Latest

Cyberwarfare / Nation-state attacks

Suspected State-Sponsored Hackers Pummel US and Australia

Jeremy Kirk  •  February 19, 2019

Recent apparently state-sponsored hack attacks have hit dozens of companies in the U.S. and political parties in Australia. Officials say China and Iran appear to have escalated their online espionage campaigns, seeking to gather better intelligence and steal intellectual property.

Application Security

Facebook's Leaky Data Bucket: App Stored User Data Online

Jeremy Kirk  •  February 18, 2019

A security consultancy discovered Facebook user data exposed in two different places online without authentication or encryption. The data, which is now offline, came from an Android app that purported to offer statistical information to logged-in users.

Cyberwarfare / Nation-state attacks

Report: UK Believes Risk of Using Huawei Is Manageable

Mathew J. Schwartz  •  February 18, 2019

Britain's intelligence establishment has reportedly concluded that any risks posed by Chinese-built Huawei networking equipment used as part of the country's 5G rollout can be minimized if the process is appropriately managed.

Compliance

Report: Facebook Faces Multibillion Dollar US Privacy Fine

Mathew J. Schwartz  •  February 15, 2019

The Federal Trade Commission is reportedly negotiating a settlement with Facebook that includes a multibillion dollar fine for its privacy failures. But the social network is alarmed about the proposed settlement agreement's terms and conditions, The Washington Post reports.

Application Security

WannaCry Hero Loses Key Motions in Hacking Case

Jeremy Kirk  •  February 15, 2019

A famed British computer security researcher has lost several key motions in a federal hacking case that stems from his alleged contribution to two types of banking malware. The rulings could complicate the challenges for the defense team of Marcus Hutchins, who remains in the U.S.

Artificial Intelligence & Machine Learning

Business Email Compromises: The Growing Threat in Healthcare

Marianne Kolbasuk McGee  •  February 15, 2019

Business email compromise attacks are becoming far more common in the healthcare sector, says Rod Piechowski of the Healthcare Information and Management Systems Society, who discusses promising technologies to help address the threat.

Blockchain & Cryptocurrency

Protecting Cryptocurrency in the Era of 'Deep Fakes'

Nick Holland  •  February 15, 2019

The latest edition of the ISMG Security Report highlights how thieves can use "deep fake" photos in an attempt to steal cryptocurrency. Also featured: A discussion of the implications of "data gravity" and an analysis of whether the era of mega-breaches is ending.

Cybercrime

US Air Force Veteran Charged in Iran Hacking Scheme

Jeremy Kirk  •  February 14, 2019

A former U.S. Air Force counterintelligence agent was indicted for disclosing classified information and helping Iran compromise the computers of other U.S. intelligence agents. The case marks another damaging leak for the American government.

Anti-Fraud

Roses Are Red, Romance Scammers Make You Blue

Mathew J. Schwartz  •  February 14, 2019

This Valentine's Day, authorities are once again warning individuals to watch out for anyone perpetrating romance scams. The FTC says Americans lost $143 million to romance scams in 2017, while in the U.K., Action Fraud says reported romance scam losses in 2018 topped $64 million.

HIPAA/HITECH

Securing Healthcare Payment Transactions

Marianne Kolbasuk McGee  •  February 13, 2019

As more hospitals seek new methods for collecting payments from patients, they face the challenge of securing those transactions, says Dan Berger of AxiaMed, who describes HIPAA and PCI compliance issues in an interview at the HIMSS19 conference.

Breach Preparedness

Battling Big Breaches: Are We Getting Better?

Mathew J. Schwartz  •  February 13, 2019

What if organizations' information security practices have gotten so good that they're finally repelling cybercriminals and nation-state attackers alike? Unfortunately, the five biggest corporate breaches of the past five years - including Yahoo, Marriott and Equifax - suggest otherwise.

Application Security

Major Flaw in Runc Poses Mass Container Takeover Risk

Jeremy Kirk  •  February 12, 2019

Red Hat, Amazon and Google have issued fixes for a serious container vulnerability. The flaw in the "runc" container-spawning tool could allow attackers to craft a malicious container able to "break out" and gain root control of a host system, potentially putting thousands of other containers at risk.