Collaborate Disseminate
Many thanks to USENIX Enigma 2020 for publishing their outstanding AppSecCali 2020 Conference Videos. Enjoy!
Permalink
The post USENIX Enigma 2020 – Sarah Harvey’s ‘Third-Party Integrations: Friend Or Foe?’ appeared first on Se… Continue reading USENIX Enigma 2020 – Sarah Harvey’s ‘Third-Party Integrations: Friend Or Foe?’
Many thanks to USENIX Enigma 2020 for publishing their outstanding AppSecCali 2020 Conference Videos. Enjoy!
Permalink
The post USENIX Enigma 2020 – Filippo Valsorda’s ‘Securing the Software Supply Chain’ appeared first on Secu… Continue reading USENIX Enigma 2020 – Filippo Valsorda’s ‘Securing the Software Supply Chain’
Many thanks to USENIX Enigma 2020 for publishing their outstanding AppSecCali 2020 Conference Videos. Enjoy!
Permalink
The post USENIX Enigma 2020 – Riana Pfefferkorn’s, Daniel J. Weitzner’s & Matt Blaze’s Panel Discussion:… Continue reading USENIX Enigma 2020 – Riana Pfefferkorn’s, Daniel J. Weitzner’s & Matt Blaze’s Panel Discussion: ‘Encrypted Messaging’
As the Supreme Court prepares to consider a controversial federal anti-hacking law, a group of prominent cybersecurity researchers and legal advocates is pleading with the court not to criminalize digital research in the public interest. In a brief filed with the court Wednesday led by digital rights group Electronic Frontier Foundation, the researchers warned that if violations of a company’s “terms of service” are deemed to be illegal, it risks chilling important research into voting systems, medical devices and other key equipment. “Despite widespread agreement about the importance of this work—including by the government itself— researchers face legal threat for engaging in socially beneficial security testing,” wrote the EFF, the nonprofit Center for Democracy & Technology, and cybersecurity companies Bugcrowd, Rapid7, SCYTHE and Tenable. Famous security researchers like Peiter “Mudge” Zatko and Chris Wysopal, who warned Congress of the internet’s insecurities in the 1990s as members of the L0pht hacking collective, […]
The post Researchers to Supreme Court: Terms of service violations shouldn’t be CFAA crime appeared first on CyberScoop.
Continue reading Researchers to Supreme Court: Terms of service violations shouldn’t be CFAA crime
Two years ago, when researchers at antivirus company Trend Micro reported on a new mobile data-stealing kit known as FakeSpy, they warned there could be more to come from the hackers. Directing the Android-focused malware at users outside of South Korea and Japan, where it was discovered, would simply be a matter of reconfiguring the code, the researchers said. That’s exactly what happened. On Wednesday, another set of researchers, from security company Cybereason, revealed how FakeSpy’s operators have been impersonating various postal services in attacks on users in the U.S., China and Europe in the last several weeks. The hackers have taken aim at thousands of users with the help of phony text messages that, if clicked, install code capable of siphoning off financial data from mobile applications. The findings show how, with an effective mobile malware kit written, hackers can tweak the code to target different parts of the world and see […]
The post Operators of Android hacking kit impersonate postal services in US and Europe appeared first on CyberScoop.
Continue reading Operators of Android hacking kit impersonate postal services in US and Europe
A sweeping set of surveillance campaigns has hit Google Chrome users, leading to nearly 33 million downloads of malicious software in the last three months, researchers at California-based Awake Security said Thursday. The researchers believe the unidentified hackers used Chrome extensions and other malicious tools — along with domains issued by a single registrar — to spy on computer users in sectors such as oil and gas, finance and health care. The hackers “were very effective in reaching a large number of industries and subverting controls that were in place,” said Gary Golomb, Awake Security’s cofounder and chief scientist. U.S. government contractors were among those targeted, Golomb said. He declined to identify the victims. The discovery exposes another gap in web browser security despite pledges from Google and other vendors to proactively block malicious code from appearing in their official download stores. After being tipped off by Golomb’s team, Google removed […]
The post How hackers used malicious Chrome extensions in a mass spying campaign appeared first on CyberScoop.
Continue reading How hackers used malicious Chrome extensions in a mass spying campaign
A mysterious hacking group has been posing as Taiwan’s top infection-disease official in an attempt to steal sensitive data from Taiwanese users, researchers said Monday. The hackers sent meticulously written spearphishing emails to a select group of targets, which may have included Taiwan’s Centers for Disease Control employees, according to ElevenPaths, the cybersecurity unit of Spanish telecommunications firm Telefónica Group, which uncovered the activity. It’s a reminder of the lengths to which hacking groups have gone to impersonate public health authorities and break into computer networks during the COVID-19 pandemic. Over the course of a week in early May, the hackers sent emails to certain Taiwanese users urging them to get novel coronavirus tests. Attached to the email was a remote hacking tool capable of stealing login credentials and hijacking webcams. “The type of tools and the targets selected indicate that they are looking for intelligence, mainly governmental,” Miguel Ángel […]
The post ‘Vendetta’ hackers are posing as Taiwan’s CDC in data-theft campaign appeared first on CyberScoop.
Continue reading ‘Vendetta’ hackers are posing as Taiwan’s CDC in data-theft campaign
The United States Cyberspace Solarium Commission has made several recommendations for how the U.S. can strengthen its online infrastructure through government-enterprise cooperation.
The post What Enterprises Can Expect Following the Cyberspace Solarium Commission Report appeared first on Security Intelligence.
Continue reading What Enterprises Can Expect Following the Cyberspace Solarium Commission Report
Hackers often plant their malicious software on computers in stages. One piece of code can be a foothold onto a network, another delivers the malware, and yet another executes it to steal or manipulate data. But looks can be deceiving. The same code used as a staging tool in one attack might be the tip of the spear in another. For targeted organizations, spotting the difference can mean saving your data. That’s the case with a malicious program that has been used in hacking attempts against multiple economic sectors in the U.S. and Germany in the last six months, according to research published Thursday by security company Cybereason. About 150 organizations in the financial, retail, manufacturing, and health care sectors have been targeted by the Valak malware since it emerged late last year, the researchers said. More than just a “loader” that delivers malicious code, Valak can also be used […]
The post ‘Valak’ gives crooks flexibility in multi-stage malware attacks appeared first on CyberScoop.
Continue reading ‘Valak’ gives crooks flexibility in multi-stage malware attacks
Hacking tools and techniques that are capable of accessing “air-gapped” systems — those cut off from external network connections — are coveted by intelligence agencies and pored over by security researchers. Spies try to conceal them; researchers try to expose them to warn potential victims. That dynamic is behind Slovakian anti-virus company ESET’s decision Wednesday to go public with what it says is a previously unknown malicious software framework designed to steal files from air-gapped systems. Much around the hacking tool — who is using it, who some of its victims are — remains a mystery. But ESET is hoping publicizing it will shake loose more clues in their hunt for the hackers. “We believe Ramsay is intended to be used in targeted attacks only and [has] espionage written all over it,” Alexis Dorais-Joncas, a security intelligence team lead at ESET, told CyberScoop. “‘Normal’ people do not operate in air-gapped environments.” The […]
The post Researchers expose new malware designed to steal data from air-gapped networks appeared first on CyberScoop.
Continue reading Researchers expose new malware designed to steal data from air-gapped networks