Phishers are leveraging Google Translate in their attempts to steal the login credentials for users' Google and Facebook accounts. Larry Cashdollar, a member of Akamai's Security Intelligence Response Team (SIRT), received an email in early 2019 informing him that someone had accessed his Google account from a new Windows device. On his phone, the...

Scammers are now using the threat of channel suspension to coerce YouTube content creators into meeting their demands and sending over money. These digital attackers are specifically targeting YouTube's policy infringement system through which users can report a video that they feel violates the video-sharing website's policies for acceptable...

I’m excited to announce that I will be presenting at this year’s Black Hat Asia about my research into detecting and exploiting CBC padding oracles! Zombie POODLE and GOLDENDOODLE are the names I’ve given to the vulnerabilities I’ll be discussing. Similar to ROBOT, DROWN and many other vulnerabilities affecting HTTPS, these issues stem from continued...

The Department of Homeland Security (DHS) has issued an emergency directive that requires federal agencies to mitigate the threat of Domain Name System (DNS) infrastructure tampering. In "Emergency Directive 19-01," DHS explains that it's been working with the Cybersecurity and Infrastructure...

A new strain of ransomware known as "Phobos" is using the same ransom note employed by Dharma to demand payment from its victims. Ransomware incident response provider Coveware found that Phobos' ransom message differs from Dharma's only in the branding used for its header and footer. Otherwise, the notes are exactly the same. ...

Amazon GovCloud is an isolated Amazon Web Service (AWS) designed to allow customers and the U.S government agencies to move their confidential data into the cloud to address their compliance and specific regulatory requirements. It runs under ITAR, the U.S. International Traffic in Arms Regulations. With this cloud service, US citizens can run...

With the majority of people using smartphones these days, texting is all but a given when trying to communicate with your friends or family. But what about your doctor? A recent study determined that 96 percent of physicians use text messaging for coordinating patient care. This can raise eyebrows and red flags. Anyone with a cheap scanner, which...

A large number of Reddit users are being told that they will have to reset their passwords in order to regain access to their accounts following what the site is calling a "security concern." The lockout occurred as Reddit's security team investigates what appears to have been an attempt to log into many users' accounts through a credential-stuffing...

The elephant in the room is the viability and sustainability of blockchain technology. Cryptocurrency mining, for instance, requires specialized rigs that consume electricity. In certain estimates, at the time of writing, the bitcoin network's energy consumption came in at 41 globally if it was a country. This means the bitcoin blockchain consumes...

As discussed before, the blockchain-based solution is built to provide strong integrity and independent verifiability. An exception to the independent verifiability is private blockchain solutions. In this part, we discuss both of these technological dimensions and detail their applicability and limitations. Public distributed blockchain provides...

Doxxing means publishing private information about someone online to harass or intimidate them. It has ruined reputations and caused untold distress to hundreds of people. On occasion, doxxing has resulted in injury or even death. Being doxxed can have serious consequences for your safety and privacy. How can you prevent it? Doxxing and...

Phishers are bypassing common forms of two-factor authentication (2FA) in a campaign targeting hundreds of Google and Yahoo accounts. In a new report, Amnesty International uses several attack emails sent to it by Human Rights Defenders (HRDs) spread across the Middle East and North Africa to analyze the campaign. A typical attack email in this...

The National Aeronautics and Space Administration (NASA) has warned its employees of a data breach that might have compromised their personal information. On 18 December, the agency's Human Resources Messaging System (HRMES) sent out a message to all employees informing them of a potential security...

As 2018 draws to a close, it's been a fascinating year in the IT security community. From record-breaking data breaches, new regulations and the Meltdown and Spectre debacle, we can certainly say it's been eventful. To round the year off, we thought it would be interesting to ask some of our regular contributors (and followers on Twitter) what their...

News Flash: Your DNS might be broken, and you don’t even know it. But wait? How could I not know my DNS is broken? Well, the answer lies in the history of the DNS standards and what has become the cobbling together of features within authoritative and recursive DNS server software. It all started going south about 19 years ago with the introduction...

Researchers have observed a new threat using malicious memes posted on Twitter to receive command-and-control (C&C) instructions. Trend Micro observed that the malicious activity begins after a threat detected as "TROJAN.MSIL.BERBOMTHUM.AA" executes on an infected machine. As of this writing, the Japanese multinational digital security firm had not...

Thanks for playing along! By now, you’ve probably seen that the winner of our tournament is Shellshock. I long felt that this was the expected winner of Patch Insanity given the competition and I wasn’t expecting any major upsets, but there were definitely one or two. The big one that came to mind for some of us was GHOST defeating EternalBlue....

MITRE Corporation’s ATT&CK framework is a living, curated repository of adversarial tactics and techniques based on observations from actual attacks on enterprise networks. It’s a valuable trove of information for security analysts, threat hunters and incident response teams. Today, I’m going to look at a particular method for evading detection, often...