Despite BlueKeep Warnings, Many Organizations Fail to Patch

Jeffrey Burt • July 18, 2019

Weeks after Microsoft issued a patch for the BlueKeep vulnerability, which threatens devices running older versions of Windows, many organizations worldwide have yet to install patches despite alerts from the software giant, government agencies and cybersecurity companies, according to researchers at BitSight.

Business Continuity Management / Disaster Recovery

Ransomware: As GandCrab Retires, Sodinokibi Rises

Blockchain & Cryptocurrency

Senators Scrutinize Facebook's Cryptocurrency Plans

Application Security

Security Flaw Exposed Valid Airline Boarding Passes

Leak Confirms Google Speakers Often Record Without Warning

Latest

New Phishing Scheme Targets Amex Card Holders

Akshaya Asokan • July 18, 2019

Researchers have uncovered a new type of phishing campaign that is targeting American Express card users. In these incidents, attackers are sending a hyperlink as part of a phony account update to access the victim's credentials and other account details, according to researchers at the security firm Cofense.

General Data Protection Regulation (GDPR)

Patient Record Snooping Incident Leads to GDPR Fine

Marianne Kolbasuk McGee • July 18, 2019

Authorities in the Netherlands recently levied a $516,000 fine under the General Data Protection Regulation against a hospital in the Hague in connection with a data breach involving "dozens" of staffers who snooped on the electronic medical records of a celebrity.

Cybercrime

Bulgarian Authorities Arrest Suspect in Massive Data Breach

Akshaya Asokan • July 17, 2019

Bulgaria's national cybercrime unit has arrested a 20-year-old local man for his alleged role in breaching the country's tax servers and exposing the financial details and other personal data of nearly 5 million citizens, according to news media reports.

Cybercrime as-a-service

Suspected Rubella Toolkit Mastermind Arrested

Scott Ferguson • July 17, 2019

A 20-year-old Dutch man suspected of creating the Rubella Macro Builder toolkit and distributing it on underground forums has been arrested by the Dutch National Police, which received assistance from McAfee. Rubella and other toolkits enable attackers to distribute malware through weaponized Office documents.

Active Defense & Deception

How Deception Technology Is Evolving

Nick Holland • July 17, 2019

Deception technology is becoming more sophisticated, enabling organizations to battle against emerging threats, says Alissa Knight, senior analyst at Aite Group, a research and advisory company.

Application Security

How a Big Rock Revealed a Tesla XSS Vulnerability

Jeremy Kirk • July 16, 2019

Software vulnerabilities sometimes have an uncanny knack of revealing themselves, even when a bug hunter is looking someplace else. Sam Curry's probing eventually revealed a cross-site scripting flaw in a Tesla service, which netted him a $10,000 bounty.

Endpoint Security

Broadcom Reportedly Suspends Bid for Symantec

Scott Ferguson • July 15, 2019

Broadcom has reportedly suspended its effort to acquire Symantec after the two companies failed to agree on a price for the deal. The negotiations had been ongoing for several weeks.

Cybercrime

'Sea Turtle' DNS Hijackers Expand Reach

Jeffrey Burt • July 15, 2019

The group behind the Sea Turtle espionage campaign that was exposed in April is expanding its geographic reach and claiming new victims, according to researchers with Cisco's Talos unit.

Cybercrime

Phishing Campaign Tied to Amazon Prime Day

Akshaya Asokan • July 15, 2019

In the run-up to Amazon Prime Day, some of the company's customers were being targeted by a phishing kit called 16Shop, according to McAfee researchers. The campaign is similar to an earlier attack that focused on Apple users.

Security Operations

The Future SOC: Harmonizing Detection and Response

Jeremy Kirk • July 12, 2019

The success of security operations centers will depend on how well they blend key technologies - including detection, user behavior analytics and orchestration, says Haiyan Song of Splunk, who offers strategic insights.

Active Defense & Deception

Analysis: The Significance of GDPR Fines

Nick Holland • July 12, 2019

The latest edition of the ISMG Security Report analyzes the significance of fines against British Airways and Marriott for violations of the EU's GDPR. Also featured are discussions of California's privacy law as a model for other states and the next generation of deception technologies.

3rd Party Risk Management

Battling Supply Chain Security Risks

Marianne Kolbasuk McGee • July 12, 2019

Incidents involving supply chain vendors pose increasingly significant risks to health data, says Rick McElroy of Carbon Black, who addresses "island hopping" and other emerging threats.