90 percent of financial institutions targeted by ransomware in the last year
Robbing a bank used to involve a mask, a gun and a fast car, but these days it's more likely to be done via the safer and no less lucrative means of a cyberattack.
A new report from cloud security specialist Carbon Black, based on responses from CISOs at 40 major financial institutions -- including six of the top 10 global banks -- seeks to better understand the attack landscape.
Email fraud still a significant threat to businesses
Not so long ago the idea of email fraud mainly involved Nigerian princes asking for your help to liberate a few million dollars.
Things have moved on and the scammers have become more sophisticated, but email fraud is no less of a threat according to a new study by email security specialist Agari, which studied activity on 78 criminal email accounts over a period of 10 months.
Comcast website leaks details of Xfinity users -- including router passwords
Security researchers have discovered a bug in the Comcast website that makes it possible to gather information about Xfinity users. As well as customer data such as home addresses, it is also possible to access wireless network details including passwords.
The bug was reported by Karan Saini and Ryan Stevenson after they found it was possible to use the Xfinity activation website to access customer data using nothing more than a customer account ID and that customer's house or apartment number.
Red Hat responds to Speculative Store Bypass and helps explain Variant 4 chip vulnerability
As news of yet another chip vulnerability creeps out, computer users, businesses and organizations around the world are trying to assess how the latest bug affects them. To help its users and others to understand what the Speculative Store Bypass/Variant 4 vulnerability means, Red Hat has issued advisories and an explanatory video.
The company also reveals exactly which of its Linux builds are affected by the security flaw and what steps can be taken as mitigation. In addition to this, Red Hat has put together a number of resources that help to "provide more context around this vulnerability from an open source technology perspective".
Spectre and Meltdown variant 4: Microsoft, Google and Intel reveal new Speculative Store Bypass chip vulnerability
Just when you thought you could forget about the Spectre and Meltdown chip vulnerabilities, yet another variant has been discovered. Known as Speculative Store Bypass, the vulnerability affects chips from AMD and Intel, as well as Power 8, Power 9 and System z processors.
The vulnerability has been assigned CVE-2018-3639, and successful exploitation would mean that an attacker could gain access to data. The attack can be carried out through a "language-based runtime environment" such as JavaScript. Some patches exist while others are in development, and they include the same performance hit associated with patches for the previous vulnerabilities.
Banks struggle to defend against internal attacks
A new study from vulnerability assessment specialist Positive Technologies shows that banks have built up strong defenses against external attacks but still struggle with internal threats.
Whether they use social engineering, vulnerabilities in web applications, or the help of insiders, as soon as attackers access the internal network of a bank, they often find that it's secured no better than companies in other industries.
FCC investigates LocationSmart website for leaking location data for users of major US mobile carriers
LocationSmart, a company based in Southern California, is under investigation by the FCC after it was discovered that its website made it possible for just about anyone to access location data for the majority of US cell phones.
Security expert Brian Krebs reported that a bug on the LocationSmart website made it possible for anyone to check on the location of any AT&T, Sprint, T-Mobile or Verizon phone in the US. Even more worryingly, the data is said to be accurate to a few hundred yards.
Chrome will stop highlighting HTTPS sites as secure
Later this year, Chrome will adopt a new approach to indicating site security. Starting in September, the browser will no longer use a security indicator to highlight the fact that you're visiting an HTTPS page.
Instead, Google will simply issue a warning when a website is not secure. As the company puts it, "users should expect that the web is safe by default, and they’ll be warned when there’s an issue". The change is coming in Chrome 69.
F-Secure combines AI and human expertise in new security offering
It's no longer enough to just protect the perimeter in order to keep systems secure. It's now necessary to catch file-less attacks, privilege escalation and a whole range of other tactics.
The problem for smaller businesses is they often don't have the expertise in house to handle the range of threats.
How blockchain is set to change the world
In most people's minds blockchain technology is associated with cryptocurrency, but it has potential to be useful in a whole range of other areas.
Consumer research company The Opinion Economy has produced an infographic to highlight the potential of blockchain in a whole range of areas.
Publicly disclosed vulnerabilities continue to rise
The first quarter of 2018 has shown a 1.8 percent increase in the number of disclosed vulnerabilities over the same period in 2017, with 5,375 unique vulnerabilities reported.
This is one of the findings of Risk Based Security's latest Vulnerability QuickView Report, which suggests that unless the rate of increase slows down 2018 will be another record year.
100 percent of organizations have active insider threats
A new study from user behavior intelligence specialist Dtex Systems has uncovered active insider threats in all of the organizations it assessed.
Failure to gain visibility is allowing malicious and negligent employees to engage in undetected high-risk activities on every endpoint, on and off the network.
Kaspersky to move data from Russia to Switzerland to improve transparency
Kaspersky Lab has announced that it plans to move data out of Russia and into a new data center in Switzerland. The move is part of the company's Global Transparency Initiative which came in response to concerns about ties to the Russian government.
Software produced by Kaspersky has already been banned from US government systems, and the company has been on a mission to prove that Russia is not spying on other countries via its antivirus tools.
Cryptomining malware targets unpatched servers
Cybercriminals are increasingly targeting unpatched server vulnerabilities to infect machines with cryptomining malware, according to a new report.
The study from Check Point Software Technologies sees cryptomining malware dominate Check Point’s Top Ten Most Wanted Malware Index, the Coinhive variant retains the top spot with a global reach of 16 percent. Cryptoloot -- another crypto-mining malware -- is close behind with a global reach of 14 percent, while the Roughted malvertising malware came in third (11 percent).
Apps based on Electron framework are vulnerable to attack
The Electron framework -- the basis of popular apps including Skype, Slack, Signal and WordPress -- has been found to contain a security flaw that leaves it vulnerable to attack.
The GitHub-created tool has a vulnerability that allows hackers to execute arbitrary code on remote systems. CVE-2018-1000136 affects Electron 1.7.13 and older as well as Electron 1.8.4 and 2.0.0-beta.3, and the problem exists because of the interaction between Electron and Node.js.
© 1998-2026 BetaNews, Inc. All Rights Reserved. Privacy Policy - Cookie Policy.