Latest

Cyberwarfare / Nation-State Attacks

GAO: Army's New Cyber Units Understaffed and Underequipped

Apurva Venkat  •  August 19, 2019

To better prepare for cyberthreats posed by Russia and China, the U.S. Army has been building cyber and electronic warfare units. But a new report from the Government Accountability Office finds that these units are understaffed, underequipped and in need of better training.

Fraud Management & Cybercrime

Analysis: The Growth of Mobile Fraud

Nick Holland  •  August 19, 2019

Why is fraud that originates on mobile devices growing at such a rapid rate? Brooke Snelling and Melissa Gaddis of iovation offer an analysis in this joint interview.

Business Email Compromise (BEC)

Phishing Scheme Uses Google Drive to Avoid Security: Report

Akshaya Asokan  •  August 16, 2019

A newly identified phishing campaign used Google Drive to help bypass some email security features as attackers attempted to target a company in the energy industry, security firm Cofense reported this week.

Cyberwarfare / Nation-State Attacks

US CyberDome Poised to Protect 2020 Elections

Tom Field  •  August 16, 2019

An A-list of cyber experts, including former Homeland Security Secretary Jeh Johnson, has put its weight behind U.S. CyberDome, a nonpartisan initiative to protect presidential campaigns against foreign influence. Matthew Barrett, a former NIST leader and co-founder of CyberDome, outlines how this group is gearing up.

Account Takeover

The Renaissance of Deception Technology

Nick Holland  •  August 16, 2019

This edition of the ISMG Security Report discusses the latest improvements in deception technology and how best to apply it. Also featured: a report on the growth of mobile fraud, plus insights on Merck's experience recovering from a NotPetya attack.

Biometrics

Biometric Security Vendor Exposes Fingerprints, Face Data

Jeremy Kirk  •  August 15, 2019

A South Korean company that makes a biometric access control platform exposed fingerprint, facial recognition data and personal information after leaving an Elasticsearch database open, security researchers say. They found 23GB of data belonging to organizations that use Suprema's BioStar 2 system.

Cybercrime

Cloud Atlas Uses Polymorphic Techniques to Avoid Detection

Jeffrey Burt  •  August 15, 2019

The group behind the Cloud Atlas cyber espionage campaigns, which were first detected five years ago, is now deploying polymorphic techniques designed to avoid monitoring and detection, according to researchers at Kaspersky Lab.

Governance

Microsoft Issues Patches for BlueKeep-Like Vulnerabilities

Akshaya Asokan  •  August 14, 2019

Microsoft has released a set of patches for two newly discovered BlueKeep-like vulnerabilities in a number of Windows operating systems. The "wormable" bugs in remote desktop services permit propagation of malware from one compromised device to others, the company reports.

3rd Party Risk Management

Choice Hotels: 700,000 Guest Records Exposed

Jeremy Kirk  •  August 14, 2019

Choice Hotels says about 700,000 guest records were exposed after one of its vendors copied data from its systems. Fraudsters discovered the unsecured database and tried to hold the hotel chain to ransom, which it ignored.

Endpoint Security

SQLite Vulnerability Permits iOS Hack: Report

Akshaya Asokan  •  August 13, 2019

Security researchers at Check Point Software Technologies say they've uncovered an SQLite database vulnerability in Apple iOS devices that can run malicious code capable of stealing passwords and gaining persistent control on affected devices.

Artificial Intelligence & Machine Learning

Elon Musk Wants to Hack Your Brain

Mathew J. Schwartz  •  August 13, 2019

The news that serial entrepreneur Elon Musk and scientists have unveiled Neuralink - a neuroscience startup that's been in stealth mode for two years and aims to create a new computer/brain interface - might make you ask: What took him so long? Before signing up, just make sure it's immune to ransomware.

Cybercrime

Members of Chinese Espionage Group Develop a 'Side Business'

Apurva Venkat  •  August 12, 2019

Some members of a hacking group with ties to China's government that's primarily known for its complex cyberespionage campaigns have developed a side business targeting the global gaming industry for financial gain, the security firm FireEye says.