The Top 15 Security Posts – Vetted & Curated
*Threats & Defense*
1. The Rise of “Bulletproof” Residential Networks (Krebs on Security, Aug 19 2019)
“Cybercrooks increasingly are anonymizing their malicious traffic by routing it through residential broadband and wireless data connections. Traditionally, those connections have been mainly hacked computers, mobile phones, or home routers. But this story is about so-called “bulletproof residential VPN services” that appear to be built by purchasing or otherwise acquiring discrete chunks of Internet addresses from some of the world’s largest ISPs and mobile data providers.”
2. Formjacking Now Accounts For Most Web Breaches (Infosecurity Magazine, Aug 16 2019)
Magecart and similar attacks siphon payment details direct from websites
3. Threat actors are adapting and switching their operations strategically and technically (Help Net Security, Aug 16 2019)
Cybercrime campaigns and high-profile advanced persistent threat groups are shifting how they target victims and focusing more on intricate relationships with “secure syndicate” partnerships to disguise activity, according to the latest 2019 Cyber Threatscape Report from Accenture.
One of My Favorite Things
Since I started this curated newsletter in June 2017, I’ve clipped ~10,000 articles and narrowed them down into the best 20 per day & best 15 per week. This is my favorite way to cut through all the security marketing and hype. If you’re enjoying it, tell a friend. If you hate it, tell an enemy.
Thanks! – Lucas Samaras
Share on Twitter Facebook LinkedIn
*AI, IoT, & Mobile Security*
4. Hacker Releases First Public Jailbreak for Up-to-Date iPhones in Years (VICE, Aug 19 2019)
Apple accidentally unpatched a vulnerability it had already fixed, making current versions of iOS vulnerable to hackers.
5. Android users menaced by pre-installed malware (Naked Security, Aug 19 2019)
Google Project Zero researcher Maddie Stone has found a new and concerning route for malware to find its way on to Android devices – malicious apps that have been factory pre-installed.
6. Delta sues AI vendor over 2017 breach exposing info on 825K (SC Magazine, Aug 19 2019)
After information on 825,000 Delta Airlines customers was exposed and potentially stolen by at least one hacker in 2017, the airline has filed suit against chatbot vendor [24]7.ai, claiming poor security led to the breach.
*Cloud Security, DevOps, AppSec*
7. How Facebook Catches Bugs in Its 100 Million Lines of Code (Wired, Aug 15 2019)
For the past four years, Facebook has quietly used a homegrown tool called Zoncolan to find bugs in its massive codebase.
8. AWS: No Significant Issues at Other Alleged Targets of Capital One Hacker (SecurityWeek, Aug 19 2019)
Amazon Web Services (AWS) has reached out to customers allegedly targeted by Paige Thompson, the individual accused of hacking Capital One Financial, but says none of them reported any significant issues.
9. Multiple HTTP/2 DoS flaws found by Netflix (Naked Security – Sophos, Aug 19 2019)
Netflix has identified several denial of service (DoS) flaws in HTTP/2, a popular network protocol that underpins large parts of the web. Exploiting them could bring servers grinding to a halt.
*Identity Mgt & Web Fraud*
10. Forced Password Reset? Check Your Assumptions (Krebs on Security, Aug 21 2019)
“Almost weekly now I hear from an indignant reader who suspects a data breach at a Web site they frequent that has just asked the reader to reset their password. Further investigation almost invariably reveals that the password reset demand was not the result of a breach but rather the site’s efforts to identify customers who are reusing passwords from other sites that have already been hacked.”
11. China Attacks Hong Kong Protesters With Fake Social Posts (Wired, Aug 19 2019)
Twitter and Facebook say they’ve taken down misinformation campaigns from China that cast pro-democracy activists as ISIS members and cockroaches.
12. Ready or Not, Here Comes FIDO: How to Prepare for Success (SecurityWeek, Aug 21 2019)
Planning and Preparation Are Key to Successfully Adopting FIDO Standards for “Simpler, Stronger Authentication”
*CISO View*
13. Huge Survey of Firmware Finds No Security Gains in 15 Years (The Security Ledger, Aug 15 2019)
A survey of more than 6,000 firmware images spanning more than a decade finds no improvement in firmware security and lax security standards for the software running connected devices by Linksys, N…
14. VMware Plans $2.1bn Carbon Black Acquisition (Infosecurity Magazine, Aug 23 2019)
Carbon Black will become VMware’s Security Business Unit
15. Breach at Hy-Vee Supermarket Chain Tied to Sale of 5M+ Stolen Credit, Debit Cards (Krebs on Security, Aug 22 2019)
“On Tuesday of this week, one of the more popular underground stores peddling credit and debit card data stolen from hacked merchants announced a blockbuster new sale: More than 5.3 million new accounts belonging to cardholders from 35 U.S. states. Multiple sources now tell KrebsOnSecurity that the card data came from compromised gas pumps, coffee shops and restaurants operated by Hy-Vee, an Iowa-based company that operates a chain of more than 245 supermarkets throughout the Midwestern United States.”