Week in review: DNS DDoS, Linux kernel zero-day, VeraCrypt audited
Here’s an overview of some of last week’s most interesting news, reviews and articles:
Dirty COW Linux kernel zero-day exploited in the wild is now patched
Linux developer Phil Oester has spotted attackers exploiting a Linux kernel zero-day privilege escalation flaw that dates back to 2007, and has raised the alarm.
Major US DNS provider hit with DDoS, part of the Internet becomes unreachable
Among the websites that experienced issues as a result of the attack are Reddit, GitHub, Spotify, Twitter, Imgur, PayPal, Wired, Etsy, Amazon, Yelp and many others.
Review: Threat Forecasting
Threat forecasting with the help of Big Data is one way to improve an organization’s defenses but, as the writers of this book make perfectly clear, it will not predict and stop attacks 100% of the time. Still, you can achieve a considerable improvement in detecting and preventing attacks, and that could mean all the difference for the organization’s bottom line and reputation.
VeraCrypt security audit reveals many flaws, some already patched
VeraCrypt, the free, open source disk encryption software based on TrueCrypt, has been audited by experts from cybersecurity company Quarkslab.
Researchers bypass ASLR by exploiting flaw in Intel chip
ASLR is a defense mechanism present in major operating systems and many applications, and protects systems from common attacks such as buffer overflow and return-oriented programming attacks.
Net Cease: Microsoft researchers unveil anti-reconnaissance tool
Net Cease is a PowerShell script that prevents attackers who have already compromised an endpoint from getting information about other targets within the same corporate network.
Hacking 3D manufacturing systems demonstrated by researchers
Researchers from three universities combined their expertise to demonstrate the first complete sabotage attack on a 3D additive manufacturing (AM) system, illustrating how a cyber attack and malicious manipulation of blueprints can fatally damage production of a device or machine.
Android banking Trojan asks victims to send selfies with ID cards
The Acecard Android Trojan is a threat that has been around for quite some time, but the amount and types of information it is after is constantly changing.
Democracy for the Internet of Things
Could intelligent devices already in our homes, cars, and potentially even wearables, provide a direct connection between us, the citizen, and the process of driving democracy?
43+ million users affected by confirmed Weebly breach
Weebly, a popular web-hosting service featuring a drag-and-drop website builder, has been breached, and email addresses/usernames, IP addresses and encrypted passwords for some 43 million users have been stolen.
MBRFilter: Cisco open sources tool to protect the Master Boot Record
Cisco’s Talos research team has open sourced MBRFilter, a tool that aims to prevent a system’s Master Boot Record (MBR) getting overwritten by malware.
Typing while Skyping could leave you vulnerable to eavesdropping
Keystroke sounds, or acoustic emanations, can be recorded during a Skype voice or video call and later reassembled as text.
Mirai malware is infecting Sierra Wireless cellular network equipment
The malware is able to gain access to the gateway by logging into ACEmanager with the default password and using the firmware update function to download and run a copy of itself.
Cyber Europe 2016: Analyzing realistic cybersecurity incidents
Cyber Europe 2016 (CE2016) was the largest and most comprehensive EU cyber-security exercise to date.
Unregulated use of facial recognition tech threatens people’s privacy, civil rights
Released on Tuesday, an extensive and in-depth report by the Center for Privacy & Technology at the Georgetown University Law Center has revealed just how extensively the technology is used by law enforcement agencies.
Use Chaos Monkey to push engineers to build resilient cloud services
Chaos Monkey simulates the unexpected disappearance of random servers that run inside a production environment by simply switching them off.
Firmware security: An overlooked threat
An increase in connected devices as part of organizations’ hardware footprint, combined with increasingly inventive attack methods from cybercriminals, has brought firmware security into the spotlight.
How much law firms dedicate to data privacy and security
Many firms’ confidence in their own cyberattack preparedness seems misguided.
13 countries join global ransomware fight
Just three months after the successful launch of the No More Ransom project, law enforcement agencies from a further 13 countries have signed up to fight ransomware together with the private sector.