Week in review: Docker Hub breach, identifying malware in embedded systems, CCPA implementation
Here’s an overview of some of last week’s most interesting news and articles:
Mozilla will block Firefox add-ons that contain obfuscated code
Mozilla has announced that, starting from June 10, Firefox add-ons containing obfuscated code will no longer be allowed on its Add-ons portal and will be blocked.
Attackers breached Docker Hub, grabbed keys and tokens
Docker, the company behing the popular virtualization tool bearing the same name, has announced that it has suffered a security breach.
Cybercriminals targeting social media: Facebook and Instagram are becoming phishers’ favorites
Social media phishing, primarily Facebook and Instagram, saw the highest quarter- over-quarter growth of any industry with a 74.7 percent increase, according to the Vade Secure Phishers’ Favorites report for Q1 2019.
Slack warns investors it might be targeted by organized crime, nation-state hackers
Slack Technologies, the company whose cloud-based collaboration tools and services are used by companies worldwide, has warned potential investors that the company faces threats from a wide variety of sources, including “sophisticated organized crime, nation-state, and nation-state supported actors.”
50,000 companies running SAP installations open to attack via publicly released exploits
Two exploits publicly released in late April at the OPCDE security conference in Dubai could be leveraged to compromise a great number of SAP implementations, Onapsis has warned.
Supply chain attacks: Mitigation and protection
In software development, a supply chain attack is typically performed by inserting malicious code into a code dependency or third-party service integration. Unlike typical cyber attacks, supply chain attacks provide two major advantages to attackers.
Open source security: The risk issue is unpatched software, not open source use
Many of the trends in open source use that have presented risk management challenges to organizations in previous years persist today. However, new data also suggest that an inflection point has been reached, with many organizations improving their ability to manage open source risk, possibly due to heightened awareness and the maturation of commercial software composition analysis solutions.
Hacking our way into cybersecurity for medical devices
Hospitals are filled with machines connected to the internet. With a combination of both wired and wireless connectivity, knowing and managing which devices are connected has become more complicated and, consequently, the institutions’ attack surface has expanded.
Attackers actively exploiting Atlassian Confluence and Oracle WebLogic flaws
Attackers are actively exploiting recently fixed vulnerabilities in Oracle WebLogic and the Widget Connector macro in Atlassian Confluence to deliver ransomware, mine cryptocurrency and make the compromised machines participate in DDoS attacks.
Cybercriminals continue to target intellectual property, putting brand reputation at risk
Despite improvements in combating cybercrime and threats, IT security professionals are still struggling to fully secure their organization and protect against breaches with 61 percent claiming to have experienced a data breach at their current employer, according to McAfee.
SEC demands better disclosure for cybersecurity incidents and threats
As companies increasingly rely on networked systems and on the Internet, cybersecurity threats have grown. Companies that fall victim to a successful cyberattack incur substantial costs for remediation, including increased costs for cyber protection, lost revenues, legal costs and more. All of these costs can impact the riskiness and value of a public company’s stock.
Which cyber threats should financial institutions be on the lookout for?
Banks and financial services organizations were the targets of 25.7 percent of all malware attacks last year, more than any other industry, IntSigths revealed in their latest report.
Making the most of threat intelligence with threat intelligence gateways
Even though many security professionals are still dissatisfied with threat intelligence accuracy and quality, its use as a resource for network defense is growing.
Only 55% of companies plan to be ready for CCPA implementation
While reputation and consumer privacy are the biggest drivers for CCPA compliance, only 55% of companies plan to be ready by the law’s Jan. 1, 2020 effective date, according to the OneTrust and the IAPP research.
Consumers increasingly deploying biometrics as PINs and passwords continue to fail
Consumer comfort over the use of biometrics – which authenticates individuals by their physical and behavioural characteristics – is growing in the UK, with more than two thirds (64%) saying they feel comfortable using the technology.
GE trade secret theft case demonstrates need for document behavior monitoring
A former GE engineer and a Chinese national have been formally charged with 14 counts of economic espionage by the U.S. Department of Justice after stealing trade secrets from GE. The indictment describes the calculated theft of sensitive documents related to the proprietary design of GE’s gas and steam turbines.
The leading sources of stress for cybersecurity leaders? Regulation, threats, skills shortage
A perfect storm of regulation, increased threats and technological complexity is overwhelming cybersecurity decision makers, reveals new research from Symantec.
Researchers develop new technique to identify malware in embedded systems
A technique for detecting types of malware that use a system’s architecture to thwart traditional security measures has been developed by researchers from North Carolina State University and the University of Texas at Austin. The new detection approach works by tracking power fluctuations in embedded systems.
Most SMBs would pay a ransom in order to recover stolen data
More than half (55 percent) of executives at SMBs said they would pay hackers in order to recover their stolen data in ransomware attacks, according to the second quarterly AppRiver Cyberthreat Index for Business Survey.
A surprising number of used drives sold on eBay hold sensitive data
42% of used drives sold on eBay are holding sensitive data, with 15% containing personally identifiable information (PII), according to Blancco Technology Group.
New infosec products of the week: May 3, 2019
A rundown of infosec products released last week.