Latest

Governance

Citrix Releases First Patches to Fix Severe Vulnerability

Scott Ferguson  •  January 20, 2020

Citrix has released the first of several patches that address a vulnerability in its Application Delivery Controller and Gateway products that was discovered by researchers in December. If left unpatched, the vulnerability is remotely exploitable and could allow access to applications and internal networks.

Anti-Money Laundering (AML)

How Cybercriminals Are Converting Cryptocurrency to Cash

Ishita Chigilli Palli  •  January 20, 2020

Cybercriminals are using increasingly sophisticated methods to turn illicitly gained cryptocurrency into cash, which raises new concerns about enforcing anti-money laundering laws, according a report by Chainalysis.

Application Security

Microsoft Warns of Zero-Day Internet Explorer Exploits

Mathew J. Schwartz  •  January 20, 2020

Microsoft says it's prepping a patch to fix a memory corruption flaw in multiple versions of Internet Explorer that is being exploited by in-the-wild attackers, and it's issued mitigation guidance. Security firm Qihoo 360 says the zero-day flaw has been exploited by the DarkHotel APT gang.

Active Defense & Deception

Sizing Up Today's Deception Technology

Nick Holland  •  January 20, 2020

Deception technology is evolving as a powerful asset in the cybersecurity arsenal, providing significant advantages in being able to monitor an attacker's behavior, says Joseph Krull, senior analyst at Aite Group.

Cybercrime

'WeLeakInfo' Website Shut Down

Scott Ferguson  •  January 17, 2020

Law enforcement agencies in five countries have shut down WeLeakInfo.com, which allegedly provided cybercriminals with access to over 12 billion personal records culled from 10,000 data breaches.

Cybercrime

Cyberattack on a Major Bank Would Have Ripple Effect: Study

Ishita Chigilli Palli  •  January 17, 2020

A cyberattack targeting one of the largest banks in the U.S. that stops the processing of payments likely would have a major ripple effect throughout the financial system, according to a new report from the Federal Reserve Bank of New York.

Business Email Compromise (BEC)

BEC Fraudsters Targeting Financial Documents: Report

Scott Ferguson  •  January 17, 2020

As business email compromise schemes continue to evolve, some cybercriminals are focusing on accessing companies' financial documents, which provide useful information to support the theft of money, according to a new report from security firm Agari.

Cyberwarfare / Nation-State Attacks

FBI Promises 'Timely' Election Breach Reports for Officials

Akshaya Asokan  •  January 17, 2020

The FBI has created a new policy to give "timely" breach notifications to state and local officials concerning election hacking and foreign interference. The updated guidelines look to correct some of the mistakes in the run-up to the 2016 presidential election.

Active Defense & Deception

Analysis: Huawei 5G Dilemma

Nick Holland  •  January 17, 2020

The latest edition of the ISMG Security Report discusses why Britain is struggling to determine whether to use China's Huawei technology in developing its 5G networks. Plus: An update on a mobile app exposing infant photos and videos online and an analyst's take on the future of deception technology.

Governance

Windows Vulnerability: Researchers Demonstrate Exploits

Scott Ferguson  •  January 16, 2020

A day after the NSA disclosed a significant vulnerability that could affect the cryptographic operations in some versions of Windows, security researchers started releasing "proof of concept" code designed to show how attackers potentially could exploit the flaw. This highlights the urgency of patching.

Cybercrime

Alarming Trend: More Ransomware Gangs Exfiltrating Data

Mathew J. Schwartz  •  January 16, 2020

As if ransomware wasn't already bad enough, more gangs are now exfiltrating data from victims before leaving systems crypto-locked. Seeking greater leverage against non-paying victims, Maze and Sodinokibi attackers are not just threatening to leak stolen data; they're also following through.

Critical Infrastructure Security

Senators Field Legislation to Build Huawei 5G Alternatives

Mathew J. Schwartz  •  January 16, 2020

One gaping hole in the U.S. government's push to counter Chinese-built 5G telecommunications gear remains the lack of alternatives. But a bipartisan group of senators is seeking to create a $1 billion fund to create trusted, Western-built options.