Cyber Attacks, Threats, and Vulnerabilities
DarkSide ransomware is creating a secure data leak service in Iran (BleepingComputer) The DarkSide Ransomware operation claims they are creating a distributed storage system in Iran to store and leak data stolen from victims. To show they mean business, the ransomware gang has deposited $320 thousand on a hacker forum.
New stealthy hacker-for-hire group mimics state-backed attackers (BleepingComputer) A new mercenary hacker group tracked as CostaRicto by BlackBerry researchers is selling its services to entities requiring APT-level hacking expertise in cyber-espionage campaigns spanning the globe and targeting a multitude of industry sectors.
Microsoft says three APTs have targeted seven COVID-19 vaccine makers (ZDNet) The three state-sponsored hacker groups (APTs) are Russia's Strontium (Fancy Bear) and North Korea's Zinc (Lazarus Group) and Cerium.
Cyberattacks targeting health care must stop (Microsoft on the Issues) In recent months, MIcrosoft has detected cyberattacks from nation-state actors targeting prominent companies directly involved in researching vaccines and treatments for Covid-19. We are calling on the world’s leaders to affirm that international law protects health care facilities and to take action to enforce the law.
Ransomware-as-a-service: The pandemic within a pandemic (Intel 471) The following is an examination of over 25 Ransomware-as-a-service (RaaS) crews that have grown over the past year.
DHS Flags Becton Medical Pump For Cybersecurity Issues (Law360) Medical tech producer Becton Dickinson & Co.'s Alaris infusion pump has cybersecurity weaknesses that, if exploited, could force users, typically hospitals, to operate them manually, the U.S. Department of Homeland Security announced Friday.
The iOS Covid App Ecosystem Has Become a Privacy Minefield (Wired) An analysis of nearly 500 Covid-related apps worldwide shows major differences in how much data they expect you to give up.
SAD DNS: Researchers pull source code as DNS cache poisoning technique deemed ‘too dangerous’ (Daily Swig) ‘We removed the code from GitHub to protect those vulnerable servers and give them time to fix the vulnerability’
'ModPipe' POS Malware Attacking Hospitality Industry (Data Breach Today) A recently uncovered point-of-sale malware called "ModPipe" is targeting specific Oracle software used by thousands of restaurants and other businesses in
How TikTok could be used for disinformation and espionage (CBS News) The popular video-sharing app avoided a nationwide ban this week. But experts say its national security risks remain.
RiskIQ tracks wave of skimming attacks to variant of old skimmer (iTWire) Security firm RiskIQ says a wave of compromises of e-commerce websites earlier this year were carried out through use of a variant of the Ant and Cockroach skimmer which was connected to a group of attackers known as Magecart group 12. The company said the attacks had been described by another secur...
Check Point tracks Windows Pay2Key ransomware to alleged Iranian source (iTWire) Researchers from Israel-based security shop Check Point say they have traced the wallet in which bitcoin paid for ransoms extorted by the latest ransomware, Pay2Key, is located and found an Iranian company at the end of the chain. In a research brief, Check Point said the attacks using this ransomwa...
Iranian hackers target Israeli firms in 'double extortion' ransomware attack (Israel Hayom) Security company Check Point traces the transaction of four companies that decided to comply with Pay2Key scam and found they all ended on an Iranian bitcoin site that is available only to Iranian citizens.
Google Chrome Update Gets Serious: Homeland Security (CISA) Confirms Attacks Underway (Forbes) Homeland Security cybersecurity agency says update Google Chrome as attackers home in on new security flaws.
2 More Google Chrome Zero-Days Under Active Exploitation (Threatpost) Browser users are once again being asked to patch severe vulnerabilities that can lead to remote code execution.
Here Comes TroubleGrabber: Stealing Credentials Through Discord (Netskope) “TroubleGrabber” is a new credential stealer that is being spread through Discord attachments and uses Discord messages to communicate stolen credentials back to the attacker. While it bears some functional similarity to AnarchyGrabber, it is implemented differently and does not appear to be linked to the same group. TroubleGrabber is written by an individual named […]
Kaspersky discovers Ghimob banking malware targets mobile users worldwide (Back End News) When monitoring a Windows campaign from Guildma banking malware, Kaspersky researchers found URLs distributing not only a malicious .ZIP file for Windows, but also a malicious file that appeared to…
Google stops biggest-ever DDoS cyber attack to date (ETTelecom) The attacker used several networks to spoof 167 Mbps (millions of packets per second) to 180,000 exposed CLDAP, DNS, and SMTP servers, which would the..
LinkedIn phishing scams most clicked with a 47% open rate in Q3 2020 (Atlas VPN) According to data presented by the Atlas VPN team, emails impersonating LinkedIn were the most clicked on social media phishing attacks, with a 47% open rate in the third quarter of this year.
Heartbleed, BlueKeep and other vulnerabilities that didn't disappear just because we don't talk about them anymore (SANS Institute Internet Storm Center) Since new critical vulnerabilities are discovered and published nearly every day, it is no wonder that we (i.e. security professionals and security-oriented media) tend to focus on these and don’t return to the ones that came before too often. Unless there is a massive exploitation campaign, that is.
The Chinese hardware backdoors can cause transformer failures through the load tap changers (Control Global) As I was reviewing my blogs for a paper I was preparing, I found a nuclear power plant incident involving a station auxiliary transformer load tap changer (LTC) failure.
Loyalty fraud is on the rise — here's what happens when your points are stolen (The Points Guy UK) Despite being in the middle of a global pandemic, hackers are still targeting travel loyalty accounts. In fact, loyalty account fraud is on the rise, but not for the reasons you might think. A recent report out of Akamai — a cybersecurity company in the loyalty space — shows there were over 100 billion credential …
CERT-In Warns Of Multiple Vulnerabilities In WhatsApp, WhatsApp Business For iOS (IndiaTimes) Several security risks!
Bumble Vulnerabilities Put Facebook Likes, Locations And Pictures Of 95 Million Daters At Risk (Forbes) Every Bumble user could’ve had private information leaked, but the dating app says it has now fixed the issues, even if it took over half a year to do so.
Akropolis Cryptocurrency Lending Service Lost $2M In Cyber Attack (Latest Hacking News) Cryptocurrency lending and borrowing service Akropolis suffered cyber attack losing $2 million as the hackers waged a flash loan attack.
Scammers Expose Facebook Data Haul of 13 Million Records (Infosecurity Magazine) Misconfigured Elasticsearch database to blame
Report: Facebook Credit Card Scam Exposed Via Huge Data Leak (vpnMentor) Led by Noam Rotem and Ran Locar, vpnMentor’s research team recently uncovered a potentially massive phishing and credit card fraud operation targeting Facebook users.
How hackers collected sensitive data from the Land Transportation Office (Manila Bulletin) The country's transportation agency is now on a hot seat as thousands of personal information of drivers and vehicle owners were processed and saved by a website pretending to be an official LTO page.
Pluto TV likely suffered a security breach affecting 3.2 million accounts (Android Police) Pluto TV is one of the leaders in the free online TV industry, offering dozens of ad-supported channels corresponding to real-life networks (NBC, Nick,
ShinyHunters hacked Pluto TV service, 3.2M accounts exposed (Security Affairs) A hacker has shared 3.2 million Pluto TV user accounts on a hacking forum for free, he claims they were stolen by ShinyHunters threat actor. Pluto TV is an American internet television service, it is an advertiser-supported video on demand (AVOD) service that primarily offers a selection of programming content through digital linear channels designed to emulate the experience of […]
Popular stock photo service hit by data breach, 8.3M records for sale (BleepingComputer) Stock photo site 123RF has suffered a data breach after a hacker began selling a database containing 8.3 million user records on a hacker forum.
Notification of Data Security Incident (People Incorporated Mental Health Services) People Incorporated Mental Health Services (“People Incorporated”) is committed to maintaining the privacy and security of information.
Major Data Breach On Travel Sites; Mastercard Looks Beyond Cards (Black Chronicle) Credit score Card Data of Thousands and thousands of Company Leaked in Journey Website Knowledge Breach
Red Wing Shoes: No data breach in cyber attack (Grand Forks Herald) No data breach is believed to have occurred, security investigators have told company officials.
Your Computer Isn't Yours (Sneak) The personal website of Jeffrey Paul.
Saint John Suffers ‘Significant’ Cyber Attack (Country 94) The City of Saint John has shut down all of its IT systems following a "significant cyber attack." City offici...
Software glitch halts trading on Australia's stock exchange, to reopen Tuesday (Reuters) A software problem forced Australia's stock exchange to halt trading 20 minutes after opening on Monday and it plans to reopen on Tuesday, the bourse operator ASX Ltd <ASX.AX> said.
Security Patches, Mitigations, and Software Updates
Microsoft pushes 112 patches, which may cause management tools to buckle under pressure | SC Media (SC Media) Said one security expert, many organizations are likely to encounter VPN failures or downtime from legacy on-premises patch management tools buckling under the pressure.
Easily Exploitable Vulnerabilities in Oracle WebLogic Server (Netsparker) Two critical vulnerabilities identified in the Oracle WebLogic Server may allow attackers to take complete control of the server. As Oracle released patches for these vulnerabilities in October 2020 and advised users to install the latest security updates without any delay, Netsparker also released an update for Netsparker Standard and Enterprise so you can check if these critical vulnerabilities affect your server.
Microsoft is being extra careful with Windows 10 security updates for December (TechRadar) No optional updates next month, as remaining staff focus on the main security patches
Cyber Trends
The growing need for encrypted communications (TechRadar) Keeping communication private and secure is increasingly important for both businesses and consumers
Parks Associates: 68% of SMBs are concerned about cybersecurity vulnerabilities at their business locations (Parks Associates) Industry webinar featuring Comcast and Irdeto examines the changing landscape for SMBs and new opportunities for data security and network management solutions
Marketplace
Cado Security Raises $1.5M in Seed Funding for First Cloud-Native Forensics and Response Platform (GlobeNewswire) Cado Security (cadosecurity.com), provider of the world’s first cloud-native cyber forensics and response platform Cado Response, today announced the close of a $1.5 million seed round led by Ten Eleven Ventures, the original Silicon Valley-based cybersecurity venture capital firm. Cado Security will use the funding to expand its development team in the United Kingdom.
Akamai Technologies dials in mobile tech specialist Asavie with €131m deal (Sunday Times) Akamai Technologies, a Nasdaq-listed technology company, has revealed that it will pay $155m (€131m) in cash for Irish mobile telecommunications software developer Asavie.In a filing to the Securities
Palo Alto Networks To Acquire Expanse for Up To $800M (FinSMEs) Global cybersecurity company Palo Alto Networks (NYSE: PANW) is to acquire Expanse Inc., a attack surface management company
7 Cybersecurity Stocks Ready for an Online Spending Surge (InvestorPlace) The pandemic kickstarted many cybersecurity stocks. Working from home and an online shopping surge will continue that growth story.
What if antitrust regulators forced Google to sell Chrome? (Quartz) The trustbusting move would have wide-ranging consequences on user privacy, digital advertising, and Google's business model.
What Elliott may be up to with F5 Networks after past success with tech (CNBC) Elliott Associates has been eyeing another investment in the cloud space.
Inside Ingram Micro’s new cyber security push (CRN Australia) Distie retools Advanced Solutions with cyber as the glue.
BAE Systems expands, fueling Georgia Cyber Center growth, jobs (Augusta Chronicle) A huge international intelligence and security contractor is expanding its footprint in the Georgia Cyber Center, potentially bringing hundreds of jobs and new internships for students, officials said.
Products, Services, and Solutions
Digital Guardian rolls out Ryuk Ransomware Protection Content Pack to detect and defend against rising Ryuk ransomware attacks (CTOvision.com) Digital Guardian, a globally renowned company in Data Loss Prevention (DLP) and Managed Detection and Response (MDR), has developed a new Ryuk Ransomware Protection Content Pack to detect and defend […]
Darktrace’s Antigena Email named Security Innovation of the Year (Cambridge Network) Darktrace, the world’s leading cyber AI company, has today announced that Antigena Email, its AI-powered email security solution, has won Security Innovation of the Year at the 2020 UK IT Industry Awards.
Forescout expands integrations with partner solutions (Security Brief) Expanded partnerships and integrations with Splunk, CrowdStrike and CyberArk allow for better IT and OT security posture for joint customers.
NSF-ISR Information Security Program Poised to Become a Leader in Protecting the DoD Supply Chain (Yahoo) Tony Giles and Rhia Dancel are certified for new Department of Defense supply chain cybersecurity program
QOMPLX Adds Q:SCAN Internet Attack Surface Scanning Solution (PR Newswire) QOMPLX™, a leading global intelligent decision platform provider, today announced the general availability of Q:SCAN, an internet...
Technologies, Techniques, and Standards
NIST has a new cybersecurity companion guide (Federal News Network) Having just finished a multi-year revision of what you might call the bible of cybersecurity controls, there’s something new. The National Institute of Standards and Technology cybersecurity crew has a new, companion guide.
Adm. Trussler: Information Warfare ‘All About Speed for Advantage’ (Seapower) ARLINGTON, Va. —The admiral who sponsors the resources for the U.S. Navy’s information warfare operations said the modern warfare environment is increasingly governed by the speed of information and its effects on decision-making. “It is all about speed for advantage,”...
I’ve Seen the 5G Future. So Far, I’m Not Impressed. (Wall Street Journal) In South Korea, the rollout has been plagued by bad reception and a lack of consumer apps. But it’s still early.
How to Keep Your Children Safe in a Remote Learning Environment (Ann Arbor Family) There is a lot to navigate with virtual learning, but is your child's information protected? Here are some tips on ensuring a safe remote learning environment.
Design and Innovation
Facebook’s redoubled AI efforts won’t stop the spread of harmful content (VentureBeat) Facebook says it's using AI and machine learning to prioritize harmful content for human moderators, but that likely won't be enough.
Defending against the cryptographic risk posed by quantum computing (Federal News Network) Now is the time to prepare for the complex transition to post-quantum algorithms well before the advent of a quantum computer.
Academia
Successful Ransomware Attacks on Education Grew 388% in Q3 2020 (The State of Security) The number of successful ransomware attacks on the education sector increased 388% in the third quarter of 2020.
Schools Struggling to Stay Open Get Hit by Ransomware Attacks (Wall Street Journal) Districts around the U.S. are fighting a wave of increasingly aggressive hackers, who are publicly posting sensitive student information to get schools to pay up. The data can aid identity theft or be highly embarrassing for vulnerable young people.
DOE to host virtual CyberForce Competition for college students (Daily Energy Insider) The U.S. Department of Energy will host the CyberForce Competition on November 14, an event where college students compete in a realistic cybersecurity defense exercise. It is the sixth annual event, but for the first ... Read More »
IIT Roorkee students shine by securing top positions at virtual hackathon (The Statesman) A team of students at Indian Institute of Technology (IIT) Roorkee has won the Embedded Security Challenge in the virtual hardware hackathon.
TPS hires firm to investigate hack (The Blade) Toledo Public Schools will pay a cyber security contractor roughly $75,000 to investigate a suspected ransomware attack.
The district on Sept. 10 entered ...
Legislation, Policy, and Regulation
GCSC proposes rules to guide states towards responsible cyber behaviour (Computing) The proposed norms are similar to a cyber version of the Geneva Convention
International infosec rules delivered to make nations and non-state actors behave themselves online (Register) Don't hack, don't backdoor, don't hurt the internet … and don't expect rapid adoption because there's still a lot of multilateral work to be done
Microsoft President Calls for Global Crackdown on Cyberattacks (Wall Street Journal) Hacks of health-care facilities and Covid-19 research show an urgent need for more collaboration.
Why Is North Korea So Good at Cybercrime? (Diplomat) North Korea is committed to advancing its cyber capabilities, and it shows in the results.
Sweden halts 5G auction after court grants relief to Huawei (ETTelecom) Swedish telecoms regulator PTS on Monday halted 5G spectrum auctions after a court suspended parts of its decision that had excluded Chinese telecom e..
Huawei hopes Biden presidency brings a 'reset' to relations, says tech officer (CNBC) Paul Scanlan said whenever there "is a change in government, there is always the opportunity to reset the relationship."
Australia Hasn't Really Investigated Whether TikTok Is A National Security Risk As Far As We Know (Gizmodo Australia) According to the Department of Home Affairs, they've only done one brief review of TikTok in Australia and it wasn't a very thorough one.
Rwandan cyber chief: As challenges loom, Africa needs to build cyber resiliency (Israel Defense) The head of Rwanda's National Cyber Security Authority, in a speech at CybertechLive Africa, stresses that African nations must create opportunities for their growing populations of young people
Israeli cyber czar, addressing Africa, urges joint effort to repulse attacks (Israel Defense) Partnerships are essential as no single country can succeed in cybersecurity by itself, Yigal Unna says at the CybertechLive Africa conference
Taiwan is crucial to the global fight against cybercrime (MENAFN) Taiwan's national antipandemic and cybersecurity teams
US gives Qualcomm approval to sell 4G chips to Huawei despite sanctions (The Verge) The license only applies to 4G Huawei chips
EMS Not its Own Domain of Warfare, Strategy Implementer Says (Air Force Magazine) The Electromagnetic Spectrum isn't yet considered a full domain of warfare, but an aspect of every other domain, said Air Force Brig. Gen. Darrin P. Leleux.
The federal government’s chief information security officer is helping an outside effort to hunt for alleged voter fraud (Washington Post) The participation of administration officials in the Voter Integrity Fund shows the extent of the efforts by President Trump’s allies to justify his unfounded allegations of widespread ballot fraud.
DHS announces new Homeland Security Advisory Council members (Security Magazine) Acting Secretary of Homeland Security, Chad F. Wolf introduced two new members to the Homeland Security Advisory Council (HSAC): Tom Jenkins and Catherine Lotrionte. Created by President George W. Bush in 2002, the HSAC is a Department of Homeland Security federal advisory committee that provides the secretary with independent, informed recommendations, and advice on a variety of homeland security issues.
DHS boss Chad Wolf defies Trump order to fire cyber chief Chris Krebs (New York Post) Department of Homeland Security acting Secretary Chad Wolf is defying President Trump’s order to terminate election cybersecurity official Christopher Krebs, multiple sources tell The Post. T…
Calif. Privacy Law Resembles, Transcends EU Data Regulation (Law360) Companies preparing for future enforcement of the newly passed California Privacy Rights Act can look to the EU General Data Protection Regulation for guidance while understanding key differences, including the CPRA's incentive options for consumers and mandate that regulations be updated to reflect technological changes, say attorneys at Akin Gump.
Montana CISO Shares State Security Actions and Priorities (Government Technology) How does a leading state chief information security officer navigate the cyberattacks targeting his state during the pandemic and beyond? Montana CISO Andy Hanks shows us the way in this interview.
Litigation, Investigation, and Law Enforcement
TikTok Gains Extension of Divestiture Deadline (Wall Street Journal) The Committee on Foreign Investment in the U.S. has set Nov. 27 as the new deadline for a deal to turn the social-media app into an American company.
Facebook loses final appeal in defamation takedown case, must remove same and similar hate posts globally (TechCrunch) Austria’s Supreme Court has dismissed Facebook’s appeal in a long running speech takedown case — ruling it must remove references to defamatory comments made about a local politician worldwide for as long as the injunction lasts. The Austrian Supreme Court has now delivered its fi…
Op protected childhood: 113 online child predators arrested (HackRead) The arrests took place as part of Operation protected childhood initiated by ICE, HSI, MJSP against child sexual abuse material (CSAM).
ICE, international partners arrest 113 child predators (US Immigration and Customs Enforcement) OPC VII simultaneously targeted the distributors and producers of child sexual abuse material throughout the Americas.
Indonesia sees rising cyberviolence against critical voices, women : SAFEnet (The Jakarta Post) The report revealed that 60 complaints related to gender-based cyber violence were recorded in 2019.
Ticketmaster fined £1.25m over payment data breach (BBC News) More than nine million people may have had their details stolen in the 2018 cyber-attack.
Gov't Fights ACLU's Appeal In Spy Court Secrecy Case (Law360) The federal government has urged the Foreign Intelligence Surveillance Court's appeals branch not to revive the American Civil Liberties Union's case urging the spy court to declassify certain court decisions, saying it doesn't have the authority to decide the case.
Wells Fargo Ex-CEO Settles SEC Claims, Former Consumer-Unit Head Faces Fraud Case (Wall Street Journal) John Stumpf agreed to pay $2.5 million to settle civil claims over his role in the bank’s fake accounts scandal, while regulators sued another departed Wells executive over fraud allegations.
ViSalus Says Lack Of Harm Dooms $925M Robocall Award (Law360) Health supplement maker ViSalus is doubling down on its bid to ax a $925 million statutory damages award it's facing after an Oregon federal jury found it placed nearly two million unsolicited robocalls, arguing that no consumers suffered any "true harm or injury" that would warrant such a "devastating" judgment.
La Grange police blotter: Resident reports fraudulent Verizon account with $3,000 in charges (Chicago Tribune) A La Grange resident learned someone opened a Verizon account in their name and charged $3,000 in services.
