Individuals at Risk
Cyber Privacy
POS Vendor for Cannabis Dispensaries Exposed Data: Report … Database on Internet left unsecured: A point-of-sale system vendor that serves U.S. medical and recreational cannabis dispensaries left an unprotected database containing sensitive information about three clients and 30,000 of their customers exposed to the internet, researchers say. BankInfoSecurity, January 23, 2020
Apple to Address iPhone 11 Location Privacy Concern in iOS 13.3.1: Apple is rolling out a new update to its iOS operating system that addresses the location privacy issue on iPhone 11 devices that was first detailed here last month. KrebsOnSecurity, January 22, 2020
Cyber Defense
What Is Smishing, and How Do You Protect Yourself?: You’re probably familiar with email-based phishing, where a scammer emails you and tries to extract sensitive information like your credit card details or social security number. “Smishing” is SMS-based phishing—scam text messages designed to trick you. HowToGeek, January 24, 2020
On January 28, Data Privacy Day Encourages Consumers to “Own Their Privacy” and Businesses to Improve Their Data Privacy Practices: As new privacy legislation takes effect, the National Cyber Security Alliance stresses the importance of protecting personal data. Yahoo, January 16, 2020
Cyber Humor
Information Security Management in the Organization
Cybersecurity in the C-Suite & Board
Why 2020 is a turning point for cybersecurity: As internet users increase in emerging economies the same challenges of disinformation and cyberattacks experienced in more cyber-advanced countries will occur. World Economic Forum, January 23, 2020
Information Security & Privacy Management
Security Solution Opens Door to Hack – Instead of Locking Them Out … Trend Micro antivirus zero-day used in Mitsubishi Electric hack: Chinese hackers have used a zero-day in the Trend Micro OfficeScan antivirus during their attacks on Mitsubishi Electric, ZDNet has learned from sources close to the investigation. ZDNet, January 24, 2020
What Is Threat Management? Common Challenges and Best Practices: Threat management, or cyber threat management, is a framework often used by cybersecurity professionals to manage the life cycle of a threat in an effort to identify and respond to it with speed and accuracy. The foundation of threat management is a seamless integration between people, process and technology to stay ahead of threats. SecurityIntelligence, January 23, 2020
Ransomware Payments Doubled While Downtime Grew in Q4: The average ransomware payment more than doubled quarter-on-quarter in the final three months of 2019, while average downtime grew by several days, according to the latest figures from Coveware. InfoSecurity, January 23, 2020
A Complete Guide to Hacking the 2020 RSA Conference: The RSA Conference is just around the corner. If you feel like this cybersecurity conference snuck up, you’re not alone. The 29th RSAC is Feb. 23–27 at San Francisco’s Moscone Center, much earlier on the calendar than RSAC 19 or 18 were. It’s scheduled, it’s early and it’s officially go-time. SecurityIntelligence, January 23, 2020
Weathering the Privacy Storm from GDPR to CCPA & PDPA: A general approach to privacy, no matter the regulation, is the only way companies can avoid a data protection disaster in 2020 and beyond. DarkReading, January 23, 2020
Secure The Human
End-user security ignorance laid bare in new report from Proofpoint: Proofpoint’s 2020 State of the Phish report highlights an urgent need for better user training and reporting. ComputerWeekly, January 23, 2020
Cyber Warning
More Than Ransomware. Maze Ransomware Hackers Extort Victims by Publicly Releasing Stolen Data, including sensitive PII: Maze ransomware operators have infected computers from Medical Diagnostic Laboratories (MDLab) and are releasing close to 9.5GB of data stolen from infected machines. BleepingComputer, January 23, 2020
FBI Warns: Beware of Spoofed Job Application Portals: The FBI’s Internet Crime Complaint Center has issued an alert warning that fraudsters are using spoofed job application portals and websites to steal personal information, including payment card details, from would-be applicants. BankInfoSecurity, January 23, 2020
TrickBot Now Steals Windows Active Directory Credentials: A new module for the TrickBot trojan has been discovered that targets the Active Directory database stored on compromised Windows domain controllers. BleepingComputer, January 23, 2020
Increased Emotet Malware Activity: The Cybersecurity and Infrastructure Security Agency (CISA) is aware of a recent increase in targeted Emotet malware attacks. Emotet is a sophisticated Trojan that commonly functions as a downloader or dropper of other malware. Emotet primarily spreads via malicious email attachments and attempts to proliferate within a network by brute forcing user credentials and writing to shared drives. If successful, an attacker could use an Emotet infection to obtain sensitive information. Such an attack could result in proprietary information and financial loss as well as disruption to operations and harm to reputation. CISA, January 22, 2020
Cyber Update
Citrix releases new patches to plug critical server vulnerability: Additional versions of Citrix ADC and Citrix Gateway can now be protected against the severe security issue. ZDNet, January 24, 2020
Cybersecurity in Society
Cyber Privacy
Targeting TikTok’s privacy alone misses a larger issue: Chinese state control: If you or someone you know has access to a smartphone, chances are you have at least heard of TikTok—the wildly popular platform that filled the void left by Vine back in 2016, usurping SnapChat and Twitter in the process, and which allows users to create ephemeral video content for the internet that covers everything from dragging pop stars to reenacting world history to offering disquieting glimpses into the lives of its predominantly teenaged users. QZ, January 24, 2020
Essays: We’re Banning Facial Recognition. We’re Missing the Point. – Schneier on Security .. “[We must] decide how much we want to be spied on by governments and corporations — and what sorts of influence we want them to have over our lives”: Communities across the United States are starting to ban facial recognition technologies. In May of last year, San Francisco banned facial recognition; the neighboring city of Oakland soon followed, as did Somerville and Brookline in Massachusetts (a statewide ban may follow). In December, San Diego suspended a facial recognition program in advance of a new statewide law, which declared it illegal, coming into effect. Forty major music festivals pledged not to use the technology, and activists are calling for a nationwide ban. Many Democratic presidential candidates support at least a partial ban on the technology. Schneier on Security, January 20, 2020
The Secretive Company That Might End Privacy as We Know It: A little-known start-up helps law enforcement match photos of unknown people to their online images — and “might lead to a dystopian future or something,” a backer says. The New York Times, January 18, 2020
Cyber Attack
‘No smoking gun’: Bezos hacking report leaves cybersecurity experts with doubts: Washington (CNN Business)The explosive forensic analysis that concluded Amazon CEO Jeff Bezos was hacked is coming under scrutiny from independent security experts, some of whom say the evidence isn’t strong enough to reach a firm conclusion. CNN, January 24, 2020
UN calls for investigation after Saudi crown prince implicated in hack of Jeff Bezos’ phone: Davos, Switzerland (CNN Business)UN experts said they are “gravely concerned” by information they have received suggesting that a WhatsApp account belonging to Saudi Crown Prince Mohammed bin Salman was used to deliver spyware to the mobile phone of Amazon CEO Jeff Bezos. CNN, January 23, 2020
Good Samaritan or Rival Hacker Gang? Someone is uninstalling the Phorpiex malware from infected PCs and telling users to install an antivirus: Malware analysts believe someone has hijacked the Phorpiex botnet from its creator and is sabotaging its operations by alerting users they’ve been infected. ZDNet, January 23, 2019
Cyber Freedom
Iowa caucus app sparks election security concerns: Every level of the election process has come under scrutiny since the intelligence community determined Russia tried to interfere in the 2016 election. NBC, January 23, 2020
Financial Cybersecurity
Treasury Wants to Collect More Cyber Risk Details From Banks: Agency Wants to Gather More Data to Support Security of Financial Infrastructure. BankInfoSecurity, January 23, 2020
Cyberattack on major bank could spread fast, new research shows: One well-timed cyberattack on a major bank could spread rapidly throughout the American financial system, a new report concludes. FOX, January 23, 2020
Cyber Medical
GE cybersecurity flaw gets maximum risk score, triggering rare FDA notice: FDA has issued a notice about cybersecurity vulnerabilities affecting GE Healthcare Clinical Information Central Stations and Telemetry Servers. MedTechDive, January 24, 2020
