SecurityWeek

Customer Data Not Impacted, But Records Exposed Sensitive Details on Some IT Infrastructure and Applications 

Swiss authorities said Tuesday they have opened an investigation into allegations a Zug, Switzerland-based maker of encryption devices was a front operated by the CIA and West German intelligence that enabled them to break the codes of the countries that used their products.

Microsoft’s Patch Tuesday updates for February 2020 address 99 vulnerabilities, including an Internet Explorer zero-day reportedly exploited by a threat group known as DarkHotel.

US and German intelligence services raked in the top secret communications of governments around the world for decades through their hidden control of a top encryption company, Crypto AG, US, German and Swiss media reported Tuesday.

In 2014, the Obama administration accused five Chinese military agents of targeting Pittsburgh-area industrial companies including Westinghouse Electric, Alcoa and U.S. Steel. Since then, the number of companies allegedly targeted by Chinese hackers has only grown.

Adobe’s February 2020 Patch Tuesday updates fix a total of 42 vulnerabilities across the company’s Framemaker, Acrobat and Reader, Flash Player, Digital Editions and Experience Manager products.

Organizations Must Understand What’s Driving the Escalated Targeting of Industrial Networks

Critical vulnerabilities addressed in the Accusoft ImageGear library could be exploited by remote attackers to execute code on a victim machine, Cisco Talos’ security researchers report.

A researcher has discovered another DLL hijacking vulnerability in Dell SupportAssist that can be used to execute code with elevated privileges, and exploitation only requires low permissions.

Beginning March, when Firefox 74 is set to arrive in the release channel, Mozilla will disable older Transport Layer Security (TLS) protocol versions as default options for secure connections.

Attacks targeting operational technology (OT) infrastructure increased by over 2000 percent in 2019 compared to the previous year, and the piece of malware most commonly seen in these attacks was the Mirai variant named Echobot, IBM revealed on Tuesday.

Beijing said Tuesday it "never engages" in cybertheft, following US indictments of four Chinese army members for alleged involvement in the massive 2017 hacking of credit rating agency Equifax.

Adam Pezen, Carlo Licata and Nimesh Patel are among millions of people who have been tagged in Facebook photos at some point in the past decade, sometimes at the suggestion of an automated tagging feature powered by facial recognition technology.

Four members of the Chinese military have been charged with breaking into the networks of the Equifax credit reporting agency and stealing the personal information of tens of millions of Americans, the Justice Department said Monday, blaming Beijing for one of the largest hacks in history to target consumer data.

Thousands of code repositories were found exposed in over one hundred Docker registries that are accessible from the Internet without authentication, Palo Alto Network reports. 

Presidential candidates' protection of their domains is improving, but could improve further. More specifically, of the 15 current candidates, eight now protect their domains from email spoofing with enforced DMARC. In May 2019, when there were still 23 candidates, only three were protected by DMARC.

The City of North Miami Beach last week announced that ransomware was found on computers within its police department’s network.The attack was discovered on Tuesday and the FBI, the Secret Service, and the Miami-Dade Police Department were immediately alerted.

The United States government has officially charged four members of China’s People’s Liberation Army (PLA) with hacking into credit reporting agency Equifax and being responsible for the massive data breach that exposed highly sensitive information on more than 145 million Americans.

In many cases, passwords are the primary line of defense protecting user accounts from being hijacked in an account takeover (ATO) attack. With the right policies and parameters in place to ensure strong, unique passwords, this defense can be quite effective. That being said, as we all know, passwords are highly susceptible to human fallibility.

University of Maastricht Pays Roughly $240,000 in Bitcoin Following Targeted Ransomware Attack