SecurityWeek

The SANS CIS top twenty critical security controls (CSCs) is a living document reflecting world-wide expert opinion on the primary controls that can best mitigate against cyber attacks. While it lists the controls, it makes no suggestion on how they should be implemented in any specific situation.

The official Bangladesh government probe into the $81 million dollar theft via SWIFT in February has suggested the possibility of insider involvement. In February 2016 attackers successfully tricked the New York Federal Reserve Bank into transferring $81 million from the Bangladesh central bank to accounts in the Philippines. Before today, the primary Bangladesh line has been to blame SWIFT for the breach.

An OpenSSL vulnerability patched in early May with the release of versions 1.0.2h and 1.0.1t still hasn’t been patched on many of the world’s most visited websites, exposing potentially sensitive traffic to man-in-the-middle (MitM) attacks.

Carnegie Mellon University's CERT has issued a security advisory on the MEDHOST Perioperative Information Management System (PIMS), a system designed to streamline the progress from patient introduction to surgery. It's not a vulnerability we should expect these days - especially for a medical system - but PIMS contains hardcoded credentials. These credentials provide access to the customer database.

LG has released fixes for two serious vulnerabilities affecting the company’s Android smartphones, including a flaw that can be exploited remotely to delete and modify text messages.

AMSTERDAM - HACK IN THE BOX - Researchers have demonstrated that remote attackers can wirelessly change the time on network time protocol (NTP) servers over long distances using inexpensive devices.

The hackers behind the $81 million heist from the Bangladesh central bank have likely been involved in a series of attacks on the financial system, a US security firm has concluded.

Over the past few weeks, researchers have observed a spike in the number of malicious spam emails using attached JavaScript files to distribute malware such as the infamous Locky ransomware.

The authors of Android Trojans have adapted their attack models to target the permission-granting model that Google has introduced in Android 6.0 Marshmallow, security firm Symantec has discovered.

In the light of several recent data breaches and account compromises, Reddit has decided to kick off a service-wide hunt for account takeovers and is prompting users to reset their passwords when such an issue is detected.

A new TorrentLocker campaign has been detected by Heimdal Security that is geographically focused on Sweden. And like earlier campaigns, this ransomware threat is delivered by email spam - this one spoofing an invoice from the international Telia communications firm headquartered in Stockholm, Sweden.

“Defense is attack, attack is defense, each being the cause and result of the other.”

Brussels - The European Parliament called Thursday on Brussels to pursue talks with Washington to remove "deficiencies" from a deal to curb government spying on the personal Internet data of EU citizens.

BOSTON, MA - SecurityWeek’s 2016 CISO Forum will take place on June 1-2, 2016 at the Ritz Carlton, Half Moon Bay.

Texas Attorney General Ken Paxton announced that Texas has entered into an Assurance of Voluntary Compliance agreement with PayPal over alleged privacy and security violations by Venmo, a company acquired by PayPal in 2013. Under this agreement, PayPal will pay $130,000 to the State of Texas, and a further $45,000 to the state Attorney General to cover attorneys' fees.

A recently patched Adobe Flash Player vulnerability is being abused in a new malvertising campaign that redirects users to the Angler exploit kit (EK), Malwarebytes researchers warn.

Released on Wednesday in the stable channel, Chrome 51 patches 42 security vulnerabilities, including 23 flaws that have been disclosed by external researchers.

For all of last week and continuing into this week, major DNS and traffic management provider NS1 suffered a continuing and complex DDoS attack from unknown attackers with unknown motivation.