News


  • Google Taking Over Health Records Raises Patient Privacy Fears

    November 21, 2018

    Three years ago, artificial intelligence company DeepMind embarked on a landmark effort to transform health care in the U.K. Now plans by owner Alphabet Inc. to wrap the partnership into its Google search engine business are tripping alarm bells about privacy. Data protection advocates cried foul when the company reversed course on an earlier pledge to keep DeepMind ...

  • Lazarus APT Uses Modular Backdoor to Target Financial Institutions

    November 21, 2018

    The advanced persistent threat group Lazarus with North Korean links has been observed using a modular backdoor during last week to compromise a series of Latin American financial institutions by Trend Micro’s Lenart Bermejo and Joelson Soares. As unearthed by the Trend Micro research team, the APT38 threat group successfully compromised a number of computing systems ...

  • L0rdix becomes the new Swiss Army knife of Windows hacking

    November 21, 2018

    A new hacking tool making the rounds in underground forums has been deemed the latest “go-to” universal offering for attackers targeting Microsoft Windows PCs. The software is called L0rdix and according to cybersecurity researchers from enSilo is “aimed at infecting Windows-based machines, combines stealing and cryptocurrency mining methods, can avoid malware analysis tools.” In a blog ...

  • Amazon suffers data breach days before Black Friday

    November 21, 2018

    Amazon has suffered a data breach just days before Black Friday – and the company was tight-lipped about whether it had notified the British data protection authorities. Multiple Register readers forwarded us emails sent from Amazon’s UK tentacle informing them that the online sales site had “inadvertently disclosed name and email address due to a technical error”. The ...

  • Major Flaws Found in IT Pentagon Processes After First Ever Financial Audit

    November 21, 2018

    The conclusions drawn following the first U.S. Defense Department-wide financial audit are not surprising to anyone given that the Pentagon failed the audit just as expected. “We never thought we were going to pass an audit, right? Everyone was betting against us, that we wouldn’t even do the audit,” told Patrick Shanahan the Deputy Secretary of ...

  • USPS Site Exposed Data on 60 Million Users

    November 21, 2018

    U.S. Postal Service just fixed a security weakness that allowed anyone who has an account at usps.com to view account details for some 60 million other users, and in some cases to modify account details on their behalf. KrebsOnSecurity was contacted last week by a researcher who discovered the problem, but who asked to remain anonymous. The researcher said ...

  • APT29 Re-Emerges After 2 Years with Widespread Espionage Campaign

    November 20, 2018

    The group is best-known for hacking the DNC ahead of the 2016 presidential election. A phishing campaign bent on espionage, believed to be launched by the nation-state threat group known as APT29, is targeting high-value targets across the think-tank, law enforcement, media, U.S. military, imagery, transportation, pharmaceutical, national government and defense contracting sectors. It’s the first large-scale ...

  • Emotet Returns with Thanksgiving Theme and Better Phishing Tricks

    November 20, 2018

    After a short break, Emotet malware has been observed concealed in documents delivered through emails that pretended to be from financial institutions or disguised as Thanksgiving-themed greetings for employees. In early October, Emotet activity dropped off the radar, only to come back towards the end of the month with a new plugin that exfiltrates email subjects and 16KB ...

  • Russia’s Elite Hackers May Have New Phishing Tricks

    November 20, 2018

    A major question hanging over the United States midterm election season: Where was Russia? But while GRU hackersdidn’t directly interfere, they appear to be as active as ever. New research from two threat intelligence firms indicates that two prominent Russia-linked groups have been developing some clever phishing innovations, and are working purposefully to expand their reach. “There’s a lot of ramping ...

  • True Identity of Notorious Hacker tessa88 Revealed

    November 20, 2018

    In early 2016, a previously unknown hacker operating under the alias of tessa88 publicly emerged after offering an extensive list of compromised, high-profile databases for sale. The hacker offered for sale the databases of companies such as VKontakte, Mobango, Myspace, Badoo, QIP, Dropbox, Rambler, LinkedIn, and Twitter, among others. Within several months of incredibly active ...

  • Almost 50 Percent of 2018 Vulnerabilities Can Be Exploited Remotely

    November 20, 2018

    Approximately half of all vulnerabilities disclosed during 2018 come with a remote attack vector while only 13% of them require local access according to Risk Based Security’s 2018 Q3 Vulnerability Quick View Report. As reported by Risk Based Security, 16,172 vulnerabilities were published by their VulnDB team until the end of Q3 2018, with a 7% decrease when ...

  • GSA proposes new cybersecurity reporting rules for contractors

    November 19, 2018

    The General Services Administration is proposing new rules shaping how contractors protect government information on the IT systems they manage. Tucked in a Friday Federal Register post detailing the Unified Agenda of Federal Regulatory and Deregulatory Actions, two proposed rules — GSAR Case 2016-G511 and 2016-G515 — call for amending the General Services Administration Acquisition Regulation to include ...

  • A little phishing knowledge may be a dangerous thing

    November 19, 2018

    Phishing works more frequently on those who understand what social engineering is than on those who live in blissful ignorance, or so a studyof students at University of Maryland, Baltimore County suggests. Citing IBM data suggesting human error is a factor in 95 per cent of security incidents, researchers from the school’s department of computer science and electrical engineering ...

  • Hacking group returns, switches attacks from ransomware to trojan malware

    November 16, 2018

    A prolific hacking group has returned with a new campaign which looks to deliver a new remote access trojan (RAT) to victims in order to create a backdoor into PCs to steal credentials and banking information. The campaign is suspected to be the work of TA505, a well-resourced hacking group which has been active since at least 2014. ...

  • Russian Banks Under Phishing Attack

    November 16, 2018

    Banks in Russia today were the target of a massive phishing campaign that aimed to deliver a tool used by the Silence group of hackers. The group is believed to have a background in legitimate infosec activities and access to documentation specific to the financial sector. The fraudulent emails purported to come from the Central Bank of Russia (CBR) ...

  • 0-Days Found in iPhone X, Samsung Galaxy S9, Xiaomi Mi6 Phones

    November 15, 2018

    At Pwn2Own 2018 mobile hacking competition held in Tokyo on November 13-14, white hat hackers once again demonstrated that even the fully patched smartphones running the latest version of software from popular smartphone manufacturers can be hacked. Three major flagship smartphones—iPhone X, Samsung Galaxy S9, and Xiaomi Mi6—were among the devices that successfully got hacked at ...

  • Siemens Patches Firewall Flaw That Put Operations at Risk

    November 14, 2018

    The industrial company on Tuesday released mitigations for eight vulnerabilities overall. Siemens AG on Tuesday issued a slew of fixes addressing eight vulnerabilities spanning its industrial product lines. The most serious of the patched flaws include a cross-site scripting vulnerability in Siemens’ SCALANCE firewall product. The flaw could allow an attacker to gain unauthorized access to ...

  • The US Office of Personnel Management Systems Are Still Insecure

    November 14, 2018

    The security posture of the Office of Personnel Management has improved drastically and by the end of the year, the agency is on track to meeting almost all recommendations the US Government Accountability Office (GAO) made over the past two years. Full compliance is expected by the end of 2019. GAO carried out between February 2015 ...

  • State-Sponsored Actors Focus Attacks on Asia

    November 14, 2018

    Southeast Asia is the most actively attacked region, accordingly to Cyber Security firm, Group-IB. Their annual Hi-Tech Crime Trends Report 2018 advises, “In just one year, 21 state-sponsored groups were detected in this area, which is more than in the United States and Europe.” Although, not only state-sponsored groups are focusing their attention on this ...

  • 7 New Meltdown and Spectre-type CPU Flaws Affect Intel, AMD, ARM CPUs

    November 14, 2018

    Disclosed earlier this year, potentially dangerous Meltdown and Spectre vulnerabilities that affected a large family of modern processors proven that speculative execution attacks can be exploited in a trivial way to access highly sensitive information. Since then, several more variants of speculative execution attacks have been discovered, including Spectre-NG, SpectreRSB, Spectre 1.1, Spectre1.2, TLBleed, Lazy FP, NetSpectre and Foreshadow, patches for which were released ...