Introduction
Three major campaigns using malicious spam (malspam) to distribute malware stopped sending malspam before Christmas–sometime during the week ending on Sunday 2018-12-23. These three campaigns are Emotet (also known as Feodo), Hancitor (also known as Chanitor or Tordal), and Trickbot. But this week, all three campaigns have been sending out malspam again.
Fool me once, shame on you. Fool me twice, shame on me. In June of 2018, Ticketmaster announced a data breach that affected potentially five percent of their entire customer database. This breach may have resulted in the theft of confidential data to include customer payment details and more. Ticketmaster’s website security was compromised by a malware-laden chatbot which they had installed on quite a few of the Ticketmaster websites worldwide. This is deja vu all over again, as only a few months prior malware-laden chatbots brought breaches to Sears, Delta Airlines, and Best Buy. Think carefully about installing third-party web services and giving them access to your cloud infrastructure before your security operations center team has a chance to thoroughly audit their security and evaluate the risk of integrating their services with your own critical cloud infrastructure. The cyberattackers compromising chatbots on Ticketmaster may have collected names, emails, payment details, and other key login information. On the other side of the world, Paris-based FastBooking, a firm that sells hotel booking software, was hacked by a malicious attack that may have possibly impacted the data and customers of over 1,000 hotels across the world. To give you a sense of how big this breach could be, consider that in Japan, as reported so far, the FastBooking breach impacted over 380 Japan-based hotels; just one impacted Japanese hotel chain noted that it impacted the information of an estimated 124,000 of their guests. In this case of the FastBooking breach, the attacker identified a vulnerability in an application hosted on the FastBooking server, which in turn was exploited to install malicious software. As always, you are only as strong as your weakest cloud infrastructure link. Think carefully about all of your SaaS vendor services and integrating them with your cloud infrastructure. Proceed cautiously until your security operations center team has a chance to thoroughly audit their security and assess their risk as a potential vendor. The use of CipherCloud’s award-winning cloud access security broker (CASB+) can help lock down your cloud applications and protect them against all of the common cloud threats. We can stop malware and attacker tools, and meet advanced persistent threats (APTs) head-on. To learn more, request a CASB+ trial to see how it can better fit your needs.
“A gateway is the central hub that interconnects the car’s powertrain, chassis, and other components and processes the data they send. The autopilot is a driver assistant feature that helps control lane changing, parking, and other driving functions. Short for Vehicle Controller Secondary, VCSEC is responsible for security functions, including the alarm.”
Unsettling new claims have emerged about Nicholas Truglia, a 21-year-old Manhattan resident accused of hijacking cell phone accounts to steal tens of millions of dollars in cryptocurrencies from victims. The lurid details, made public in a civil lawsuit filed this week by one of his alleged victims, paints a chilling picture of a man addicted to thievery and all its trappings. The documents suggest that Truglia stole from his father and even a dead man — all the while lamenting that his fabulous new wealth brought him nothing but misery.
Written by Sean Lyngaas
Engineers and others responding to malware that hit a Saudi Arabia petrochemical plant in June 2017 missed a key opportunity to prevent the plant from shutting down a second time in August that year, an investigator of the incident said Tuesday.
To bring awareness to what threatens the integrity of websites, we are continuing a series of posts on the OWASP top 10 security risks.
Following the news that Reddit has locked user accounts whilst it investigates a potential security incident, Raj Samani, Chief Scientist and McAfee Fellow commented below.
Today, Microsoft published an advisory on CVE-2019-0624 on a spoofing vulnerability in Skype for Business 2015. It requires a few steps of the attacker and isn’t entirely straightforward to execute. They must be an authenticated user and then send a spoofed request that can then perform a XSS on the victim machine at the privilege level of the user using Skype for Business.
Box announced today that it has hired Lakshmi Hanspal to be the company’s new chief information security officer (CISO). She boasts 20 years of security experience, including holding executive security roles at SAP Ariba and Bank of America. She also spent time in a senior role at PayPal.
A team of researchers discovered six zero-day vulnerabilities in protocols and individual components used in smart buildings. The flaws could be used to steal sensitive information, access or delete critical files, or perform malicious actions.
Written by Sean Lyngaas
Vulnerabilities in radio frequency protocols used by remote controllers could allow hackers to move cranes and other big machinery at construction sites and factories, security researchers said Tuesday, raising awareness of potential safety issues in widely-used technology.
Today, we all constantly read about data breaches that could have been prevented if the impacted organization had just done what they were supposed to do. The unfortunate reality is that cyberattacks are now a matter of ‘when’ and not ‘if’ for the average enterprise. Yet the landscape is changing and protecting your environment is actually getting more challenging, not less.
[unable to retrieve full-text content]
[unable to retrieve full-text content]
[unable to retrieve full-text content]
While the DoD is in the process of reviewing the $10 billion JEDI cloud contract RFPs (assuming the work continues during the government shutdown), Microsoft continues to build up its federal government security bona fides, regardless.
Enterprises operating in the traditional monolithic environment may have strict organizational structures. As a result, the requirement for security may restrain them from transitioning to a hybrid or cloud-native application deployment model.
By Zane Pokorny on January 15, 2019
One of the biggest challenges we face in the cybersecurity realm is deciding how to prioritize our limited resources. The possible threats out there are too multifarious for any one organization to respond to comprehensively — we all need some context to decide what to focus on and what to ignore.
Management Mayhem, Part 3: How to Avoid the Hidden Costs of Certificate Management
kdobieski
Tue, 01/15/2019 – 09:59
via the always informative Catalin Cimpanu, writing at ZDNet, comes the anticipated TLS Certificate renewal failures for at least 80 United States federal websites due to the federal government shutdown. Color us bright shade of completely not surprised.