Schneier warns of 'perfect storm': Tech is becoming autonomous, and security is garbage

Tel Aviv treated to Brucey's bonus views Israel Cyber Week  With insecure computers in charge, the healthcare and transportation sectors have become a nexus of security problems, infosec veteran Bruce Schneier warned delegates at Israel Cyber Week.…

Don't panic, but your baby monitor can be hacked into a spycam

Researchers confirm hardware vulnerable to remote attacks Security researchers say they can back up a mother's claim that her baby monitor had been remotely hacked and used to spy on her family.…

Destructive Nation-State Cyber Attacks Will Rise, Say European Infosec Pros

More than 90 percent of respondents in a Tripwire survey in Europe expect attacks by state-sponsored threat actors to increase in the next 12 months.

PayPal shopping spree continues, buys Simility for $120 million

The purchase is the fourth acquisition in the last 12 months.

Want to know what all that Fortnite hype is about? Android users need to be careful

Malware writers preying on the game-curious with fake apps With online gaming hit Fornite set to make its debut on Android, malware writers are already playing on the game's hype to ensnare victims.…

Artificial Intelligence & the Security Market

A glimpse into how two new products for intrusion detection and entity resolution are using AI to help humans do their jobs.

Click2Gov Breaches Attributed to WebLogic Application Flaw

At least 10 US cities running Click2Gov software have alerted citizens to a data breach, but it turns out the problem was in the application server.

Over half of Americans would stop using an app if their messages could be read by others

Social media platforms must evolve to higher privacy standards -- to stop their users leaving for more secure channels.

Google adds a search feature to account settings to ease use

Google has announced a refresh of the Google Accounts user interface. The changes are intended to make it easier for users to navigate settings and review data the company has associated with an account — including information relating to devices, paym ...

WannaCry is back! (Psych. It's just phisher folk doing what they do)

Spamming scum fire out phishing frighteners An unusually large wave of phishing emails was spewed out this morning, with recipients warned that all their devices had been infected by WannaCry.…

Private browsing: 16 good reasons to use incognito mode

Also known as private browsing or porn mode, your browser privacy setting has all sorts of useful applications that have nothing to do with hiding the consumption of adult content.

White House Email Security Faux Pas?

The Executive Office of the President isn't complying with the DMARC protocol, but that has fewer implications than some headlines would suggest.

Algeria Shut Down the Internet to Prevent Students from Cheating on Exams

Algeria shut the Internet down nationwide to prevent high-school students from cheating on their exams. The solution in New South Wales, Australia was to ban smartphones.

Cisco patches critical Nexus flaws: Are your switches vulnerable?

You'll need to wade through Cisco's advisories to work out if software you're running is vulnerable or already fixed.

​Cybersecurity: Why this Spanish region has just created new research center

Amid recent political upheaval, Catalonia in northeastern Spain is bringing together its security initiatives.

Israel cyberczar drops hints about country's new security initiative

PM pops in to brag about industry wins Israel Cyber Week  Israel is planning to develop a "state-level cyber-shield" to improve its resilience against hacking and malware, the country's newly appointed cyberczar said on Wednesday.…

Script Kiddie Gets 20 Months After DDoSing 911

Hackers Rob Bithumb Of $32m

China-Based Hackers Burrow Inside Satellite, Defense, And Telecom Firms

Tesla Sues Former Worker For Hacking

Tesla names former Gigafactory hand as 'sabotage' mastermind

Musk blames bad Tripp Tesla has filed suit against the man it claims was behind an effort to sabotage the electric car maker.…

China-Based Cyber Espionage Campaign Targets Satellite, Telecom, Defense Firms

Threat group Thrip is using three computers based in China to steal data from targeted companies in Southeast Asia and the US, Symantec says.

Private sector needs a little sumthin' sumthin' to get it sharing threat intel – US security chap

Sharing's caring, intone government bods Israel Cyber Week  The UK's National Cyber Security Center, the information assurance division of GCHQ, might be getting a regulatory function or charging for its services before settling into the role of encourag ...

New Phishing Scam Reels in Netflix Users to TLS-Certified Sites

Researchers are warning of a new Netflix phishing scam that leads to sites with valid TLS certificates.

At last, a use for Intel's SGX – locking AI and blockchain, says Intel

Bias-enabling algorithms and smart contract tech no one quite trusts now easier to secure At the Cyber Week security conference in Israel on Tuesday, chip giant Intel plans to discuss how it is addressing threats to the overexposed tech celebrities known ...

Alphabet Launches VirusTotal Monitor to Stop False Positives

Alphabet's Chronicle security division releases VirusTotal Monitor, a tool for developers to check if their product will be flagged as malware.

The dumbest passwords people still use

Everybody knows that 12345 is a bad password. But what they're using instead isn't much stronger

Improving the Adoption of Security Automation

Four barriers to automation and how to overcome them.

Mylobot Malware Brings New Sophistication to Botnets

The malware pulls together a variety of techniques to gain a foothold and remain undiscovered.

Shared, not stirred: GCHQ chief says Europe needs British spies

Director insists collaboration will continue after Brexit The head of GCHQ has publicly called for security co-operation with Britain's EU allies to continue after Brexit.…

World Cup 2018: The tech security challenges around the big event

All big events have tech security implications, but the World Cup in Russia throws up a few additional issues.

Hot new application for blockchain: How does botnet control sound?

It could happen, warns researcher BSides Tel Aviv  Blockchain technologies might be abused to create a takedown-resistant infrastructure for botnets.…

​South Korean crypto exchange Bithumb hacked

South Korean cryptocurrency exchange Bithumb has been hacked and tokens worth 35 billion won ($31.5 million) have been stolen, following the hack on compatriot Coinrail earlier this month.

Intel Hyperthreading causes Spectre worries

OpenBSD disables it via update.

Most Websites and Web Apps No Match for Attack Barrage

The average website is attacked 50 times per day, with small businesses especially vulnerable.

APT15 Pokes Its Head Out With Upgraded MirageFox RAT

This is the first evidence of the China-linked threat actor's activity since hacked the U.K. government and military in 2017 (which wasn't made public until 2018).

Olympic Destroyer Returns to Target Biochemical Labs

The threat actors appear to be in a reconnaissance phase, which could be a prelude to a larger cyber-sabotage attack meant to destroy and paralyze infrastructure.

'Olympic Destroyer' Reappears in Attacks on Europe, Russia

The attack group known for targeting the 2018 Winter Olympics has resurfaced in campaigns against European financial and biochem companies.

Verizon stops selling customer location to two data brokers after one is caught leaking it

Verizon is cutting off access to its mobile customers’ real-time locations to two third-party data brokers “to prevent misuse of that information going forward.” The company announced the decision in a letter sent to Senator Ron Wyden (D-OR), who al ...

How to Prepare for 'WannaCry 2.0'

It seems inevitable that a more-powerful follow-up to last year's malware attack will hit sooner or later. You'd better get prepared.

CrowdStrike Secures $200M Funding Round

The new funding round brings the company's valuation to more than $3 billion.

Cisco CPO: Privacy Is Not About Secrecy or Compliance

Michelle Dennedy sat down with Dark Reading at the recent Cisco Live to set the record straight about privacy, regulation, encryption, and more.

5 Tips for Integrating Security Best Practices into Your Cloud Strategy

Do 'cloud-first' strategies create a security-second mindset?

Hackers Who Sabotaged The Olympic Games Return For More Mischief

Elon Musk emails Tesla workers: 'We've been extensively sabotaged by employee'

Tesla employee leaks sensitive Tesla data to third parties and tried to sabotage its manufacturing software.

Free Societies are at a Disadvantage in National Cybersecurity

Jack Goldsmith and Stuart Russell just published an interesting paper, making the case that free and democratic nations are at a structural disadvantage in nation-on-nation cyberattack and defense. From a blog post: It seeks to explain why the United Sta ...

Um, excuse me. Do you have clearance to patch that MRI scanner?

Healthcare regulations working against cybersecurity, claims expert Israel Cyber Week  Healthcare regulations oblige medical equipment vendors to focus on developing the next generation of technologies rather than addressing current cybersecurity issues, ...

Pass gets a fail: Simple Password Store suffers GnuPG spoofing bug

Brinkmann files third signature spoof vulnerability in a month Security researcher Marcus Brinkmann has turned up another vulnerability in the GnuPG cryptographic library, this time specific to the Simple Password Store.…

Apple pays $9m for iOS devices bricked by security test

Contacts 5000 customers.

​Attorney-General'
s Department caught up in PageUp breach

The Attorney-General's Department joins Wesfarmers, the National Australia Bank, Telstra, the Reserve Bank of Australia, Australia Post, Medibank, and the ABC as those potentially affected by the PageUp data breach.

Yubico snatched my login token vulnerability to claim a $5k Google bug bounty, says bloke

USB gizmo biz apologies amid infosec drama Yubico has apologized to a security vulnerability researcher who had complained the dongle peddler lifted his work to nab a $5,000 Google bug bounty.…

Exposed Container Orchestration Systems Putting Many Orgs at Risk

More than 22,600 open container orchestration and API management systems discovered on the Internet.

Google Home, Chromecast Leak Location Information

The devices don’t require authentication for connections received on a local network; and, HTTP is used to configure or control embedded devices.

Mass. Man Pleads Guilty in ATM Jackpotting Operation

Citizens Bank ATM and others targeted in the scheme.

macOS QuickLook Feature Leaks Data Despite Encrypted Drive

Researchers demonstrate how an encrypted macOS hard drive can still leak unprotected data via the operating system’s Finder and QuickLook feature.

Vulnerabilities in these IoT cameras could give attackers full control, warn researchers

Researchers at VDOO discover vulnerabilities which, if left unpatched, could allow attackers to take control of the devices or rope cameras into botnets.

Huawei Rejects Australia Security Concerns

F-Secure Buys MWR InfoSecurity

Finnish endpoint security company buys British security service provider in cash deal.

7 Ways Cybercriminals Are Scamming a Fortune from Cryptocurrencies

Cryptocurrencies, how do hackers love thee? Let us count the ways.

The paranoid's guide to traveling to digitally scary places like Russia or China

If you're considering traveling to one of the many countries that has a dubious relationship with digital privacy, you'll need to protect yourself. While the standard advice is a VPN, David Gewirtz takes you a few steps deeper into the murky cloak and dag ...

This sneaky Windows malware delivers adware - and takes screenshots of your desktop

Zacinlo malware has been targeting Windows devices since 2012.

Kaspersky pulls plug on Europol joint venture after EU parliament vote to ban its software

Fresh political woes for Russian security firm Kaspersky, which has reacted angrily to a vote in the European Union Parliament last week to ban its software — on the grounds that it has been “confirmed as malicious“. Kaspersky denies this character ...

Ridiculously Insecure Smart Lock

Tapplock sells an "unbreakable" Internet-connected lock that you can open with your fingerprint. It turns out that: The lock broadcasts its Bluetooth MAC address in the clear, and you can calculate the unlock key from it. Any Tapplock account an unlock ...

'90s hacker collective man turned infosec VIP: Internet security hasn't improved in 20 years

L0pht luminary Chris Wysopal talks to The Reg Interview  It has been 20 years since Chris Wysopal (AKA Weld Pond) and his colleagues at the Boston-based L0pht* hacker collective famously testified before the US Senate that the internet was hopelessly ins ...

US-CERT warns of more North Korean malware

'Typeframe' springs from the same den as 'Hidden Cobra' The United States Department of Homeland Security's Computer Emergency Response Team (US-CERT) has warned against another malware campaign it says originates from North Korea.…

AMP does maths on infosec shortage

Fresh eyes, broader reach.

Lack of collaboration, disclosure affecting APAC security posture

Threat actors are collaborating more effectively than legit businesses in the region, which aren't sharing enough intelligence with others in the industry, says Microsoft Asia CSO.

PageUp confirms some data compromised in breach

The SaaS-based recruitment firm has confirmed some data was compromised in the recent malware attack it suffered.

Boffins offer to make speculative execution great again with Spectre-Meltdown CPU fix

Good thing too because Intel's planned chip changes may break Google's Retpoline A group of computer science researchers has proposed a way to overcome the security risk posed by speculative execution, the data processing technique behind the Spectre and ...

Vermont Librarian Wins Small-Claims Suit Against Equifax

In a David-and-Goliath moment, the 49-year-old librarian has won satisfaction in the wake of its head-spinningly massive 2017 data breach.

Friday Squid Blogging: Cephalopod Week on Science Friday

It's Cephalopod Week! "Three hearts, eight arms, can't lose." As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here.

WannaCry Kill Switch Hero Faces New Charges, But Code Evals Say Little

The Feds say Marcus Hutchins is behind both the UPAS Kit backdoor and the Kronos banking trojan.

Email, Social Media Still Security Nightmares

Phishing and banking trojans continue to be major threats brought into the enterprise.

Hackers Crack iPhone Defense Built to Block Forensic Tools

Grayshift, the company behind a system to help police break into iPhones, says it found a workaround for USB Restricted Mode.

Sir, you've been using Kaspersky Lab antivirus. Please come with us, sir

US govt bans agencies from using Russian outfit's wares The US government issued an interim rule this morning prohibiting agencies from using products or services that have pretty much anything to do with Kaspersky Lab.…

Can Russian hackers be stopped? Here's why it might take 20 years

Deterring hackers is almost impossible when the rewards are so great and the risks are so low. Can anything stop them?