Week in review: New LTE attacks, Android P security, backdooring connected cars
Here’s an overview of some of last week’s most interesting news and articles:
How to improve your security infrastructure when you’re on a budget
You may not be able to solve all your security needs immediately with a small budget, but the important thing is that you are working towards your security goals and taking steps to move the needle forward.
New LTE attacks open users to eavesdropping, fake messages, location spoofing
A group of researchers has uncovered ten new attacks against the 4G LTE wireless data communications technology for mobile devices and data terminals. The attacks exploit design flaws in the communications protocol and unsafe practices employed by the stakeholders and can be used to achieve things like impersonating existing users, spoofing the location of the victim device, delivering fake emergency and warning messages, eavesdropping on SMS communications, and more.
Not all who pay a ransom successfully recover their compromised data
Once again, China (74.0%) and Mexico (71.9%) are atop the list of countries affected by ransomware, with newly added Spain (80%) in first position.
How to choose a penetration testing service
One main benefit of third party penetration testing is that companies avoid potential conflict of interest or various biases that internal security teams often have from testing the same application over and over again. In addition, outsourcing your penetration testing efforts can offer fresh and customized methodologies that can be utilized by the external resources which usually means better quality and coverage.
Backdooring connected cars for covert remote control
We’ve all known for a while now that the security of connected cars leaves a lot to be desired. The latest proof of that sad state of affairs comes from Argentinian security researchers and hackers Sheila Ayelen Berta and Claudio Caracciolo.The pair is set to demonstrate a hardware backdoor for the CAN bus that can be controlled remotely at the upcoming Hack in the Box conference in Amsterdam.
Android P: Expected security and privacy improvements
Google has released a developer preview of the next version of Android, currently called “Android P.”
UK govt wants IoT manufacturers to take responsibility for security
The UK government aims to shift the burden of securing IoT devices away from consumers and put the onus of securing them squarely on the manufacturers.
Infrastructure security: Don’t just sit there, do something!
Around 4 am on March 28, 1979, things started to go badly wrong deep inside the bowels of reactor number two at Three Mile Island. The master control panel lit up like a Christmas tree. Lights flashed, horns blared. But the crucial information needed by the operators was lost in the noise.
Exim vulnerability opens 400,000 servers to remote code execution
If you’re using the Exim mail transfer agent on your Internet-connected Unix-like systems and you haven’t yet upgraded to version 4.90.1, now is the time to do it as all previous versions contain a vulnerability that can be exploited to achieve remote code execution.
Locked Windows machines can be compromised through Cortana
Compromising locked Windows computers that have the Cortana voice-activated virtual assistant enabled is relatively easy – or it was until Microsoft made a simple tweak.
Vermeer’s Camera: Uncovering the link between art criticism and cybersecurity
Recently, there has been a convergence between the language of information security and art criticism: we now talk of ‘provenance’, ‘curation’, ‘authentication’ and ‘attribution’. In our world, this is the language of governance and regulation.
Robots hijacked by ransomware may soon become a reality
How soon will we see our home, office or industrial robots being hijacked and held ransom by attackers? If they dedicate their efforts to research, that day may come sooner rather than later.
Vulnerable Apache Solr, Redis, Windows servers hit with cryptominers
Vulnerable servers of all kinds are being targeted, compromised and made to mine cryptocurrencies for the attackers.
Cryptocurrency-stealing malware relies on victims copy-pasting wallet info
An unconventional email spam campaign has been delivering unusual cryptocurrency-stealing malware to American and Japanese users.
The driving force of cloud security investments
A new Netwrix report supplements the 2018 Netwrix Cloud Security Report, unveiling survey findings specific to various industries and regions. Overall, 853 organizations shared their feedback for the survey, conducted in November 2017. All organizations are public or hybrid cloud users.
Cyber attacks becoming No. 1 business risk
SonicWall recorded 9.32 billion malware attacks in 2017 and saw more than 12,500 new Common Vulnerabilities and Exposures (CVE) reported for the year.
Criminals can build Web dossiers with data collected by browsers
Everybody knows by now that websites collect information about users’ location, visited pages, and other data that can help them improve or monetize the experience. But just a small minority of Internet users realizes that browsers also collect/store information that can help attackers compile a “Web dossier” to be used for future attacks.
Global security trends for 2018: GDPR, identity and access security
In its third annual global IT security survey, Versasec found Europe’s General Data Protection Regulation (GDPR) is impacting security planning around the world, smart card deployment is on the rise, and that many companies continue to rely on the inadequate protection offered by usernames and passwords alone.
Researchers explore real-world deployment of connected medical devices
ZingBox researchers detected, identified and analyzed the behavior of medical devices deployed in more than 50 hospitals, clinics, and other healthcare locations.
New infosec products of the week: March 9, 2018
A rundown of infosec products released last week.