Trump's Crypto Plans Raise Alarms Over Conflicts of Interest

Chris Riotta • November 28, 2024

President-elect Donald Trump's strong cryptocurrency support amid market volatility is raising concerns over potential conflicts of interest, with experts warning his agenda - including potential plans to appoint a White House crypto czar - could destabilize the economy and undermine public trust.

Blockchain & Cryptocurrency

Feds Indict 5 Suspects Tied to Scattered Spider Cybercrime

Latest

DevSecOps

Sonatype, Snyk, Black Duck Top Comp Analysis Forrester Wave

Michael Novinson • November 29, 2024

Sonatype, Snyk and Black Duck remained atop Forrester's software composition analysis rankings as commoditization of core features has led to increased competition. Pressure in the market has increased due to both a saturation of core functionalities and license identification.

Security and Exchange Commission compliance (SEC)

CyberEdBoard Profiles in Leadership: Patrick Benoit

Anna Delaney • November 29, 2024

Patrick Benoit, a seasoned security leader and CyberEdBoard member, advises security leaders to lead by example and not worry about showing any of their own vulnerabilities, not least when they make a mistake. "It's OK to fail or misstep … That's what makes you a stronger leader," he said.

ISMG Editors: Major Crypto Mixer Decision Redefines Rules

Anna Delaney • November 29, 2024

In the latest weekly update, ISMG editors discussed Tornado Cash's landmark legal victory and what it means for crypto mixers, the impact of artificial intelligence on data privacy, and advancements in cybersecurity for which the industry can be thankful as it heads into 2025.

Endpoint Security

Just Like Windows: Linux Targeted by First-Ever UEFI Bootkit

Prajeet Nair • November 28, 2024

Cybersecurity researchers have discovered the first-ever UEFI bootkit designed to target Linux systems and subvert their boot process for malicious purposes. The "Bootkitty" malware, first uploaded to VirusTotal this month, appears to be more "proof of concept" than full-fledged threat, they said.

Breach Notification

Breach Roundup: Microsoft Tries Again With Windows Recall

Anviksha More • November 28, 2024

This week, Microsoft previews its latest attempt to introduce AI-enabled Windows Recall - now with added privacy features; over 1,000 cybercrime suspects busted in Africa; regulators report "smart" device update promises often missing; and Florida IT professional caught spying for China.

Blockchain & Cryptocurrency

Cryptohack Roundup: Judge Strikes Down 'Dealer Rule' Change

Rashmi Ramesh • November 28, 2024

This week's cryptohack roundup includes a U.S. federal judge striking down the SEC's expanded "Dealer Rule," a Python crypto library update stealing credentials, why digital payment apps are being excluded from some types of federal oversight, and drug cartels laundering profits via Tether.

Electronic Healthcare Records

Exposed on the Web: Thousands of Devices, Medical Records

Marianne Kolbasuk McGee • November 28, 2024

Thousands of unique IP addresses are potentially exposing medical devices, electronic medical records systems and other sensitive healthcare information to the internet, said security researcher Himaja Motheram of security firm Censys, which made the discovery.

Critical Infrastructure Security

T-Mobile Disputes Claims of Chinese Hack on Customer Data

Chris Riotta • November 27, 2024

T-Mobile disputed claims Wednesday that Chinese state-sponsored hackers breached its systems and stole customer data, warning that some U.S. communications networks may still be compromised and detailing how its layered defenses and third-party cybersecurity partnerships thwarted the attack.

DDoS Protection

Script Kiddie 'Matrix' Builds Massive Botnet

Prajeet Nair • November 27, 2024

An apparent Russian script kiddie is converting widespread security gaps into powerful botnets capable of launching global-scale distributed denial-of-service attacks. A threat actor with the online moniker "Matrix" is exploiting IoT vulnerabilities such as default credentials and outdated software.

Next-Generation Technologies & Secure Development

New EU Tech Commissioner to Focus on Tech Sovereignty

Akshaya Asokan • November 27, 2024

Newly appointed EU tech commissioner Henna Virkkunen will lead efforts to establish Europe's tech sovereignty, said European Commission President Ursula von der Leyen, who will start a second term on Dec. 1. Virkkunen was a liberal-conservative Finnish member of the European Parliament.

Breach Notification

Victims Must Disclose Ransom Payments Under Australian Law

Jayant Chakravarti • November 26, 2024

The Australian government's proposed cybersecurity legislation passed both houses of the Parliament on Monday, formalizing the government's strategy to boost ransomware payment reporting, mandate basic cybersecurity standards for connected devices and enhance critical infrastructure security.

Security Operations

Russian Hackers Target Mozilla, Windows in New Exploit Chain

Chris Riotta • November 26, 2024

Two vulnerabilities in Mozilla products and Windows are being actively exploited by RomCom, a Kremlin-linked cybercriminal group known for targeting businesses and conducting espionage, warn security researchers from Eset. Exploiting the two flaws together enables attackers to execute arbitrary code.