Week in review: Gemalto SIM heist, Lenovo’s Superfish blunder, cyber spies compromising disk firmware
Here’s an overview of some of last week’s most interesting news and articles:
Google relaxes its rigid 90-day bug disclosure period
Google has announced that its 90-day vulnerability disclosure period will, from now on, be little longer if the situation warrants it.
Carbanak cyber gang stole hundreds of millions from banks
Since late 2013, an international cyber criminal group has been targeting banks around the world and has made off with $300 million – possibly even more – by compromising the banks’ systems with malware and using the information gleaned via it to their advantage, Kaspersky Lab has revealed.
BYOD: Better stay used to it
There are three main approaches to securing BYOD: IT policy, training and technical solutions.
Is there an overarching organization that helps Arab hackers?
Trend Micro researchers have unearthed two separate but closely linked malware campaigns attributed to Arab parties.
Equation Group: Cyber espionage, compromising HDD firmware, sophisticated malware
For several years, the Kaspersky Lab Global Research and Analysis Team (GReAT) has been monitoring more than 60 advanced threat actors responsible for cyber-attacks worldwide. They’ve discovered the Equation Group, a threat actor that has been active for almost twenty years.
Declaring personal data bankruptcy and the cost of privacy
We’re a society in conflict. On one hand there’s outrage over government surveillance programs and wholesale data breaches. On the other hand, so many trade their identities away for a pittance, or even for nothing – valuing them, wrongly, at zero.
Hackers and makers to meet in Amsterdam at HITB Haxpo
This year’s Hack In The Box Security Conference in Amsterdam will once again feature the HITB Haxpo, which will feature a brand new start up village in addition to the usual community and hackerspaces area. Expect to see the latest in innovative, adaptive technologies with talks in covering everything from security to the latest technology in gadgetry, toys and tools.
What’s critical to the success of the Internet of Things?
Managing identities and access is critical to the success of the Internet of Things (IoT), but in its current form identity and access management (IAM) cannot provide the scale or manage the complexity that the IoT brings to the enterprise.
Flaw in Netgear Wi-Fi routers exposes admin password, WLAN details
The vulnerability is found in the embedded SOAP service, which is a service that interacts with the Netgear Genie application that allows users to control (change WLAN credentials, SSIDs, parental control settings, etc.) their routers via their smartphones or computers.
Beware of fake Windows 10 “activators”
The considerable interest users have shown for testing Microsoft’s Windows 10 Technical Preview version has not passed unnoticed by cyber scammers and malware peddlers.
New Android Trojan fakes device shut down, spies on users
A new Android Trojan that tricks users into believing they have shut their device down while it continues working, and is able to silently make calls, send messages, take photos and perform many other tasks, has been discovered and analyzed by AVG researchers.
UK banks’ customers can access accounts with their fingerprint
iPhone users who are also customers of UK banks RBS and NatWest can now access their online banking app by simply pressing their finger on their phone’s home button.
Windows 10 will offer password-free authentication
“I’m happy to announce Microsoft has contributed design inputs to the Fast IDentity Online (FIDO) Alliance, to be incorporated within FIDO 2.0 Technical Specifications,” said Dustin Ingalls, Group Program Manager for Windows Security & Identity.
Visual hacking exposed
While most security professionals focus on thwarting data breaches from cyber attacks, a new study exposes visual hacking, a low-tech method used to capture sensitive, confidential and private information for unauthorized use, as an under-addressed corporate risk.
Lepide Exchange Recovery Manager 15.0 released
Lepide Software released version 15.0 of Lepide Exchange Recovery Manager. The latest version allows users to add Office 365 as Source directly in Lepide Exchange Recovery Manager.
Lenovo computers come with pre-installed adware and MITM proxy
If you have recently bought a new Lenovo computer, you’re in for a nasty surprise: the company has been shipping them with pre-installed adware. And, what’s even worse, the software in question is also using MITM SSL certificates, which is made possible by the installation of a self-signing certificate authority. Here are instructions on how to wipe Superfish adware and the offending cert from your Lenovo laptop.
How cybercriminals hack our brains
Intel Security reveals some of the basic persuasion techniques currently in use by cybercriminals, which all businesses and employees should be aware of.
Over 250,000 home routers sport same SSH keys, warns researcher
With a simple search, John Matherly, the creator of Shodan, has discovered with it more than 250,000 routers that share the same SSH key, meaning they also share the same private key. An attacker could access and hijack them if the devices are configured to allow remote access and authentication.
Gemalto announces investigation of massive SIM heist
A set of documents from Edward Snowden’s trove indicate that the US NSA and the UK GHCQ have managed to compromise the networks of Dutch SIM card manufacturer Gemalto and acquire encryption keys that protect the privacy of cellphone communications of millions of users around the globe.