Week in review: Hackers breaching law firms, ransomware flare-up, and how to get your talk accepted at Black Hat

Here’s an overview of some of last week’s most interesting news, podcasts and articles:

Hackers breaching law firms for insider trading info
Two of the most prestigious law firms in the US who are best known for their financial services and corporate practices have had their computer networks compromised by hackers.

US govt has unlocked San Bernardino gunman’s iPhone
The US Department of Justice has found a way to get into the iPhone 5C owned by Syed Farook, one of the San Bernardino shooters.

Linux security isn’t enough to stop data breaches
In this podcast recorded at RSA Conference 2016, Angela Lepadatu, Marketing Coordinator at CoSoSys, talks about why organizations need to take further steps to protect Linux setups from data breaches.

Consumers living in smart homes are willing to sell personal data
A majority of respondents worldwide might be willing to share their personal data collected from their smart home with companies in exchange for money, and 70 percent agree companies should give coupons and discounts to customers in return for data about device usage, according to Intel Security.

Flaw in HID door controllers lets attackers unlock doors, deactivate alarms
Trend Micro researcher Ricky Lawshae has unearthed a critical vulnerability in HID’s VertX and Edge door controllers. Exploiting the flaw is easy, and could result in attackers gaining complete control of the device, meaning they could unlock doors and switch off alarms controlled through it.

SideStepper vulnerability can be used to install malicious apps on iOS
Check Point researchers have identified SideStepper, a vulnerability that can be used to install malicious apps on iPhones and iPads to steal login credentials and sensitive data.

Samas ransomware enters hospitals through vulnerable servers
There’s hardly a day anymore that we don’t hear about a hospital being hit with ransomware. But while most have been infected via phishing emails carrying or linking to the malware, the latest incidents show a new modus operandi when it comes to malware delivery: compromising servers by leveraging vulnerabilities and spreading the ransomware to Windows machines from there.

Creating secure devices for the Internet of Things
We often hear how insecure embedded devices around us are and with sensors communicating from the most seemingly benign of devices – watches, thermostats, kettles and even garden equipment – what are the key challenges for organisations in making IoT devices that are safer by design? What are the design constraints that lead to these devices being insecure?

Don’t get stuck with dead end User Behavior Analytics
Why are most UBA products dead ended?

How to get your talk accepted at Black Hat
Interest to speak at Black Hat is overwhelming and, naturally, in the selection process you go head-to-head with many infosec heavyweights. Speaking at Black Hat is not just a chance to get your work in front of a discerning audience and to create a brand of yourself – it’s become a matter of prestige.

Web application security with Acunetix
In this podcast recorded at RSA Conference 2016, Ian Muscat, Product Communications Manager at Acunetix, talks about Acunetix Vulnerability Scanner, available both as an online and on premise solution. It detects and reports a wide array of vulnerabilities in applications built on architectures such as WordPress, PHP, ASP.NET, Java Frameworks, Ruby on Rails and many others.

Carders use custom built POS malware to hit US retailers
Crooks are dead set on stealing as much payment card information as possible before US retailers switch to chip-enabled cards, meaning they are trying to leverage all available POS malware on the market.

NIST security standard to protect credit cards, health information
For many years, when you swiped your credit card, your number would be stored on the card reader, making encryption difficult to implement. Now, after nearly a decade of collaboration with industry, a new computer security standard published by the National Institute of Standards and Technology (NIST) not only will support sound methods that vendors have introduced to protect your card number, but the method could help keep your personal health information secure as well.

1,400+ vulnerabilities found in automated medical supply system
Security researchers have discovered 1,418 vulnerabilities in CareFusion’s Pyxis SupplyStation system – automated cabinets used to dispense medical supplies – that are still being used in the healthcare and public health sectors in the US and around the world.

Commonly used IoT devices vulnerable to privacy theft
A technical investigation by Bitdefender has discovered that four commonly used Internet of Things (IoT) consumer devices are vulnerable to attack. The analysis reveals that current authentication mechanisms of many Internet-connected devices can easily be bypassed to expose smart households and their inhabitants to privacy theft.

Encryption we can trust: Are we there yet?
Encryption is arguably the most important single security tool that we have, but it still has some serious growing up to do.

Security and privacy issues in QQ Browser put millions of users at risk
Citizen Lab researchers identified security and privacy issues in QQ Browser, a mobile browser produced by China-based Tencent, which may put millions of users of the application at risk of serious compromise.

Petya ransomware encrypts files, disks, locks users out of computers
A new type of ransomware does not only encrypt the victims’ files, but also their disk’s Master File Table (MFT), and it replaces the boot drive’s existing Master Boot Record (MBR) with a malicious loader. It makes the entire computer unusable until the ransom is paid or until the victims decide to cut their losses, repair the MBR themselves, and reinstall Windows.

Printers all over the US “hacked” to spew anti-Semitic fliers
Andrew “Weev” Auernheimer, one of the two men who were prosecuted and convicted for harvesting e-mails and authentication IDs of 114,000 early-adopters of Apple’s iPad from AT&T’s servers, is back to his old tricks: using publicly accessible assets for furthering his own goals.

Container security for enterprise computing
The largest pain-point today for organizations moving to a container strategy is that containers are being adopted and managed by developers. Operations and security do not have the level of visibility and control that they are accustomed to. At the same time, for DevOps to succeed, security and operations controls must be as agile and move as quickly as the assets to be protected. In this podcast recorded at RSA Conference 2016, John Morello, CTO at Twistlock, talks about the Twistlock Container Security Suite.

PHP, Python still fail to spot revoked TLS certificates
In 2012, a group of researchers demonstrated that SSL certificate validation is broken in many applications and libraries, and pointed out the root causes for that situation: badly designed APIs of SSL implementations and data-transport libraries. Four years later, Sucuri Security researchers wanted to check what’s the current situation.

Has Reddit been served with a National Security Letter?
Reddit has published its 2015 Transparency Report, and there is one thing missing from it: the entire section about national security requests.

Why SMBs need threat intelligence
Most of the innovative work being done in information security comes from to small to medium sized companies. At the same time, there’s a lack of security solutions for other companies of the same size operating in other spaces. In this podcast recorded at RSA Conference 2016, Mark Seward, VP of Product Marketing at Anomali, says that when security is your differentiator as a business, everybody wins.