SecurityWeek

Influential Organizations and Individuals or Those With Ties to Government or Political Institutions May be Targets for Cyber Attacks 

Was North Korea behind the ransomware epidemic that hit global computer networks earlier this month?

The developers of the Samba interoperability software suite announced on Wednesday the availability of security updates that patch a serious remote code execution vulnerability. Researchers have warned that there are many vulnerable systems accessible directly from the Internet.

Although it dominated headlines over the past couple of weeks, WannaCry wasn’t the only ransomware family running rampant. Another active threat was Jaff, a ransomware family that emerged just days before the WannaCry outbreak.

A new research report takes an unusual angle. Rather than analyzing a threat or an attacker, it looks at the psychology of the user -- or more specifically, the user of smartphones and apps. What it found is that the modern use of apps is so interwoven with daily life, they have almost become part of their users' DNA.

Samsung Electronics is investigating claims by a German hacking group that it fooled the iris recognition system of the new flagship Galaxy S8 device, the firm said Wednesday.

Former CIA director John Brennan said Tuesday that he warned Russia last summer against meddling in the US presidential election but the Russians went ahead and did it, anyway.

U.S. retail giant Target has entered a settlement with the Attorneys General of 47 states and it has agreed to pay $18.5 million over the massive data breach suffered by the company in 2013.

Multi-factor authentication (MFA) is the security industry's response to failings in the simple and traditional userID/password authentication approach. MFA is considered to be a primary solution to help defeat phishing and to demonstrate compliance. But it suffers from one major drawback: user friction.

In my previous article, I outlined details of the changing threat landscape in Industrial Control Systems (ICS). Of note, I pointed – as we have been with a good deal of frequency – to the growing risk of cyber-crime activity/ransomware activity on the shop floor.

Qatar said Wednesday it had begun an inquiry into an unprecedented security breach by hackers who posted fake news stories attributed to its ruler on highly sensitive regional political issues.

Traditional Network Defenses Can’t Mitigate the Majority of Data Breaches.

ICS-CERT has published an advisory describing several vulnerabilities, including ones rated critical, in Rockwell Automation’s Allen-Bradley MicroLogix programmable logic controllers (PLCs). Firmware updates that patch the flaws are available only for some devices.

In a cyber intrusion dubbed Operation Cobalt Kitty, the OceanLotus hacking group -- otherwise known as APT32 -- played cat-and-mouse with a security firm that was tracking its every move.

Trend Micro has released a “critical patch” for its ServerProtect for Linux 3.0 product to address half a dozen vulnerabilities discovered in March by researchers at Core Security.

Google Project Zero researcher Tavis Ormandy has released a tool designed for porting Windows dynamic link library (DLL) files to Linux in an effort to improve fuzzing. The expert demonstrated the tool’s capabilities by porting a Windows Defender component to Linux.

Qatar said Wednesday its official state news agency was hacked and subsequently carried a "false statement" on sensitive regional topics attributed to the country's Emir, Sheikh Tamim bin Hamad Al-Thani.

A bug in the Twitter social network allowed an attacker to post tweets as a different user, without having access to the victim’s account.

We know they’re a huge problem — any organization can be targeted by the wrath of a massive DDoS attack, from government websites to individual’s blogs. But as attacks have become bigger, more frequent and more widespread, it seems that they’re increasingly being regarded as an unstoppable force majeure, like a hurricane or earthquake, which simply has to be survived. 

New Multi-factor Authentication Offering Seeks Balance Between Strong Security and Ease of Use