Last week the Idaho National Laboratory (INL) and the Department of Homeland Security (DHS) announced the successful completion of the 100th iteration of the Industrial Control Systems Cybersecurity training on defending systems used across the critical infrastructure sectors. Since April 2007, over 4,000 cybersecurity professionals have participated in the advanced course. These professionals represent all 50 states, the international cyber community and all 16 of the nation’s critical infrastructures. The training is conducted in Idaho Falls, Idaho, and is hosted by the DHS Industrial Control Systems Cyber Emergency Response Team (ICS-CERT). Lane Thames, Software Development Engineer and Security Researcher at…
ISBuzz Team
A security researcher has published a vulnerability and proof-of-concept exploits in Google’s Internet of Things security cameras, marketed as Nest Dropcam, Nest Dropcam Pro, Nest Cam Outdoor and Nest Cam Indoor; these vulnerabilities were disclosed to Google last fall, but Google/Nest have not patched them despite the gravity of the vulnerability and the long months since the disclosure. IT security experts from DomainTools, Tripwire and Tenable Network Security commented below. Tim Helming, Director, Product Management at DomainTools: “There was never any reason to believe that the Nest systems would be impervious to vulnerability and exploit, so in a way this doesn’t come…
New Corero study reveals a rise in number of DDoS attacks since 2016, with 56 percent of security teams viewing DDoS attacks as increased concern; pressure mounts on ISPs to deal with heightened threat Marlborough, MA & London, UK. attacks are a greater security threat to businesses in 2017 than ever before, and Internet Service Providers (ISPs) need to do something about it according to a new survey of IT security professionals and network operators released today from Corero Network Security (LSE:CNS). The annual study, the Corero DDoS Impact Survey 2017, polled top technology decision makers and security experts at the 2017 RSA Security…
A new WikiLeaks Vault 7 leak titled “Dark Matter” claims, with unreleased documents, that the Central Intelligence Agency has been bugging “factory fresh” iPhones since at least 2008. IT security experts from FireMon, prpl Foundation and Comparitech.com commented below. Paul Calatayud, CTO at FireMon: “The validity of the dumps from my 18 years of experience in cyber including 8 years within the army cyber teams would lead me to state these claims have basis and are worth taking real consideration over. “The tools are very noteworthy yet to be expected if you understand the space. We have seen issues with suppliers and manufacturers…
Over the past six months, the number of Locky ransomware infections has gone down and is expected to reach an all-time low this month, in March. Ever since the ransomware launched in mid-February 2016, Locky has been one of the most active and prevalent ransomware families on the Internet. IT security experts from Imperva, AlienVault and ESET commented below. Morgan Gerhart, VP at Imperva: “In the end, these guys are out to make money. It is likely that the “yield” from Locky started to diminish over time. This is natural, as various entities develop countermeasures. So the attackers moved on. This is…
Prague, Czech Republic. Avast , the leader in digital security products for business and consumers, revealed that more than half (52%) of the most popular PC applications running on PCs around the world, including Flash and Java are out-of-date. The Avast PC Trends Report Q1 2017, based on insights from the company’s AVG TuneUp product, highlights the top 10 outdated applications, the most used programs and hardware, and shows the problems people face by not keeping their PC up-to-date. Most critically, people are exposing their PC and their personal data to risks, as malware targets older versions of software to exploit vulnerabilities. Gathered anonymously from 116…
The servers hosting Daphne Caruana Galizia’s personal blog have suffered a DDoS attack. Prior to the DDoS attack, Mrs Caruana Galizia said that a fake Gmail account was setup – similar to her personal email address. Sean Newman, Director at Corero Network Security commented below. Sean Newman, Director at Corero Network Security: “While the motivations for the DDoS attack against Malta Independent Columnist and blogger Daphne Caruana Galizia’s website are still unknown, media censorship should not be ruled out. News outlets, online publications, media personalities, journalists and their blogs are all especially vulnerable to DDoS attacks, simply because of the content and news stories they…
Much of the excitement surrounding the WikiLeaks “Vault 7” release of purported CIA documents concludes that the CIA has broken encryption. We didn’t reach the same conclusion. We explore potential vulnerabilities in encryption apps and conclude that end-to-end encryption, coupled with strong protection at the device level remains the best way to secure everyday communication. Headlines WikiLeaks’ recent release of documents purportedly from the CIA, called “Vault 7,” has created quite a media storm. Allegedly, the CIA has been able to bypass encrypted messaging apps on Android phones. Many commentators conclude that the CIA has been able to “break” encryption, enabling it…
Thousands of industrial facilities have their systems infected with common malware every year, and the number of attacks targeting ICS is higher than it appears, according to a study conducted by industrial cybersecurity firm Dragos. This includes one variant posing as Siemens PLC firmware that has been in action since 2013. The backdoor malware is packaged to appear as a Siemens programmable logic controller installer file, and around 10 industrial sites have reported coming across the targeted attack campaign, seven of which are located in the US as well as some in Europe and China. IT security experts from Airbus Cybersecurity and…
A recent discovery has found that there is a remote execution vulnerability on LastPass’ Chrome extension, that allows complete access to internal privilege LastPass RPC commands. This effectively could mean that victims passwords could be stolen by hackers. Lee Munson, Security Researcher at Comparitech.com commented below. Lee Munson, Security Researcher at Comparitech.com: “LastPass may have had a flaw, albeit one that was quickly patched, but that doesn’t mean password managers should be dismissed as a bad idea by the masses. On the contrary, despite bugs and vulnerabilities being present in just about all software, the risks here are minimal, especially given how keen the security community…