The Bundesrat of Germany – the country’s Federal Council – passed legislation last week requiring critical infrastructure businesses and institutions to implement more robust information security standards. According to reports , the new law will affect more than 2,000 essential service providers, including transportation, health, water, utilities, telecoms, as well as financial services and...

Mozilla has blocked every version of Adobe Flash Player running in its Firefox web browser and will continue to do so until Adobe has patched certain publicly known security vulnerabilities. Firefox users who seek to view videos, adverts, and other Flash-based content will now be required to dismiss a warning that reads, "Flash is known to be vulnerable. Use with caution." Mozilla's decision...

I’ve spent a copious amount of time on the Darknet this year in a quest to gain more understanding on how cybercriminals think. I’ve been studying their communities, how they operate in the Darknetmarkets (such as Silk Road ), perusing their forums, analyzing their marketing techniques, and contemplating how they justify their criminal activities. It’s been fascinating, and at the same time...

Given the recent high-profile breaches, a key challenge facing government agencies and other security-minded organizations is rooting out malware that has already become embedded on key assets. Multiple vendors are offering cloud-based sandbox analytics services, and/or on-premises appliances, that can analyze new binaries to determine if they have suspicious behavior. These services are aimed at...

A DDoS attack continues to affect the Asian Pacific servers of messenger app Telegram as of Monday morning. The attack was first revealed by the company on Twitter early Friday morning. Four hours after its initial announcement, Telegram posted again , stating that the attack had become global and was now affecting users' access worldwide. Source: Twitter Connectivity for the app, which has...

Microsoft is ending Windows Server 2003 support on July 14, 2015 , when the popular platform will no longer receive security updates. End of life migration is a serious transition for organizations, and many will keep the using outdated platforms long after the deadline . How should organizations that are still in transition prepare for the inevitable increase in exploits targeting vulnerable...

Yet another zero-day Flash exploit has been found in the massive data dump that is the result of a major compromise of Italian espionage software maker Hacking Team. Vulnerabilities CVE-2015-5122 and CVE-2015-5123 are similar to the previous Flash vulnerability (CVE-2015-5119 ) found in the Hacking Team arsenal CVE-2015-5119, however there is currently no patch available for it. Adobe has promised...

A cyber attack on the United States power grid, causing outages and damage to infrastructure, could have a major impact on the country’s economy, costing up to $1 trillion in the most extreme scenario. A recent report, produced by the University of Cambridge’s Centre for Risk Studies and Lloyd’s of London insurance, outlines the potential implications of this hypothetical scenario, which is caused...

Caspar Bowden, a passionate British privacy advocate, has passed away after a battle with cancer. In 1998, Bowden helped co-found the Foundation for Information Policy Research (FIPR), a prominent think tank for privacy based in the UK. He also became one of the most outspoken dissenting voices with regards to government backdoor surveillance into cloud computing services prior to the Snowden...

Cyber-attacks are continually increasing in scope and complexity; advanced persistent threats are becoming more difficult to detect; and over the past decade, there has been a growing “detection deficit,” according to the 2015 Verizon Data Breach Report . While 60 percent of attackers are able to gain access within minutes, the detection of attacks is usually days or longer. The core of this...

Earlier this year, the PCI Security Standards Council officially released PCI DSS 3.1 only months after its predecessor (version 3.0) came into effect. With a typical three-year period between standard revisions, the out-of-band update caught many off guard, especially organizations still in the process of complying with the changes from the previously established data security standard. Although...

OpenSSL has released an advisory urging users to update their systems in the wake of a high-severity alternative chains certificate forgery bug. "During certificate verification, OpenSSL (starting from version 1.0.1n and 1.0.2b) will attempt to find an alternative certificate chain if the first attempt to build such a chain fails," the advisory reads. "An error in the implementation of this logic...

Back in 2013, technology giants Apple, Microsoft, Facebook and Twitter all suffered a serious security breach. Their corporate networks had all been attacked by the same hacking gang, after Mac-using staff visited a website for iOS developers hosting a zero-day Java exploit. The previously unseen Pintsized Trojan horse was able to waltz around the Gatekeeper protection in OS X, and install itself...

A member of the hacking group Lizard Squad has been found guilty of 50,700 charges of "cybercrime", according to Finnish media . Julius “zeekill” Kivimaki, age 17, has received a two-year sentence suspended sentence and has been "ordered to fight against cybercrime." He will not be going to prison. The charges filed against Kivimaki include breaching protected computers, felony payment fraud...

A hacker has been sentenced to 50 months in prison for his role in a fraudulent ATM withdrawal scheme that resulted in the theft of $14 million worldwide. According to a press statement released by the United States Attorney's Office for the Eastern District of New York, Qendrim Dobruna pleaded guilty to bank fraud last year after participating in what is known among underground hacker syndicates...

We’re in the midst of a national cybersecurity crisis. Breaches, such as the ongoing OPM breach , are continuing at an alarming rate; organizations are building their security infrastructure, but are lacking staff. We need more skilled cybersecurity professionals, yet we don’t have a consolidated plan for building the cybersecurity skills pipeline. Then there’s the crisis regarding our kids and...

The private Italian spyware firm Hacking Team has become the victim of a hack itself, with more than 400GB of data compromised and released via a torrent. The hacker "PhineasFisher"– who claims responsibility for the data heist – is also responsible for surveillance tech company Gamma International based in the UK. One of the most damaging aspects of the hack so far has been the revealing of...

Cisco has released a patch for a password vulnerability that was recently discovered in its Unified Communications Domain Manager (Unified CDM) Platform Software. According to a security advisory released by the company, "A vulnerability in the Cisco Unified Communications Domain Manager Platform Software could allow an unauthenticated, remote attacker to login with the privileges of the root user...

At DEF CON 23 this summer, an information security consultant plans to unveil ProxyHam, a hardware device that bears much promise for the future of web anonymity. Benjamin Caudill , who is founder and Principal Consultant for Rhino Security Labs , developed the product in response to the growing threats against web privacy, particularly those arising from national security surveillance-based...

The FUD Wagon is rolling strong today after multiple online media outlets have picked up the story that Wi-Fi Sense, available on Windows Phone 8.1 and the soon to be released Windows 10, is Microsoft’s latest security blunder. The best advice that I can offer when you see these articles is to close them... close them, and forget that you’ve ever seen them. I don’t want you to just take my word...