SecurityWeek

A threat actor using Iranian-language tools, Iranian hosting companies, operating from the Iranian IP space at times was observed targeting the Syrian opposition in an elaborately staged malware operation, Citizen Lab researchers reveal.

Panasonic Avionics, one of the world’s biggest suppliers of inflight entertainment and communications systems, has launched a bug bounty program on the HackerOne platform.

We in the security industry have gotten into a bad habit of focusing the majority of our attention and marketing dollars on raising awareness of the latest emerging threats and new technologies being developed to detect them. One just has to look at the headlines or spend fifteen minutes walking the show floor at a major security conference to see this trend.

Banner Health is warning 3.7 million patients, staff and food and beverage customers that their personal data may have been stolen during a security breach traced back to June 23. Headquartered in Arizona, Banner is one of the largest non-profit healthcare systems in the US. It owns and operates 29 acute-care hospitals and numerous health-related services.

A stock trader from Suwanee, Georgia, pleaded guilty this week to conspiracy to commit wire fraud for his role in an international hacking and trading scheme that earned participants millions of dollars.

Just two weeks after Chrome 52 was released in the stable channel, Google has issued an update to resolve 10 security vulnerabilities, 7 of which were discovered by external developers.

Black Hat USA 2016 – Researchers at Microsoft have demonstrated that a Windows vulnerability previously believed to be exploitable only in physical access scenarios can also be launched remotely, which could make it a tempting target for advanced persistent threat actors.

Thirty-nine percent of enterprises were hit by ransomware last year, according to new figures from Osterman research commissioned by endpoint security firm Malwarebytes. Of those, 40% paid the attackers in order to retrieve their data. These statistics come from a new survey designed to explore the effect of ransomware on business: The State of Ransomware.

Researchers have uncovered several critical and high severity vulnerabilities in Cisco’s small business RV series routers. The networking giant has released patches for some of the security holes.

Malware operators can hide the use of malicious macros to distribute malware by simply renaming the offending Office documents, Cisco researchers reveal.

Can the US election be hacked? The recent breach of Democratic National Committee data, along with other electronic intrusions, has raised concerns about cyber incidents that could affect the outcome of the US presidential race, or other contests.

IBM this week unveiled a new penetration testing group that will operate under its security services division to help customers uncover security gaps in their networks.

Black Hat USA 2016 – Ruckus Wireless, a global company that specializes in wireless networking equipment for enterprises and service providers, is working on developing patches for several vulnerabilities identified by an expert in its access point (AP) products.

More than 1,500 vulnerabilities specific to industrial control systems (ICS) have been disclosed in the past 15 years and many of them did not have vendor patches when their existence was made public, according to a new report from FireEye.

Black Hat USA 2016 – Imperva today revealed details on four high-profile attack vectors affecting HTTP/2, the new version of the HTTP protocol.

15 million Iranian Telegram users have reportedly had their phone number and their ID registered with the Telegram encrypted chat app compromised.

An issue affecting Microsoft’s Windows operating system could result in leaked user credentials if Internet Explorer and Edge are being used, researchers discovered.

Deep in the DNA of threat detection firm Endgame is the twin concept of stealth and offense. This is contrary to the usual view of information security that often portrays itself as visible and defensive.

We have a documentation and writing problem in the information security field, and it holds us back.