SecurityWeek

Newly introduced bipartisan legislation aims to implement improved cybersecurity protections for K-12 educational institutions in the United States.

Legion Loader is a new dropper that is already in wide use. It is distinctive by the wide range of malware it has been seen to drop, and its continuing development. The implication is that it is available for hire as part of the burgeoning malware-as-a-service black market.

As if having their data encrypted wasn’t bad enough, businesses that fell victim to Maze ransomware now face another threat: their data could become public.

Former National Security Agency contractor Edward Snowden violated secrecy agreements with the U.S. government that allow it to claim proceeds from a memoir he published earlier this year, a judge ruled Tuesday.

Facebook and Google this week announced that they will partner again next year for the second edition of BountyCon, their Asia-Pacific bug hunting conference. 

DNS-over-HTTPS (DoH) traffic can apparently be identified without actually decrypting it, a security researcher has discovered.The DoH protocol is aimed at improving the overall security of the Internet by using TLS when sending DNS queries and getting DNS responses over HTTP.

Strengthen Your Security Posture in 2020 

A former employee of Palo Alto Networks and his friends have been charged by the U.S. Securities and Exchange Commission (SEC) for their roles in an insider trading ring.

A fifth former Google worker has filed a complaint with federal regulators accusing the company of improperly firing employees for labor organizing activity.Kathryn Spiers, a security engineer, said Google fired her after she created a pop-up notification for employees to inform them of their labor rights.

A 62-year-old man from Harrison City, Pennsylvania, has been sentenced to prison for planting logic bombs in programs he created for German industrial giant Siemens.

Hunting Magecart with URLscan.io

A cyber-espionage group has targeted hundreds of industrial companies in South Korea and other countries using malware designed to help hackers steal passwords and documents, industrial cybersecurity firm CyberX revealed on Tuesday.

Vulnerabilities discovered in Acer and ASUS software preinstalled on most PCs from these companies could lead to privilege escalation and the execution of arbitrary payloads, SafeBreach warns.

Lab test provider LifeLabs said Tuesday that it paid a ransom to secure data for Canadians that was stolen in a data breach in late October.

LifeLabs, which does blood work and other tests across Canada, said in a letter to customers that their names, contact information, health card numbers and lab test results were exposed in a cyber attack on its computers in early November.

Firefox users will be getting private and secure encrypted Domain Name System (DNS) services from NextDNS, after Mozilla added the company to its Trusted Recursive Resolver (TRR) program. 

A vulnerability Intel has addressed in the Rapid Storage Technology (RST) could allow a local user to escalate privileges to System.Intel RST is a Windows-based application that is provided with many computers that feature Intel chips to deliver improved performance and reliability when SATA disks are used.

Satori Cyber on Tuesday emerged from stealth mode with a data protection and governance platform, and $5.25 million in seed funding from YL Ventures.

Two men were sentenced Monday to probation and community service for trying to hack the IRS to obtain President Donald Trump's tax returns.

WhatsApp's end-to-end encryption is only secure if you don't have the encryption keys. But researchers at Check Point Research developed a method of discovering the encryption keys, a produced a tool to manipulate messages.