SecurityWeek

A Lamborghini-driving Moscow hacker who called his operation Evil Corp and has ties to the FSB Russian intelligence service was indicted by US authorities Thursday for the cybertheft of tens of millions of dollars.

Microsoft this week issued guidance regarding Windows Hello for Business (WHfB) public keys that persist even after the devices they are tied to are removed from Active Directory.

Chinese tech giant Huawei is asking a U.S. federal court to throw out a rule that bars rural phone carriers from using government money to purchase its equipment on security grounds.

Competing in today's digital marketplace requires that organizations be cyber-savvy. End users and customers need organizations to understand things like web application development, digital shopping and other online transactions, the effective use of social media, and using digital tools to get and keep customers.

Cisco Talos this week released a new tool designed to make it easier to create complex applications that have lengthy dependency chains.Called Mussels, the cross-platform, general-purpose dependency build automation tool allows software developers to easily download, build, and assemble app dependencies.

Moxa Urges Users to Replace Discontinued Industrial AP Filled With Security Holes

Amazon Web Services (AWS) has expanded its portfolio with three new services and capabilities meant to help organizations build and operate securely in the cloud.

A hacker was able to access private customer reports on HackerOne after one of the platform’s security analysts inadvertently shared a session cookie. 

Austria-based IT security services and consulting company SEC Consult on Wednesday announced the release as open source of its SEC Xtractor assisted hardware analysis tool.

CrackQ Password Cracking Manager is an Interface for Hashcat Served by a REST API and a JavaScript Web App

Magecart started as the name given to a single criminal gang operating a software skimming attack targeting payment card data on web sites. The process proved so successful that other gangs began to use the same approach. 

One of the vulnerabilities Google addressed in Android with the December 2019 set of monthly patches is a critical vulnerability that could result in a permanent denial of service.

The Greek philosopher Heraclitus is quoted as having said, “change is the only constant in life.”  While I’m not sure that I agree with this statement completely, it is an interesting one. The quote provoked me to think about how it might apply to the security profession. After some thinking, I do believe that we can learn some interesting security lessons from Heraclitus. Change may not always be on the docket.

A new Python-based remote access Trojan (RAT) has been used in campaigns targeting a wide range of industries, BlackBerry Cylance revealed this week.

Understanding the Threats, Risks, and Vulnerabilities Associated With Cloud Environments is Critical to Securing Data

Federal officials are considering requiring that all travelers — including American citizens — be photographed as they enter or leave the country as part of an identification system using facial-recognition technology.

Researchers at IBM X-Force have come across what appears to be a new piece of malware that has been used in highly targeted attacks aimed at energy and industrial organizations in the Middle East.

A university student in California has filed a class-action lawsuit against video app TikTok, which she accuses of harvesting large amounts of user data and storing it in China."TikTok clandestinely has vacuumed up and transferred to servers in China vast quantities of private and personally-identifiable user data," the court filing said.

Google has shared some data on the adoption of Transport Layer Security (TLS) by Android applications and it seems that significant progress has been made over the past two years.