Category: Fity Feeds

The education industry faces a security crisis, one that goes beyond protecting the classrooms and hallways. IT professionals in the education sector see cybersecurity as their top priority, consistently ranking it as their No. 1 concern.

Posted under: Research and Analysis

Yesterday Twitter revealed they had accidentally stored plain-text passwords in some log files. There was no indication the data was accessed and users were warned to update their passwords. There was no known breach, but Twitter went public anyway, and was excoriated in the press and… on Twitter.

Deception Technology , Next-Generation Technologies, Secure Development

After a distributed denial-of-service attack knocked some servers offline during a local election in Tennessee this week, Knox County is working with an outside security contractor to investigate the cause. The attack took the Knox County Election Commission site displaying results of the county mayoral primary offline during Tuesday night voting. The county resorted to distributing printed results during the outage.

Give a man a fish and you feed him for a day;
teach a man to fish and you feed him for a lifetime.
~ Maimonides

In response to news of the discovery of Spectre NG, with 8 new variations on the Spectre vulnerability, IT security experts commented below.

[unable to retrieve full-text content]

WannaCry drove a 415 percent increase in ransomware attacks and accounted for 90 percent of all detection reports in 2017.

blog / May 04, 2018

by Sara Boddy

It’s a sad state of Internet affairs when the US government must publish a US-CERT Alert about Russia targeting US entities through negligent network infrastructure misconfigurations.¹ In Alert TA18-106A, US-CERT discloses that since 2015, the US government, in partnership with the UK, has been receiving data from numerous sources that “large numbers” of enterprise-class and SOHO (small office/home office)/residential routers and switches worldwide have been compromised, and that the threat actors are indeed from the Russian military. US-CERT alert was quick to point out that Russia “didn’t need to use zero-days or malware to exploit the devices.”

The State Department will double the cyberdefense aid it pledged to Ukraine last year to $10 million in an effort to bolster the security of an ally in the crosshairs of alleged Russian hackers, according to department spokesperson.

Creating an environment of security and compliance throughout your enterprise can be a challenge as a main goal is to effectively ensure confidentiality, integrity, and availability for compliance goals throughout the environment. When considering the management of enterprise security and compliance, one message should remain at the forefront of our minds: enterprise compliance is not static, and should be under constant review. 

Introduction

FireEye’s Mandiant Red Team recently discovered vulnerabilities
present on the Logitech Harmony Hub Internet of Things (IoT) device
that could potentially be exploited, resulting in root access to the
device via SSH. The Harmony Hub is a home control system designed to
connect to and control a variety of devices in the user’s home.
Exploitation of these vulnerabilities from the local network could
allow an attacker to control the devices linked to the Hub as well as
use the Hub as an execution space to attack other devices on the local
network. As the Harmony Hub device list includes support for devices
such as smart locks, smart thermostats as well as other smart home
devices, these vulnerabilities present a very high risk to the users.

Executive Summary

John Doerr, the venture capitalist who’s funded companies including Google, Intuit, and Amazon, describes a system he calls “Objectives and Key Results,” or OKR, the subject of his new book. He learned it from Intel CEO Andy Grove in the 1970s, and has taught it to hundreds of organizations since then. He views it as a significant improvement over traditional methods of setting goals. In the OKR system, the objective is what you want to have accomplished. The key results are how you’re going to get it done. Doerr says this transparency helps organizations be more focused, aligned, and committed in their work.

Cisco has released several patches for users of WebEx clients and its Access Control System, all of which are mandatory if users want to keep using the products safely. The release comes two weeks after the networking giant issued critical patches for an array of WebEx installments.

Over the past few days, we have been analyzing a development with the Necurs botnet – a cybercrime operation dating back to 2012 that quickly became one of the largest spam botnets in the world. We reported on the infamous cybergang responsible for the distribution of global malware campaigns such as “Locky” and “GlobeImposter” in two blog posts (here and here) that explained how malware is spread via Necurs. And now we have seen a new link to that chain with attackers serving brand new files via the same botnet. These files are spreading malicious Visual Basic Scripts (VBScripts) and our analysis suggests that the authors are using the services provided by the Necurs botnet to reach more victims. The ultimate goal of the attackers is to make systems vulnerable to attacks with the ability to steal personal data and to infect them with keyloggers, banking malware, and ransomware.

via Joseph Cox, writing at Motherboard (a Vice property), tells ths unfortunate tale of a Russian company selling zero-day exploit code, targeting hospital software… Today’s MustRead. H/T

Security researchers have caught a Bitcoin-hijacking Chrome extension that only managed to grab one BitCoin transaction before being exposed. Researchers said the malicious extensions used an attack technique that first emerged last year, dubbed FacexWorm, and added that they noticed re-emerging activity earlier this month. FacexWorm propagates in malicious Facebook Messenger messages and only attacks Chrome. Allan Liska, Senior Solutions Architect at Recorded Future has observed this evolved / advancing threat and commented below.

For several years now, wireless carriers have been busy telling anybody who’d listen that fifth-generation (5G) wireless will be a game-changing broadband revolution. Time and time again, their marketing departments have breathlessly insisted that everything from smart cities to next-gen medical care will only be possible through the miracle of 5G connections.

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, Hawaii-based restaurant Zippy’s suffered a POS data breach. In addition, Uber executive John Flynn argued that user expectations on data protection are rising, but consumers still aren’t implementing the right precautions for their own data safety.