Content by Mathew J. Schwartz

Bug-Fixing Imperative: 'Patch, Protect or Pray'

Mathew J. Schwartz  •  June 26, 2017

Rapid patching and adoption of updated software has long been a "must do" security imperative. But as WannaCry demonstrated, many organizations have yet to master the patch-management challenge, says Jack Huffard, president and COO of Tenable.

Parliament Pwnage: Talk Weak Passwords, Not 'Cyberattack'

Mathew J. Schwartz  •  June 26, 2017

Opportunistic attackers may have breached some Parliament email accounts by brute-force guessing their way into accounts with weak passwords. But such a breach is hardly the "cyberattack" some are making it out to be.

British Parliament Targeted by Brute-Force Email Hackers

Mathew J. Schwartz  •  June 26, 2017

Members of Parliament in Britain have had their remote email access suspended following an apparent brute-force hack attempt aimed at exploiting weak passwords to gain access to their accounts. Officials say fewer than 90 email accounts appear to have been breached.

FBI: Reported Internet-Enabled Crime Losses Hit $1.3 Billion

Mathew J. Schwartz  •  June 23, 2017

The FBI says reported losses due to internet crime last year totaled $1.3 billion, based on nearly 300,000 complaints logged with its Internet Complaint Center. It warns that CEO fraud, ransomware, tech-support fraud and extortion are becoming increasingly prevalent.

Threats: Social Engineering and Malicious Spam Dominate

Mathew J. Schwartz  •  June 22, 2017

Good news: Exploits kits are in decline, thanks to concerted efforts to disrupt their efficacy. Unfortunately, criminals are diversifying their attacks, focusing more on social engineering - including tech-support scams - and malicious spam campaigns.

Honda Hit by WannaCry

Mathew J. Schwartz  •  June 21, 2017

One month after the SMB-targeting WannaCry worm outbreak began spreading globally, Honda discovered fresh infections at multiple facilities, and was forced to temporarily idle one plant as a result of the ransomware.

South Korean Hosting Firm Pays $1 Million Ransom

Mathew J. Schwartz  •  June 20, 2017

South Korean web hosting firm Nayana has agreed to pay attackers a record-shattering $1 million to unlock 153 Linux servers crypto-locked by ransomware. Security researchers say the infection was likely exacerbated by the company running ancient versions of the Linux kernel, as well as Apache and PHP.

Leak Reveals CIA 'CherryBlossom' Program Targeting Routers

Mathew J. Schwartz  •  June 19, 2017

A new dump from WikiLeaks has revealed an apparent CIA project - code named "CherryBlossom" - that since 2007 has used customized, Linux-based firmware covertly installed on business and home routers to monitor internet traffic and exploit targets' devices.

British Security Services Tie North Korea to WannaCry

Mathew J. Schwartz  •  June 16, 2017

Britain's security services have reportedly concluded that the WannaCry ransomware outbreak was launched by Lazarus group, a hacking team tied to North Korea. Attribution aside, security experts question how many organizations can defend themselves against Lazarus attacks.

Neutrino Exploit Kit: No Signs of Life

Mathew J. Schwartz  •  June 15, 2017

Good news: The Neutrino exploit kit - once a major exploit kit player - appears to have disappeared from the cybercrime scene. While it's unclear if Neutrino is gone for good, rivals have already filled any gaps in the market.

Two New Ransomware Decryptors Give Victims a Free Out

Mathew J. Schwartz  •  June 15, 2017

Victims of Jaff and EncrypTile ransomware can take advantage of two new free tools from security firms that exploit weaknesses in the malware crypto to forcibly crack encrypted files on demand - no potential ransom-payment required.

Euro Cops Cuff Suspected Payment Card Fraudsters

Mathew J. Schwartz  •  June 14, 2017

Police in Europe have dismantled a cross-border gang devoted to perpetrating payment card fraud that they say used card skimmers, micro cameras and other devices to harvest payment card data from at least 3,000 victims.

Marissa Mayer Bids Adieu to Yahoo

Mathew J. Schwartz  •  June 13, 2017

Marissa Mayer bids adieu to Yahoo as Verizon completes its acquisition of the company for $4.48 billion - a $350 million discount gained after the search giant last year revealed that it had suffered two massive data breaches.

Security Investments Consume SWIFT's Profits

Mathew J. Schwartz  •  June 13, 2017

Banks that collectively own SWIFT saw their profits vanish last year as the organization increased its investments in information security, even as the interbank messaging service handled record volumes of money-moving messages.

French Officials Detail 'Fancy Bear' Hack of TV5Monde

Mathew J. Schwartz  •  June 12, 2017

New details have emerged relating to the 2015 hack attack against French broadcaster TV5Monde, which resulted in multiple television channels going dark as well as social media channels run by the broadcaster being hijacked and used to spew purported jihadist propaganda.