Author Archives: Tim Starks

CISA probes scope, potential fallout of Log4j vulnerability

Posted on by

A top government cyber official said Tuesday that the Cybersecurity and Infrastructure Security Agency hasn’t seen hackers compromise federal agencies by exploiting the Apache Log4j vulnerability — but the agency’s still fearful of widespread attacks stemming from it. Most of all, CISA’s Eric Goldstein said during a phone call Tuesday evening, the government is eager for help from the public in assembling a comprehensive list of all the products that might be susceptible to hackers using the vulnerability, known as Log4Shell in the widely deployed logging library, which the agency expects could affect hundreds of millions of devices or more. CISA and private sector cybersecurity investigators have struck exceptionally dire notes about the potential fallout that have not, as of yet, come to fruition. It’s that unknown potential, however, that has prompted CISA to try to get organizations to patch their systems and take other steps to secure them. “Certainly […]

The post CISA probes scope, potential fallout of Log4j vulnerability appeared first on CyberScoop.

Continue reading CISA probes scope, potential fallout of Log4j vulnerability→

DHS establishes its own bug bounty program, offering outsiders $500 to $5K for discovering flaws

Posted on by

The Homeland Security Department is launching a bug bounty program to invite researchers to probe its systems for flaws, DHS Secretary Alejandro Mayorkas said Tuesday. Under the “Hack DHS” initiative Mayorkas discussed at the Bloomberg Technology Summit, ethical hackers would receive between $500 and $5,000 for identifying vulnerabilities, depending on their severity. The department would verify flaws within 48 hours and fix them within 15 days, or for complex bugs, develop a plan to do so during that period. “We’re focused not only on protecting and enhancing the cybersecurity of the private sector and of the federal government at large but, of course, we as a department have to lead by example and so what we are very focused on is identifying vulnerabilities and addressing or remediating those vulnerabilities,” Mayorkas said. DHS is later to the bug bounty trend than some other federal agencies, with the Defense Department initiating its […]

The post DHS establishes its own bug bounty program, offering outsiders $500 to $5K for discovering flaws appeared first on CyberScoop.

Continue reading DHS establishes its own bug bounty program, offering outsiders $500 to $5K for discovering flaws→

Defense Department blocks ads to counter malvertising, official tells Congress

Posted on by

The Defense Department employs multiple methods of blocking internet advertisements because of the threats that malicious ads pose, the Pentagon said in a letter Monday. The department’s answer to a summer inquiry from Sen. Ron Wyden, D-Ore., follows similar responses from the intelligence community in which agencies said they rely on ad-blockers as a security measure. In January, the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency also urged federal agencies to block ads because of the potential for malicious activity. “Yes, the Defense Information Systems Agency (DISA) has deployed various technologies to protect against online-advertising related malware and data collection threats,” wrote Kelly Fletcher, who’s currently serving in the role of DOD’s chief information officer. “Web content filter and Sharkseer tools block bad traffic that traverses our internet access points and Cloud Based Internet Isolation (CBII) also isolates all traffic, including ads.” While the letter didn’t specify when […]

The post Defense Department blocks ads to counter malvertising, official tells Congress appeared first on CyberScoop.

Continue reading Defense Department blocks ads to counter malvertising, official tells Congress→

CISA warns ‘most serious’ Log4j vulnerability likely to affect hundreds of millions of devices

Posted on by

Cybersecurity and Infrastructure Security Agency Director Jen Easterly told industry leaders in a phone briefing Monday that a vulnerability in a widely-used logging library “is one of the most serious I’ve seen in my entire career, if not the most serious.” “We expect the vulnerability to be widely exploited by sophisticated actors and we have limited time to take necessary steps in order to reduce the likelihood of damage,” she said of the Apache Log4j flaw. The issue is an unauthenticated remote execution vulnerability that could allow an intruder to take over an affected device.  Hundreds of millions of devices are likely to be affected, said Jay Gazlay of CISA’s vulnerability management office in the call with critical infrastructure owners and operators.   CISA, a component of the Department of Homeland Security, is setting up a dedicated website as soon as Tuesday to provide information and counter “active disinformation,” said Eric […]

The post CISA warns ‘most serious’ Log4j vulnerability likely to affect hundreds of millions of devices appeared first on CyberScoop.

Continue reading CISA warns ‘most serious’ Log4j vulnerability likely to affect hundreds of millions of devices→

Cyber incident reporting mandates suffer another congressional setback

Posted on by

House and Senate negotiators have excluded provisions from a must-pass defense bill that would have mandated many companies to report major cyberattacks and ransomware payments to federal officials. A compromise version of the fiscal 2022 National Defense Authorization Act (NDAA) released Tuesday leaves out the language, which would set timeframes for when critical infrastructure owners and operators must report major incidents and some companies would have to report making ransomware payments. Supporters of the language ran out of time to reach an agreement on the final phrasing before NDAA sponsors moved ahead on their final compromise bill, a senior Senate aide said. It’s a big setback for backers of the reporting mandates, as attaching provisions to the annual NDAA has been the path for a number of monumental cyber ideas to become law. Still, some key disputes over the reporting mandate provisions have been resolved, and backers might be able […]

The post Cyber incident reporting mandates suffer another congressional setback appeared first on CyberScoop.

Continue reading Cyber incident reporting mandates suffer another congressional setback→

Court hands Microsoft control of websites linked to spying by Chinese hackers

Posted on by

Microsoft obtained a court order to seize websites from a Chinese government-linked espionage group that was using the sites to attack government agencies, think tanks and human rights organizations in 29 countries, the company said Monday. The legal move is aimed at a hacking outfit that Microsoft calls Nickel, which is also known as APT15, Ke3chang or Vixen Panda. It’s been around since at least 2010, and frequently spies on foreign affairs of interest to China. “Obtaining control of the malicious websites and redirecting traffic from those sites to Microsoft’s secure servers will help us protect existing and future victims while learning more about Nickel’s activities,” wrote Tom Burt, Microsoft’s corporate vice president for customer security and trust. “Our disruption will not prevent Nickel from continuing other hacking activities, but we do believe we have removed a key piece of the infrastructure the group has been relying on for this […]

The post Court hands Microsoft control of websites linked to spying by Chinese hackers appeared first on CyberScoop.

Continue reading Court hands Microsoft control of websites linked to spying by Chinese hackers→

CISA’s advisory panel is announced, set to make recommendations on major cyber topics

Posted on by

The Cybersecurity and Infrastructure Security Agency on Wednesday named members to a new cyber advisory panel that will make recommendations on subjects ranging from battling misinformation to gaining aid from the hacker community on national cyber defense. Among the 23 members selected are leaders from social media, cybersecurity companies, major technology firms and critical infrastructure sectors such as finance and energy. It includes officials from Johnson & Johnson and Walmart, as well as a longtime cybersecurity journalist and the mayor of Austin, Texas. “We’re at a pivotal moment in our history — one that demands we think anew about ensuring the security and resilience of our digital infrastructure in the face of increasingly sophisticated cyber threats,” said CISA Director Jen Easterly, whose agency is a part of the Department of Homeland Security. “I look forward to partnering with these distinguished leaders from across industry, academia, and government to tackle some […]

The post CISA’s advisory panel is announced, set to make recommendations on major cyber topics appeared first on CyberScoop.

Continue reading CISA’s advisory panel is announced, set to make recommendations on major cyber topics→

UK threatens Clearview AI with nearly $23M fine over its facial recognition tech

Posted on by

British regulators say they intend to fine Clearview AI, a facial recognition company that bills itself as the world’s largest, nearly $23 million for “alleged serious breaches” of the nation’s data protection laws. The fines stem from a joint investigation by the U.K. Information Commissioner’s Office (ICO) and its Australian counterpart. The ICO now awaits a response from Clearview AI before possibly levying the fine in mid-2022. “I have significant concerns that personal data was processed in a way that nobody in the UK will have expected,” U.K. Information Commissioner Elizabeth Denham said on Monday. “Clearview AI Inc’s services are no longer being offered in the UK. However, the evidence we’ve gathered and analysed suggests Clearview AI Inc were and may be continuing to process significant volumes of UK people’s information without their knowledge.” The increased scrutiny from U.K. regulators has something of a parallel in the U.S., where in […]

The post UK threatens Clearview AI with nearly $23M fine over its facial recognition tech appeared first on CyberScoop.

Continue reading UK threatens Clearview AI with nearly $23M fine over its facial recognition tech→

Months-long Interpol crackdown nets more than 1,000 online fraud arrests

Posted on by

An Interpol operation to combat online fraud concluded with the arrests of 1,003 people and the interception of $27 million in illicit funds, according to the international police organization, which conducted the crackdown alongside 20 countries. Waged from June to September of this year, “Operation HAECHI-II” targeted online crime like romance scams, investment fraud and money laundering associated with illegal online gambling. But it also turned up a business email compromise scheme in Colombia and led to alerts about malware tied to the popular Netflix show “Squid Game.” Interpol said the crackdown demonstrated how cybercrime has risen to new levels since the outbreak of the coronavirus. It’s the latest international warning about how the pandemic has fueled a crime wave, even setting aside attacks targeting the health care sector or exploiting COVID-19 that have flourished over the past two years. “The results of Operation HAECHI-II show that the surge in […]

The post Months-long Interpol crackdown nets more than 1,000 online fraud arrests appeared first on CyberScoop.

Continue reading Months-long Interpol crackdown nets more than 1,000 online fraud arrests→

Incident reporting, ransomware payment legislation faces trouble in Senate

Posted on by

Legislation requiring critical infrastructure owners to report major cyber incidents to the federal government, and mandating that ransomware victims disclose when they make payments, has hit a significant snag in the Senate. A bipartisan group of senators announced a proposal in November that would require critical infrastructure owners and operators to report within 72 hours to the Department of Homeland Security’s Cybersecurity and Infrastructure Agency when they suffer major cyber incidents, as defined by CISA. It also would require reporting of ransomware payments to CISA from a broader set of organizations, excluding only individuals and some smaller businesses, within 24 hours. Advocates hope that by requiring swift reporting of major incidents, federal officials can help reduce the damage more quickly. Gathering intelligence about ransomware payments would help law enforcement and national security officials understand and act on digital extortion trends, officials say. Backers were unable to advance the proposal last […]

The post Incident reporting, ransomware payment legislation faces trouble in Senate appeared first on CyberScoop.

Continue reading Incident reporting, ransomware payment legislation faces trouble in Senate→