Week in review: Keylogger in HP laptops, ICS-tailored malware, new issue of (IN)SECURE
Here’s an overview of some of last week’s most interesting news and articles:
Keylogger found in Synaptics driver on HP laptops
For the second time this year, a security researcher unearthed a keylogger in a driver used on a number of HP laptops.
US man is behind the 2015 Hacking Team hack?
Who’s behind the 2015 Hacking Team hack? According to a notice received by Guido Landi, one of the former Hacking Team employees that was under investigation for the hack, a 30-year old Nashville, Tennesee resident might have had something to do with it.
Flaw in Office 365 with Azure AD Connect could result in domain compromise
The Preempt research team has uncovered a vulnerability with Microsoft Office 365 when integrated with an on-premises Active Directory Domain Services (AD DS) using Azure AD Connect software that unnecessarily gives users elevated administrator privileges, making them “stealthy” administrators.
(IN)SECURE Magazine issue 56 released
(IN)SECURE Magazine is a free digital security publication discussing some of the hottest information security topics.
Android vulnerability allows attackers to modify apps without affecting their signatures
Among the many Android vulnerabilities patched by Google this December is one that allows attackers to modify apps without affecting their signatures.
Attackers disrupt plant operations with ICS-tailored malware
Dubbed “TRITON” and “TRISIS” by researchers, the malware was discovered after it was deployed against a victim in the Middle Easy, and inadvertently led to an automatically shutdown of the industrial process.
Whitepaper: Top 20 cyber attacks on ICS
The technique for evaluating the risk of cyber-sabotage of industrial processes are well understood by those skilled in the art. Essentially, such risk assessments evaluate a typically large inventory of possible cyber attacks against the cyber-physical system in question, and render a verdict.
Our smart future and the threat of cyber-kinetic attacks
A growing number of today’s entertainment options show protagonists battling cyber-attacks that target the systems at the heart of our critical infrastructure whose failure would cripple modern society.
Script-based attacks and overall malware on the rise
Research found that scripting threats accounted for 68 percent of all malware during throughout Q3 2017.
Preventing good containers from going bad
Containers go bad everyday, and often without warning. All it takes is one CVE impacting an image, and now all containers deployed using this image are at an increased level of risk of compromise.
Security company Fox-IT reveals, details MitM attack they suffered in September
Dutch IT security consultancy/service provider Fox-IT has revealed that it has suffered a security breach, which resulted in some files and emails sent by the company’s customers to be intercepted by an unknown attacker.
Examining attitudes towards confidential data
Dramatic differences exist between values placed on PII data by attackers, security professionals, insurers and regulators.
An analysis of 120 mobile app stores uncovers plethora of malicious apps
RiskIQ analyzed 120 mobile app stores and more than 2 billion daily scanned resources.
eBook: Defending against crypto-ransomware
According to the Symantec 2017 Internet Security Threat Report, the average ransom demand has reached over $1000 in the last year. Download your copy of the eBook and get a walkthrough on various ways ransomware can be delivered to computers, five stages of crypto-ransomware infection, and best practices that can be applied immediately to minimize the damage.
1.4 billion unencrypted credentials found in interactive database on the dark web
A data dump containing over 1.4 billion email addresses and clear text credentials is offered for download in an underground community forum.
Enterprise USB security is outdated and inadequate
While USB drives are ubiquitous for employees across all industries, security policies for these devices are often severely outdated or grossly inadequate for protecting critical enterprise data.
MoneyTaker’s stealthy hacking spree spread from US to Russia
A stealthy group of Russian-speaking hackers has been targeting financial organizations (banks, credit unions, lenders) in the US and Russia, stealing money and documentation that could be used for new attacks.
Will IoT botnets catapult the industry toward security regulation in 2018?
Attackers demonstrated the power of an IoT-fueled botnet in 2016 when the Mirai botnet took down major websites like Reddit, Twitter and GitHub. Despite the damages, no significant changes to the IoT industry occurred.
A layered approach to modern identity
The way we work is evolving. Traditional desktop computers and laptops are slowly giving way to the mobile device. With this shift towards mobile access at work, home and everywhere in between, comes a shift in both user expectations and behaviors
Consumers are ready to say goodbye to passwords
A new survey of 1,000 Americans exploring awareness and perceptions of biometric authentication confirms that consumers continue to have a strong interest in new biometric technologies that make their lives easier.
By 2020, artificial intelligence will create more jobs than it eliminates
2020 will be a pivotal year in AI-related employment dynamics, according to Gartner, as artificial intelligence (AI) will become a positive job motivator.
New infosec products of the week: December 15, 2017
A rundown of infosec products released last week.