Zaid Shoorbajee – Page 18 – WindowsTechs.com

Amazon DNS service server hijacked for $152,000 Ether theft

Posted on April 24, 2018 by Zaid Shoorbajee

Hackers made off with about $152,000 worth of Ether on Tuesday in an attack that exploited weaknesses in the internet’s infrastructure to steal users’ cryptowallet keys. The hackers did so by exploiting a weakness in DNS servers serving MyEtherWallet, a cryptocurrency exchange. DNS is a service that connects domain names like myetherwallet.com to whatever IP address it’s hosted on. “This is not due to a lack of security on the [MyEtherWallet] platform. It is due to hackers finding vulnerabilities in public facing DNS servers,” the company wrote in a Reddit post. Hackers hijacked the DNS servers around noon UTC, the company said, and redirected user traffic to a replica of myetherwallet.com hosted on a Russian server. The actual exploit was through the Border Gateway Protocol (BGP), explains security researcher Kevin Beaumont. BGP is the system that actually directs traffic to a website. MyEtherWallet noted in the Reddit post that, because users were rerouted to a phishing […]

The post Amazon DNS service server hijacked for $152,000 Ether theft appeared first on Cyberscoop.

Continue reading Amazon DNS service server hijacked for $152,000 Ether theft→

SEC fines Yahoo remnant Altaba $35 million for failing to disclose breach

Posted on April 24, 2018 by Zaid Shoorbajee

Altaba, the company formerly known as Yahoo, agreed to pay the Securities and Exchange Commission a $35 million fine for failing to disclose to investors a massive data breach for two years, the regulator announced Tuesday. Altaba agreed to pay the fine without admitting nor denying any wrongdoing. According to the SEC, Yahoo learned of an intrusion by Russian hackers in 2016 just days after it occurred. The incident resulted in the theft of sensitive information and credentials of 500 million users. And while news of the breach circulated within the company, Yahoo didn’t properly investigate the breach or consider whether to inform its investors, the SEC said. News of the incident only became public when Yahoo was in the midst of being acquired by Verizon. “Yahoo’s failure to have controls and procedures in place to assess its cyber-disclosure obligations ended up leaving its investors totally in the dark about a massive data breach,” said […]

The post SEC fines Yahoo remnant Altaba $35 million for failing to disclose breach appeared first on Cyberscoop.

Continue reading SEC fines Yahoo remnant Altaba $35 million for failing to disclose breach→

Open letter urges states to spend election security funds wisely

Posted on April 24, 2018 by Zaid Shoorbajee

As states start receiving their slice of a new federal fund to enhance the administration of elections, an ensemble of election security advocates is calling on the officials to spend that money on things like replacing paperless machines and improving network security. Signatories of an open letter to election officials in all 50 states include subject matter experts from think tanks and universities, former state election officials and former federal government officials. State and local election officials have been deliberating over how to make the best use of a $380 million election improvement fund that Congress included in an omnibus spending bill last month. “While federal funding can help states address these issues, simply upgrading or replacing election infrastructure is not sufficient,” the letter states. At the top of the list, the group urges states to replace paperless voting machines with ones that produce a paper record — “a physical record of the vote that […]

The post Open letter urges states to spend election security funds wisely appeared first on Cyberscoop.

Continue reading Open letter urges states to spend election security funds wisely→

Australia and Portugal join NATO cyber cooperative

Posted on April 23, 2018 by Zaid Shoorbajee

A NATO-backed group that’s designed to coordinate international cybersecurity efforts is getting two new members: Australia and Portugal. The two countries will join the Cooperative Cyber Defence Centre of Excellence (CCDOE) based in Tallinn, Estonia, according to separate announcements on Monday. The organization acts as a think tank for the development of global cyber norms, cybersecurity training requirements and also helps communicate goals shared between different countries. “We are glad to welcome Portugal, another strong NATO Ally joining the Centre. CCDCOE offers a unique opportunity for all NATO Allies to practice together new interdisciplinary approaches in cyber defence,” Merle Maigre, director of CCDCOE, said in a statement. The CCDOE is known for hosting cyber warfare training simulations that are intended to build relations between member countries. Of Australia joining the group, Maigre said: “Accession of Australia expands the reach and cooperation of like-minded nations in cyber defence beyond the Euro-Atlantic area, making our […]

The post Australia and Portugal join NATO cyber cooperative appeared first on Cyberscoop.

Continue reading Australia and Portugal join NATO cyber cooperative→

Lawmakers want to know how to mitigate cyber risk in medical devices

Posted on April 20, 2018 by Zaid Shoorbajee

House lawmakers are calling on stakeholders in the health care industry for tips on how to secure old technology in the medical field. The Committee on Energy and Commerce put out a request for information Friday detailing its concern that outdated equipment and software used in hospitals and other medical organizations pose cybersecurity vulnerabilities that can put patients at risk. “While health care cybersecurity is a complex, nuanced challenge with many different contributing factors, the use of legacy technologies, which are typically more insecure than their modern counterparts, continues to be a root cause of many incidents,” the committee wrote. Fueling the committee’s concern is the WannaCry ransomware attack that paralyzed operations at numerous hospitals and health organizations around the world. The May 2017 attack, which has been widely attributed to North Korea, exploited unpatched versions of Microsoft Windows. In some cases, the machines were being used to run medical devices, such as MRI scanners and […]

The post Lawmakers want to know how to mitigate cyber risk in medical devices appeared first on Cyberscoop.

Continue reading Lawmakers want to know how to mitigate cyber risk in medical devices→

First-of-its-kind forum on election security gathers state and local officials with feds

Posted on April 19, 2018 by Zaid Shoorbajee

A top U.S. election official says that the allegations of Russian meddling in the 2016 presidential election came with a silver lining: At least we’re now focusing on election security. Christy McCormick, a member of the Election Assistance Commission, told a crowd of state and local election officials from across the country on Wednesday that the events of 2016 jump-started a focus on election security that was not as prominent before. “I know that election officials have always focused on these problems to some degree. Not so laserly focused on election security but I think this has brought this to the forefront for us in the last couple of years. So if there’s a good consequence to what happened, that is one of them,” McCormick said Wednesday at a public forum the EAC hosted in Miami to allow the state and local officials to discuss their election security plans ahead of upcoming […]

The post First-of-its-kind forum on election security gathers state and local officials with feds appeared first on Cyberscoop.

Continue reading First-of-its-kind forum on election security gathers state and local officials with feds→

Election security bill still needs work in some areas, state officials tell Senate sponsors

Posted on April 17, 2018 by Zaid Shoorbajee

Several secretaries of state are telling the main backers of a Senate election security bill that the legislation might need tweaks to how it addresses information sharing, state-federal communication channels, funding mechanisms and post-election audits, among other things. The secretaries, who are the top election officials in their states, met with bill sponsors James Lankford, R-Okla., and Amy Klobuchar, D-Minn., in person and via phone Monday to discuss the Secure Elections Act. The legislation is intended to bolster election security by smoothing out coordination between the state and federal levels and providing states financial support for operations and equipment upgrades. State secretaries from Indiana, Louisiana, Minnesota, Missouri, Colorado and New Mexico participated in the meeting. A spokesperson for Indiana Secretary of State Connie Lawson said that the secretary suggested quicker intelligence reporting to states. Among the ways the Department of Homeland Security is currently coordinating with states is by sponsoring security clearances for state election officials to review information about […]

The post Election security bill still needs work in some areas, state officials tell Senate sponsors appeared first on Cyberscoop.

Continue reading Election security bill still needs work in some areas, state officials tell Senate sponsors→

NIST releases updated cybersecurity framework

Posted on April 17, 2018 by Zaid Shoorbajee

The National Institute of Standards and Technology on Monday released a much-anticipated update to its Cybersecurity Framework, which provides organizations with guidelines for implementing cybersecurity practices. Updates in Version 1.1 include refreshed guidelines on authentication and identity; cyber risk self-assessments; managing supply chain cybersecurity; and vulnerability disclosure. “This update refines, clarifies and enhances Version 1.0,” said Matt Barrett, program manager for the framework, in the release. “It is still flexible to meet an individual organization’s business or mission needs, and applies to a wide range of technology environments such as information technology, industrial control systems and the Internet of Things.” President Donald Trump issued an executive order in May 2017 directing all federal agencies to use the Cybersecurity Framework, including future versions, to manage cybersecurity risk. Beyond that, the framework also serves as reference point for the private sector. “First, business leaders and policymakers view the Framework as a pillar for managing enterprise […]

The post NIST releases updated cybersecurity framework appeared first on Cyberscoop.

Continue reading NIST releases updated cybersecurity framework→

Cybersecurity adviser Rob Joyce to leave White House, return to NSA

Posted on April 16, 2018 by Zaid Shoorbajee

Rob Joyce is planning to leave his post as White House cybersecurity coordinator and return to work at the National Security Agency, a U.S. official confirmed to CyberScoop on Monday. The news comes less than a week after Joyce’s boss, Thomas Bossert, resigned as White House homeland security adviser. Joyce has been filling Bossert’s role in an acting capacity. Bossert’s resignation was reportedly at the request of John Bolton, the newly appointed national security adviser. The departures of Joyce and Bossert leave big gaps in the Trump administration’s cybersecurity expertise. In his main role, Joyce has been involved in developing the framework surrounding how the U.S. responds to foreign cyberthreats. He participated in a call with reporters on Monday to issue an alert about Russian-backed hacking efforts targeting internet routers. Joyce has also been vocal to push for carveouts for security research in the impending European General Data Protection Regulation, which many say has a chilling effect on […]

The post Cybersecurity adviser Rob Joyce to leave White House, return to NSA appeared first on Cyberscoop.

Continue reading Cybersecurity adviser Rob Joyce to leave White House, return to NSA→