SecurityWeek

It’s almost a cliche to talk about how often breaches occur—in 2015 alone, we’ve seen high-profile breaches from everyone from Anthem, the popular work collaboration tool Slack, and even the federal government thanks to the recent US Office of Personnel Management attack.

A threat group believed to be sponsored by a nation state has compromised over 100 websites in an effort to track and profile potential targets, FireEye reported on Monday.

The Anonymous internet hacking network declared war on the Islamic State group in a Youtube video Monday, vowing vengeance for attacks in Paris that left 129 dead and hundreds injured. "Anonymous everywhere in the world is going to hunt you down," a hooded figure in black, wearing the group's signature Guy Fawkes mask said in French.

Libpng, the official Portable Network Graphics (PNG) reference library, has been updated to address a couple of memory corruption vulnerabilities.

Thousands of websites have already been infected with the Linux file-encrypting ransomware dubbed Linux.Encoder1, security firms reported.

Police body cameras acquired from Martel Electronics have been found to be infected with the notorious Conficker worm.

Google plans to ramp up security at its free email service by letting users know when messages arrive via unencrypted connections that could be prone to snooping or tampering. "These warnings will begin to roll out in the coming months," Elie Bursztein and Nicolas Lidzborski of the Gmail security team said in a blog post this week.

Over the past few months, Google has been busy squashing security vulnerabilities in its popular Android mobile operating system, but many remain undiscovered, and some can be easily exploited.

Hacking back, whether as part of an active defense strategy or a threat intelligence effort, is a controversial practice that many security firms and experts officially advise against. However, retribution is in some cases part of active defense offerings and researchers do occasionally compromise the infrastructure of threat groups to unmask their activities.

Vulnerabilities in business applications and industrial processes can expose companies in the oil and gas sector to high-impact cyberattacks, researchers have warned.

A vulnerability in the Spring Social core library can be exploited by malicious actors to hack users’ accounts on vulnerable websites through a CSRF-style attack.

A new point-of-sale (PoS) malware has been widely distributed by cybercriminals alongside ad fraud and information-stealing threats.

Radiflow, a maker of Industrial Control System (ICS) network security solutions, has introduced a new Intrusion Detection System (IDS) designed specifically for Operational Technology (OT) networks.

The Tor Project, the organization behind the Tor anonymity network, claims the FBI paid Carnegie Mellon University “at least $1 million” to help the agency deanonymize users suspected of conducting criminal activities.

In my role as Managing Principal at Cigital, I spend most of my week talking with information security professionals at a wide variety of organizations. In discussing all of the issues facing security organizations, one issue stands above them all—talent. Never have I seen such a shortage of talent in the security industry as I do today.

Microsoft has reissued one of the security patches released on Tuesday as part of its monthly update cycle after many customers complained that it caused the Outlook email client to crash.

Misty-eyed old-timers are mourning the passing of one of the world’s most elegant encryption algorithms. RC4 was designed by Ron Rivest in the late 1980s. Initially, RC4 was a proprietary trade secret of RSA Security. Perhaps due to the algorithm’s simplicity (you can keep it in your head), it leaked out into the Internet in the 1990s where it became the de facto TLS bulk encryption protocol for over a decade.

A point-of-sale (PoS) malware that went largely undetected for the past several years has been analyzed by researchers at Trustwave.Dubbed by the security firm “Cherry Picker,” the threat has been around since at least 2011, but it managed to stay under the radar thanks to its sophisticated functionality and use in highly targeted attacks.

Most of the top 200 and top 100 applications available for Android users via the Google Play store can be decompiled and reverse engineered, a new report from mobile application security solutions provider SEWORKS claims.

A nasty Trojan that allows malicious actors to remotely control infected devices has been pre-loaded on many types of Android tablets sold on Amazon and other online stores, Cheetah Mobile has warned.