🕴 Credential Compromises By the Numbers 🕴

Recent statistics show just how much credential stealing has become a staple in the attacker playbook.

📖 Read

via "Dark Reading: ".

❌ Razy Malware Attacks Browser Extensions to Steal Cryptocurrency ❌

The malware targets victims in multiple, sneaky ways as they move around the web.

📖 Read

via "Threatpost | The first stop for security news".

🕴 Satya Nadella: Privacy Is a Human Right 🕴

In a talk at the World Economic Forum, Microsoft's CEO voiced support for GDPR and expressed hope the United States creates a similar approach to privacy.

📖 Read

via "Dark Reading: ".

🕴 Ukraine Sees Surge in Election-Targeted Cyberattacks 🕴

The nation suspects Russia's hand in the attacks, which seem aimed at disrupting the upcoming presidential election.

📖 Read

via "Dark Reading: ".

<b>&#9000; Three Charged for Working With Serial Swatter &#9000;</b>

<code>The U.S. Justice Department has filed criminal charges against three U.S. men accused of swatting, or making hoax reports of bomb threats or murders in a bid to trigger a heavily armed police response to a target’s address. Investigators say the men, aged 19 to 23, all carried out the attacks with the help of Tyler Barriss, a convicted serial swatter whose last stunt in late 2018 cost an Oklahoma man his life.</code><code>Media</code><code>Image: FBI.gov</code><code>FBI agents on Wednesday arrested Neal Patel, 23, of Des Plaines, Ill. and Tyler Stewart, 19 of Gulf Breeze, Fla. The third defendant, Logan Patten, 19, of Greenwood, Mo., agreed to turn himself in. The men are charged in three separate indictments with conspiracy and conveying false information about the use of explosive devices.</code><code>Investigators say Patten, who used the Twitter handle “@spared,” hired Barriss in December 2017 to swat individuals and a high school in Less’s Summit, Mo.</code><code>Around the same time, Stewart, a.k.a. “@tragic” on Twitter, allegedly worked with Barriss to make two phony bomb threats to evacuate a high school in Gurnee, Ill. In that incident, Barriss admitted telling police in Gurnee he had left explosives in a classroom and was high on methamphetamine and was thinking about shooting teachers and students.</code><code>Also in December 2017, Patel allegedly worked with Barriss to plan a bomb threat targeting a video game convention in Dallas, Texas. Patel is also accused of using stolen credit cards to buy items of clothing for Barriss.</code><code>The Justice Department’s media release on the indictments doesn’t specify which convention Barriss and Patel allegedly swatted, but a Wired story from last year tied Barriss to a similarly timed bomb threat that caused the evacuation of a major Call of Duty tournament at the Dallas Convention Center.</code><code>“When the social media star SoaR Ashtronova tweeted about the confusion she felt as she fled the event beneath the whir of police helicopters, Barriss taunted her from one of his Twitter accounts: ‘It got ran, baby girl. Thats what happens,” Wired reported.</code><code>Interestingly, it was a dispute over a $1.50 grudge match in a Call of Duty game that would ultimately lead to Barriss’s final — and fatal — swatting a year later. On Dec. 28, 2018, Barriss phoned police in Wichita, Kan. from his location in California, telling them he was a local man who’d just shot his father and was holding other family members hostage.</code><code>Prosecutors say Barriss did so after getting in the middle of a dispute between two Call of Duty gamers, 18-year-old Casey Viner from Ohio and Shane Gaskill, 20, from Wichita. Viner allegedly asked Barriss to swat Gaskill. But when Gaskill noticed Barriss’ Twitter account suddenly following him online, he tried to deflect the attack. Barriss says Gaskill allegedly dared him to go ahead with the swat, but then gave Barriss an old home address — which was then being occupied by someone else.</code><code>When Wichita police responded to the address given by Barriss, they shot and killed 28-year-old Andrew Finch, a father of two who had no party to the dispute and did not know any of the three men.</code><code>Both Viner and Gaskill have been charged with wire fraud, conspiracy and obstruction of justice. Barriss pleaded guilty in Nov. 2018 to a total of 51 charges brought by federal prosecutors in Los Angeles, Kansas and Washington, D.C. He has agreed to serve a sentence of between 20 to 25 years in prison. Barrris is slated to be sentenced on March 1, 2019.</code><code>Stewart’s attorney declined to comment. Lawyers assigned to Patel and Patten could not be reached for comment.</code><code>As the victim of a swatting attack in 2013 and several other unsuccessful attempts, I am pleased to see federal authorities continue to take this crime seriously. According to the FBI,…

❌ Phishing Campaign Delivers Nasty Ransomware, Credential-Theft Two-Punch ❌

A spate of phishing emails with Word attachments deliver both the Gandcrab ransomware and Ursnif executable.

📖 Read

via "Threatpost | The first stop for security news".

🔐 Major vulnerability found in Android ES File Explorer app 🔐

Popular application ES File Explorer for Android has a significant vulnerability, putting your data at risk. Learn what's involved and how to remediate the threat.

📖 Read

via "Security on TechRepublic".

❌ Threatpost News Wrap Podcast For Jan. 25 ❌

From a massive GDPR fine on a big tech company, to an emergency government security alert, here are the top security stories of the week.

📖 Read

via "Threatpost | The first stop for security news".

🔐 5 ways to enforce company security 🔐

There are several actions companies can take to improve overall employee awareness about security. View the top five below.

📖 Read

via "Security on TechRepublic".

❌ LabKey Vulnerabilities Threaten Medical Research Data ❌

LabKey Server version 18.3.0-61806.763, released on January 16, patches all three issues, so users should update as soon as possible.

📖 Read

via "Threatpost | The first stop for security news".

🕴 Internet Society to Issue Privacy Code of Conduct 🕴

Security pros know all too well that following basic privacy guidelines can cut down on human errors that can lead to serious security breaches.

📖 Read

via "Dark Reading: ".

⚠ Monday review – the hot 24 stories of the week ⚠

From the US gov's emergency directive to the 10 Year Challenge, and everything in between. It's weekly roundup time.

📖 Read

via "Naked Security".

⚠ YouTube subscribers getting spammed by celebrity imposters ⚠

YouTube personality Philip DeFranco warned that the messages pretending to be from him and other top influencers are scams.

📖 Read

via "Naked Security".

⚠ Even Microsoft can’t escape ‘reply all’ email storms ⚠

Of all the calamities that befall email users, few are more dreaded than the ‘reply all’ storm.

📖 Read

via "Naked Security".

⚠ Twitter scammers jump in on real-time complaints to companies ⚠

”Hi there,” said the polite (and fake) help desk, leading to a back-and-forth between a lying scammer and a lying security analyst.

📖 Read

via "Naked Security".

⚠ BGP secure routing experiment ends in online row ⚠

An experiment to make the internet safer ended up breaking parts of it last week.

📖 Read

via "Naked Security".

⚠ How to protect yourself this Data Privacy Day ⚠

Today is Data Privacy Day. We asked around at Sophos for some tips from people that live security day in and day out.

📖 Read

via "Naked Security".

⚠ How my Instagram account got hacked ⚠

After years of embarrassment, I'm finally ready to admit how and why my Instagram account got hacked.

📖 Read

via "Naked Security".

❌ WordPress Users Urged to Delete Zero-Day-Ridden Plugin ❌

The development team of the vulnerable Total Donations plugin appears to have abandoned it, and did not respond to inquiries from researchers.

📖 Read

via "Threatpost | The first stop for security news".

🕴 3 Ways Companies Mess Up GDPR Compliance the Most 🕴

The best way to conform to the EU's new privacy regulation is to assume that you don't need to hold on to personal data, versus the opposite.

📖 Read

via "Dark Reading: ".

❌ Active Scans Target Vulnerable Cisco Routers for Remote Code-Execution ❌

Cyberattackers are targeting a pair of just-patched vulnerabilities that allow remote unauthenticated information disclosure leading to remote code-execution.

📖 Read

via "Threatpost | The first stop for security news".