Week in review: Windows 10 anti-ransomware, secure remote browsing, infosec and media
Here’s an overview of some of last week’s most interesting news and articles:
NotPetya successor Bad Rabbit hits orgs in Russia, Ukraine
Bad Rabbit ransomware, apparently modeled on NotPetya, has hit a number of organizations across Russia, Ukraine, and Eastern Europe on Tuesday.
Is the Windows 10 controlled folder access anti-ransomware feature any good?
With the release of Windows 10 Fall Creators Update, users get a new feature aimed at stopping ransomware from encrypting their most important files.
The impact of threat hunting on your security operations
Threat hunting starts with the assumption that an incident has happened, but it’s not based on already received alerts. Effective hunts depend more on the knowledge, skills and instincts of human analysts than on tools. Still, there can be no doubt that good tools can help threat hunters channel their capabilities more efficiently.
Critical flaws in maritime comms system could endanger entire ships
IOActive security consultant Mario Ballano has discovered two critical cybersecurity vulnerabilities affecting Stratos Global’s AmosConnect communication shipboard platform.
Beware fake Android cryptocurrency trading apps on Google Play
Two phishing apps that were made to look like the official app of popular cryptocurrency exchange Poloniex have been booted off Google Play after ESET researchers notified Google of their existence.
Infosec shouldn’t eat their own, we’re better than this
As professionals we rely on an informed press to convey information to a variety of audiences. Here, too, we require trust to build an efficient relationship.
Researchers turn LG’s Hom-Bot vacuum cleaner into a real-time spying device
Check Point researchers have discovered a vulnerability in LG’s smart home infrastructure that could have allowed hackers to take over the legitimate user’s account and, through it, take remote control of all the LG SmartThinQ home appliances.
Top threats impacting endpoint security decisions
Research shows that the majority of businesses across the globe are either currently or planning to incorporate machine learning in their endpoint defenses.
Secure remote browsing: A different approach to thwart ever-changing threats
A defense-in-depth strategy is essential to modern enterprises, and organizations must deepen their defenses as quickly as possible to fully protect themselves. One promising technology proposes to achieve this by removing web browsing activity from endpoints altogether, while still enabling users to seamlessly and securely interact with the web-based content they need in order to do their jobs. The key to this approach? Secure remote browsing.
Infosec expert viewpoint: DDoS attacks
What do infosec experts think about the threat of modern DDoS attacks, their evolution, and DDoS protection mechanisms?
Offshore law firm Appleby confirms data breach
Appleby, a major offshore law firm based in Bermuda, has confirmed it has suffered a data security incident in 2016 that resulted in some of their data being compromised.
Camera-based, single-step two-factor authentication resilient to pictionary, shoulder surfing attacks
A group of researchers from Florida International University and Bloomberg LP have created Pixie, a camera-based two-factor authentication system that could end up being a good alternative to passwords and biometrics-based 2FA options.
The 10 misconceptions of using a policy-based approach for access control
The principle of Attribute Based Access Control (ABAC) has existed for many years. It’s the evolution from simple access control lists and role-based access control, to a highly flexible system for administering access based on the evaluation of attributes.
The race to quantum supremacy and its cybersecurity impact
ABI Research forecasts that the first attack-capable quantum machines will make their market debut by 2030. Michela Menting, Research Director at ABI Research warns, “When they do, even the latest and best in class cybersecurity technologies will be vulnerable.”
Coinhive breached due to old, reused password
Coinhive has suffered another setback: their DNS records have been surreptitiously changed by attackers, allowing them to steal cryptocurrency mined via the project’s script.
Data-driven analysis of vulnerabilities in real-world OT networks
Many are exposed to the public internet and easy to traverse using simple vulnerabilities like plain-text passwords. Lack of even basic protections can enable attackers to quietly perform reconnaissance before sabotaging physical processes.
Immersive technologies are game changers for cybersecurity job growth
A new ESG study, which surveyed more than 500 people aged 16 to 24, revealed that 74% of respondents said the use of VR tools would increase their likelihood of pursuing cybersecurity careers.
New infosec products of the week: October 27, 2017
A rundown of infosec products released last week.