SecurityWeek

In today’s world we expect flexibility without compromising security. We may need a crossover with “stow and go” seats and underfloor storage so we can turn it into a van. But we don’t expect its safety rating to drop when we change the configuration. We may need a work space that can be reconfigured into cubicles, team rooms, quite zones, and work cafes. But we assume worker safety regardless of the configuration.

Researchers have demonstrated how an Internet of Things (IoT) worm designed to target smart bulbs can cause significant disruptions to lighting systems in a city. The malware can spread by itself, but attackers can also use cars and drones for distribution.

The iOS applications of Twitter, LinkedIn and possibly other major vendors can be abused by hackers to initiate phone calls to arbitrary numbers. The attacker can also prevent the victim from ending the call.

The Russia-linked threat actor known as Pawn Storm ramped up its attacks against governments and embassies after seeing that researchers discovered the Windows and Flash Player zero-day exploits it had been using.

I have lost count of the number of conversations I’ve either observed or been involved in where people simply aren’t listening to one another.  Whether it’s in a meeting, at a conference, in a social setting, or elsewhere, sometimes I take a step back and marvel at the complete breakdown in communication.  In some cases, it almost seems as if there are two different conversations happening at the same time between the same two people.

Siemens has released updates and temporary fixes to address a medium-severity privilege escalation vulnerability affecting many of its industrial products.

Little is currently known about how money was stolen from thousands of Tesco Bank current account (checking account) holders last weekend. It is clear now, however, that approximately 9,000 customers rather than the initial estimate of 20,000 were affected.

Cybercriminals delivered the Svpeng Trojan to Android users via Google AdSense and a zero-day vulnerability in the Android version of the Chrome web browser.

TrickBot, a new piece of malware that experts believe is somehow linked to the notorious Dyre Trojan, is now fully operational and it has been used to target banks in the United Kingdom, Australia and other countries.

The 14 security bulletins released on Tuesday by Microsoft address many serious issues, including a couple of Windows vulnerabilities actively exploited by malicious actors and bugs for which exploits are already publicly available.

A new survey and report shows strong faith but poor confidence in current data analytics. For example, 70% of respondents to the survey believe that analytics are integral to understanding how products are used; 71% to understanding business performance, and 70% to understanding fraud. But at the same time, only 43% are confident in the analytics insights for risk and security; 38% for customer insights; and just 38% for business operations.

Google’s Android Security Bulletin for November 2016 patched a total of 83 vulnerabilities in the operating system, one of which was the Dirty COW flaw in Linux kernel that was disclosed a few weeks back.

Security updates released by Adobe on this Patch Tuesday address one vulnerability in Connect for Windows and nine arbitrary code execution flaws in Flash Player.

As information security professionals, we spend a lot of time thinking about what security products are the highest priority. But as most of these decisions are mired in the nuances and details of the modern enterprise, I’d like to simplify things by bringing us back to a favorite childhood game: What would you bring on a deserted island?

Chancellor Angela Merkel on Tuesday said Russia could try to influence Germany's general elections next year through cyber attacks or disinformation campaigns, after Washington accused the Kremlin of similar meddling in the US vote.

A vulnerability in OAuth 2.0 could result in an attacker being able to sign into a victim’s mobile app account and take control of it, security researchers have discovered.

Google on Monday released its November 2016 Android security patches to resolve 83 vulnerabilities in the mobile operating system, 23 of which have been rated Critical.

The OpenSSL Project informed users on Monday that it’s preparing a patch for several vulnerabilities affecting version 1.1.0.OpenSSL version 1.1.0c, which is scheduled for release on November 10 between 12:00 and 16:00 UTC, will address several security holes. The most serious of them has been classified as “high severity” and it does not affect versions prior to 1.1.0.

SAP released its November 2016 security updates Tuesday, addressing two very high priority (Hot News) Security Notes, both meant to resolve OS command execution vulnerabilities.