🔐 LinkedIn used 18M non-member emails to target Facebook ads. Were you a victim? 🔐

A Data Protection Commissioner investigation found that LinkedIn violated data protection policies shortly before onset of GDPR.

📖 Read

via "Security on TechRepublic".

🕴 Paper Trail Absence May Still Plague 2020 Election 🕴

The recommendation for paper ballots may go unheeded in all or part of at least 6 states in the next national election.

📖 Read

via "Dark Reading: ".

🕴 7 Real-Life Dangers That Threaten Cybersecurity 🕴

Cybersecurity means more than bits and bytes; threats are out there IRL, and IT pros need to be prepared.

📖 Read

via "Dark Reading: ".

<b>&#9000; Half of all Phishing Sites Now Have the Padlock &#9000;</b>

<code>Maybe you were once advised to “look for the padlock” as a means of telling legitimate e-commerce sites from phishing or malware traps. Unfortunately, this has never been more useless advice. New research indicates that half of all phishing scams are now hosted on Web sites whose Internet address includes the padlock and begins with “https://”.</code><code>Media</code><code>A live Paypal phishing site that uses https:// (has the green padlock).</code><code>Recent data from anti-phishing company PhishLabs shows that 49 percent of all phishing sites in the third quarter of 2018 bore the padlock security icon next to the phishing site domain name as displayed in a browser address bar. That’s up from 25 percent just one year ago, and from 35 percent in the second quarter of 2018.</code><code>This alarming shift is notable because a majority of Internet users have taken the age-old “look for the lock” advice to heart, and still associate the lock icon with legitimate sites. A PhishLabs survey conducted last year found more than 80% of respondents believed the green lock indicated a website was either legitimate and/or safe.</code><code>In reality, the https:// part of the address (also called “Secure Sockets Layer” or SSL) merely signifies the data being transmitted back and forth between your browser and the site is encrypted and can’t be read by third parties. The presence of the padlock does not mean the site is legitimate, nor is it any proof the site has been security-hardened against intrusion from hackers.</code><code>Media</code><code>A live Facebook phish that uses SSL (has the green padlock).</code><code>Most of the battle to combat cybercrime involves defenders responding to offensive moves made by attackers. But the rapidly increasing adoption of SSL by phishers is a good example in which fraudsters are taking their cue from legitimate sites.</code><code>“PhishLabs believes that this can be attributed to both the continued use of SSL certificates by phishers who register their own domain names and create certificates for them, as well as a general increase in SSL due to the Google Chrome browser now displaying ‘Not secure’ for web sites that do not use SSL,” said John LaCour, chief technology officer for the company. “The bottom line is that the presence or lack of SSL doesn’t tell you anything about a site’s legitimacy.”</code><code>The major Web browser makers work with a number of security organizations to index and block new phishing sites, often serving bright red warning pages that flag the page of a phishing scam and seek to discourage people from visiting the sites. But not all phishing scams get flagged so quickly.</code><code>I spent a few minutes browsing phishtank.com for phishing sites that use SSL, and found this cleverly crafted page that attempts to phish credentials from users of Bibox, a cryptocurrency exchange. Click the image below and see if you can spot what’s going on with this Web address:</code><code>Media</code><code>This live phish targets users of cryptocurrency exchange Bibox. Look carefully at the URL in the address bar, and you’ll notice a squiggly mark over the “i” in Bibox. This is an internationalized domain name, and the real address is https://www.xn--bbox-vw5a[.]com/login</code><code>

</code><code>Load the live phishing page at https://www.xn--bbox-vw5a[.]com/login (that link has been hobbled on purpose) in Google Chrome and you’ll get a red “Deceptive Site Ahead” warning. Load the address above — known as “punycode” — in Mozilla Firefox and the page renders just fine, at least as of this writing.</code><code>This phishing site takes advantage of internationalized domain names (IDNs) to introduce visual confusion. In this case, the “i” in Bibox.com is rendered as the Vietnamese character “&#7881;,” which is extremely difficult to distinguish in a URL address bar.</code><code>As KrebsOnSecurity noted in March…

🕴 Transforming into a CISO Security Leader 🕴

Are you thinking of changing your career route from techie to CISO? Are you making the right choice? Only you know for sure.

📖 Read

via "Dark Reading: ".

❌ User Confidence in Smartphone Security Abysmal ❌

Sixty-six of percent of phone users said they had suffered data-related harm: 11 percent suffered identity theft, 22 percent account hacking, 14 percent credit cards hacking and 12 percent financial fraud. 

📖 Read

via "Threatpost | The first stop for security news".

🔐 IoT security market will hit $9.88B by 2025, as privacy issues abound 🔐

As IoT devices flood the market, consumers are pushing for more privacy initiatives, according to recent Grand View Research report.

📖 Read

via "Security on TechRepublic".

ATENTION‼ New - CVE-2017-1418

IBM Integration Bus 9.0.0.0, 9.0.0.11, 10.0.0.0, and 10.0.0.14 (including IBM WebSphere Message Broker 8.0.0.0 and 8.0.0.9) has insecure permissions on certain files. A local attacker could exploit this vulnerability to modify or delete these files with an unknown impact. IBM X-Force ID: 127406.

📖 Read

via "National Vulnerability Database".

🕴 Ransomware Attack Forced Ohio Hospital System to Divert ER Patients 🕴

Malware infection fallout sent ambulances away from East Ohio Regional Hospital and Ohio Valley Medical Center over the Thanksgiving weekend.

📖 Read

via "Dark Reading: ".

❌ USPS, Amazon Data Leaks Showcase API Weaknesses ❌

The incidents affected millions, just as Black Friday, Cyber Monday and the holiday shopping season kicked off.

📖 Read

via "Threatpost | The first stop for security news".

🕴 USPS Web Vuln Exposes Data of 60 Million 🕴

The US Postal Service recently fixed a security bug that allowed any USPS.com account holder to view or change other users' data.

📖 Read

via "Dark Reading: ".

❌ Mobile Rotexy Malware Touts Ransomware, Banking Trojan Functions ❌

A mobile malware has accelerated its activity in 2018, launching more than 70k attacks in August through October.

📖 Read

via "Threatpost | The first stop for security news".

🔐 Microsoft details the causes of its recent multi-factor authentication meltdown 🔐

Microsoft has posted a root cause analysis of the multifactor authentication issue which hit a number of its customers worldwide last week. Here's what happened.

📖 Read

via "Security on TechRepublic".

❌ Knuddels Flirt App Slapped with Hefty Fine After Data Breach ❌

It's Germany's first GDPR fine, for an incident that affected millions of accounts.

📖 Read

via "Threatpost | The first stop for security news".

🕴 Buckle Up: A Closer Look at Airline Security Breaches 🕴

Cyberattacks on airports and airlines are often unrelated to passenger safety - but that's no reason to dismiss them, experts say.

📖 Read

via "Dark Reading: ".

⚠ Parents slam “weirdo” fraudsters for using child’s Facebook pic for cash ⚠

Did you help spread the viral scowling Pop-Tart™-deprived kid photo last week? Can't be helped, mom said, but using it to raise cash was "lame."

📖 Read

via "Naked Security".

⚠ LinkedIn rapped for targeting ads at 18 million Facebook users ⚠

What upset the Data Protection Commissioner: none of the 18 million email addresses were those of LinkedIn users.

📖 Read

via "Naked Security".

⚠ Google Maps scammers put their own phone numbers onto bank listings ⚠

Once they get victims on the phone, the crooks get their account PINs and CVV numbers for debit/credit cards and then drain their accounts.

📖 Read

via "Naked Security".

🕴 See the Future of Cybersecurity at Black Hat Europe 🕴

New tools, techniques, and a plan for training a new generation of crack security experts are all in the cards for attendees of Black Hat Europe in London next week.

📖 Read

via "Dark Reading: ".

⚠ Microsoft patches Patch Tuesday’s Outlook 2010 problem patch ⚠

Just weeks after issuing a Windows 10 patch of doom that started deleting users’ precious files, Microsoft ‘fixed’ Outlook 2010 with a November Patch Tuesday update that promptly borked it.

📖 Read

via "Naked Security".

🔐 How to install AIDE intrusion detection system on CentOS 7 🔐

Your CentOS 7 servers are rock solid, but could still use a bit of help. Find out how to install an easy to use intrusion detection system in less than five minutes.

📖 Read

via "Security on TechRepublic".