Author Archives: Tim Starks

Here comes the bride: New map matches threat intel to cyber defenses

Posted on by

A popular method that organizations lean on to reduce their cybersecurity risks is marrying a popular tool that cyber pros consult when they analyze hacking groups — in a way they think everyone can use. The project to conjoin the National Institute of Standards and Technology’s cybersecurity framework and MITRE ATT&CK framework, announced Tuesday, comes with backing from big players: JPMorgan Chase, a nonprofit center operated by an offshoot of MITRE, the cybersecurity company AttackIQ and the nonprofit Center for Internet Security that’s perhaps best known for its work with state and local governments. The idea behind the mapping project is to harmonize the risk management sides of cyber with the threat intelligence side of cyber, via models that any organization can employ. Usually unifying those two sides would be something that only a large outfit, like the U.S. military or major investment banks, would be able to pull off, […]

The post Here comes the bride: New map matches threat intel to cyber defenses appeared first on CyberScoop.

Continue reading Here comes the bride: New map matches threat intel to cyber defenses→

HackerOne, Verizon weigh pros and cons of making live hacking contests virtual

Posted on by

Among all the ways COVID-19 has affected the cybersecurity world, perhaps nothing is more impossible than live hacking events, which were once a staple of the industry. The coronavirus forced bug bounty company HackerOne and Verizon Media into hosting two online hacking events together since the outbreak, and they recently completed what they billed as the world’s largest live hacking contest. Live hacking events, whether virtual or in-person, give companies a chance to lure ethical hackers to find their security flaws before the attackers do, and can serve as recruiting opportunities for corporate positions, too. What made the most recent competition stand out was its massive size, and what the experiment could mean for the rest of the bug bounty community. The HackerOne/Verizon Media duo wasn’t the first to move live hacking events online. Pwn2Own made a similar transition in March. With more than 3,000 people from 59 countries registering […]

The post HackerOne, Verizon weigh pros and cons of making live hacking contests virtual appeared first on CyberScoop.

Continue reading HackerOne, Verizon weigh pros and cons of making live hacking contests virtual→

Commerce Department breached as Treasury, others reportedly victimized by suspected Russian hackers

Posted on by

Hackers breached the Commerce Department, and reportedly have infiltrated the Treasury Department and other U.S. agencies, in incidents that government security officials said on Sunday that they were fighting to contain. “We can confirm there has been a breach in one of our bureaus,” a Commerce Department spokesperson said. The spokesperson added that Commerce has asked the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency “and the FBI to investigate, and we cannot comment further at this time.” Reuters reported that foreign nation-backed hackers have been monitoring email traffic at the Treasury Department and Commerce Department’s National Telecommunications and Information Administration, and the attackers apparently used similar tools to breach other agencies. “The United States government is aware of these reports and we are taking all necessary steps to identify and remedy any possible issues related to this situation,” said John Ullyot, a spokesman for the White House’s National […]

The post Commerce Department breached as Treasury, others reportedly victimized by suspected Russian hackers appeared first on CyberScoop.

Continue reading Commerce Department breached as Treasury, others reportedly victimized by suspected Russian hackers→

As FireEye grapples with breach investigation, questions remain

Posted on by

FireEye’s announcement this week that hackers breached its systems has sent shockwaves through the cybersecurity community, raising new questions about how one of the most influential security firms in the U.S. grappled with an apparently state-sponsored attack. It also has triggered policy discussions about whether the U.S. government should do more to protect cyber industry titans like FireEye, one of the top cybersecurity firms in the world with customers that counts Fortune 500 companies among its clients. The hack adds FireEye to the list of cybersecurity companies that have experienced their own breaches, a roster stretching back to at least the beginning of the last decade. “This news has rocked the cybersecurity industry to our core, unlike anything since the RSA hack” from 2011, said Tom Bossert, president of Trinity Cyber and the former homeland security adviser to President Donald Trump. “It’s a pretty big deal.” FireEye revealed on Tuesday […]

The post As FireEye grapples with breach investigation, questions remain appeared first on CyberScoop.

Continue reading As FireEye grapples with breach investigation, questions remain→

Meet ODoH, where privacy means just not knowing anything

Posted on by

Being oblivious on the internet usually isn’t a recipe for protecting privacy. But Cloudflare announced Tuesday that it was launching support for a protocol that makes obliviousness its chief trait. Developed in conjunction with engineers from Apple and Fastly, it’s called Oblivious DNS over HTTPS, or ODoH for short. It’s a newly proposed Domain Name System standard that Cloudflare, an internet services and cybersecurity provider, says separates IP addresses from queries, which means no one entity can see both simultaneously. ODoH is one of three privacy initiatives Cloudflare hailed on Tuesday, with the other two meant to improve password security and halt metadata leaks. “Fundamentally what we’re trying to do with these announcements is to help point out places on the internet — or aspects of how the internet is built — that have a privacy hole, or an issue that make it easier to have their privacy compromised in […]

The post Meet ODoH, where privacy means just not knowing anything appeared first on CyberScoop.

Continue reading Meet ODoH, where privacy means just not knowing anything→

33 connectivity flaws render millions of IT, IoT devices vulnerable

Posted on by

Several sets of internet communication protocols used by major vendors of connected products have vulnerabilities that could affect millions of devices, researchers revealed on Tuesday. Four of the vulnerabilities are critical, meaning attackers could use them to remotely take over devices ranging from a “smart” refrigerator to an industrial networking switch in the electrical grid, according to the security vendor Forescout. The flaws exist in information technology, operational technology and so-called internet of things products. The Forescout study, dubbed AMNESIA:33, focuses on 33 vulnerabilities in four open-source TCP/IP stacks. TCP/IP stands for “Transmission Control Protocol/Internet Protocol,” which is used to communicate between computers. Open-source TCP/IP stacks serve as the foundational connectivity components of devices around the world. (A TCP/IP stack is an implementation of the TCP/IP protocol.) It marks the second time this year that a set of TCP/IP stack vulnerabilities emerged that could affect a large number of devices. […]

The post 33 connectivity flaws render millions of IT, IoT devices vulnerable appeared first on CyberScoop.

Continue reading 33 connectivity flaws render millions of IT, IoT devices vulnerable→

A look inside Congress’ biggest cyber bill ever

Posted on by

Congress this week is slated to pass what just might be the most significant cybersecurity legislation ever. This year’s annual defense policy bill, known as the National Defense Authorization Act (NDAA), is loaded with provisions that would reshape the federal bureaucracy on cybersecurity. It would create a national cyber director in the White House and strengthen the Department of Homeland Security’s Cybersecurity and Information Security Agency (CISA), among other changes. “I believe it’s safe to say that this is the most important piece of cybersecurity legislation ever passed” should the final bill advance this week, said Sen. Angus King, I-Maine, who co-chaired the Cyberspace Solarium Commission that produced many of the proposals in the legislation. Mark Montgomery, executive director of the commission, called it “the most substantive” cyber legislation Congress will have passed. Others agree. “I think that’s true, 100%,” said Jonathan Reiber, a former Defense Department cybersecurity official during […]

The post A look inside Congress’ biggest cyber bill ever appeared first on CyberScoop.

Continue reading A look inside Congress’ biggest cyber bill ever→

Congress set to establish White House national cyber director, enact other Solarium Commission recommendations

Posted on by

Congress is on the verge of creating a Senate-confirmed national cyber director within the White House who would advise the president on cybersecurity and coordinate the federal government’s related work. And supporters say it would improve on a White House czar position that President Donald Trump controversially eliminated: In addition to Senate confirmation, it would be housed outside of, rather than under, the National Security Council. Multiple sources familiar with negotiations on an annual must-pass defense policy bill say that the final agreement will include the national cyber director position. And it will largely reflect a proposal by the Cyberspace Solarium Commission, which earlier this year put together a comprehensive report that made sweeping recommendations. The Trump White House had opposed the creation of the position. It’s not the only major recommendation from the Solarium Commission that was included in the legislation, either, according to those sources. It would grant the Department of Homeland Security the power to […]

The post Congress set to establish White House national cyber director, enact other Solarium Commission recommendations appeared first on CyberScoop.

Continue reading Congress set to establish White House national cyber director, enact other Solarium Commission recommendations→

TrickBot adds firmware tool that researchers say could lead to ‘bricking’ devices

Posted on by

The malicious software known as TrickBot has morphed again, this time with a module that probes booting process firmware for vulnerabilities, possibly setting the stage for attacks that could ultimately destroy devices, researchers say. Two cybersecurity companies, Eclypsium and Advanced Intelligence (Advintel), dubbed the TrickBot add-on module “TrickBoot,” since it targets the UEFI/BIOS firmware. Firmware is permanent code programmed into a hardware device, while UEFI and BIOS are two kinds of specifications that manage a device’s start-up. TrickBoot, then, is s a “significant step in the evolution of TrickBot,” the researchers say, that could make TrickBot especially pesty. “Since firmware is stored on the motherboard as opposed to the system drives, these threats can provide attackers with ongoing persistence even if a system is re-imaged or a hard drive is replaced,” they wrote.”Equally impactful, if firmware is used to brick a device, the recovery scenarios are markedly different (and more difficult) than recovery […]

The post TrickBot adds firmware tool that researchers say could lead to ‘bricking’ devices appeared first on CyberScoop.

Continue reading TrickBot adds firmware tool that researchers say could lead to ‘bricking’ devices→

Researchers suggest 25 countries are using a kind of mobile spyware that monitors texts, location

Posted on by

A private surveillance firm that exploits mobile network vulnerabilities to spy on calls, texts and location data is doing business with at least 25 governments around the globe, including some with histories of human rights abuses, concludes a report released Tuesday. The findings from the University of Toronto’s Citizen Lab scrutinize the work of the company Circles, which is a sister firm of the Israeli software surveillance broker NSO Group. Human rights activists frequently criticize NSO Group for selling its equipment to repressive regimes, a charge it rejects, even as it is the subject of a lawsuit from Facebook, which alleges that attackers used NSO Group tech to spy on thousands of WhatsApp users. The countries Citizen Lab identified as “likely” customers of Circles: Australia, Belgium, Botswana, Chile, Denmark, Ecuador, El Salvador, Estonia, Equatorial Guinea, Guatemala, Honduras, Indonesia, Israel, Kenya, Malaysia, Mexico, Morocco, Nigeria, Peru, Serbia, Thailand, the United Arab Emirates, Vietnam, Zambia and Zimbabwe. […]

The post Researchers suggest 25 countries are using a kind of mobile spyware that monitors texts, location appeared first on CyberScoop.

Continue reading Researchers suggest 25 countries are using a kind of mobile spyware that monitors texts, location→