Week in review: Estonia blocks certificates on ID cards, Chrome extension steals all data
Here’s an overview of some of last week’s most interesting news and articles:
Chris Eng: An infosec journey from offense to defense
“Come to my lab, I promise you’ll learn something cool,” a friend told Chris Eng. Within a couple of hours, he had walked him through writing an exploit for an obscure Linux bug, and Eng was hooked on the idea that one could leverage a programming error to gain root privileges on the system.
The clock is ticking on GDPR: Is your business ready?
There are very few businesses that contribute to the global economy that this new regulation won’t touch.
Crooks poison results for financial-related searches to deliver banking malware
Cyber crooks are using a clever approach to deliver banking malware to the right victims: they are poisoning the search results for specific banking-related keywords.
How much do criminals pay for certificates on the dark web?
The Cyber Security Research Institute (CSRI) conducted a six-month investigation into the sale of digital code signing certificates on the dark web.
WordPress site admins: Update immediately!
The advice comes from the WordPress Foundation and Anthony Ferrara, VP of engineering at Lingo Live, who flagged a SQL injection vulnerability in the popular CMS that could be exploited to take over sites running on it.
Estonia blocks certificates on 760,000 ID cards due to identity theft risk
The decision is the result of the discovery of a security vulnerability in the Infineon-developed RSA library, which could be exploited by attackers to discover the RSA private key corresponding to an RSA public key generated by this library.
Malicious Chrome extension steals all data
Some extensions’ main purpose is to inject ads and spam users. Others’ is to push tech support scams or malware, or steal online banking credentials. “Catch-All” goes after every piece of data the victim posts on any website, including login credentials for all kinds of online services.
Would you let Amazon unlock your door?
Amazon recently announced the launch of the Amazon Key, allowing the Amazon delivery person to open your door in order to place your package inside, where presumably it will be safe from theft, the weather, roaming wolf packs, bears, and general mishap. Not all the commentary about this service (and associated camera, lock, etc.) have been positive.
Researchers analyze 3,200 unique phishing kits
Duo Security researchers set out to analyze phishing kits left behind by lazy phishers on compromised websites/servers, so they trawled through sites hosting phishing URLs that have been submitted to Phishtank and OpenPhish.
Firefox will soon block canvas-based browser fingerprinting attempts
Starting with Firefox 58, users will be able to refuse websites’ requests for information extracted via the HTML5 canvas element, which can be used to fingerprint their browsers.
Higher education CIOs expect business model change due to digital transformation
Higher education CIOs recognize that key organizational priorities are enrollment and student success, but fail to show innovation with regard to the top technologies required to differentiate themselves and win, according to a survey from Gartner.
Can an international cyber convention ever succeed?
Will we ever be able to reach an agreement on how international cyber activity should be controlled and regulated?
BEC scammers are robbing art galleries and collectors
BEC scammers are targeting art galleries, collectors and artists, swindling them out of money and, on occasion, ruining their businesses.
A closer look at hybrid cloud security challenges
Most enterprises face major challenges when managing security across their hybrid enterprise networks both during and after cloud migrations.
7 tips to reduce risks of data breaches
Seven best practices for enterprises to improve IAM maturity and reduce security risk.
The mobile workforce: Productive, but susceptible to data compromise
An enterprise’s biggest problem when it comes to data compromise isn’t just technologies that are vulnerable, it’s how their employees use technology.
Ransomware victims are paying the ransom in record numbers
Employees actions may be contributing to ransomware spike.
FireEye releases open source managed password cracking tool
FireEye has released GoCrack, an open source tool for managing password cracking tasks across multiple machines.
New infosec products of the week: November 3, 2017
A rundown of infosec products released last week.