Week in review: Mac ransomware, women in infosec, and the death of SHA-1
Here’s an overview of some of last week’s most interesting news, articles and podcasts:
The dangers that come with buying pre-owned IoT devices
When you buy a second-hand connected car, can you be sure that it is not still not reachable by its former owner? Similarly, when you sell your own connected car, how can you be sure that it will not leak the personal information you fed it to the next owner?
Which countermeasures improve security and which are a waste of money?
If you want to know about which cyber defenses are most effective and which are a waste of money and resources, ask a hacker. And that’s just what Nuix researchers did.
Women in infosec: Real-life experiences and challenges
In all segments of society and business, minorities encounter problems that the majority rarely or never faces. And information security is – I think we can all agree – a world where men represent a considerable majority.
Insider threat vs. inside threat: Redefining the term
In this day and age, the term insider threat is often misused. The correct term should be “inside threat,” as that addresses user credentials and system compromises by an outside entity.
Detecting PLC malware in industrial control systems
How can attackers load programmable logic controllers (PLC) with destructive malware, and how can the operators of industrial control systems (ICS) detect it?
New attack sounds death knell for widely used SHA-1 crypto hash function
SHA-1 is definitely, provenly dead, as a group of researchers from CWI Institute in Amsterdam and Google have demonstrated the first practical technique for generating a collision.
Removing admin rights mitigates most critical Microsoft vulnerabilities
Avecto has analyzed the security bulletins Microsoft released in the past year, and came to an important conclusion: an overwhelming majority of all the critical Microsoft vulnerabilities discovered and fixed in 2016 can be mitigated by simply removing admin rights across an organization.
New macOS ransomware masquerades as software cracking tools
New crypto ransomware dubbed Filecoder is stalking macOS users, ESET researchers warn.
Passages: Secure virtual browser for malware isolation
Over 90% of undetected attacks come through the web. In this podcast recorded at RSA Conference 2017, Lance Cottrell, Chief Scientist at Ntrepid, talks about Passages, a secure virtual browser that provides complete protection from web-based attacks.
The devastating impact of healthcare data breaches
One in four U.S. consumers have had their personal medical information stolen from technology systems.
Stethoscope spurs employees to implement better security practices
Stethoscope is a web application that collects information about users’ devices and provides them with specific recommendations for securing them.
Advanced Windows botnet spreads Mirai malware
Kaspersky Lab experts are analyzing the first Windows-based spreader for the Mirai malware as part of a concerted effort to close down Mirai botnets in the wild.
Cyber crooks’ latest tricks for targeting Chrome users
Chrome users have lately been targeted with a few unusual malware delivery and scam attempts.
Microsoft pushes out patches for critical Flash Player vulnerabilities
Microsoft has skipped its February 2017 Patch Tuesday and postponed the release of those patches for March, but there are apparently security vulnerabilities that must be fixed now.
Cloud-based databases need new approaches to ensure data security
Database-as-a-Service (DBaaS) offers high availability, multi-tenancy and the ability to scale as demand grows without the high cost of buying new hardware and related maintenance costs. But security with cloud computing is a concern as IT moves away from controlling the physical IT infrastructure to managing data housed by the third-party cloud supplier.
Results of the rogue Access Point experiment at RSA Conference 2017
The security of open Wi-Fi hotspots has been a subject of great concern for years.
CompTIA Cybersecurity Analyst certification to include behavioral analytics
CompTIA unveiled a vendor-neutral certification, CompTIA Cybersecurity Analyst (CSA+), that brings behavioral analytics to the forefront of assessing cyber threats.
New infosec products of the week: February 24, 2017
A rundown of infosec products released last week.