Individuals at Risk
Cyber Privacy
ADT Tech Hacks Home-Security Cameras to Spy on Women: A former ADT employee pleads guilty of accessing customers’ cameras so he could spy on them. ThreatPost, January 22, 2021
Chinese Startup Leaks 318 Million Private Records Obtained Through Data Scraping Facebook, Instagram, and LinkedIn Social Profiles: A Chinese social media management startup leaked over 400GB of personally identifiable information (PII) of social media users, including celebrities and social media influencers worldwide and the US. SocialArks obtained the information by data scraping social media networks, which remains a controversial practice banned by the affected networks. CPO, January 22, 2022
Cyber Update
Critical Security Vulnerabilities Discovered on the Amazon Kindle: There have been a number of critical vulnerabilities discovered on the entire Amazon Kindle line of e-readers. The attacks could give hackers access to your entire device. Amazon has issued a patch to close all of the loopholes and everyone is encouraged to download the 5.13.4. firmware update right away, even people who have elected to root their device. GoodEReader, January 22, 2021
Cyber Humor
Information Security Management for the Organization
Cybersecurity in the C-Suite & Board
These are the top cybersecurity challenges of 2021: The far-reaching cybersecurity breaches of 2020, culminating in the widespread Solarwinds supply chain attack, were a reminder to decision-makers around the world of the heightened importance of cybersecurity. Cybersecurity is a board-level issue now for many firms. World Economic Forum, January 21, 2021
Information Security Management
CISA Launches Campaign to Reduce the Risk of Ransomware: WASHINGTON – The Cybersecurity and Infrastructure Security Agency (CISA) announced the Reduce the Risk of Ransomware Campaign today, a focused, coordinated and sustained effort to encourage public and private sector organizations to implement best practices, tools and resources that can help them mitigate this cybersecurity risk and threat. DarkReading, January 22, 2021
The Importance Of Time And Speed In Cybersecurity: Winston Churchill said, “To build may have to be the slow and laborious task of years. To destroy can be the thoughtless act of a single day.” This quote is applicable to cybersecurity, as the investments required for proper defense are incomparable to the resources needed to conduct a cyberattack. Forbes, January 22, 2021
Council Post: Some Uncomfortable Questions About Your Ransomware Defenses: At this point, we’re all familiar with the aftermath of ransomware attacks. We have all read the early reports about companies, hospitals and city governments that are suddenly “experiencing delays” or have “services temporarily unavailable.” Few of us are surprised when the truth comes out a day or two later: A ransomware attack was to blame. Forbes, January 21, 2021
Ransomware is now the biggest cybersecurity concern for CISOs: Phishing, account compromise and business email compromise attacks are all worries for organisations – but it’s fear of ransomware attacks that is causing the biggest concern. ZDNet, January 21, 2021
Cyber Talent
CISSP certification guide: Requirements, training, and cost: This “gold standard” certification demonstrates your skills and testifies to your experience. CSO, January 21, 2021
Cybersecurity in Society
Cyber Crime
Hackers publish thousands of files after government agency refuses to pay ransom: Ransomware gang publishes stolen data after Scottish Environment Protection Agency (SEPA) refuses to pay ransom – as agency confirms operations remain disrupted. ZDNet, January 22, 2021
Phishing scam had all the bells and whistles—except for one: A reminder that stuff published on the Internet gets published on the Internet. ars technica, January 21, 2021
Fueled by Profits, Ransomware Persists in New Year: Increasing Ransomware Varieties and Attack Volume Look Set to Continue, Experts Warn. BankInfoSecurity, January 21, 2021
Healthcare Web Application Attacks Increased by 51% Since the Introduction of COVID-19 Vaccines: Web application attacks targeting the healthcare industry increased by 51% since COVID-19 vaccines were introduced, according to cybersecurity firm Imperva. The increase in the cyber-attacks was noted when the vaccines were disseminated between Nov and Dec 2020. CPO, January 21, 2021
The State of Ransomware in the US: Report and Statistics 2020: Another banner year for cybercriminals. “In 2019, the U.S. was hit by an unprecedented and unrelenting barrage of ransomware attacks.” Those were the opening words of our last State of Ransomware report. Unfortunately, the barrage continued into 2020 with at least 2,354 US governments, healthcare facilities and schools being impacted. The impacted organizations included: Emsisoft, January 18, 2021
Hackers used 4 zero-days to infect Windows and Android devices: Boobytrapped websites are used by attackers to infect people who visited them. ars technica, January 13, 2021
Cyber Attack
SonicWall Breached Via Zero-Day Flaw In Remote Access Tools: Sophisticated hackers compromised SonicWall’s NetExtender VPN client and SMB-oriented Secure Mobile Access 100 series product, which are used to provide employees and users with remote access to internal resources. CRN, January 23, 2021
National Cybersecurity
FSB warns of US cyberattacks after Biden administration comments: The Russian government has issued a security alert on Thursday evening warning Russian businesses of potential cyberattacks launched by the United States in response to the SolarWinds incident. ZDNet, January 22, 2021
Biden Prodded to Take Muscular Approach to Cybersecurity: Officials and analysts are urging the Biden administration to be more aggressive than its predecessors in dealing with cyber threats from adversaries such as Russia and China as well as non-state actors. NationalDefense, January 22, 2021
After big hack of U.S. government, Biden enlists ‘world class’ cybersecurity team: WASHINGTON/SAN FRANCISCO (Reuters) – President Joe Biden is hiring a group of national security veterans with deep cyber expertise, drawing praise from former defense officials and investigators as the U.S. government works to recover from one of the biggest hacks of its agencies attributed to Russian spies. Reuters, January 22, 2021
Biden Orders Sweeping Assessment of Russian Hacking, Even While Renewing Nuclear Treaty: There will be no “reset” of the American relationship with Moscow, administration officials say. But in an era of constant confrontation in cyberspace, the president seeks to avoid a nuclear arms race. The New York Times, January 21, 2021
Cyber Law
The Arrest of a Florida Data Scientist Demonstrates a Weird Hole in Cybercrime Law: “I’m not a hacker,” data scientist Rebekah Jones told CNN in December after police executed a warrant to search her home for electronic devices, looking for evidence that she had accessed a Florida state emergency management system without authorization. Despite that protestation, this week Jones was arrested and charged with illegally accessing a Florida state computer. The charges suggest that while what she’s accused of did not entail any sophisticated hacking or technical skills thanks to the state’s lackluster security practices, it may well still have involved illegal use of computers. Slate, January 21, 2021
Cyber Regulation
HIPAA Safe Harbor Bill Becomes Law; Amends HITECH Act to Requires HHS to Incentivize Best Practice Security in Violation Findings: January 11, 2021 – President Donald Trump officially signed HR 7898 into law on January 5. The HIPAA Safe Harbor bill amends the HITECH act to require the Department of Health and Human Services to incentivize best practice cybersecurity for meeting HIPAA requirements. HealthItSecurity, January 11, 2021
Cyber Defense
New website launched to document vulnerabilities in malware strains: Launched by security researcher John Page, the new MalVuln website lists bugs in malware code. ZDNet, January 22, 2021
Know Your Enemy
New Charges Derail COVID Release for Hacker Who Aided ISIS: A hacker serving a 20-year sentence for stealing personal data on 1,300 U.S. military and government employees and giving it to an Islamic State hacker group in 2015 has been charged once again with fraud and identity theft. The new charges have derailed plans to deport him under compassionate release because of the COVID-19 pandemic. KrebsOnSecurity, January 19, 2021
Joker’s Stash Carding Market to Call it Quits: Joker’s Stash, by some accounts the largest underground shop for selling stolen credit card and identity data, says it’s closing up shop effective mid-February 2021. The announcement came on the heels of a turbulent year for the major cybercrime store, and just weeks after U.S. and European authorities seized a number of its servers. KrebsOnSecurity, January 18, 2021
Cyber Enforcement
DDoS-Guard To Forfeit Internet Space Occupied by Parler: Parler, the beleaguered social network advertised as a “free speech” alternative to Facebook and Twitter, has had a tough month. Apple and Google removed the Parler app from their stores, and Amazon blocked the platform from using its hosting services. Parler has since found a home in DDoS-Guard, a Russian digital infrastructure company. But now it appears DDoS-Guard is about to be relieved of more than two-thirds of the Internet address space the company leases to clients — including the Internet addresses currently occupied by Parler. Parler, KrebsOnSecurity, January 21, 2021
Europol announces bust of “world’s biggest” dark web marketplace: You probably don’t need to be told what sort of products were on offer at an online retail site called DarkMarket. NakedSecurity, January 14, 2021
Disinformation
Why Fights Over The COVID-19 Vaccine Are Everywhere On Facebook: And why it’s threatening our best hope for ending the pandemic. FiveThirtyEight, January 22, 2021
Cyber Misc
When Adobe Stopped Flash Content From Running It Also Stopped A Chinese Railroad: Adobe’s Flash, the web browser plug-in that powered so very many crappy games, confusing interfaces, and animated icons of the early web like Homestar Runner is now finally gone, after a long, slow, protracted death. For most of us, this just means that some goofy webgame you searched for out of misplaced nostalgia will no longer run. For a select few in China, though, the death of Flash meant being late to work, because the city of Dalian in northern China was running their railroad system on it. Yes, a railroad, run on Flash, the same thing used to run “free online casinos” and knockoff Breakout games in mortgage re-fi ads. JaloPink, January 22, 2021
