Industrial control systems (ICS) are no strangers to digital attacks. In its Threat Landscape for Industrial Automation Systems in H1 2017 report (PDF), Kaspersky Lab blocked attack attempts against 37.6 percent of ICS computers that use the Russian security firm's products. It also detected 18,000 variants of 2,500 different malware families that...

By now, we’re all aware of the Equifax breach that affected 143 million customer records. Equifax reports that Apache Struts vulnerability CVE-2017-5638 was used by the attackers. Equifax was not running its vulnerable struts application in a container, but what if it had been? Containers are more secure, so this whole situation could have been...

Last time, I had the opportunity to speak with Carrie Roberts. She's a red team engineer at Walmart with lots of penetration testing experience. This time, I had the pleasure of speaking with Glenda Snodgrass. She's a founder and the president of The Net Effect, a cybersecurity services company that's based in Alabama. They must be doing something...

Britain's largest and busiest airport has launched an investigation to determine how someone found a USB containing 2.5GB of its data on the street. News of the incident involving Heathrow London Airport first came to light when an unemployed man contacted The Sunday Mirror. He told the tabloid he was on his way to a local library to search for work...

Halloween is upon us! It isn’t just a time for Steven King movies and trick-or-treating, but it's also a time to reflect back on some of our own horror stories in IT. To help celebrate Halloween, we have asked some folks from the security industry to share their scary security stories with us. We hope you enjoy. Feel free to share your own stories...

An investigation into the 2017 WannaCry outbreak found that the ransomware affected 34% of National Health Service (NHS) trusts in England. Following the May 2017 attack that struck more than 200,000 organizations in at least 100 countries, the UK government's National Audit Office (NAO) launched an inquiry into the matter. Its purpose was to...

Reports appeared on Tuesday that a new ransomware outbreak was hitting organisations in Russia and Ukraine. Victims included the Russian newswire Interfax, Ukraine's Odessa airport, and the Kiev subway system. Media outlets like Fontanka.ru found their website's disrupted by the attack, and urged readers to follow them on social media for updates...

In less than a decade, cryptocurrency became almost mainstream. Many people are familiar with Bitcoin, which was the first decentralized digital currency. In fact, there are more than 10 different cryptocurrencies with a market cap exceeding 1 billion US dollars. Some are very similar, but others significantly differ in the mathematical and...

In our previous article, we laid the groundwork for what we believe to be a serious threat to ICS/SCADA devices: social engineering. We continue here with some definitions, some of which you may already know. Phishing Phishing is a relatively broad term for any attempt to trick victims into sharing sensitive information, such as passwords,...

The Iran Computer Emergency Response Team Coordination Center (Iran CERTCC) has warned users of an ongoing distribution campaign for Tyrant ransomware. First spotted by G Data security researcher Karsten Hahn, the strain is currently making its way to unsuspecting users via modified versions of the Psiphon VPN app. Upon successful infection, Tyrant...

On October 2-4, 2017, the Retail Cyber Intelligence Sharing Center (R-CISC) hosted Securing Retail 002, the second iteration of its annual summit first held in April 2016. Speakers from Microsoft, Target and other Fortune 500 companies shared their thoughts on the retail digital security landscape with attendees over the course of the two-day event....

A new variant of Android banking malware known as LokiBot triggers ransomware capabilities if a victim attempts to remove it from their infected device. The malware, which bears the same name as a Windows info-stealer that can exfiltrate credentials from over 100 software tools, is making its rounds as a kit sold on hacking forums. Interested...

In my last interview, I spoke to Katherine Teitler, who is the director of content for MISTI Training Institute. She also helps run the InfoSec World conference. This time, I spoke with Carrie Roberts. She has a senior red team role with Walmart. She's also a pretty good cartoonist if I say so myself. Kimberly Crawley: Tell me a bit about what you...

Microsoft has released a new feature called "Controlled Folder Access" that helps Windows users protect their data against ransomware. First announced in June 2017, Controlled Folder Access is an option in Windows Defender Security Center that went live in mid-October. Its purpose is to protect files contained in designated folders against...

Words have meaning. Cybersecurity and IT professionals routinely abuse the terms “policy” and “standard” as if they are synonymous. The same holds true for compliance terms since these terms tend to get thrown in the same bucket even though there are significant differences that should be kept in mind. Why Should You Care? Beyond just using...

At the U.S. Republican National Convention in Cleveland last year, more than 1,200 people connected to free WiFi networks with names like “I Vote Trump! Free Internet,” “I Vote Hillary! Free Internet,” and “Xfinitywifi.” They transferred gigabytes of data, doing things like checking e-mails and chatting. Some even shopped on Amazon or logged into...

Google has announced a bug bounty program covering other developers' popular Android apps available for download in its Play Store. On 19 October, the American multinational technology company launched its Google Play Security Rewards Program. Here's a high-level description of the new framework: "Google Play is working with the independent bug...

Industrial control system (ICS) cybersecurity has come a long way over the last decade. Today, we have well-established guidance for securing industrial plants and SCADA systems, including IEC-62443, NERC CIP and the NIST Cybersecurity Framework. Industry and governmental efforts to build awareness of cyber risks have also been successful. Most...

In 2014, the FBI warned that healthcare systems, including medical devices, were at an increased risk of cyber-attacks due to the unfortunate coupling of poor cybersecurity practices in the healthcare industry with patient health information (PHI) that commands high value on the dark web. This warning has largely been realized. The cost and...

A new, “highly prevalent” strain of Android malware was found infecting several Minecraft-related apps on the Google Play store, adding compromised devices into a botnet. According to security researchers at Symantec, at least eight mobile apps – with an install base ranging from 600,000 to 2.6 million devices – were infected with Sockbot. “The...