The Top 15 Security Posts – Vetted & Curated
*Threats & Defense*
1. CISA Adds Ransomware Module to Cyber Security Evaluation Tool (SecurityWeek, Jul 01 2021)
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday announced the release of a new module for its Cyber Security Evaluation Tool (CSET), namely the Ransomware Readiness Assessment (RRA).
2. Ransomware hits hundreds of US companies, security firm says (AP, Jul 02 2021)
The REvil gang, a major Russian-speaking ransomware syndicate, appears to be behind the attack, said John Hammond of the security firm Huntress Labs. He said the criminals targeted a software supplier called Kaseya, using its network-management package as a conduit to spread the ransomware through cloud-service providers. Other researchers agreed with Hammond’s assessment.
3. Authorities Take Down DoubleVPN Service for Aiding Cybercriminals (SecurityWeek, Jun 30 2021)
Law enforcement agencies in Europe, the US, and Canada on Tuesday announced the takedown of DoubleVPN, a virtual private network (VPN) service that allegedly helped cybercriminals conduct nefarious activities.
Filter Out the Noise
Since I started this curated security news in June 2017, I’ve clipped ~19,000 articles and narrowed them down into the best 20 per day & best 15 per week. This is my favorite way to cut through all the security marketing and hype. If you’re enjoying it, tell a friend. If you hate it, tell an enemy.
Thanks! – Lucas Samaras
Share on Twitter Facebook LinkedIn
*AI, IoT, & Mobile Security*
4. Secure AI is the foundation of trustworthy AI (Help Net Security, Jun 30 2021)
AI-based recommendation systems are used in many online services we enjoy today, including search engines, online shopping sites, streaming services, and social media. However, their growing influence over what people see and do on the internet has raised concerns about their susceptibility to various types of abuse, such as their active use to spread disinformation and promote conspiracy theories. Andy Patel, a researcher with cybersecurity provider F-Secure’s Artificial Intelligence Center of
5. Apps with 5.8 million Google Play downloads stole users’ Facebook passwords (Ars Technica, Jul 02 2021)
Researchers uncovered 9 apps that used a sneaking method to pilfer credentials.
6. This Hacker Broke Into His School’s HVAC Before Thermostats Became ‘Smart’ (VICE, Jul 02 2021)
In the latest episode of the My First Hack series, Andrew Tierney—better known as Cybergibbons—tells the story of the time he discovered he could use his telephone to control his school’s heating system.
*Cloud Security, DevOps, AppSec*
7. Pentagon Cancels Disputed JEDI Cloud Contract With Microsoft (SecurityWeek, Jul 06 2021)
The Pentagon said Tuesday it is canceling a cloud-computing contract with Microsoft that could eventually have been worth $10 billion and will instead pursue a deal with both Microsoft and Amazon.
8. It’s High Time for a Security Scoring System for Applications and Open Source Libraries (Dark Reading, Jul 06 2021)
A benchmarking system would help buyers choose more secure software products and, more importantly, light a fire underneath software producers to make products secure.
9. GitHub Unveils AI Tool to Speed Development, but Beware Insecure Code (Dark Reading, Jul 01 2021)
The company has created an AI system, dubbed Copilot, to offer code suggestions to developers, but warns that any code produced should be tested for defects and vulnerabilities.
*Identity Mgt & Web Fraud*
10. Kaseya Hacked via Authentication Bypass (Dark Reading, Jul 08 2021)
The Kaseya ransomware attack is believed to have been down to an authentication bypass. Yes, ransomware needs to be on your radar — but good authentication practices are also imperative.
11. Dozens of Chinese phone games now require facial scans to play at night (Ars Technica, Jul 07 2021)
After a 2018 test, "Midnight Patrol" system officially rolls out to 60 Tencent games.
12. Intuit to Share Payroll Data from 1.4M Small Businesses With Equifax (Krebs on Security, Jul 01 2021)
Financial services giant Intuit this week informed 1.4 million small businesses using its QuickBooks Online Payroll and Intuit Online Payroll products that their payroll information will be shared with big-three consumer credit bureau Equifax starting later this year unless customers opt out by the end of this month.
Intuit says the change is tied to an “exciting” and “free” new service that will let millions of small business employees get easy access to employment and income verification services when they wish to apply for a loan or line of credit.
*CISO View*
13. How REvil Ransomware Took Out Thousands of Business at Once (Wired, Jul 04 2021)
More details have come to light as to how the notorious hacking group pulled off its unprecedented attack.
14. Cyber attack against U.S. IT provider forces Swedish chain to close 800 stores (Reuters, Jul 04 2021)
The Swedish Coop grocery store chain closed all its 800 stores on Saturday after a ransomware attack on an American IT provider left it unable to operate its cash registers.
15. Kaseya Left Customer Portal Vulnerable to 2015 Flaw in its Own Software (Krebs on Security, Jul 08 2021)
Last week cybercriminals deployed ransomware to 1,500 organizations, including many that provide IT security and technical support to other companies. The attackers exploited a vulnerability in software from Kaseya, a Miami-based company whose products help system administrators manage large networks remotely. Now it appears Kaseya’s customer service portal was left vulnerable until last week to a data-leaking security flaw that was first identified in the same software six years ago.