Spam email with an attached Microsoft Word document that contains a malicious macro designed to download and execute Emotet malware (Source: Brad Duncan)

Emotet Malware Returns to Work After Holiday Break

Mathew J. Schwartz • January 18, 2019

Cybercrime outfits appeared to take a vacation around the December holidays. But attacks involving Emotet, Hancitor and Trickbot have resurged following their December slowdown, as has the Fallout exploit kit, lately serving GandCrab ransomware.

Cyberwarfare / Nation-state attacks

Cybercrime Gangs Advertise Fresh Jobs, Hacking Services

Latest

Endpoint Security

Legacy Medical Devices: Tackling Cybersecurity Challenges

Marianne Kolbasuk McGee • January 18, 2019

How can healthcare organizations better address the many challenges they face involving the security of legacy medical devices? Device security specialist Ben Ransford offers insights on critical steps that can help reduce the risks.

Breach Preparedness

Ransomware: A Pervasive, Evolving Threat

Nick Holland • January 18, 2019

Leading the latest edition of the ISMG Security Report is an in-depth look at why ransomware remains a pervasive threat and how it's evolving. Also featured: updates on venture capital investments in cybersecurity and a study of vulnerabilities in industrial remotes.

Cybersecurity

Venture Capital Pours Into Cybersecurity

Nick Holland • January 18, 2019

Venture capitalists invested $5.3 billion in cybersecurity companies in 2018, about 20 percent more than in 2017 and twice as much as 2016, according to research from Strategic Cyber Ventures. What's ahead for 2019 and beyond?

Cybersecurity

Your Garage Opener Is More Secure Than Industrial Remotes

Jeremy Kirk • January 16, 2019

Radio controllers used in the construction, mining and shipping industries are vulnerable to hackers, Trend Micro says in a new report. To address the issue, researchers say, manufacturers need to move away from proprietary communication protocols and embrace secure standards, such as Bluetooth Low Energy.

Cybersecurity

Quantum Computing: Sizing Up the Risks to Security

Suparna Goswami • January 16, 2019

Within the next five to 10 years, quantum computing will get so powerful that it could be used to break encryption on the fly, predicts Steve Marshall, CISO at U.K.-based Bytes Software Services.

Governance

Avoiding Critical Security Risk Analysis Mistakes

Marianne Kolbasuk McGee • January 16, 2019

Privacy attorney Adam Greene provides tips for avoiding mistakes when conducting a HIPAA security risk analysis and spells out the essential steps to take.

Governance

Hard-Coded Credentials Found in ID, Access Control Software

Jeremy Kirk • January 15, 2019

Researchers from Tenable Security claim they have found what is essentially a skeleton key for an ID and access control system that could open the doors for anyone, plus other less severe but nonetheless zero-day vulnerabilities.

Application Security

Why Software Bugs Are So Common

Suparna Goswami • January 15, 2019

The recent exposure of customer data on the website of Singapore Airlines as a result of a software bug is further evidence of the persistent challenge of adequately addressing security during the development stage.

Cybercrime

UK Sentences Man for Mirai DDoS Attacks Against Liberia

Jeremy Kirk • January 14, 2019

A U.K. court has sentenced Daniel Kaye, 30, after he admitted launching DDoS attacks against Liberia's largest telecommunications company in 2015 and 2016. A rival internet services provider paid Kaye $100,000 to launch the attacks.

Cybercrime

Boston Children's Hospital Hacker Gets Long Prison Sentence

Marianne Kolbasuk McGee • January 11, 2019

A hacktivist who launched distributed denial-of-service attacks on Boston Children's Hospital and another local facility in 2014 has received a lengthy prison sentence and must pay restitution. But will the outcome of the case deter other hackers?

Breach Preparedness

Government Shutdown: Experts Fear Deep Cybersecurity Impact

Jeremy Kirk • January 11, 2019

The U.S. government shutdown is impacting agencies integral to the nation's cybersecurity readiness, and experts fear its long-term impact on the country's cyberattack response capabilities, as well as the risk that it will drive away desperately needed new cybersecurity talent from entering public service.

General Data Protection Regulation (GDPR)

'Right to Be Forgotten' Should Be EU-Only, Adviser Says

Mathew J. Schwartz • January 11, 2019

Europe's "right to be forgotten" should not apply worldwide, but only inside the EU, according to a nonbinding opinion issued to the European Court of Justice by one of its advocate generals regarding a case that arose from a dispute between France's data privacy watchdog and Google.