SecurityWeek

Google has teamed up with the University of California, Berkeley to conduct a study on the effectiveness of notifications sent out by the company to webmasters whose websites have been compromised.

Kovter, a recently discovered piece of ransomware, represents the latest step in the evolution of a malicious program from police scareware to ad fraud Trojan and now file-encrypting malware.

Ransomware authors are always looking for new techniques to make their extortion business more efficient, and researchers have discovered a new method that cybercriminals are using to deliver decryption keys: blockchains.

Google has updated its User Data Policy for the Chrome Web Store, in an attempt to improve the safety and privacy for users of its Chrome web browser.

A hacker using the handle "Phineas Fisher" has described how he hacked into surveillance software maker Hacking Team. Hacking Team is an Italian firm that hacks to order, primarily for law enforcement agencies and intelligence agencies. Last summer, Phineas Fisher (now going by the alias Hack Back!) on Twitter broke into Hacking Team and stole and published thousands of internal documents, some source code and several 0-day exploits.

Researchers at Arbor Networks’ Security Engineering and Response Team (ASERT) have identified what they believe to be a tool used in advanced persistent threat (APT) attacks aimed at various entities in East Asia.

Short-URL enumeration can be used to discover and read shared content stored in the cloud, including files for which the user didn’t create a short URL, researchers have demonstrated.

ICS-CERT has published advisories detailing several vulnerabilities in ICS products from Accuenergy, Ecava and Sierra Wireless, including issues that have been rated “high severity.”

Microsoft released several security updates this month as part of its regular Patch Tuesday update, including the overhyped Badlock flaw.

Bangladesh police probing a $81 million electronic heist from the central bank said Monday that more than 20 unnamed foreigners were involved in the audacious theft.

IBM Security has warned WordPress website administrators about a sharp increase in the number of attacks leveraging a variant of a PHP webshell called C99.

Researchers at Cisco have identified millions of machines that could become infected with file-encrypting ransomware due to out-of-date software.Ransomware attacks aimed at organizations have been increasingly common and malicious actors have been trying to come up with new methods to make their operations more profitable.

Apple urged a federal court Friday to reject efforts to force the company to help break into an iPhone as part of a New York drug investigation. In the latest case involving efforts to compel Apple to help law enforcement break encryption, the company said the court should simply rule the assistance is unnecessary and not authorized by law.

Authorities successfully disrupted a large-scale ATM skimming operation as part of a collaboration with Italian law enforcement, Europol announced Thursday.

A DNS configuration issue on a Western Digital (WD) server supporting the company's My Cloud NAS products could have been exploited by malicious actors to gain access to potentially valuable user data. WD has taken steps to address the problem.

Microsoft Publishes White Papers on Incident Response and Shared Responsibility for Azure Cloud Customers

VMware released updates for several of its products on Thursday to address a critical vulnerability.The VMware Client Integration Plugin (CIP) provides access to a virtual machine’s console in the vSphere Web Client, and allows users to connect virtual devices that reside on a client computer to a virtual machine.

The General Data Protection Regulation is now, effectively, law. Businesses have 730 days from official publication (expected to be in June) to comply. It would be a mistake to think that this is just a European issue: it will affect every business throughout the world that holds or uses European personal data.

The California Assembly Bill 1681 was quietly dropped this week without a vote. The bill would have authorized $2,500 penalties for phone manufacturers and operating system providers if they do not comply with court orders to decrypt phones. In effect, it would force phone providers to include a backdoor or face repeated fines.

“Lizard Squad” Knocks Video Game Servers of Blizzard Entertainment OfflineServers operated by Blizzard Entertainment went down yesterday following a distributed denial of service (DDoS) attack against the video game company,claimed by the Lizard Squad hacking group.