Week in review: MalwareTech arrested, hacking Amazon Echo
Here’s an overview of some of last week’s most interesting news, articles and podcasts:
US senators introduce bill to improve IoT security, protect researchers probing it
The Internet of Things (IoT) Cybersecurity Improvement Act of 2017 would require that devices purchased by the US government meet certain minimum security requirements.
UK researcher who stopped WannaCry charged with creating and distributing banking Trojan
Marcus Hutchins, the 23-year-old UK researcher who found the kill-switch domain in the WannaCry ransomware code and registered it, preventing the malware to wreak even more chaos than it did, has been arrested in Las Vegas on Wednesday.
Hackers can turn Amazon Echo into a covert listening device
New research released by MWR InfoSecurity reveals how attackers can compromise the Amazon Echo and turn it into a covert listening device, without affecting its overall functionality.
Container security: The seven biggest mistakes companies are making
Here are the seven biggest container security mistakes companies are making, and how they can “adjust their sails” to ensure smooth sailing ahead.
The anatomy of a completely fileless attack
There are malware that are fileless only while entering a user’s system (and they eventually reveal themselves when they execute their payload), and there are completely fileless malware attacks, where the entire infection chain is fileless.
What leads women to cybersecurity, and what makes them stay?
Caroline Wong, Vice President of Security Strategy at app security company Cobalt, asked over 300 women currently employed in the cybersecurity sector about their experience, background, everyday work, and plans and wishes for the future, and compiled a report based on the results.
HBO hacked, attackers leak GoT script and some episodes
The breach has been confirmed by HBO, who said that proprietary information, including some of their programming, was compromised as a result of the “cyber incident,” but did not specify what specific data was stolen.
Mozilla sets up private, encrypted file sharing service for large files
Mozilla has launched an online service for private sharing of encrypted files between two users. It’s called Send, and it’s meant to ensure users’ shared files do not remain online forever.
How to select a suitable incident response program for your organization
In this podcast recorded at Black Hat USA 2017, Susan Carter, Sr. Manager Threat Intelligence and Incident Response Services at NTT Security, talks about how to select a suitable incident response program for your organization, and outlines the options organizations have to help them prepare for that imminent attack or breach.
Another popular Chrome extension hijacked through phishing
Chris Pederick, the creator and maintainer of the Web Developer for Chrome extension, is the latest victim of attackers who hijack popular Chrome add-ons in order to push ads onto users.
Large corporations increasingly considering blockchain deployment
57% of large corporations are either actively considering or are in the process of deploying blockchain technology.
Weaponizing machine learning to improve cyber defenses
At this year’s edition of DEF CON, researchers from Bishop Fox have demonstrated DeepHack, their own proof-of-concept, open-source hacking AI. At the same conference, Hyrum Anderson, Technical Director of Data Science at Endgame, explained how an AI agent trained through reinforcement learning to modify malware can successfully evade machine learning malware detection.
Most SMBs plan to outsource IT security this year
Although businesses recognize the growing threats, 71 percent still admit not being ready to address them.
Nmap 7.60 released: SSH support, SMB2/SMB3 improvements, 14 more scripts
Nmap is a free and open source utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime.
Hackers impersonate women online to get into target corporate networks
By all (online) accounts, Mia Ash was a pretty and successful photographer based in London, and she was looking for friendship and love on the Internet. But unfortunately for those who believed her to be a real person, she does not actually exist – the illusion that she does was meticulously created by hackers.
Shark or not? 3 real-life security scenarios and how to tell which will really bite
In most shark movies, the person swims along oblivious to the looming and hidden threat – a continuous false negative. In fact, false negatives are very bad for both swimmers and security professionals.
Intrusion detection is speeding up: Is it enough to tackle global cyber threats?
As criminals continue to develop new methods to break or sidestep cyber defences, in many cases the focus is shifting towards the ability to detect and respond to an incident as quickly as possible.
Identity-in-depth and the evolution of defense
All of your defensive layers are irrelevant if the attacker has valid credentials that allow them through the castle door.
New infosec products of the week: August 4, 2017
A rundown of infosec products released last week.