Week in review: DDoS attacks becoming more effective, and how to build trust between business and IT
Here’s an overview of some of last week’s most interesting news, articles and interviews:
Gathering and using threat intelligence
In this interview, Tomer Teller, Security Innovation Manager at Check Point, talks about the role of threat intelligence in the modern security architecture, discusses how it can help identify sophisticated malware attacks, and illustrates the essential building blocks of a robust threat intelligence solution.
State of the Internet: Trends impacting online business
Akamai Technologies provides insight into key global statistics such as connection speeds, overall attack traffic, network connectivity/availability issues, and traffic patterns across leading Web properties and digital media providers.
The impact of IoT on IT infrastructure
Enterprises say they are prepared for the Internet of Things (IoT) and see it as a potential opportunity. However, as it stands today, there may not be enough network capacity to handle the demand that will accompany an anticipated explosion in the number of connected devices.
5 essential mobile security tips
It doesn’t matter if you’re using iOS, Android, Windows Phone or BlackBerry, these tips apply to every mobile device that connects to the Internet.
How to build trust between business and IT
As information security professionals we need to realize that helping business leaders understand the threats posed by cyber security is a challenge that we need to face in order to keep our systems secure.
Google Drive update fixes data-leaking flaw
Google has fixed a security issue that made some of the files stored on Google Drive and shared with friends or colleagues via a direct link potentially reachable by unauthorized third parties, and calls users to remove previously shared documents.
DDoS attacks are becoming more effective
Disruptive cyber-attacks are becoming more effective at breaching security defenses, causing major disruption and sometimes bringing down organizations for whole working days, according to a new global study from BT.
Banking malware sniffs out data sent over HTTPS
Careful online banking users can sometimes spot that something is amiss when malware installed on their computer pops up phishing pages or adds fields to legitimate banking forms. But the Emotet banking malware doesn’t bother with that, and sniffs out data sent over secured connections instead.
IEEE launches Anti-Malware Support Service
AMSS is designed to increase the availability of and access to stronger cryptographic and metadata cybersecurity tools and resources, as well as to unite key computer security stakeholders in the development of new ones.
Wireless security risks and defenses
In this interview, Kent Lawson, CEO of Private WiFi, talks about the key threats exposed by wireless access, offers protection advice and illustrates the trends that will shape wireless security in the future.
Western energy companies hit by state-sponsored hackers
Symantec researchers have confirmed the findings of their colleagues at F-Secure, who have been monitoring the spreading of the Havex malware family, and have put them in a larger context, tying them to the activities of a hacking group they dubbed Dragonfly.
Facebook SDK flaw allows unauthorized access to Facebook accounts
MetaIntell has uncovered a significant security vulnerability in the Facebook SDK (V3.15.0) for both iOS and Android. Dubbed Social Login Session Hijacking, when exploited this vulnerability allows an attacker access to a user’s Facebook account using a session hijacking method that leverages the Facebook Access Token (FAT).
Microsoft disrupts malware networks and APT operations
Microsoft’s Digital Crimes Unit struck again, and was allowed to seize 23 free domain names in an effort to strike a fatal blow to malware delivery networks run by a Kuwaiti and an Algerian national.
Microsoft hardens encryption for Outlook, OneDrive
Microsoft is making good on the promises they made last December, when they announced that they will – among other things – strengthen the encryption of customer data across their networks and services, including Outlook.com, Office 365, SkyDrive and Windows Azure.
Bug in WordPress plugin allows unauthorized file upload
WordPress users who also use the MailPoet plugin are urged to update it as soon as possible, as all versions but the latest one are plagued with a critical flaw that could allow attackers to remotely upload any file on their vulnerable website.
Exploit switches off Microsoft EMET’s protection features
By leveraging and modifying a “semi-random public exploit” researchers have managed to deactivate all protection features of the latest version of Microsoft’s Enhanced Mitigation Experience Toolkit and “get shell” on the target system and execute code.
Android HijackRAT poised to hit mobile banking users
A highly versatile piece of Android malware has been unearthed by FireEye researchers. Posing as “Google Service Framework”, the malicious app is capable of stealing phone and user information, banking credentials, and gives the malware peddler remote access to the device. And, in addition to all this, it’s also able to kill a range of AV apps.
The building blocks of a successful authentication infrastructure
In this interview, Josh Alexander, CEO of Toopher, discusses how an increasingly mobile workforce shapes the way an organization deals with authentication issues, provides advice to a CISO with the task of upgrading an outdated authentication infrastructure, and much more.
eBook: Advanced Malware Exposed
Advanced Malware Exposed is a must read for anyone who wants to understand and protect against advanced, persistent threats who are using this new generation of highly sophisticated advanced malware. This eBook provides a broad overview on the major aspects of advanced malware, its underpinnings, its impact on modern business practices, and briefly suggests possible solutions. It includes a foreword by Robert Lentz, former CISO, DoD.
No-IP reclaims control of domains seized by Microsoft
Microsoft has relinquished control of the 23 domain names it seized control of on last Monday with the blessing of a Nevada federal court.
Estimated $3.75bn stolen by Brazil fraud ring
An estimated $3.75 billion have been netted by a single fraud ring that took advantage of a popular Brazilian payment method – the Boleto – by wielding a frequently upgraded piece of malware that silently intercepted and rerouted payments to the crooks’ bank accounts.