Week in review: Critical GnuTLS library flaw, and new Android devices sold with pre-installed malware
Here’s an overview of some of last week’s most interesting news, videos, and podcasts:
Mt. Gox users targeted with fake promises of lost Bitcoin recovery
Bitcoin exchange Mt. Gox has shared more details about the issues that have led to it filing for bankruptcy protection just as malware peddlers have started taking advantage of affected users’ desperation and desire to recover their lost bitcoins.
Cisco offers $300k for IoT security solutions
Cisco has launched a new competition and is calling on “visionaries, innovators, and implementers” to propose practical solutions for issues affecting security of the Internet of Things.
Cyber crooks will go after medical records next
As security firms and law enforcement agencies continue to cooperate and successfully take down botnets, cyber crooks will be forced to look for new and more lucrative targets, and especially ones that are poorly secured.
Netflix users targeted in active tech support scam
Malwarebytes’ security researcher Jerome Segura has recently analyzed a rather creative tech support scam that is actively targeting Netflix users.
Zeus retrieves attack list hidden in sunset and cat images
Malware peddlers employing a new Zeus banking Trojan variant have resorted to hiding the malware’s configuration file into innocuous-looking sunset and cat photos.
Video: RSA Conference 2014 showcase
The world’s top information security professionals and business leaders gathered in San Francisco for RSA Conference 2014. Here’s a closer look at the show, watch in HD for the best experience.
The security of embedded devices
Embedded devices are everywhere and they make our lives more convenient, but from a security standpoint, they can be intimidating, especially if we’re talking about an infusion pump or a piece of equipment that runs the critical infrastructure. In this podcast recorded at RSA Conference 2014, Billy Rios, Director of Threat Intelligence at Qualys, provides an understanding of these systems – they are computers after all.
Three-year-old Uroburos rootkit likely created by Russian state-sponsored hackers
Researchers from German antivirus company G Data have discovered and analyzed a complex rootkit with spying capabilities and believe that it has been created and employed by Russian-speaking hackers working for a nation-state.
Whitepaper: Planning a career path in cybersecurity
The field of cybersecurity is growing quickly; so quickly that there are positions sitting open waiting to be filled by qualified individuals. The need for personnel knowledgeable and experienced in security implementation and management has never been greater.
300,000 routers compromised in DNS hijacking campaign
Some 300,000 confirmed – but most likely many more – small office/home office (SOHO) routers have been compromised and their DNS settings changed to use two IP addresses in London, effectively allowing yet unknown attackers to perform Man-in-the-Middle attacks.
More Bitcoin thefts, Bitcoin bank Flexcoin shuts down
Mere days after Mt. Gox filed for bankruptcy, “Bitcoin bank” Flexcoin and Bitcoin exchange Poloniex have announced that they have been successfully targeted by thieves.
GnuTLS library flaw opens way for MitM attacks
A critical cryptographic bug similar to the one recently discovered in iOS and OS X has been revealed to exist in the GnuTLS code library, widely used in open source software and Linux distributions.
New approach to SQL injection detection
In this podcast recorded at RSA Conference 2014, Dave Rosenberg, CTO at DB Networks, talks about a new approach to SQL injection detection and explains how they solve this problem in their products.
New Android devices sold with pre-installed malware
A wide range of smartphones and tablets manufactured by Samsung, Motorola, Asus and LG Electronics have apparently been compromised with malicious apps before being sold to unsuspecting clients.
The password is dead: Next generation access management strategies
In this podcast recorded at RSA Conference 2014, Eugene Shablygin, CEO and founder of WWPass Corporation, discusses the death of the password and talks about alternative access management strategies that offer greater security.
Microsoft’s quest to make users drop Windows XP continues
As the date of the scheduled retirement of Windows XP – arguably one of Microsoft’s most popular products ever – draws near, the company continues its quest to make as many users as possible migrate to a newer version of the OS, preferably to Windows 8.1.
A peek into China’s burgeoning mobile cybercriminal underground
Every country’s cybercriminal underground market has distinct characteristics, and with 500 million national mobile Internet users and the number continuously rising, the Chinese underground market is awash with cyber crooks buying and selling services and devices aimed at taking advantage of them.
HTTPS can’t be trusted to obscure private online activity
A group of researchers has proven that HTTPS is a lousy privacy tool, and that anyone who can view, record and analyze visitors’ traffic can identify – with 89 percent accuracy – the pages they have visited and the personal details they have shared.
New technique targets C code to spot malware attacks
Researchers from North Carolina State University have developed a new tool to detect and contain malware that attempts root exploits in Android devices. The tool improves on previous techniques by targeting code written in the C programming language – which is often used to create root exploit malware, whereas the bulk of Android applications are written in Java.
Exploring identity relationship management
rying to solve the identity management and security issues for the employees and customers of a large Fortune 1000 corporation is a massive undertaking. In this podcast recorded at RSA Conference 2014, Mike Ellis, CEO of ForgeRock, talks about how today’s solutions must link devices and new mobile and social apps to a single security platform that works all the time, everywhere, on premises or off in the cloud.
Cybercriminals increasingly drawn to Tor anonymity and hidden services
Initially created to help political dissidents bypass traffic restrictions and hide their online activity from authoritarian governments, the Tor anonymity network has long since become a great tool for cyber crooks to hide their criminal activities and infrastructure.
Dendroid spying RAT malware found on Google Play
A new Android malware toolkit called Dendroid is being offered for sale by its creators, and at least one of the malicious APKs created with it has managed to fool Google Play’s Bouncer.
Personal info of 12 million KT customers stolen and misused
Two men have been arrested in connection with the massive KT Corp. data breach that resulted in the theft of personal and financial information of some 12 million customers of the South Korean telecom giant.
Egnyte CSO details company security roadmap
In this podcast recorded at RSA Conference 2014, Kris Lahiri, CSO at Egnyte, talks about his security roadmap, which details the company’s plans to raise the global standard for secure file sharing in the enterprise.