Latest News

5 months ago
Cynthia Brumfield / Metacurity

Friday Report: More End-of-Week Bombshells, Still No Russian Midterm Cyberattacks, More Moves Against China

Welcome to Metacurity’s Friday Report where we wrap up the week’s infosec news according to the big themes that emerged during the week.

First, this past week was slightly quiet in terms of cybersecurity news but as seems to be the case over the past several months, the most eye-popping news dropped on Friday. In the first big Friday news drop, Daily Beast reporters were told by numerous sources that from around 2009 to 2013, the U.S. intelligence community experienced crippling intelligence failures related to a compromise of the CIA’s internet-based covert communications system used to interact with its informants. The compromise started in Iran but spread outward, resulting in the deaths of dozens of people and possibly leading to similar moves by China, which led to equally disastrous outcomes. (Read the rest of the report here.)

Become a Patron!

5 months ago
Ari Indyk / Vancouver Sun

Canada’s Mandatory Breach Reporting Requirements Went Into Effect November 1

On November 1, Canada’s federal government brought into force key provisions of the Personal Information Protection and Electronic Documents Act (PIPEDA), a cornerstone of Canadian privacy regulations which requires to Canadian organizations to report a breach of security safeguards to the Privacy Commissioner, keep a comprehensive record of every breach for two years, and notify impacted stakeholders when there is a real risk of significant harm. Some critics of PIPEDA maintain that the federal government won’t have sufficient resources to actively implement the law particularly when it comes to ensuring that companies fully comply with the reporting requirements.

5 months ago
Gareth Corfield / The Register

UK Educational Electronics Company Kitronik Hit by Card Data Stealing Magecart Malware

Credit card data skimming malware Magecart, which enabled allowed the theft of payment card data from British Airways’ and other websites, including NewEgg and Ticketmaster, has struck Educational electronics outlet Kitronik, operating on the company’s website over August and September. Details exposed in the infection on Kitronik’s website included customers’ names, email addresses, card numbers, expiry dates, CVV (verification) codes and cardholders’ postal addresses. Kitronik didn’t reveal how many customers were affected or whether it had informed the UK’s Information Commissioner’s Office (ICO), which is now required under the GDPR.

5 months ago
Tariq Panja / New York Times

FIFA Braces for Stories Stemming From a Second Hack It Experienced Earlier This Year

Soccer’s governing body FIFA said that it suffered a second hack earlier this year and is bracing for more damaging leaks. This hack occurred in March and appears to be unrelated to Russian intelligence’s breach of FIFA systems in 2017. FIFA President Gianni Infantino admitted to a new hack while talking to the press after a FIFA Council meeting last week in Kigali, Rwanda. It’s not clear what information was exposed but a consortium of European media organizations plans to publish a series of stories based in part on the internal documents as early as today.

5 months ago
Andrei Zakharov / BBC Russian Service

Hackers Are Selling Personal Facebook Messages of at Least 81,000 Users, Likely Obtained via Malicious Browser Extensions

Hackers appear to have compromised and published private messages from at least 81,000 Facebook users’ accounts and the perpetrators told BBC Russian Service that they have details from a total of 120 million accounts, which they are attempting to sell. The data was likely obtained through malicious browser extensions and Facebook claims its security has not been compromised. Many of the users whose data were compromised are in Ukraine and Russia but some are from the UK, US, Brazil and elsewhere. The breach came to light when a post from a user nicknamed FBSaler appeared on an English-language internet forum offering what the user claimed was personal information for 120 million Facebook user accounts for sale.

5 months ago
Zach Dorfman and Jenna McLaughlin / Yahoo News

Catastrophic Compromise of CIA Communications System Began in Iran and Spread to the Rest of the World, Coincided With Similar Events in China, Officials

From around 2009 to 2013, the U.S. intelligence community experienced crippling intelligence failures related to a compromise of the CIA’s internet-based covert communications system used to interact with its informants, according to eleven former U.S. intelligence and government officials directly familiar with the matter. The global problem originated in Iran following the U.S. discovery of a secret Iranian underground enrichment facility, which prompted Iran to begin a “mole hunt,”  and spread to the rest of the world and involved multiple intelligence agencies, congressional intelligence committees, independent contractors and internal government watchdogs. The fallout of the compromise was the deaths of dozens of people around the world and damage that will persist for years. The vulnerabilities in the communications system were overlooked due to its ease of use and the Iranians apparently discovered the system by using Google, eventually hitting on the right string of advanced search terms to locate other secret CIA websites. The Iranian effort coincided with a similar series of events in China in 2011 and 2012, where officials believe that former Beijing-based CIA officer Jerry Lee, who was charged with spying on behalf of the Chinese government in May 2018, was partially responsible for the destruction of the CIA’s China-based source network. It’s unclear whether China and Iran cooperated.

5 months ago
Zachary Fryer-Biggs / Center for Public Integrity

In First Case Under New Trump Presidential Memorandum, U.S. Intel Community and Pentagon Agreed to Offensive Cyberattack If Russia Directly Interferes With Midterm Elections, Sources

In preparation to defend against an electronic attack by Russia against the 2018 midterm elections, the U.S. intelligence community and the Pentagon have quietly agreed on the outlines of an offensive cyberattack, according to officials familiar with the plan, indicating that the U.S. is more formally integrating offensive cyberattacks into its military planning. U.S. military hackers have been given the go-ahead to gain access to Russian cybersystems required to implement the plan, the officials said. Only direct interference, efforts to tamper with voting registration and recording votes, would bring “swift and severe action” under the plan, with mere social disinformation campaigns insufficient grounds to launch an attack. The effort is the first such initiative under the classified National Security Presidential Memorandum 13 (NSPM 13), designed to allow Defense Secretary James Mattis and Director of National Intelligence Dan Coats to approve retaliatory strikes without the approval of others in the government, and in certain cases without White House approval.

5 months ago
Jordan Valinsky / CNN

Senator Wyden Releases Draft Bill That Would Hold Executives Criminally Responsible for Lying About User Privacy Violations

Senator Ron Wyden (D-OR) has released a draft bill, the Consumer Data Protection Act, that would give the Federal Trade Commission the ability to place harsher penalties on tech companies that violate users’ privacy. The bill, which would cover companies that generate more than $50 million in revenue and store information on more than 1 million users, would require companies to submit an “annual data protection report” ensuring compliance with the law that specifies any regulations they possibly violated and include statements from the company’s CEO, chief privacy officer and chief information security officer. If an executive intentionally misleads the government, he or she could be held criminally responsible and fined as much as $5 million and be imprisoned as long as 20 years if they are found guilty. The bill also proposes the FTC hire a new chief technologist and 50 new staffers to monitor privacy abuses.

5 months ago
Ellen Nakashima / Washington Post

Chinese Company Charged With Stealing Micron Trade Secrets as DOJ Ramps Up Campaign to Crack Down on Chinese Economic Theft Activity

In a continuation of the Trump administration’s ongoing campaign to highlight China’s role in intellectual property theft, the Justice Department unsealed charges against several individuals and Chinese and Taiwanese companies for trade-secret theft while unveiling a broad initiative to combat what the administration says is growing economic activity by China. The initiative fuses ongoing efforts within the FBI, Justice Department and other federal agencies into a single coordinated initiative to pursue trade-secret theft cases. According to the indictment, the Chinese government set up a state-owned company, Fujian Jinhua Integrated Circuit Co. Ltd., for the express purpose of developing DRAM technology and sought to learn trade secrets through the criminal acts of former employees of semiconductor company Micron’s Taiwan branch. The president of Micron’s Taiwan subsidiary, Chen Zhengkun, also known as Stephen Chen, left to join United Microelectronics Corporation, a semiconductor foundry headquartered in Taiwan, and then orchestrated the theft of trade secrets from Micron worth up to $8.75 billion, according to DOJ.

Podcasts

5 months ago
ISC StormCast

Windows Defender Sandboxing Bug; BLE Vulnerability

Johannes Ullrich talks about Windows Defender Sandboxing Bug, Bleedingbit Bluetooth Low Energy Vulnerability, Cisco ASA/Firepower DoS Vulnerability Actively Exploited.


5 months ago
The Deception Chronicles

Episode 73: MlleLicious

This week’s interview is with MlleLicious who assists information security organizations interested in improving inclusion as well as fostering genuine diversity in both the industry and conferences.


5 months ago
Cracking Cyber Security

The hacker vs the defender and a paranoid future

This week’s podcast focuses on hackers vs defenders, how to convince the board to invest in the unknown and the future of cybersecurity in a discussion with Juraj Malcho, CTO at ESET. Also, why a dose of healthy paranoia could be good for us…


5 months ago
Smashing Security

102: Ethical dilemmas, Girl Scouts, and porn-loving US officials

Graham Cluley and Carole Theriault, joined this week by Dan Raywood discuss the week’s top news including: Who deserves to die in a driverless car crash? Who has been sniffing around the Girl Scouts’ email account? And just how long would it take for a geologist to visit 9,000 adult web pages?


Spotlight










Cybersecurity Events

Mar. 4-8RSA ConferenceSan Francisco, CAUSA
Mar. 10BSides San Jose 2018San JoseCosta Rica
Mar. 13-14Tactical EdgeBogotaColombia
Mar. 18-22TROOPERS19HeidelbergGermany
Mar. 19NFEA - Cyber Security 2019OsloNorway
Mar. 26-29BlackHat AsiaSingaporeSingapore
Mar. 28-30Women in CyberSecurityPittsburgh, PAUSA
Apr. 11-12CypherConMilwaukee, WIUSA
Apr. 16-19LocoMocoSecKauai, HawaiiUSA
Apr. 24-26ICS Cyber Security ConferenceSingaporeSingapore
Apr. 25-26BSides Kansas CityKansas City, MOUSA
Apr. 27-28BSides CharmTowson, MDUSA
May 1-2Global Cyber Innovation SummitBaltimore, MDUSA
May 3NaijaSecCon Cybersecurity ConferenceLagosNigeria
May 3-4ThotconChicago, ILUSA


Support Us!

Subscribe to Our Newsletter

Subscribe to our newsletter and get our daily and highly enjoyable summary of cybersecurity developments you must know if you want to stay ahead.

We don't spam and we value your privacy. We don't sell or share our subscriber lists ever. For more information, please read our privacy policy at Metacurity's Privacy Policy page.

DON'T FORGET TO CONFIRM YOUR SUBSCRIPTION AFTER SIGNING UP. PLEASE CHECK YOUR SPAM FILTER FOR OUR CONFIRMATION EMAIL.


Get Metacurity Updates on Alexa!

Metacurity has hundreds (and growing!) of listeners on Alexa. Enable our skill here and join your top infosec peers in listening to our exclusive summaries of the day’s top infosec news.