🔐 WannaCry: One year later, is the world ready for another major attack? 🔐

ZDNet's Danny Palmer examine's the aftermath of WannaCry, Notpetya, and Bad Rabbit.

📖 Read

via "Security on TechRepublic".

🕴 Establishing True Trust in a Zero-Trust World 🕴

Our goal should not be to merely accept zero trust but gain the visibility required to establish real trust.

📖 Read

via "Dark Reading: ".

🔐 A free decryption tool is available for Thanatos ransomware victims 🔐

ZDNet's Danny Palmer explains the evolution of the world's weirdest ransomware.

📖 Read

via "Security on TechRepublic".

🕴 Dell Forces Password Reset for Online Customers Following Data Breach 🕴

Move prompts questions about scope of intrusion and strength of company's password hashing.

📖 Read

via "Dark Reading: ".

🕴 Anti-Botnet Guide Aims to Tackle Automated Threats 🕴

The international guide is intended to help organizations defend their networks and systems from automated and distributed attacks.

📖 Read

via "Dark Reading: ".

🕴 MITRE Changes the Game in Security Product Testing 🕴

Nonprofit has published its first-ever evaluation of popular endpoint security tools - measured against its ATT&CK model.

📖 Read

via "Dark Reading: ".

🕴 Overall Volume of Thanksgiving Weekend Malware Attacks Lower This Year 🕴

But ransomware attacks go through the roof, new threat data from SonicWall shows.

📖 Read

via "Dark Reading: ".

🔐 The top tech news of 2018, ranked 🔐

It's been a wild of a year for tech. Here are the biggest tech news stories on our readers' minds.

📖 Read

via "Security on TechRepublic".

⚠ Driver loses his car to hackers. TWICE. ⚠

He slapped a tracker on the new one and installed CCTV... which did a fine job of recording the thieves' 90-second-long relay attack.

📖 Read

via "Naked Security".

⚠ 57m Americans’ details leaked online by another misconfigured server ⚠

Misconfigured Elasticsearch servers spilled personal details on 57 million Americans, said reports this week.

📖 Read

via "Naked Security".

🔐 What is a man-in-the-middle attack? 🔐

Here's a quick rundown of what a man-in-the-middle attack is, and why it's so dangerous.

📖 Read

via "Security on TechRepublic".

🔐 Man-in-the-middle attacks: A cheat sheet 🔐

Cybercrime takes on a lot of forms, with one of the oldest and most dangerous being man-in-the-middle attacks. Here's what you need to know about MITM attacks, including how to protect your company.

📖 Read

via "Security on TechRepublic".

⚠ Prisoners allegedly posed as underage girls in $560K sextortion scam ⚠

They allegedly victimized 442 military men by sending nude photos and then calling, pretending to be irate fathers or police.

📖 Read

via "Naked Security".

⚠ Busted! DOJ exposes huge ad-fraud operation, eight charged ⚠

The US Department of Justice has charged eight men with running a vast ad-fraud scheme.

📖 Read

via "Naked Security".

❌ 2014 Marriott Data Breach Exposed, 500M Guests Impacted ❌

The hackers had access to the impacted database since 2014.

📖 Read

via "Threatpost | The first stop for security news".

🔐 What is a man-in-the-disk attack? 🔐

Android users should beware of this dangerous attack that targets their mobile device's storage.

📖 Read

via "Security on TechRepublic".

🕴 New Report Details Rise, Spread of Email-based Attacks 🕴

Criminals are diversifying their target list and tactics in a continuing effort to keep email a valuable attack vector against enterprise victims.

📖 Read

via "Dark Reading: ".

🔐 Man-in-the-disk attacks: A cheat sheet 🔐

A flaw in Android external storage opens up legitimate apps to being hacked and gives illegitimate ones a window to exploit. Learn more about man-in-the-disk attacks, including how to avoid them.

📖 Read

via "Security on TechRepublic".

<b>&#9000; Marriott: Data on 500 Million Guests Stolen in 4-Year Breach &#9000;</b>

<code>Hospitality giant Marriott today disclosed a massive data breach exposing the personal and financial information on as many as a half billion customers who made reservations at any of its Starwood properties over the past four years.</code><code>Media</code><code>Marriott said the breach involved unauthorized access to a database containing guest information tied to reservations made at Starwood properties on or before Sept. 10, 2018, and that its ongoing investigation suggests the perpetrators had been inside the company’s networks since 2014.</code><code>Marriott said the intruders encrypted information from the hacked database (likely to avoid detection by any data-loss prevention tools when removing the stolen information from the company’s network), and that its efforts to decrypt that data set was not yet complete. But so far the hotel network believes that the encrypted data cache includes information on up to approximately 500 million guests who made a reservation at a Starwood property.</code><code>“For approximately 327 million of these guests, the information includes some combination of name, mailing address, phone number, email address, passport number, Starwood Preferred Guest account information, date of birth, gender, arrival and departure information, reservation date and communication preferences,” Marriott said in a statement released early Friday morning.</code><code>Marriott added that customer payment card data was protected by encryption technology, but that the company couldn’t rule out the possibility the attackers had also made off with the encryption keys needed to decrypt the data.</code><code>The hotel chain did not say precisely when in 2014 the breach was thought to have begun, but it’s worth noting that Starwood disclosed its own breach involving more than 50 properties in November 2015, just days after being acquired by Marriott. According to Starwood’s disclosure at the time, that earlier breach stretched back at least one year — to November 2014.</code><code>Back in 2015, Starwood said the intrusion involved malicious software installed on cash registers at some of its resort restaurants, gift shops and other payment systems that were not part of the its guest reservations or membership systems.</code><code>However, this would hardly be the first time a breach at a major hotel chain ballooned from one limited to restaurants and gift shops into a full-blown intrusion involving guest reservation data. In Dec. 2016, KrebsOnSecurity broke the news that banks were detecting a pattern of fraudulent transactions on credit cards that had one thing in common: They’d all been used during a short window of time at InterContinental Hotels Group (IHG) properties, including Holiday Inns and other popular chains across the United States.</code><code>It took IHG more than a month to confirm that finding, but the company said in a statement at the time it believed the intrusion was limited to malware installed at point of sale systems at restaurants and bars of 12 IHG-managed properties between August and December 2016.</code><code>In April 2017, IHG acknowledged that its investigation showed cash registers at more than 1,000 of its properties were compromised with malicious software designed to siphon customer debit and credit card data — including those used at front desks in certain IHG properties.</code><code>Marriott says its own network does not appear to have been affected by this four-year data breach, and that the investigation only identified unauthorized access to the separate Starwood network.</code><code>Starwood hotel brands include W Hotels, St. Regis, Sheraton Hotels & Resorts, Westin Hotels & Resorts, Element Hotels, Aloft Hotels, The Luxury Collection, Tribute Portfolio, Le Méridien Hotels & Resorts, Four Points by Sheraton and Design Hotels that participate in the Starwood Preferred Guest (SPG) progra…

❌ Newsmaker Interview: Katie Moussouris on Improving Bug Bounty Programs ❌

The bug bounty "queen" Katie Moussouris discusses the biggest mistakes that companies launching these programs are making.

📖 Read

via "Threatpost | The first stop for security news".

🔐 Marriott reveals data breach affecting 500 million hotel guests 🔐

Hackers have had access to the Starwood guest reservation database since 2014.

📖 Read

via "Security on TechRepublic".