⚠ Targeted ransomware attacks – SophosLabs 2019 Threat Report ⚠

This year's SophosLabs Threat Report is out. We talk targeted ransomware attacks, and in particular, SamSam.

📖 Read

via "Naked Security".

🔐 How to improve enterprise IoT security: 5 tips 🔐

Some 15% of companies struggling with IoT security lost at least $34 million in the last couple years. Here are five ways to stay better protected.

📖 Read

via "Security on TechRepublic".

🔐 69% of ATMs can be hacked to spit cash in minutes 🔐

ATM vulnerabilities highlight the importance of securing machines against network attacks, according to a Positive Technologies report.

📖 Read

via "Security on TechRepublic".

🕴 To Click or Not to Click: The Answer Is Easy 🕴

Mega hacks like the Facebook breach provide endless ammo for spearphishers. These six tips can help you stay safer.

📖 Read

via "Dark Reading: ".

🔐 AI, IoT, and edge computing drive cybersecurity concerns for 2019 🔐

As companies adopt emerging technologies, the cyber risk landscape is set to grow larger in the new year, according to a Forcepoint report.

📖 Read

via "Security on TechRepublic".

🕴 Can Businesses Stand Up to Cybercrime? Only 61% Say Yes 🕴

While 96% of US organizations say business resilience should be core to company strategy, only 61% say it actually is.

📖 Read

via "Dark Reading: ".

❌ Siemens Patches Firewall Flaw That Put Operations at Risk ❌

The industrial company on Tuesday released mitigations for eight vulnerabilities overall.

📖 Read

via "Threatpost | The first stop for security news".

🔐 Researchers discover seven new Meltdown and Spectre attacks 🔐

Experiments showed that processors from AMD, ARM, and Intel are affected.

📖 Read

via "Security on TechRepublic".

🕴 Sharpen Your Malware-Fighting Skills at Black Hat Europe 🕴

Don't miss out on the Black Hat Briefings, Trainings, and Arsenal tools that will equip you with the knowledge and skills you need to deal with today's top malware.

📖 Read

via "Dark Reading: ".

🕴 Understanding Evil Twin AP Attacks and How to Prevent Them 🕴

The attack surface remains largely unprotected from Wi-Fi threats that can result in stolen credentials and sensitive information as well as backdoor/malware payload drops.

📖 Read

via "Dark Reading: ".

🕴 Airlines Have a Big Problem with Bad Bots 🕴

Bad bots account for 43.9% of all traffic on their websites, APIs, and mobile apps, according to a new analysis of 100 airlines.

📖 Read

via "Dark Reading: ".

🕴 Black Hat: European Security Pros Wrestling With Potential Breaches, Privacy Issues 🕴

Black Hat Europe attendee survey shows European cybersecurity leaders are uncertain of their ability to protect end user data - and are fearful of a near-term breach of critical infrastructure.

📖 Read

via "Dark Reading: ".

🕴 Cryptojacking, Mobile Malware Growing Threats to the Enterprise 🕴

At the same time, criminal organizations continue to look for new ways to attack their victims.

📖 Read

via "Dark Reading: ".

<b>&#9000; Calif. Man Pleads Guilty in Fatal Swatting Case, Faces 20+ Years in Prison &#9000;</b>

<code>A California man who pleaded guilty Tuesday to causing dozens of swatting attacks — including a deadly incident in Kansas last year — now faces 20 or more years in prison.</code><code>Media</code><code>Tyler Raj Barriss, in an undated selfie.</code><code>Tyler Barriss, 25, went by the nickname SWAuTistic on Twitter, and reveled in perpetrating “swatting” attacks. These dangerous hoaxes involve making false claims to emergency responders about phony hostage situations or bomb threats, with the intention of prompting a heavily-armed police response to the location of the claimed incident.</code><code>On Dec. 28, 2018, Barriss placed a call from California to police in Wichita, Kansas, claiming that he was a local resident who’d just shot his father and was holding other family members hostage.</code><code>When Wichita officers responded to the address given by the caller — 1033 W. McCormick — they shot and killed 28-year-old Andrew Finch, a father of two who had done nothing wrong.</code><code>Barriss admitted setting that fatal swatting attack in motion after getting in the middle of a dispute between two Call of Duty gamers, 18-year-old Casey Viner from Ohio and Shane Gaskill, 20, from Wichita.</code><code>Viner allegedly asked Barriss to swat Gaskill. But when Gaskill noticed Barriss’ Twitter account (@swattingaccount) suddenly following him online, he tried to deflect the attack. Barriss says Gaskill allegedly dared him to go ahead with the swat, but then gave Barriss an old home address — 1033 W. McCormick — which was then being occupied by Finch’s family.</code><code>Viner and Gaskill are awaiting trial. A more detailed account of their alleged dispute is told here.</code><code>According to the Justice Department, Barriss pleaded guilty to making hoax bomb threats in phone calls to the headquarters of the FBI and the Federal Communications Commission in Washington, D.C. He also made bomb threat and swatting calls from Los Angeles to emergency numbers in Ohio, New Hampshire, Nevada, Massachusetts, Illinois, Utah, Virginia, Texas, Arizona, Missouri, Maine, Pennsylvania, New Mexico, New York, Michigan, Florida and Canada.</code><code>U.S. Attorney Stephen McAllister said Barriss faces 20 years or more in prison. Barriss is due to be sentenced Jan. 30, 2019.</code><code>Many readers following this story over the past year have commented here that the officer who fired the shot which killed Andrew Finch should also face prosecution. However, the district attorney for the county that encompasses Wichita decided in April that the officer will not face charges, and will not be named because he isn’t being charged with a crime.</code><code>As the victim of a swatting attack in 2013 and two other attempted swattings, I’m glad to finally see a swatting prosecution that may actually serve as a deterrent to this idiotic and extremely dangerous crime going forward.</code><code>It’s also great to see police departments like Seattle’s taking steps to help head off swatting incidents before they happen. Last month, the Seattle Police 911 Center launched a new program that lets residents register their address and corresponding concerns if they feel they may be the target of swatting.</code><code>But it would also be nice if more police forces around the country received additional training on exercising restraint in the use of deadly force, particularly in responding to hostage or bomb threat scenarios that have hallmarks of a swatting hoax.</code><code>For example, perpetrators of swatting often call non-emergency numbers at state and local police departments to carry out their crimes precisely because they are not local to the region and cannot reach the target’s police department by calling 911. This is exactly what Tyler Barriss did in the Wichita case and others. Swatters also often use text-to-speech (TTY) services for the hearing…

🕴 Security Teams Struggle with Container Security Strategy 🕴

Fewer than 30% of firms have more than a basic container security plan in place.

📖 Read

via "Dark Reading: ".

🕴 Small-Time Cybercriminals Landing Steady Low Blows 🕴

High-end crime groups are acquiring the sorts of sophisticated capabilities only nation-states once had, while low-tier criminals maintain a steady stream of malicious activity, from cryptomining to PoS malware.

📖 Read

via "Dark Reading: ".

❌ Pwn2Own Trifecta: Galaxy S9, iPhone X and Xiaomi Mi6 Fall to Hackers ❌

Hacker contest earns participants $325,000 based on the discovery of 18 vulnerabilities.

📖 Read

via "Threatpost | The first stop for security news".

❌ Bitcoin Giveaway Scam Balloons, with Google the Latest Victim ❌

A slew of verified Twitter accounts have been hijacked and altered, used to tweet out a bogus Bitcoin giveaway scam.

📖 Read

via "Threatpost | The first stop for security news".

⚠ Steganography – cool cybersecurity trick or dangerous risk? [VIDEO] ⚠

Burying secret data in plain sight- is it a clever cybersecurity trick, or a way to attract the very attention you wanted to avoid?

📖 Read

via "Naked Security".

⚠ France: Let’s make the internet safer! US: ‘How about NO?!’ ⚠

Don't cry for us, Argentina: Critics saw potential for government meddling without court order, among other issues.

📖 Read

via "Naked Security".

⚠ DARPA uses a remote island to stage a cyberattack on the US power grid ⚠

It enacted a worst-case, "black start" scenario: swaths of the country's grid offline for a month, battery backups exhausted.

📖 Read

via "Naked Security".