🕴 Retailers Make Big Strides In Offering Clear Unsubscribe Links 🕴

Fifth annual Online Trust Alliance survey said retailers get good marks for offering clear unsubscribe links, using tools like SPF and DKIM and honoring unsubscribe requests.

📖 Read

via "Dark Reading: ".

❌ Podcast: Breaking Down the Magecart Threat (Part Two) ❌

In part two of our podcast series on Magecart, we talk to expert Yonathan Klijnsma, who has been tracking the threat for years.

📖 Read

via "Threatpost | The first stop for security news".

🕴 Holiday Hacks: 6 Cyberthreats to Watch Right Now 🕴

'Tis the season for holiday crafted phishes, scams, and a range of cyberattacks. Experts list the hottest holiday hacks for 2018.

📖 Read

via "Dark Reading: ".

<b>&#9000; What the Marriott Breach Says About Security &#9000;</b>

<code>We don’t yet know the root cause(s) that forced Marriott this week to disclose a four-year-long breach involving the personal and financial information of 500 million guests of its Starwood hotel properties. But anytime we see such a colossal intrusion go undetected for so long, the ultimate cause is usually a failure to adopt the most important principle in cybersecurity defense that applies to both corporations and consumers: Assume you are compromised.</code><code>TO COMPANIES</code><code>For companies, this principle means accepting the notion that it is no longer possible to keep the bad guys out of your networks entirely. This doesn’t mean abandoning all tenets of traditional defense, such as quickly applying software patches and using technologies to block or at least detect malware infections.</code><code>It means accepting that despite how many resources you expend trying to keep malware and miscreants out, all of this can be undone in a flash when users click on malicious links or fall for phishing attacks. Or a previously unknown security flaw gets exploited before it can be patched. Or any one of a myriad other ways attackers can win just by being right once, when defenders need to be right 100 percent of the time.</code><code>The companies run by leaders and corporate board members with advanced security maturity are investing in ways to attract and retain more cybersecurity talent, and arranging those defenders in a posture that assumes the bad guys will get in.</code><code>This involves not only focusing on breach prevention, but at least equally on intrusion detection and response. It starts with the assumption that failing to respond quickly when an adversary gains an initial foothold is like allowing a tiny cancer cell to metastasize into a much bigger illness that — left undetected for days, months or years — can cost the entire organism dearly.</code><code>The companies with the most clueful leaders are paying threat hunters to look for signs of new intrusions. They’re reshuffling the organizational chart so that people in charge of security report to the board, the CEO, and/or chief risk officer — anyone but the Chief Technology Officer.</code><code>They’re constantly testing their own networks and employees for weaknesses, and regularly drilling their breach response preparedness (much like a fire drill). And, apropos of the Marriott breach, they are finding creative ways to cut down on the volume of sensitive data that they need to store and protect.</code><code>Media</code><code>TO INDIVIDUALS</code><code>Likewise for individuals, it pays to accept two unfortunate and harsh realities:</code><code>Reality #1: Bad guys already have access to personal data points that you may believe should be secret but which nevertheless aren’t, including your credit card information, Social Security number, mother’s maiden name, date of birth, address, previous addresses, phone number, and yes — even your credit file.</code><code>Reality #2: Any data point you share with a company will in all likelihood eventually be hacked, lost, leaked, stolen or sold — usually through no fault of your own. And if you’re an American, it means (at least for the time being) your recourse to do anything about that when it does happen is limited or nil.</code><code>Marriott is offering affected consumers a year’s worth of service from a company owned by security firm Kroll that advertises the ability to scour cybercrime underground markets for your data. Should you take them up on this offer? It probably can’t hurt as long as you’re not expecting it to prevent some kind of bad outcome. But once you’ve accepted Realities #1 and #2 above it becomes clear there is nothing such services could tell you that you don’t already know.</code><code>Once you’ve owned both of these realities, you realize that expecting another company to safeguard your security is a fool’s errand…

⚠ Monday review – the hot 21 stories of the week ⚠

From Black Mirror-esque social ratings IRL to the guy who had his car stolen by hackers - twice, and everything in between. It's weekly roundup time.

📖 Read

via "Naked Security".

⚠ Faster fuzzing ferrets out 42 fresh zero-day flaws ⚠

A group of researchers has found 42 zero-day flaws in a range of software tools using a new take on an old concept - fuzzing.

📖 Read

via "Naked Security".

⚠ Microsoft cracks down on tech support scams, 16 call centers raided ⚠

Police raided 16 Indian call centers last week - a second big raid sparked by Microsoft filing complaints about tech support scammers.

📖 Read

via "Naked Security".

⚠ Router attack exploits UPnP and NSA malware to target PCs ⚠

The UPnProxy router compromise uncovered earlier in 2018 is now being used to attack computers on networks connected to the same gateways.

📖 Read

via "Naked Security".

⚠ Printers pulled into 9100 port attack spew PewDiePie propaganda ⚠

Printers worldwide printed messages urging people to subscribe to the vlogger's YouTube channel in a demo of a well-known vulnerability.

📖 Read

via "Naked Security".

❌ YouTuber PewDiePie Promoted Via 50K Hacked Printers ❌

The incident sheds light on just how insecure printers are.

📖 Read

via "Threatpost | The first stop for security news".

🕴 Filling the Cybersecurity Jobs Gap - Now and in the Future 🕴

Employers must start broadening their search for experienced security professionals to include people with the right traits rather than the right skills.

📖 Read

via "Dark Reading: ".

❌ iOS Fitness Apps Robbing Money From Apple Victims ❌

The two apps, “Fitness Balance App” and “Calories Tracker app,” were tricking users into payments of $120.

📖 Read

via "Threatpost | The first stop for security news".

❌ Lenovo Ordered to Pay $7.3M in Superfish Fiasco ❌

The laptop giant will settle a 32-state class-action lawsuit stemming from pre-installing vulnerable ad-targeting software.

📖 Read

via "Threatpost | The first stop for security news".

🔐 5 major data breach predictions for 2019 🔐

Biometrics and gaming are just a couple of the new cyberattack vectors professionals can expect in 2019. Here is what else to look out for.

📖 Read

via "Security on TechRepublic".

❌ U.S. Military Members Catfished and Hooked for Thousands of Dollars ❌

Prisoners in South Carolina posed convincingly as beautiful women on social media platforms.

📖 Read

via "Threatpost | The first stop for security news".

🕴 Microsoft, Mastercard Aim to Change Identity Management 🕴



📖 Read

via "Dark Reading: ".

❌ Chris Vickery on the Marriott Breach and a Rash of Recent High-Profile Hacks ❌

In this Newsmaker Interview, ‘breach hunter’ Chris Vickery explores a recent spate of breaches from Marriott, USPS and Dell EMC.

📖 Read

via "Threatpost | The first stop for security news".

🔐 Huawei's smartphone OS aims to challenge iOS/Android dominance: Can it succeed? 🔐

Huawei is developing their own OS as a contingency plan in the event US sanctions make using Android unviable. In a crowded market, is there room for a third OS?

📖 Read

via "Security on TechRepublic".

🕴 'Influence Agents' Used Twitter to Sway 2018 Midterms 🕴

About 25% of political support in Arizona and Florida was generated by influence agents using Twitter as a platform, research shows.

📖 Read

via "Dark Reading: ".

🕴 First Lawsuits Filed in Starwood Hotels' Breach 🕴

Class-action suits have been filed on behalf of guests and shareholders, with more expected.

📖 Read

via "Dark Reading: ".

❌ Lawsuit Claims Pegasus Spyware Helped Saudis Spy on Khashoggi ❌

The lawsuit alleges that NSO Group violated international law by allowing Pegasus to be used by oppressive regimes to hunt dissidents and journalists.

📖 Read

via "Threatpost | The first stop for security news".