The Top 15 Security Posts – Vetted & Curated
*Threats & Defense*
1. Chinese Hackers Target Air-Gapped Military Networks (SecurityWeek, May 15 2020)
A threat actor believed to be operating out of China has been targeting physically isolated military networks in Taiwan and the Philippines, Trend Micro reports.
2. Attackers Routinely Use Older Vulnerabilities to Exploit Businesses, US Cyber Agency Warns (Dark Reading, May 13 2020)
Security issues in Microsoft products dominate the US government’s top 10 list of commonly exploited vulnerabilities, but Apache Struts, Adobe Flash, and Drupal are also routinely targeted.
3. US Government Exposes North Korean Malware (Schneier on Security, May 14 2020)
US Cyber Command has uploaded North Korean malware samples to the VirusTotal aggregation repository, adding to the malware samples it uploaded in February.
Filter Out the Noise
Since I started this curated newsletter in June 2017, I’ve clipped ~14,000 articles and narrowed them down into the best 20 per day & best 15 per week. This is my favorite way to cut through all the security marketing and hype. If you’re enjoying it, tell a friend. If you hate it, tell an enemy.
Thanks! – Lucas Samaras
Share on Twitter Facebook LinkedIn
*AI, IoT, & Mobile Security*
4. DoJ Again Asks for Backdoors After Hacking Shooter’s iPhones (SecurityWeek, May 19 2020)
The U.S. Department of Justice announced on Monday that the FBI managed to gain access to the data stored on two iPhones belonging to an individual who last year killed and wounded several people at a United States naval base.
5. Cell-tower attacks by idiots who claim 5G spreads COVID-19 reportedly hit US (Ars Technica, May 18 2020)
US warns carriers to boost security, citing reports of attacks in several states.
6. AI and Cybersecurity (Schneier on Security, May 19 2020)
“Ben Buchanan has written “A National Security Research Agenda for Cybersecurity and Artificial Intelligence.” It’s really good — well worth reading.”
*Cloud Security, DevOps, AppSec*
7. Cloud Exposes SMBs to Attack as Human Error Grows (Infosecurity Magazine, May 19 2020)
Verizon’s annual Data Breach Investigations Report is compiled from an analysis of 32,002 security incidents and 3950 confirmed breaches.
The report claimed that smaller businesses comprised just over a quarter (28%) of the total number of breaches.
However, more telling was the alignment of top breach-related threats: phishing came top for both SMBs and larger firms, with password dumper malware and stolen credentials featuring in the top four for both.
More than a fifth (20%) of attacks on SMBs were against web applications and involved the use of stolen credentials.
In fact, attacks against cloud-based data were on the up overall with web app threats doubling to 43%. Credential theft, errors and social attacks like phishing accounted for over two-thirds (67%) of breaches.
8. The Elementor Attacks: How Creative Hackers Combined Vulnerabilities to Take Over WordPress Sites (Wordfence, May 20 2020)
“we can release full details of the attack campaign and associated vulnerabilities. Today’s report includes details on how attackers were using a combination of two vulnerabilities to compromise sites. Now that the vendors have released fixes and the community has had time to update, we are releasing a video walkthrough of a site being exploited, and a full disclosure of all technical details of these vulnerabilities and the associated attack campaign.”
9. Cloud WAF Comparison Using Real-World Attacks (Medium, May 18 2020)
Are the cloud WAFs any good in blocking common web application attacks? We decided to find out and the results were surprising.
*Identity Mgt & Web Fraud*
10. Less than a quarter of Americans use a password manager (Help Net Security, May 17 2020)
A large percentage of Americans currently do not take the necessary steps to protect their passwords and logins online, FICO reveals.
11. Google Chrome Redesign Puts Security & Privacy in Users’ Hands (Dark Reading, May 19 2020)
The Chrome browser will tell users if their browser is up to date, malicious extensions are installed, and/or a password has been compromised.
12. U.S. Secret Service: “Massive Fraud” Against State Unemployment Insurance Programs (Krebs on Security, May 16 2020)
“A well-organized Nigerian crime ring is exploiting the COVID-19 crisis by committing large-scale fraud against multiple state unemployment insurance programs, with potential losses in the hundreds of millions of dollars, according to a new alert issued by the U.S. Secret Service.”
*CISO View*
13. 2019 Data Breach Investigations Report (Verizon Enterprise, May 19 2020)
Read the new 2019 Data Breach Investigations Report from Verizon. Get hands-on access to industry-leading data, information and processes via DBIR Interactive.
14. Industry Reactions to Verizon 2020 DBIR: Feedback Friday (SecurityWeek, May 22 2020)
Industry professionals have commented on various findings in the latest DBIR.
15. Officials: Israel linked to a disruptive cyberattack on Iranian port facility (Washington Post, May 19 2020)
The attack in early May is believed to have been retaliation for an earlier hacking attempt targeting Israeli water supplies.