Threats & Defense
World Cup watching: The common threats found (WeLiveSecurity, Jun 13 2018)
On the eve of the 2018 FIFA World Cup in Russia, we take a closer look at the possible cybersecurity risks that exist on sports-streaming websites
Meet ‘Bro’: The Best-Kept Secret of Network Security (Dark Reading, Jun 14 2018)
This often overlooked open source tool uses deep packet inspection to transform network traffic into exceptionally useful, real-time data for security operations.
Paul Manafort accused of ‘foldering’ to hide communications (Graham Cluley, Jun 16 2018)
You make an email account and share the password to the account with the person you wish to communicate with. Then you write your message but crucially don’t send it. Instead, you save it as a draft.
AI, IoT, & Mobile Security
Startup Working on Contentious Pentagon AI Project Was Hacked (Wired, Jun 18 2018)
Current and former employees say computers at Clarifai, which is analyzing drone images as part of Project Maven, were hacked last fall.
World Cup 2018: How to Secure Your Devices When Traveling in Russia (Wired, Jun 14 2018)
Russia expects as many as 2 million visitors during the 2018 World Cup, most of whom should take extra precautions against the country’s many cyber risks.
In Trump Rebuke, US Senate Votes to Reimpose Ban on China’s ZTE (SecurityWeek, Jun 18 2018)
The US Senate defied President Donald Trump by voting Monday to overrule his administration’s deal with Chinese telecom firm ZTE and reimpose a ban on high-tech chip sales to the company.
Cloud Security, DevOps, AppSec
Malicious Docker Containers Earn Cryptomining Criminals $90K (Threatpost, Jun 14 2018)
Researchers said over a dozen malicious docker images available on Docker Hub allowed hackers to earn $90,000 in cryptojacking profits.
DevSecOps: Secrets in the Cloud (DZone, Jun 17 2018)
Akash Mahajan told his personal journey with system hardening in his talk, The Secrets in Our Clouds. Perhaps his experiences could help you implement or improve system hardening for you own system.
Researchers claim Chrome bug bounty paid to the wrong people (Naked Security – Sophos, Jun 19 2018)
Yubico has been drawn into a rare public spat over how the discovery of a security flaw affecting it products was credited.
Identity Mgt & Web Fraud
Uber fights off scammers every day. Here’s how it learned the tricks (CNET, Jun 16 2018)
An exclusive look at the ride-sharing service’s never-ending battle against cybercriminals.
Remote Authentication GeoFeasibility Tool (FireEye, May 29 2018)
While the ability to access resources from anywhere is imperative for employees, threat actors often leverage stolen credentials to access systems and data. Due to large volumes of remote access connections, it can be difficult to distinguish between a legitimate and a malicious login. FireEye released GeoLogonalyzer to help organizations analyze logs to identify malicious logins.
AT&T, Sprint, Verizon to Stop Sharing Customer Location Data With Third Parties (Krebs on Security, Jun 19 2018)
In the wake of a scandal involving third-party companies leaking or selling precise, real-time location data on virtually all Americans who own a mobile phone, AT&T, Sprint and Verizon now say they are terminating location data sharing agreements with third parties.
CISO View
Free Societies are at a Disadvantage in National Cybersecurity (Schneier on Security, Jun 19 2018)
Dan Geer often said that “the price of freedom is the probability of crime.” We are willing to pay this price because it isn’t that high.
Alleged Vault 7 leaker was busted because of basic security blunders (Naked Security – Sophos, Jun 20 2018)
The FBI says that it was Schulte’s poor opsec – for one thing, he allegedly reused cellphone passwords on all three layers of password protection that were used to (feebly) lock up an incriminating, encrypted file – that got him busted.
“WannaCrypt” ransomware scam demands payment in advance! (Naked Security – Sophos, Jun 22 2018)
To avoid the need for actual ransomware, just insist on payment up front…