500 Million Yahoo Accounts Stolen By State-Sponsored Hackers

Yahoo says it was the victim of state-sponsored hackers who stole information associated with 500 million accounts. Yahoo CISO Bob Lord said the attack happened on the company’s network in late 2014; he did not name the country responsible. “The account information may have included names, email...

Warning — Bitcoin Users Could Be Targeted by State-Sponsored Hackers

Another day, another bad news for Bitcoin users. A leading Bitcoin information site is warning users that an upcoming version of the Blockchain consolidation software and Bitcoin wallets could most likely be targeted by "state-sponsored attackers." Recently, one of the world's most popular...

Malware Dropper Built to Target European Energy Company

A malware dropper with designs on specific targets was found in a private underground forum and is likely the predecessor to the Furtim malware that was uncovered in May. Researchers at SentinelOne today published a report that says the dropper sample they investigated, which they’re calling SFG,...

Red Line Drawn: China Recalculates Its Use of Cyber Espionage

On Sept. 25, 2015, President Barack Obama and Chinese President Xi Jinping agreed that neither government would “conduct or knowingly support cyber-enabled theft of intellectual property” for an economic advantage. Some observers hailed the agreement as a game changer for U.S. and Chinese...

5 Things Google has Done for Gmail Privacy and Security

Over the past few years, Google has increasingly improved the online security and protections of its Gmail users. Besides two-factor authentication and HTTPS, Google has added new tools and features to Gmail that ensures users security and privacy, preventing cyber criminals and intelligence...

Yahoo Deploys Passwordless Account Key Tool

In hopes of eliminating the password, at least on the company’s mobile apps, Yahoo on Friday deployed a stable version of its Account Key mechanism. The feature, essentially two-step authentication—without the first step—allows Yahoo users to log into the company’s Finance, Fantasy, Mail,...

Gentle Reminder at RSA: Hacking Back is a Bad Idea

SAN FRANCISCO—Surely all breached organizations consider hacking back as some means of response to being attacked and losing intellectual property. Thankfully there was a room full of lawyers at RSA Conference on Wednesday to remind IT pros of what a colossally bad idea that is. Putting aside the...

Twitter State-Sponsored Attack Notification

Twitter’s decision to notify users when their accounts are targeted in state-sponsored attacks earned its share of praise. But Twitter’s silence in terms of specifics about the attacks—whether by choice or gagged by a National Security Letter—has foisted some anxiety upon those who were notified....

Microsoft will Inform You If Government is Spying on You

Following in the footsteps of Twitter, Facebook and Google, Microsoft promises to notify users of its e-mail Outlook and cloud storage OneDrive services if government hackers may have targeted their accounts. The company already notifies users if an unauthorized person tries to access their Outlo...

Yahoo to Warn Users of State-Sponsored Attacks

Yahoo has announced it will follow in the footsteps of Twitter and Facebook and begin warning users when it believes their accounts have been targeted by a state-sponsored actor. Bob Lord, who was hired as the company’s new CISO in October, discussed the initiative in a blog post Monday. Lord sai...

Twitter State-Sponsored Attack Notification

Update A relatively small number of Twitter users, including a few connected to security and privacy advocacy, have been informed that their accounts have been targeted by state-sponsored hackers. Notifications began appearing in the inboxes of affected users two days ago, with very little concre...

Juan Andres Guerrero-Saade on the Dangers of APT Security Research

Juan Andres Guerrero-Saade from Kaspersky Lab’s Global Research & Analysis Team GReAT joins Ryan Naraine on the podcast to discuss the “identity crisis” in the anti-malware industry and the ethics and perils of investigating state-sponsored or geopolitically significant threats. READ The Ethics a...

Operation Lotus Blossom APT - Elise Malware

Advanced Persistent Threat APT type attacks continue to emerge on a global scale. What makes these attacks deviate from the norm is often the resources required to develop and implement them: time, money, and the knowledge required to create custom pieces of malware to carry out specific, targete...

Writing OS X Malware at Black Hat 2015

Patrick Wardle has one word for today’s generation of Mac OS X malware: lame. Sure there are advanced samples out there developed by nation-state sponsored groups or exploit vendors such as Hacking Team, but for the most part, Wardle says, we’re still talking about malware that are standalone...

Hill Debates Course of Action on China Cyberespionage

Lawmakers and experts on the U.S.-China Economic and Security Review Commission today debated with and quizzed security and legal experts on the best course of action against cyberespionage attributed to China. The Senate committee heard pros and cons related to a number of possible scenarios...

Powerful Linux Trojan 'Turla' Infected Large Number of Victims

Security researchers have discovered a highly nasty Linux trojan that has been used by cybercriminals in state sponsored attack in order to steal personal, confidential information from government institutions, military and pharmaceutical companies around the world. A previously unknown piece of ...

USPS Breach Hits Customers, Employees

The United States Postal Service is continuing its investigation around a cyber attack at the agency that managed to compromise the information of both employees and customers earlier this year. The USPS announced in a statement on Monday that it recently fell victim to a “cyber intrusion inciden...

Michael Chertoff Risk Management ACSC Keynote

BOSTON – Former Homeland Security secretary Michael Chertoff gave enterprises a pep talk Wednesday during his keynote address at the Advanced Cyber Security Center’s annual conference. In a climate where massive financial services organizations such as JP Morgan Chase have been breached, the Whit...

Bugzilla Vulnerability Exposes Bug Collections

Hundreds of open source software projects that make use of Bugzilla, Mozilla’s bug-tracking software, anxiously await a patch for a vulnerability that exposes private bugs collected by the system. Mozilla is today expected to make available a patch for the vulnerability in its account creation...

Mozilla 1024-Bit Deprecation Leaves 107,000 Sites Untrusted

When Firefox 32 shipped this week, Mozilla also officially ended its support of 1024-bit certificate authority certificates in its trusted store. While it still takes a considerable amount of resources to factor and crack a 1024-bit RSA key, important organizations such as NIST have been advising...