Equifax breach was ‘entirely preventable’ had it used basic security measures, says House report

Satan Ransomware Variant Exploits 10 Server-Side Flaws

Windows, Linux systems vulnerable to self-propagating 'Lucky' malware, security researchers say.

New Google+ Breach Will Lead to Early Service Shutdown

A breach affecting more than 52 million users was patched, but not before leading to the company rethinking the future of the service.

Nice phone account you have there - shame if something were to happen to it. Samsung fixes ID-theft flaws

If Artem Moskowsky owes you money, its a good time to ask A recently-patched set of flaws in Samsung's mobile site was leaving users open to account theft.…

Google+ hit by second API bug impacting 52.5 million users

Google moves Google+ sunset date forward, from August 2019 to April 2019.

Google Accelerates Google+ Shutdown After New Bug Discovered

The consumer version of Google+ will now be shut down in April instead of August after a bug was found that impacts at least 50 million users.

Sextortion Emails Force Payment via GandCrab Ransomware

Emails say they contain a link with screenshots of victims' compromising activity. In reality, the link executes ransomware.

Google+ security bug gave developers access to non-public data from 52.5M users

Google+ was a bit of a disaster for the company when it was still alive, and now that it’s walking dead, it’s becoming even more of a stone around its neck. After disclosing a major security bug in October that affected just under half a million users ...

2018 Annual Report from AI Now

The research group AI Now just published its annual report. It's an excellent summary of today's AI security challenges, as well as a policy agenda to address them. This is related, and also worth reading.

Microsoft Calls For Facial Recognition Tech Regulation

Data Breaches In The Last 30 Days Affect A Billion People

Amazon Reportedly Fires Workers In Seller Scam Crackdown

Privacy, security fears about ID cards? UK.gov's digital bod has one simple solution: 'Get over it'

Yeah, how about you work for us... Digital minister Margot James reckons Brits need to "get over" their concerns about privacy and cyber security and let the government assign them with ID cards.…

These hackers are using Android surveillance malware to target opponents of the Syrian government

SilverHawk hacking campaign uses fake versions of secure messaging apps like WhatsApp and Telegram to plant spyware on devices.

Android adware tricks ad networks into thinking it's an iPhone to make more money

New Android adware discovered in 22 apps downloaded over two million times.

ACCC goes after Google, Facebook in the name of fake news and data transparency

The consumer watchdog wants to protect the integrity of news content in Australia by holding digital giants accountable over what is available and shared on their platforms. It also wants regulation and transparency around how they collect and use data.

Malicious sites abuse 11-year-old Firefox bug that Mozilla failed to fix

Bug dealt with in Chrome and Edge, but still a problem for Firefox users.

'PowerSnitch' Hacks Androids via Power Banks

Researcher demonstrates how attackers could steal data from smartphones while they charge up.

Bethesda blunders, IRS sounds the alarm, China ransomware, and more

Plus, congress wants more cybersec training, better breach laws Roundup  This week, we saw Linux get pwned, a teen hacker go down, and Julian Assange vowing to stay right where he is.…

Those annoying sextortion scams are redirecting users to ransomware now

Sextortion emails take a dark turn and are now trying to infect users with the GandCrab ransomware.

ThreatList: Gift Card-Themed BEC Holiday Scams Spike

Watch out for emails about gift cards and corporate donations, researcher warn.

Problems with the Squid Emoji

The Monterey Bay Aquarium has some problems with the squid emoji. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here.

Criminals Use Locally Connected Devices to Attack, Loot Banks

Tens of millions of dollars stolen from at least eight banks in East Europe, Kasperksy Lab says.

Linux.org hacked and plastered with anti-transgender filth

Web admin blames public Whois and lack of 2FA Linux.org was hacked on Friday morning, with the hacker plastering the message "G3T 0WNED L1NUX N3RDZ" complete with expletives and a very NSFW image (a hairy asshole).…

DHS looking into tracking Monero and Zcash transactions

DHS has had great success with tracking and analyzing Bitcoin transactions already. They are now looking for similar solutions for tracking "privacy coins."

TA505 Crooks are Now Targeting US Retailers with Personalized Campaigns

Threat group moves away from “smash-and-grab” attacks and adopts a boutique approach to targeting victims.

Back Issues of the NSA's Cryptolog

Five years ago, the NSA published 23 years of its internal magazine, Cryptolog. There were lots of redactions, of course. What's new is a nice user interface for the issues, noting highlights and levels of redaction.

Australia Passes Encryption-Breaking Laws

Kubernetes Deployments Around the World Show Vulnerabilities

Kubernetes owners who expose APIs to the Internet are leaving their systems open to hackers.

Banks Attacked through Malicious Hardware Connected to the Local Network

Kaspersky is reporting on a series of bank hacks -- called DarkVishnya -- perpetrated through malicious hardware being surreptitiously installed into the target network: In 2017-2018, Kaspersky Lab specialists were invited to research a series of cyberth ...

Brit bomb hoax teen who fantasised about being a notorious hacker cops 3 years in jail

So much for the Apophis Squad's Twitter boasts A teenage bomb hoaxer from Watford who taunted the UK's National Crime Agency on Twitter while pretending to be a hacker crew called Apophis Squad has been jailed for three years.…

Using Fuzzing to Mine for Zero-Days

Infosec Insider Derek Manky discusses how new technologies and economic models are facilitating fuzzing in today's security landscape.

UK Supreme Court considers whether spy court should be immune to legal probes

Privacy International lays out its case to El Reg The UK's highest court has this week heard arguments in Privacy International's long-running attempt to challenge decisions made by Britain's shadowy spying oversight court, the Investigatory Powers Tribun ...

The Technology 202: More than 200 companies are calling for a national privacy law. Here's an inside look at their proposal.

Posted by InfoSec News on Dec 07https://www.washingtonp
ost.com/news/powerpost/pa
loma/the-technology-202/2
018/12/06/the-technology-
202-more-than-200-compani
es-are-calling-for-a-nati
onal-privacy-law-here-s-a
n-inside-look-at-their-pr
oposal/5c0819be1b326b60d1 ...

Eastern European banks lose tens of millions of dollars in Hollywood-style hacks

Posted by InfoSec News on Dec 07https://www.zdnet.com/a
rticle/eastern-european-b
anks-lose-tens-of-million
s-of-dollars-in-hollywood
-style-hacks/ By Catalin Cimpanu Zero Day ZDNet December 7, 2018 Cyber-criminal gangs are believed to have stolen tens of mil ...

Senators Introduce Bill to Let Hackers Reports Bugs to DHS

Posted by InfoSec News on Dec 07https://www.nextgov.com
/cybersecurity/2018/12/se
nators-introduce-bill-let
-hackers-reports-bugs-dhs
/153337/ By Heather Kuldell Managing Editor Nextgov 12/06/2018
A bipartisan pair of senators introduced a bill that would req ...

Japan looking at banning Huawei and ZTE from government deals

Land of the Rising Sun could be the next nation to exclude Chinese telco vendors.

Microsoft adopts ethical principles aiming to bar misuse of face recognition technology

Bans use for unlawful discrimination.

Stop making cyber security so boring, difficult and inaccessible: ANZ CISO

“Complex language which scares people…”

Stop making cyber security so scary, difficult and inaccessible: ANZ CISO

Complex language frightens.

Trudeau denies involvement in Huawei arrest

The Canadian government was given a few days' notice of the imminent arrest of Huawei's CFO on behalf of US authorities, with Wanzhou Meng facing a bail hearing on Friday.

Kubernetes Vulnerability Hits Top of Severity Scale

The security issue strikes at some of the basic reasons for the rising popularity of containers as an architecture and Kubernetes as an orchestration mechanism.

Adobe Flash Zero-Day Spreads via Office Docs

Adobe has patched a zero-day in its Flash player after attackers leveraged the exploit in an active campaign.

Clues in Marriott hack implicate China

Government intelligence gathering operation.

ESET Discovers 21 New Linux Malware Variants

Facebook Defends Mark Zuckerberg's Exposed Emails

Bringing Compliance into the SecDevOps Process

Application security should be guided by its responsibility to maintain the confidentiality, integrity, and availability of systems and data. But often, compliance clouds the picture.

Infected WordPress Sites Are Attacking Other WordPress Sites

Researchers identified a widespread campaign of brute force attacks against WordPress websites.

Evidence in Starwood/Marriott Breach May Point to China

Attackers used methods, tools previously used by known Chinese hackers.

Boosting SOC IQ Levels with Knowledge Transfer

Despite shortages of skills and staff, these six best practices can improve analysts' performance in a security operations center.

Facebook Defends Data Policies On Heels of Incriminating Internal Docs

The company allegedly tried to hide away new policy changes that would collect Android app users' call and message logs.

Too little, too late? Should we be faster to point the finger of blame at cyber attackers?

Nations need to come together to condemn hostile cyber activity much sooner, says former Foreign Secretary of Estonia.

Windows 10 security question: How do miscreants use these for post-hack persistence?

Infosec duo worked out how to remotely set their own answers Black Hat  Crafty infosec researchers have figured out how to remotely set answers to Windows 10’s password reset questions “without even executing code on the targeted machine”.…

VPN services 2018: The ultimate guide to protecting your data on the internet

Whether you're in the office or on the road, a VPN is still one of the best ways to protect yourself on the big, bad internet.

The best VPN services: Our 10 favorite vendors for protecting your privacy

Whether you're in the office or on the road, a VPN is still one of the best ways to protect yourself on the big, bad internet. One of these could be your best bet.

More data joy: Email scammers are buying marks' info from legit biz intelligence firms

London Blue gang probably has your firm's org chart Black Hat  A Nigerian email scammer gang has evolved to the point where it has corporate-style specialist departments and uses commercial business intelligence data brokers to help plan its attacks.…

Brits' DNA data sent to military base after 'foreign' hack attacks – report

100,000 Genomes Project is secure, insists chair An ambitious project to map the DNA of a million Brits has experienced such sustained hack attacks that officials have had to shift the data to a Ministry of Defence (MoD) facility in Wiltshire.…

Australia now has encryption-busting laws as Labor capitulates

So-called protections in the Bill are necessary, Opposition leader Bill Shorten has said.

Pencil manufacturers rejoice: Oz government doesn't like e-voting

Paper's safer, says parliamentary committee An Australian parliamentary committee has nixed the idea of internet voting for federal elections Down Under, for now.…

Google kills off Allo to focus on Messages

Google has said it will bring all of Allo's best features to Messages, with the former to be killed off in March 2019.

Twelve US states join for the first time to file multistate data breach lawsuit

Lawsuit details a long list of security fails on MIE's part.

Huawei chief financial officer arrested in Vancouver

Faces extradition to the US over Iran sanctions busting allegations.

Govt to green-light 'selectively' targeted vulnerabilities

Under its encryption bill.

It's December 2018, and your Mac's kernel can be pwned by a rogue app

Apple moves to shore up a baker's dozen weak points in macOS Apple has released a fresh set of updates for its Mac and iOS platforms.…

A botnet of over 20,000 WordPress sites is attacking other WordPress sites

Botnet is still up and running but law enforcement has been notified.

Boffins confirm AI GAN see through your text CAPTCHA test

Attack bots unleashed as major sites left wide open to abuse If you're one of those people who hates picking out cars, street signs and other objects in CAPTCHA image grids, then get used to it because the days of text-based alternatives are numbered.…

Toyota Builds Open-Source Car-Hacking Tool

'PASTA' testing platform specs will be shared via open-source.

Flash zero-day... leveraging ActiveX…embedded in Office Doc...BINGO!

It's like a greatest hits album of terrible security policies Stop us if you've heard this one: A Flash zero-day vulnerability is being actively targeted in the wild.…

Google's Cloud Security Command Center gets beta release

Cloud Security Command Center is Google's dashboard for assessing and remediating security risks in a GCP environment.

Google Cloud Security Command Center Now in Beta

The beta release of Google Cloud SCC will include broader coverage across the cloud platform and more granular access controls, among other features.

Republican Committee Email Hacked During Midterms

The National Republican Congressional Committee detected the compromise of four staffers' email accounts in April.

Windows 10 Security Questions Prove Easy for Attackers to Exploit

New research shows how attackers can abuse security questions in Windows 10 to maintain domain privileges.

North Korean APT Uses Chrome Extension To Infect Victims

GOPwned: Republicans Fall Victim To Email Hack

Nearly 250 Pages Of Devasting Internal Facebook Documents Posted Online By UK Parliament

The Case for a Human Security Officer

Wanted: a security exec responsible for identifying and mitigating the attack vectors and vulnerabilities specifically targeting and involving people.