U.S. Rep. Bill Foster, D-Ill.

Congressman Makes Case for National Patient ID

Marianne Kolbasuk McGee • August 11, 2020

Rep. Bill Foster, D-Ill., who has twice introduced a measure to pave the way for a national patient identifier, explains in an in-depth interview why he believes such an ID is essential.

COVID-19

Breaches Tied to Pharmacy Looting: Security Lessons

Latest

Business Continuity Management / Disaster Recovery

Avaddon Ransomware Joins Data-Leaking Club

Mathew J. Schwartz • August 12, 2020

Yet another ransomware-wielding gang has threatened to steal and leak the data of any victims who refuse to pay a ransom: The operators of Avaddon ransomware have created a dedicated data-leak site that already lists a construction firm victim, and the gang continues to recruit new affiliates.

Business Email Compromise (BEC)

Beware: AgentTesla Infostealer Now More Powerful

Akshaya Asokan • August 12, 2020

The operators behind the AgentTesla remote access Trojan have upgraded the infostealer with additional capabilities, including the ability to steal credentials from VPNs, web browsers, FTP files and email clients, Sentinel Labs reports. The low-cost malware is used in BEC scams and other campaigns.

3rd Party Risk Management

Snapdragon Chip Flaws Could Facilitate Mass Android Spying

Mathew J. Schwartz • August 11, 2020

Qualcomm is prepping patches for its Snapdragon Digital Signal Processor, used in an estimated 1 billion or more Android devices, after researchers at Check Point counted 400 flaws that attackers could exploit to take control of devices and steal all data they store.

Fraud Management & Cybercrime

Using DNS Data for Cybercrime Intelligence

Jeremy Kirk • August 11, 2020

The Domain Name System, which is at the heart of the internet, is a rich source of data that can help organizations defend themselves against cybercrime. DNS pioneer Paul Vixie says monitoring DNS traffic is crucial, and it's advisable to run your own recursive resolver.

COVID-19

Phishing Campaign Spoofs SBA Loan Offer

Prajeet Nair • August 10, 2020

Malwarebytes reports that a newly discovered phishing campaign is spoofing a U.S. Small Business Administration loan offer in an attempt to steal banking credentials and other personal data.

Business Email Compromise (BEC)

BEC Scam Targets Executives' Office 365 Accounts

Chinmay Rautmare • August 10, 2020

A recently uncovered BEC scam has targeted the Office 365 accounts of executives at over 1,000 companies worldwide, collecting more than 800 sets of credentials in an attempt to commit payment fraud, according to Trend Micro.

Account Takeover

How Was Reddit Defaced?

Jeremy Kirk • August 10, 2020

Reddit had a very "Make America Great Again" weekend, as more than 70 subreddits were temporarily hijacked and used to post "MAGA" messages in support of U.S. President Donald Trump. Attackers claim they used social engineering and password stuffing to compromise the accounts.

Critical Infrastructure Security

US Intelligence Adds More Details on Election Interference

Akshaya Asokan • August 8, 2020

Russia, China and Iran are all seeking to influence the 2020 U.S. Presidential election in November, according to a new report from the Office of the Director of National Intelligence that offers details about each country's plans and goals.

Anti-Phishing, DMARC

FBI on China, Election Security and Impact of COVID-19

Tom Field • August 8, 2020

The day after President Trump issued executive orders to ban Chinese-owned social media apps TikTok and WeChat, Sanjay Virmani of the FBI's San Francisco office shared insights on the Chinese cyberthreat, election security and crime trends in the wake of COVID-19.

Cyberwarfare / Nation-State Attacks

The Debate Over Trump 'Ban' of TikTok, WeChat

Doug Olenick • August 7, 2020

President Donald Trump's executive order banning the Chinese-owned TikTok and WeChat apps could prove to be unenforceable, some privacy and security specialists say. But some Republican lawmakers hailed the move, citing the national security risks posed by the apps.

Application Security

Analysis: Hijacking of Twitter Hacker's Virtual Hearing

Anna Delaney • August 7, 2020

The latest edition of the ISMG Security Report analyzes the hijacking of a virtual court hearing in the Twitter hacking case. Also featured: Why network segmentation is more important than ever; update on Windows print spooler vulnerability.

Cybercrime

Exploring the Forgotten Roots of 'Cyber'

Mathew J. Schwartz • August 7, 2020

One day, you may drive your Tesla Cybertruck on Cyber Monday to your cybersecurity job, backed by a cyber insurance policy as you safeguard cyberspace against the threat of cyberwar. Or cyber whatever, since we've obviously entered the era of "maximum cyber." But what does cyber even mean?