Changes that expand the Federal Bureau of Investigation's (FBI) hacking and surveillance powers took effect on 1 December under Rule 41. Previously, it was an established fact of criminal procedure that a judge's warrants pertained only to a suspected criminal's misdeeds in particular district. If the subject committed crimes in multiple districts,...

Cloud computing has come a long way in just a few years. Now, most businesses use some sort of cloud service, whether it be for a specific software application, infrastructure requirements, or more. The cloud certainly represents the way many companies are choosing to operate, but some have shown reluctance to adopt cloud solutions. One of the major...

Organizations around the globe remain unprepared to prevent, detect and respond to cyber attacks, revealed a recent study conducted by the Ponemon Institute. The 2016 Cyber Resilient Organization study surveyed over 2,400 security and IT professionals from the U.S., U.K., France, Germany, United Arab Emirates, Brazil and Australia. Of the...

A few well-known UK brands have hit the headlines recently as a result of a breach or security issue. For instance, Tesco Bank announced 40,000 customer accounts were affected by a “sophisticated” attack. Half of those had money taken from them. As a result, Tesco Bank could incur a severe penalty imposed by regulators. That fee would be in addition...

Meet John. He's a 53-year-old accountant who owns property in New Zealand. He's also an experienced investor who likes to invest in New Zealand shares. As such, he understands how trading works, and he knows a good opportunity when he sees one. But there are some things you don't know about John. For starters, his first name isn't John. It's a...

A new ransomware called "CryptoLuck" is infecting victims via a legitimate, code-signed program from Google known as "GoogleUpdate.exe." Security researcher Kafeine spotted the RIG-E (Empire) exploit kit distributing CryptoLuck via malvertising. It's not the first time they've detected an exploit kit campaign distributing ransomware. In this...

WhatsApp has announced its plans to make a new two-step verification (2SV) feature available to all of its more than one billion active monthly users. 2SV is an optional security mechanism that adds another step (not factor) to a web service's login process beyond entering in a username and password. As a result, the feature helps to protect users'...

What has happened? The AdultFriendFinder website appears to have been hacked, exposing the personal information of hundreds of millions of user accounts. What is AdultFriendFinder? I don't want to be indelicate, so I'll just tell you it's strapline: "Hookup, Find Sex or Meet Someone Hot Now". Oh! So like Ashley Madison? Yes, very much so. And we all...

At some point in our lives, we have all experienced a time when we had something break, quit working, or at the very least not work the way we expected. After exhausting our personal skills in trying to figure out how to fix the problem, we end up calling the repairman – the expert that will help us get back on track. In the IT Ops and IT Security...

Google has announced it will now label websites that it continuously flags for displaying unsafe or malicious content as "repeat offenders." For more than a decade, Google has worked to protect users with the help of Safe Browsing. It's a feature that examines billions of URLs on a daily basis in search of unsafe web resources. Safe Browsing looks...

In late September, when Apple released iOS 10, it also took a dramatic step back in at least one aspect of iPhone and iPad security. Russian firm Elcomsoft discovered that local password-protected iTunes backups made of iPhones and iPads running iOS 10 were an astonishing 2500 times faster to crack than iOS 9. ...

An Austrian security researcher recently unveiled a vulnerability affecting Netflix that allowed attackers to takeover user accounts. In a blog post published on Monday, the researcher – known as ‘Slashcrypto’ – explained the attack works when a victim’s voicemail can be hacked to bypass the password reset function of Netflix. “… When a user wanted...

The Bizarro Sundown exploit kit is spreading two versions of Locky ransomware via the still-active ShadowGate malvertising campaign. In October, Trend Micro spotted two versions of Bizarro Sundown, a modification of the earlier Sundown exploit kit which rose to prominence with RIG following Neutrino's demise. The first iteration reared its ugly head...

A Promoted Tweet claims it can help Twitter users get their accounts verified, but in reality, it's just a scam. Promoted Tweets are a way by which Twitter users can pay for a Tweet to reach a wide audience and generate engagement with their current followers. As such, they are an excellent tool for anyone looking to advertise something....

We at The State of Security have explored all the ways people can strengthen their security online in acknowledgement of National Cyber Security Awareness Month (NCSAM) 2016. We kicked off the public awareness campaign by providing tips on how users can protect their passwords, as well as defend against ransomware and other common IT security...

The newest variant of Locky ransomware has begun to add yet another file extension to the files it encrypts, and it is the .thor file extension. The virus drops a _WHAT_is.html and the same named .bmp type of file after an infection has been caused. The ransomware also creates several other files, such as a malicious .dll file that causes the...

Good samaritans and skinflints beware! Plugging in that USB stick you found lying around on the street outside your office could lead to a security breach. This is no secret, of course. We have all (hopefully) been aware of the dangers of inserting an unknown USB device into our computers for some time. Heck, the technique has even made it into the...

Think of a word that sparks an emotion in you. It could be as simple as “shoes,” which makes my wife smile every time, or it could be a dark and foreboding word. Certain words trigger an emotional—sometimes visceral—response. For me, one of those words is “breach.” In a recent post about the Department of Health and Human Services’ (HHS)...

I’m working with a couple of organizations faced with NIST 800-171 compliance. The first is a small manufacturing company doing business with a prime contractor. The second is a tribal business unit with federal contracts. Both must be compliant by December 2017 or risk losing their federal business. From what I can tell, neither organization was...

Working for a security services vendor provides me the opportunity to work with a variety of cool tools in our quest to develop new and innovative security services. The most recent project I was deeply involved in is the development of a DNS security service called SecureSurf. The foundational goal of the design of this service was to provide a...