Individuals at Risk
Cyber Privacy
Data firm leaks 48 million user profiles it scraped from Facebook, LinkedIn, others> Exclusive: Profile data was scraped without user consent or knowledge to “build a three-dimensional picture” on millions of people. ZDNet, April 18, 2018
Facebook: We’re not the only ones collecting your data across the web: The embattled social media site explains its collection of data from people who aren’t logged in — while pointing out other popular sites do the same. ZDNet, April 16, 2018
More Than Half of Android Apps for Kids Are Violating US Privacy Laws: Privacy experts have analyzed 5,855 child-directed Android apps and have found that more than half —57%— are potentially violating the Children’s Online Privacy Protection Act (COPPA), a US law protecting children’s private data online. BleepingComputer, April 16, 2018
Cyber Defense
Chrome anti-phishing protection… from Microsoft!: Microsoft has made its SmartScreen anti-phishing API available to Chrome browser users through an extension called Windows Defender Browser. Naked Security, April 20, 2018
LinkedIn fixes bug in AutoFill that could leak personal data to third parties and attackers: LinkedIn’s AutoFill button is supposed to only work on approved websites, but any website could have tricked users into providing personal data with just one click anywhere on their screen. TechRepublic, April 20, 2018
Google Makes Safe Browsing Enabled by Default in Android Apps: Google has announced that all Android apps featuring WebView would come with Safe Browsing enabled by default to provide additional protection to users. Softpedia News, April 19, 2018
U.S.-U.K. Warning on Cyberattacks Includes Private Homes: LONDON — The United States and Britain on Monday issued a first-of-its-kind joint warning about Russian cyberattacks against government and private organizations as well as individual homes and offices in both countries, a milestone in the escalating use of cyberweaponry between major powers. The New York Times, April 16, 2018
Cyber Warning
Malware That Can Format Hard Drives Infects 50,000 Minecraft Accounts: Approximately 50,000 Minecraft accounts have been infected with malware that can format users’ hard drives, delete backup data, and remove system applications, according to a research from security vendor Avast. Softpedia News, April 19, 2018
Cryptominer Malware Threats Overtake Ransomware, Report Warns: SAN FRANCISCO – Cryptomining malware is the top threat to watch out for this year, according to a new report – with attacks jumping higher than ransomware instances in the first quarter of 2018. ThreatPost, April 18, 2018
iOS Trustjacking Attack Exposes iPhones to Remote Hacking. Attack exploits flaw in “iTunes Wi-Fi sync” feature: Symantec researchers have found a loophole in how iPhone users pair devices with Mac workstations and laptops. They say attackers can exploit this flaw —which they named Trustjacking— to take over devices without the phone owner’s knowledge. BleepingComputer, April 18, 2018
Information Security Management in the Organization
Cyber Defense
Survey says: Many breaches accomplished in less than an hour: Penetration testers and hackers are having little problem breaching the perimeter and quickly locating critical data with 12 percent saying they can get into a system in less than an hour and despite learning their company is vulnerable some firms still opt to do nothing to improve security. SC Magazine, April 13, 2018
Cyber Leadership
As Cyber Risk Escalates, the C-Suite Must Take Action. So far, 2018 has started out to be a very good year for cybercriminals: So far, 2018 has started out to be a very good year for cybercriminals. In the first week of April alone, restaurant chains and large department stores, some of America’s major retailers, disclosed significant data breaches. A multitude of government and healthcare organizations around the world have also been breached in the short three-and-a-half months of this year. SecurityIntelligence, April 19, 2018
Cybersecurity And The Board’s Responsibilities — ‘What’s Reasonable Has Changed’: Michael Yaeger focuses his practice on white collar criminal defense and investigations, securities enforcement, internal investigations, accounting fraud, cybercrime/cybersecurity and data security matters, as well as related civil litigation. Yaeger also leads internal investigation and cybercrime-related representations for financial services companies and provides guidance on drafting written information security plans and incident response plans for investment advisers. Forbes, April 18, 2018
Cyber Talent
Women in Security: Perspectives on Inclusion, Issues and Progress From the RSA Conference 2018: The RSA Conference (RSAC) 2018 in San Francisco isn’t just ground zero for 45,000 security professionals and the site of an impressive glass-walled security operations center (SOC). It also served as a forum for several crucial industry conversations about women in security. SecurityIntelligence, April 20, 2018
Cybersecurity in Society
Cyber Crime
Gold Galleon Hacking Group Plunders Shipping Industry: SAN FRANCISCO – Researchers have identified the hacking group behind several widescale business email compromise (BEC) attacks gouging the maritime shipping industry millions of dollars since last year. Attackers are taking advantage of the industry’s lax security and the use of outdated computers, according to a report released here at the RSA Conference Wednesday. ThreatPost, April 18, 2018
A Sobering Look at Fake Online Reviews. Bogus reviewers earn $25 – $35 for each fake listing: In 2016, KrebsOnSecurity exposed a network of phony Web sites and fake online reviews that funneled those seeking help for drug and alcohol addiction toward rehab centers that were secretly affiliated with the Church of Scientology. Not long after the story ran, that network of bogus reviews disappeared from the Web. Over the past few months, however, the same prolific purveyor of these phantom sites and reviews appears to be back at it again, enlisting the help of Internet users and paying people $25-$35 for each fake listing. KrebsOnSecurity, April 18, 2018
Cyber Defense
NIST Cybersecurity Framework 1.1: A Blueprint For Compliance And Assurance: In February 2014 the U.S. National Institute of Standards in Technology (‘NIST’) published the first NIST Cybersecurity Framework, responding to an Executive Order on improving critical infrastructure cybersecurity issued by President Obama. At the end of last year, NIST released draft two of the Framework for Improving Critical Infrastructure Cybersecurity Version 1.1, which incorporates feedback received by NIST since the release of Version 1.0. The National Law Review, April 20, 2018
NIST Releases Version 1.1 of its Popular Cybersecurity Framework: GAITHERSBURG, Md.—The U.S. Commerce Department’s National Institute of Standards and Technology (NIST) has released version 1.1 of its popular Framework for Improving Critical Infrastructure Cybersecurity, more widely known as the Cybersecurity Framework. NIST, April 16, 2018
Caught short by NotPetya, Australia to establish 24/7 ‘cyber newsroom.’ Australian Cyber Security Centre’s expanded role to include more proactive advice to wider range of stakeholders: David George from CERT Australia, which will soon merge into the Australian Cyber Security Centre (ACSC), has said that WannaCry and NotPetya “sent a shiver down the spine of the Australian government because, frankly, we were caught a little unawares”. ZDNet, April 13, 2018
Cyber Threat
Facebook’s anti-abuse system appears unable to keep cybercriminals from buying and selling selling hacked accounts, credit cards, and identities. Another place we need Facebook to up its game!! Facebook has built some of the most advanced algorithms for tracking users, but when it comes to acting on user abuse reports about Facebook groups and content that clearly violate the company’s “community standards,” the social media giant’s technology appears to be woefully inadequate. KrebsOnSecurity, April 20, 2018
Deleted Facebook Cybercrime Groups Had 300,000 Members: Hours after being alerted by KrebsOnSecurity, Facebook last week deleted almost 120 private discussion groups totaling more than 300,000 members who flagrantly promoted a host of illicit activities on the social media network’s platform. The scam groups facilitated a broad spectrum of shady activities, including spamming, wire fraud, account takeovers, phony tax refunds, 419 scams, denial-of-service attack-for-hire services and botnet creation tools. The average age of these groups on Facebook’s platform was two years. KrebsOnSecurity, April 16, 2018
Know Your Enemy
If cybercrime were a country, it would have the 13th highest GDP in the world. New study estimates cybercrime economy at $1.5 Trillion a year: Threat actors generate, launder, spend, and reinvest more than $1.5 trillion in illicit funds, according to a new study on cybercrime’s ‘web of profit.’ DarkReading, April 20, 2018
New hacker groups emerging in Asia and in the Middle East, finds Kaspersky: Security researchers observed a noticeable spurt in the activities of advanced persistent threat (APT) groups based in certain parts of Asia and in the Middle East during the first three months of the year. SC Media, April 18, 2018
Cyber Freedom
American Elections are Too Easy to Hack. We Must Take Action Now: Elections serve two purposes. The first, and obvious, purpose is to accurately choose the winner. But the second is equally important: to convince the loser. To the extent that an election system is not transparently and auditably accurate, it fails in that second purpose. Our election systems are failing, and we need to fix them. Schneier on Security, April 18, 2018
National Cybersecurity
34 tech firms sign accord to defend customers at all costs from cybercriminal and nation-state cyber-attacks and to not provide any technical aid to governments looking to launch cyber-attacks on countries, companies, or individuals: An industry group of 34 high-tech companies led by Microsoft, have signed today a tech accord, agreeing to defend customers at all costs from cybercriminal and nation-state cyber-attacks, but also not to provide any technical aid to governments looking to launch cyber-attacks on other countries, companies, or individual users. BleepingComputer, April 17, 2018
US-CERT Issues Warning: Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Device: This joint Technical Alert (TA) is the result of analytic efforts between the Department of Homeland Security (DHS), the Federal Bureau of Investigation (FBI), and the United Kingdom’s National Cyber Security Centre (NCSC). This TA provides information on the worldwide cyber exploitation of network infrastructure devices (e.g., router, switch, firewall, Network-based Intrusion Detection System (NIDS) devices) by Russian state-sponsored cyber actors. Targets are primarily government and private-sector organizations, critical infrastructure providers, and the Internet service providers (ISPs) supporting these sectors. This report contains technical details on the tactics, techniques, and procedures (TTPs) used by Russian state-sponsored cyber actors to compromise victims. Victims were identified through a coordinated series of actions between U.S. and international partners. US-CERT, April 16, 2018
Cyber Enforcement
Unmasked and Serving 17 Months – The Mystery Hacker Who Stole Data on 168 Million People: The FBI has quietly solved a rash of bulk database thefts that affected 168 million users of some of the internet’s most popular websites, The Daily Beast has learned. DailyBeast, April 19, 2018