Individuals at Risk
Cyber Privacy
The Secretive Company That Might End Privacy as We Know It: A little-known start-up helps law enforcement match photos of unknown people to their online images — and “might lead to a dystopian future or something,” a backer says. The New York Times, January 18, 2020
70,000 Tinder Photos of Women Just Got Dumped on a Cyber-Crime Forum: More than 70,000 photos of Tinder users are being shared by members of an online cyber-crime forum, Gizmodo has learned, raising concerns about the potential for abusive use of the photos. Ominously, only women appear to have been targeted. Gizmodo, January 16, 2020
TikTok Security Flaws May Have Allowed Hackers to Steal Personal Data: At the moment, TikTok is one of the hottest video sharing apps among teenagers and young adults around the world. Some security flaws recently discovered by an Israeli firm reveal that it may also be one of the most vulnerable. Security researchers at Check Point characterized the flaws as “core to TikTok’s systems”, raising serious questions about the safety of the Beijing-based app. CPO, January 17, 2020
Is TikTok a Cybersecurity Threat?: Recently, the US government launched a national security review of the video platform and app TikTok. The investigation follows the acquisition of the platform by the Chinese firm ByteDance in 2017. InfoSecurity, January 15, 2020
Secure The Human
These subject lines are the most clicked for phishing: The most successful email lures don’t promise riches, but issue imminent cybersecurity warnings or urgent office messages, a report reveals. TechRepublic, January 16, 2020
Phishing for Apples, Bobbing for Links: Anyone searching for a primer on how to spot clever phishing links need look no further than those targeting customers of Apple, whose brand by many measures remains among the most-targeted. Past stories here have examined how scammers working with organized gangs try to phish iCloud credentials from Apple customers who have a mobile device that is lost or stolen. Today’s piece looks at the well-crafted links used in some of these lures. KrebsOnSecurity, January 13, 2020
Cyber Update
Patch Tuesday, January 2020 Edition: Microsoft today released updates to plug 50 security holes in various flavors of Windows and related software. The patch batch includes a fix for a flaw in Windows 10 and server equivalents of this operating system that prompted an unprecedented public warning from the U.S. National Security Agency. This month also marks the end of mainstream support for Windows 7, a still broadly-used operating system that will no longer be supplied with security updates. KrebsOnSecurity, January 14, 2020
Cyber Humor
Information Security Management in the Organization
Information Security Management and Governance
What is information security? Definition, principles, and jobs: Information security is a set of practices intended to keep data secure from unauthorized access or alterations. Here’s a broad look at the policies, principles, and people used to protect data. CSO, January 17, 2020
Cybersecurity in the C-Suite
Five Ways Business Directors Can Prepare For The Future Of Cybersecurity: In a business environment where a company’s reputation increasingly depends on how well it acts as a steward of customer, client and partner information, boards of directors must be able to make informed decisions about cybersecurity. Forbes, January 15, 2020
Ransomware, phishing and cyberattacks scare business chiefs the most: Forget fire and flood, the top business risk is now a cyber disaster, according to survey of execs. ZDNet, January 14, 2020
Directors Be Warned – You are Responsible for Your Company’s Data Security: On January 6, 2020, the Director of the Federal Trade Commission’s (FTC) Consumer Protection Bureau published a blog post with changes to the FTC’s approach to its orders and settlements of data breach enforcement actions. One of the key elements of the report was a revision to the FTC’s routine enforcement practice to ensure that its remedial data security orders include greater specificity about compliance expectations for companies subject to enforcement action and for third-party assessors engaged to conduct FTC-mandated monitoring and audits of targeted companies’ data security practices. Robert Braun, JMBM Cybersecurity Lawyer Forum, January 13, 2020 (Robert is a member of the SecureTheVillage Leadership Council)
Cyber Warning
Business Email Compromise (BEC) Fraudsters Targeting Financial Documents: Report … ‘Aging Accounts’ a Useful Tool for Stealing Money: As business email compromise schemes continue to evolve, some cybercriminals are focusing on accessing companies’ financial documents, which provide useful information to support the theft of money, according to a new report from security firm Agari. BankInfoSecurity, January 17, 2020
Alarming Trend: More Ransomware Gangs Exfiltrating Data: As if ransomware wasn’t already bad enough, more ransomware gangs are now exfiltrating data from victims before leaving systems crypto-locked. Seeking greater leverage to force victims to accede to their ransom demand, attackers are threatening to leak stolen data and then following through. First, they leak chunks of data before leaking much more – or everything they took – in an attempt to teach future victims a lesson. BankInfoSecurity, January 16, 2020
Cybersecurity in Society
Cyber Crime
Travelex says some in-store systems are back up and running after ransomware attack .. Currency exchange company is gradually bringing systems back online, and said no customer data has been stolen in the attack .. Attackers claim 5GB stolen: Travelex says it has restored some more of its customer-facing systems following a ransomware attack which hit the currency exchange service on New Year’s Eve. ZDNet, January 17, 2020
Travelex boss breaks silence after cyber attack … Claims “there is no evidence that any data has left the organisation.” … Hackers told BBC they gained access to the network 6 months ago & have downloaded 5GB of sensitive customer data: The boss of Travelex has broken his silence about a cyber attack that forced its staff to use pen and paper and halted travel money sales at some banks and supermarkets. BBC, January 17, 2020
New Orleans Mayor: Ransomware Attack Cost City $7 Million: The City of New Orleans ransomware attack has caused at least $7 million in financial damage to date, Mayor Latoya Cantrell told WVUE. In addition, Cantrell said she expects the ransomware attack’s financial impact to continue to grow — despite the fact that the city has recovered $3 million via a cyber insurance policy that was purchased before the incident. MSSP Alert, January 16, 2020
Ransomware Costs in 2019: 2019 saw a lot of action. But protests in Hong Kong, Notre Dame burning, and President Trump being impeached weren’t the only things that went on. “In 2019, the U.S. was hit by an unprecedented and unrelenting barrage of ransomware attacks,” said Emsisoft’s The State of Ransomware in the US: Report and Statistics 2019. The ransomware costs of 2019 are higher than they ever have been, and are expected to rise even further in 2020. CPO, January 15, 2020
Cyber Attack
U.N. Weathers Storm of Emotet-TrickBot Malware … A concerted, targeted phishing campaign took aim at 600 different staffers and officials, using Norway as a lure: The operators behind the notorious Emotet malware have taken aim at United Nations personnel in a targeted attack ultimately bent on delivering the TrickBot trojan. ThreatPost, January 15, 2020
Russians Hacked Ukrainian Gas Company at Center of Impeachment: With President Trump facing an impeachment trial over his efforts to pressure Ukraine to investigate former Vice President Joseph R. Biden Jr. and his son Hunter Biden, Russian military hackers have been boring into the Ukrainian gas company at the center of the affair, according to security experts. The New York Times, January 13, 2020
Cyber Defense
N.S.A. Takes Step Toward Protecting World’s Computers, Not Just Hacking Them: The intelligence agency alerted Microsoft to a vulnerability in Windows. Typically, it would keep quiet and exploit the flaw. The New York Times, January 14, 2020
National Cybersecurity
Iran May Deploy Wiper Malware in Response to U.S. Military Strike, Experts Warn: Wiper malware erases the contents of a machine’s hard drive and makes it impossible for it to reboot. IEEE, January 15, 2020
Essays: China Isn’t the Only Problem With 5G: The security risks inherent in Chinese-made 5G networking equipment are easy to understand. Because the companies that make the equipment are subservient to the Chinese government, they could be forced to include backdoors in the hardware or software to give Beijing remote access. Eavesdropping is also a risk, although efforts to listen in would almost certainly be detectable. More insidious is the possibility that Beijing could use its access to degrade or disrupt communications services in the event of a larger geopolitical conflict. Since the internet, especially the “internet of things,” is expected to rely heavily on 5G infrastructure, potential Chinese infiltration is a serious national security threat. Schneier on Security, January 10, 2020
Cyber Freedom
The Cybersecurity 202: FBI pledges more transparency on election hacking but may not go far enough: The FBI has pledged to revamp its policies for sharing information about election breaches, bowing to criticism that it was far too secretive about Russian hacking efforts in 2016. The Washington Post, January 17, 2020
Hackers Are Coming for the 2020 Election — And We’re Not Ready: Why the threats to our elections are more sophisticated and widespread than ever. Rolling Stone, January 17, 2020
FBI will start notifying states when hackers hit local elections: Before the policy change, the agency notified only affected counties about cyberattacks. CNet, January 16, 2020
Georgia election server showed signs of tampering, expert says: The server was left exposed to the open internet for at least six months, a problem the same expert discovered in August 2016. NBC, January 16, 2020
Financial Cybersecurity
Federal banking regulators issued a cybersecurity warning to financial institutions, citing a ‘heightened risk’ environment amid global tensions: “Implementing and maintaining effective cybersecurity controls is critical to protecting financial institutions from malicious activity, especially in periods of heightened risk,” the Federal Deposit Insurance Corp. and Office of the Comptroller of the Currency said in a joint bulletin. AmericanBanker, January 16, 2020
Cyber Enforcement
FBI Seizes Domain That Sold Info Stolen in Data Breaches: The website, WeLeakData.com, claimed to have more than 12 billion records gathered from over 10,000 breaches. DarkReading, January 17, 2020
Cyber Terrorism
Alleged Member of Neo-Nazi Swatting Group Charged: Federal investigators on Friday arrested a Virginia man accused of being part of a neo-Nazi group that targeted hundreds of people in “swatting” attacks, wherein fake bomb threats, hostage situations and other violent scenarios were phoned in to police as part of a scheme to trick them into visiting potentially deadly force on a target’s address. KrebsOnSecurity, January 10, 2020
Cyber Miscellany
How the internet helped crack the Astros’ sign-stealing case: NEW YORK — When allegations that the Houston Astros had stolen signs electronically during their 2017 World Series championship season surfaced in November, Jimmy O’Brien was sitting in his new apartment in Harlem, waiting for some Verizon workers to finish setting up his cable internet. ESPN, January 17, 2020
