Doug Vitale Tech Blog

September – October 2015 News Archive

MySQL servers hijacked with malware to perform DDoS attacks

Symantec, 29 Oct 2015 – We’ve discovered malware that targets MySQL servers to make them conduct distributed denial-of-service (DDoS) attacks against other websites. The attackers initially injected a malicious user-defined function (Downloader.Chikdos) into servers in order to compromise them with the Trojan.Chikdos.A DDoS malware. The majority of the compromised servers are in India, followed by China, Brazil and the Netherlands. [More]

Teen Who Hacked CIA Director’s Email Tells How He Did It

Wired, 19 Oct 2015 – A hacker who claims to have broken into the AOL account of CIA Director John Brennan says he obtained access by posing as a Verizon worker to trick another employee into revealing the spy chief’s personal information. [More]

Cyberattacks threaten $305B in cumulative lifetime revenue in next 5 years

Fierce Health IT, 15 Oct 2015 – The healthcare industry stands to lose $305 billion in cumulative lifetime revenue due to cyberattacks that will take place during the next five years, according to a report from Accenture. It estimates that 1 in 13 patients–roughly 25 million people–will have personal information stolen from technology systems by 2020. [More]

Encryption Is More Important, and Easier, Than Ever

New York Times, 14 Oct 2015 – Twenty years after Netscape introduced encryption to web browsers to safeguard the private data of Internet users, roughly two-thirds of web traffic still moves on unprotected channels, according to research by Sandvine, a network equipment provider. But now, the computer industry and the United States government have embarked on a major, multifront campaign to have basic web encryption — known as HTTPS or TLS encryption — more widely adopted. [More]

New USB killer ‘destroys computer within seconds’

WeLiveSecurity, 14 Oct 2015 – A Russian security researcher has developed a more powerful “USB killer”, which has double the power of its original predecessor. Dark Purple, as he is known, revealed that the latest version can “fry” a computer within seconds of being inserted into a USB port. [More]

Top European Court Rules That NSA Spying Makes U.S. Unsafe For Data

The Intercept, 6 Oct 2015 – The European Union no longer considers the United States a “safe harbor” for data because the National Security Agency surveillance exposed by whistleblower Edward Snowden “enables interference, by United States public authorities, with the fundamental rights of persons.” The EU’s highest court, the Court of Justice, declared on Tuesday that an international commercial data-sharing agreement allowing U.S. companies free-flowing access to large amounts of European citizens’ data was no longer valid. [More]

Hackers see cloud as ‘a fruit-bearing jackpot’ for cyber attacks, 6 Oct 2015 – Cyber-criminals and hackers are increasingly attacking cloud infrastructure, which they see as a “fruit-bearing jackpot” as more organizations are making use of public cloud to store their data than ever before, a security company claims. While organizations are embracing the cloud, a report by Alert Logic suggests that IT decision-makers shouldn’t assume that data they store off-premise is harder for hackers to acquire. [More]

Trend Micro: More data breaches caused by lost devices than malware or hacking

NetworkWorld, 5 Oct 2015 – Trend Micro’s new cybersecurity report says most breaches are actually caused by device loss, rather than malware or hacking. [More]

Government Is the Biggest Cybersecurity Threat

US News and World Report, 2 Oct 2015 – Government workers see their own agencies as a bigger cybersecurity threat than hackers from China or Russia, according to a new survey. The biggest threat to federal cybersecurity is “the negligent insider” at an agency who fails to take enough precautions while using or protecting government networks, according to 44 percent of federal workers responding to the survey. [More]

Is there an Internet-of-Things vigilante out there?

Symantec, 1 Oct 2015 – Let me introduce you to Linux.Wifatch, one of the latest pieces of code infecting Internet of Things (IoT) devices. We first heard of Wifatch back in 2014, when an independent security researcher noticed something unusual happening on his home router. The researcher identified running processes that didn’t seem to be part of the legitimate router software and decided to investigate further. During his analysis he discovered a sophisticated piece of code that had turned his home router into a zombie connected to a peer-to-peer network of infected devices. For all intents and purposes, it appeared like the author was trying to secure infected devices instead of using them for malicious activities. [More]

15 Million People Hacked in T-Mobile Vendor Data Breach

Gizmodo, 1 Oct 2015 – T-Mobile customers should be on alert: hackers stole the personal information of around 15 million people, including Uncarrier users, from its credit reporting agency, Experian. The stolen data including Social Security numbers, addresses, and phone numbers. [More]

Goodbye MagStripe, Hello Chip Cards

IEEE Spectrum, 1 Oct 2015 – Developed at IBM in the 1960s, rolled out in the 70s, caught on globally in the 80s, ubiquitous in the 90s, and now stepping aside — the magnetic stripe card has had a brilliant career. But now the magnetic stripe card is going into forced retirement, replaced by the chip card after just too many security breaches that cost banks and retailers far too much money. [More]

A Matter of Life and Death: Why We Must Take IoT Flaws Seriously, 29 Sep 2015 – Let’s face it, data breaches are a dime a dozen today. There’s a much more dangerous and far-reaching threat that we should all be aware of: vulnerabilities in Internet of Things (IoT) and connected devices. When these are exploited, we’re not just talking about CEOs losing their job – in a worst case scenario these flaws could result in human fatalities. [More]

Get ready for organized cybercrime

ExtremeTech, 28 Sep 2015 – A new post from security blogger Brian Krebs has focused attention on a growing trend in the cybercrime underground: cooperation. The post focuses on the now-defunct Enigma hacking forum, which allowed would-be attackers to post some specific detail of the attack they want to complete — say, they need to get through the security on a particular brand and model of router. If the forum’s user base had someone with the required skills, access, or connections, then an ad-hoc cybercrime team can be created. [More]

Linus Torvalds: why a truly secure computing platform will never exist

BGR, 25 Sep 2015 – Speaking at LinuxCon 2015 last month, Torvalds talked about security as something unattainable in a perfect sense. He thinks, for example, it’s meaningless to ask what computing platform today is the most secure. The most secure platform, he offers in response, is something that’s “not actually usable.” [More]

Malware implants on Cisco routers revealed to be more widespread

CIO, 21 Sep 2015 – Attackers have installed malicious firmware on nearly 200 Cisco routers used by businesses from over 30 countries, according to Internet scans performed by cybercrime fighters at the Shadowserver Foundation. Last Tuesday, FireEye subsidiary Mandiant warned about new attacks that replace the firmware on integrated services routers from Cisco Systems. The rogue firmware provides attackers with persistent backdoor access and the ability to install custom malware modules. [More]

Windows devices account for 80% of malware infections transmitted via mobile

CSO Online, 18 Sep 2015 – According to a Wednesday report from Alcatel-Lucent’s Motive Security Lab, in June Windows devices accounted for 80% of the infections spotted on hardware that relied on mobile networks for Internet connectivity. Meanwhile, Android’s share of the total infection count dropped to about 20% after long hovering at the 50% mark. [More]

The cloud industry is growing but so is wariness over security

Computer World UK, 11 Sep 2015 – In a significant reversal in infosecurity professionals’ views on future cloud use, far more expect to see cloud use at their organizations increasing over the next two to three years than when we last polled the industry in 2013. Yet this does not appear to signify a corresponding increase in confidence in cloud security. Cloud-based services are cited as the biggest security concern by 49 percent of professionals and are ranked above cyber-terrorism as a top 10 security threat. [More]

Cyberattack on New York Blues plan Excellus affects 10 million

Modern Healthcare, 9 Sep 2015 – Excellus Blue Cross and Blue Shield, a Rochester, N.Y.-based insurer, disclosed Wednesday afternoon that it was the victim of a sophisticated cyberattack by hackers who may have gained access to over 10 million personal records. [More]

The First Law of Intrusion Detection: You Can’t Detect What You Can’t See

Invincea, 8 Sep 2015 – It seems so basic, but lost in the hyperbole of security marketing is this basic law: that which you can’t see, you can’t detect. The basic issue is one of sensors and methods. If the sensor you deploy can’t spot a certain indicator of intrusion, then it won’t be able to alert you to the intrusion. Similarly, if your detection/protection approach only fires on certain conditions and the adversary’s methods are outside your approach’s scope, you won’t detect or protect against that attack. [More]

Why Stephen Hawking is Right About the Danger of Artificial Intelligence

LinkedIn, 7 Sep 2015 – The invention of an Internet aware artificial intelligence has the potential to cause incalculable damage to online government and business infrastructures, wireless hardware devices, and implantable Bio Technologies; not just on Earth, but within space as well. [More]

Cedexis Gives Real-Time View of Internet Outages

eWeek, 3 Sep 2015 – Cedexis has built its business on knowing what is going on in the Internet throughout the world at all times. Every day the company collects more than 5 billion measurements, creating a real-time picture of how traffic is moving through Internet service provider (ISP), cloud and content delivery networks (CDNs) worldwide. Now the company is sharing the information with everyone. Cedexis this week unveiled Radar Live, a portal that gives users a view of a real-time map of the world that shows through blips on the screen where disruptions are occurring. [More]


Written by Doug Vitale

November 19, 2015 at 2:29 PM

%d bloggers like this: