

Information Security Management in the Organization

Information Security Management and Governance

Report claims investors lost £42billion in market value due to cyber breaches in past year: Following the news that investors have lost £42billion due to cyber breaches in the past year. Raj Samani, Chief Scientist at McAfee commented below. InformationSecurityBuzz, April 15, 2017

Cyber Awareness

Why businesses should care about identity theft: Identity theft is a type of fraud that’s directed squarely against individuals, but to believe that businesses don’t suffer any consequences or costs associated with it is simply wrong. HelpNetSecurity, April 14, 2017
Social Engineering | SANS Security Awareness Newsletter: A common misconception most people have about cyber attackers is that they use only highly advanced tools and techniques to hack into people’s computers or accounts. This is simply not true. Cyber attackers have learned that often the easiest way to steal your information, hack your accounts, or infect your systems is by simply tricking you into making a mistake. In this newsletter, you will learn how these attacks, called social engineering, work and what you can do to protect yourself. SANS, January 2017

Cyber Defense

Finding and Fixing Cybersecurity Vulnerabilities as Basic as Blocking and Tackling: When I was a CTO running a data center, I used to ask my ops team to do the shotgun test. They had to imagine our worst enemy came into the data center with a shotgun with one slug. What could they destroy to do the most damage? (I didn’t realize until recently that this was a modified version of Netflix’s Chaos Monkey testing approach.) Forbes, April 14, 2017
Swimming in Security Data Without Drowning: How much information do you need to manage your security? Until recently, the answer was always “more.” That is changing as the sheer volume of available data grows. SecurityIntelligence, April 14, 2017

Cyber Security in Society

Cyber Crime

Hackers Take Control of Airbnb Accounts. Hosts Robbed. Guests Defrauded. Airbnb Fighting Back: Airbnb says that its rating and review system builds trust between people and accomplishes the impossible — convincing people to let complete strangers sleep in their homes. BuzzFeed, April 14, 2017
Shoney’s Hit By Apparent Credit Card Breach: It’s Friday, which means it’s time for another episode of “Which Restaurant Chain Got Hacked?” Multiple sources in the financial industry say they’ve traced a pattern of fraud on customer cards indicating that the latest victim may be Shoney’s, a 70-year-old restaurant chain that operates primarily in the southern United States. KrebsOnSecurity, April 14, 2017

Know Your Enemy

Malware crooks and nation-sponsored hackers used same Microsoft Word 0-day exploit. Strange bedfellows?: A critical Microsoft Word zero-day that was actively exploited for months connected two strange bedfellows, including government-sponsored hackers spying on Russian targets and financially motivated crooks pushing crimeware. ars technica, April 12, 2017
Hot on the Credential Theft Trail: Tracking a Hacker from a Dropbox Phishing Campaign: We (the Imperva Defense Center research team) frequently investigate cases of credential theft to gain a deeper understanding of methods and tools used by cyber criminals—in particular, to learn how accounts are taken over once credentials are compromised through phishing campaigns. We recently chose to deep dive into a specific phishing attack and the person behind it. Along the way, we may have discovered a new meaning to the term, ‘Nigerian prince’ (those notorious advance-fee scams of the 90s). You’ll see what we mean as the story unfolds. Here’s how we tracked down one bad-news hacker. Imperva, April 11, 2017

National Cyber Security

Major Leak Suggests NSA Was Deep in Middle East Banking System: FOR EIGHT MONTHS, the hacker group known as Shadow Brokers has trickled out an intermittent drip of highly classified NSA data. Now, just when it seemed like that trove of secrets might be exhausted, the group has spilled a new batch. The latest dump appears to show that the NSA has penetrated deep into the finance infrastructure of the Middle East—a revelation that could create new scandals for the world’s most well-resourced spy agency. Wired, April 14, 2017
To win the cybersecurity war, we need to teach our kids cybersecurity: If you ask kids right now what they want to be when they grow up, you probably won’t hear “hacker.” But hackers are absolutely essential to protecting cyberspace from computer criminals. We need to teach kids how to hack. TheHill, April 13, 2017
Microsoft: Foreign Surveillance Requests Under FISA Up Sharply in 2016. Highest Since 2011: Microsoft Corp (MSFT.O) said on Thursday it had received at least a thousand surveillance requests from the U.S. government that sought user content for foreign intelligence purposes during the first half of 2016. Reuters, April 13, 2017
Wikileaks releases a how to hack Windows guide from CIA dump: As a continuing part of its Vault7 series of leaked documents, the leaks site Wikileaks has released a new cache of 27 documents allegedly belonging to the US Intelligence agency the CIA. TechWorm, April 11, 2017
Stewart Baker with Nick Weaver, Berkeley’s Int’l Computer Science Institute: Our guest interview is with Nick Weaver, of Berkeley’s International Computer Science Institute. It covers the latest dumps of hacker tools, the vulnerability equities process, the so-bad-you-want-to-cover-your-eyes story of Juniper and the Dual_EC hacks, and ends with a tour of recent computer security disasters, from the capture of a bank’s entire online presence, to the pwning of Dallas’s emergency sirens, and a successful campaign to compromise the outsourcing firms that supply IT to small and medium sized businesses. Steptoe Cyberblog, April 11, 2017
Russian News Falsely Links Arrested Spammer Pyotr Levashov to Russian Meddling in U.S. Election: Over the past several days, many Western news media outlets have predictably devoured thinly-sourced reporting from a Russian publication that the arrest last week of a Russian spam kingpin in Spain was related to hacking attacks linked to last year’s U.S. election. While there is scant evidence that the spammer’s arrest had anything to do with the election, the success of that narrative is a sterling example of how the Kremlin’s propaganda machine is adept at manufacturing fake news, undermining public trust in the media, and distracting attention away from the real story. KrebsOnSecurity, April 11, 2017
DHS head: North Korea more of a cyber threat: Homeland Security Secretary John Kelly said he’s more concerned about North Korea launching a cyber attack on the U.S. than any direct military action. TheHill, April 4, 2017

Critical Infrastructure

Smart cities can be vulnerable: That Dallas emergency siren hack is a warning of things to come: Though relatively benign, a recent hack of a major city’s safety infrastructure should give mayors reason to worry. Salon, April 14, 2017

Cyber Law

New Mexico Data Breach Legislation Passes: New Mexico recently became the 48th state to pass some form of data breach notification legislation, leaving Alabama and South Dakota as the lone holdouts. The Data Breach Notification Act was signed by New Mexico Governor Susana Martinez on April 6, 2017. The law applies to persons that own or license personal identifying information of New Mexico residents, defined as an individual’s first name or first initial and last name in combination with a social security number, driver’s license number, government-issued ID number, account number plus security or access code or password, or biometric data. The statute is triggered by a security breach, defined as the unauthorized acquisition of data that compromises the security, confidentiality, or integrity of personal identifying information. Importantly, the statute contains a full exemption for entities “subject to” the Gramm-Leach-Bliley Act or HIPAA. Alston&Bird, April 11, 2017

Financial Cyber Security

How Hackers Hijacked a Bank’s Entire Online Operation: THE TRADITIONAL MODEL of hacking a bank isn’t so different from the old-fashioned method of robbing one. Thieves get in, get the goods, and get out. But one enterprising group of hackers targeting a Brazilian bank seems to have taken a more comprehensive and devious approach: One weekend afternoon, they rerouted all of the bank’s online customers to perfectly reconstructed fakes of the bank’s properties, where the marks obediently handed over their account information. Wired, April 4, 2017

Internet of Things

STORIES FROM TWO YEARS IN AN IOT HONEYPOT: SINT MAARTEN—Curious just how susceptible some of the more vulnerable IoT devices are, a researcher set up a series of honeypots at his friends’ houses to record traffic, exploit attempts and other statistics. ThreatPost, April 14, 2017

Cyber Enforcement

LA County Deputy DA Maria Ramirez on Investigating Business eMail Compromise and Ransomware: When she first joined the Los Angeles County district attorney’s office, Maria Ramirez prosecuted street gangs. Now she’s cracking down on cyber gangs and is opening her case file to share lessons learned from cases involving business email compromise and ransomware. BankInfoSecurity, April 13, 2017

Cyber Sunshine

U.S. Accuses Russian Email Spammer Pyotr Levashov of Vast Network of Fraud: Several years ago, federal agents traveled to Moscow to enlist the help of their Russian counterparts in arresting one of the world’s most pernicious email spammers. They were rebuffed, a former American law enforcement official who was there said. The spammer, who used the pseudonym Peter Severa, was protected, probably by the Russian government, and could not be touched. The New York Times, April 10, 2017
Alleged Spam King Pyotr Levashov Arrested: Authorities in Spain have arrested a Russian computer programmer thought to be one of the world’s most notorious spam kingpins. KrebsOnSecurity, April 10, 2017

Secure the Village

North Hollywood High team wins national cybersecurity competition!!!! CONGRATULATIONS!!!!! Russians and Chinese hackers beware. Americans, breathe a sigh of relief. Students from North Hollywood High have got your back. LA Times, April 8, 2017

Fake News

Google joins the efforts to halt the spread of fake news: Earlier this week, Google rolled out a new tool to help users around the globe differentiate between real and fake news. Tested on news stories in a handful of countries over recent months, the “Fact Check” tag adds additional information to some of the technology giant’s search and news results. NakedSecurity, April 13, 2017

Jeff Snyder’s, SecurityRecruiter.com, Jeff Snyder CoachingSecurity Recruiter Blog, 719.686.8810



SecurityRecruiter.com's Security Recruiter Blog