SecurityWeek

Researchers at Palo Alto Networks have come across a new piece of ransomware that has been used in targeted attacks aimed at multiple government organizations in the Middle East. Instead of asking for money, the attackers behind this campaign instruct victims to make a political statement on their website.

CIA: We Are Innovative but We Don’t Spy on Fellow Americans

Implementing Intent-based Network Security (IBNS) Takes Planning, Consideration, and Incremental Implementation

Apple and Google are confident that a majority of the vulnerabilities disclosed by WikiLeaks as part of the “Vault 7” release, which focuses on the hacking tools allegedly used by the U.S. Central Intelligence Agency (CIA), do not affect the latest versions of their products.

Researchers at SEC Consult have discovered several potentially serious vulnerabilities in a popular pricing solution from Sweden-based company Navetti. The vendor has released a software update that patches the flaws.

A high severity remote code execution (RCE) vulnerability affecting the Apache Struts 2 framework has been exploited in the wild, warns Cisco’s Talos intelligence and research group.

While most certificate authorities (CAs) haven’t been issuing certificates using the SHA-1 cryptographic hash function for more than two months, 1 in 5 websites worldwide still use such certificates, according to analysis by security firm Venafi.

Released this week, the latest version of the Firefox Web browser warns users when they are entering their passwords on pages that are not secure.

WikiLeaks’ “Vault 7” release appears to confirm that the U.S. National Security Agency (NSA) was behind the threat actor tracked as the “Equation Group.” Documents also show that the Central Intelligence Agency (CIA) learned from the NSA’s mistakes after its activities were exposed by security researchers.

Verifone is investigating a breach that it has described as "a limited cyber intrusion" into its corporate network." It believes that "that due to our immediate response, the potential for misuse of information is limited."

Security firms have started assessing the impact of the CIA hacking tools exposed on Tuesday by WikiLeaks as part of the leak dubbed “Vault 7.”

Video surveillance company Dahua Technology has started releasing firmware updates to address a serious vulnerability in some of its video recorders and IP cameras.

A cybercrime group tracked by FireEye as FIN7 has been observed targeting nearly a dozen organizations in the United States, focusing on personnel that handles filings to the Securities and Exchange Commission (SEC).

Global engineering and construction giant Bechtel has opened a new cyber security lab aimed at protecting industrial equipment and software that control facilities such as power plants, chemical plants, and other large-scale critical infrastructure operations.  

Every year, the RSA Conference is an exciting opportunity to get the security industry together to debrief on the past year and look ahead toward how we can ensure more security in the coming months. This year, as always, I was inspired by the great work and technological advancements on display from a wide range of impressive security vendors.

Google this week released a new set of monthly security patches for Android to address over 100 vulnerabilities in the platform, 35 of which carry a Critical severity rating.

Tachyon Takes on Tanium With Promise to Go From Detection to Remediation Across the Entire IT Estate in Seconds

WikiLeaks revealed on Tuesday that it has obtained thousands of files allegedly originating from a high-security network of the U.S. Central Intelligence Agency (CIA). The leak, dubbed “Vault 7,” apparently exposes the CIA’s vast hacking capabilities.

A group of researchers from Austria's Graz University of Technology have demonstrated that malware running on Intel SGX (Software Guard Extensions) can attack the host and can be used to extract RSA private keys.