Cybersecurity

Internet Domain Shutdowns: Ineffective and Risky, Experts Warn

Efforts to curb illegal online content through domain shutdowns are proving ineffective and carry significant risks, according to a new report by eco and its topDNS initiative. more

Malware Increasingly Uses DNS As Command and Control Channel to Avoid Detection

Number of malware threats that receive instructions from attackers through DNS is expected to increase, and most companies are not currently scanning for such activity on their networks, security experts said at the RSA Conference 2012 on Tuesday. While most malware-generated traffic passing through most channels used for communicating with botnets (such as TCP, IRC, HTTP or Twitter feeds and Facebook walls) can be detected and blocked, it's not the case for DNS (Domain Name System) and attackers are taking advantage of that, said Ed Skoudis, founder of Counter Hack Challenges and SANS fellow. more

Trump Signs Cybersecurity Executive Order, Experts Weigh in on the New Draft

The long-waited cybersecurity executive order expected to launch sweeping reviews of the federal government's digital vulnerabilities, was signed today by President Trump. more

Into the Gray Zone: Considering Active Defense

Most engineers focus on purely technical mechanisms for defending against various kinds of cyber attacks, including "the old magic bullet," the firewall. The game of cannons and walls is over, however, and the cannons have won; those who depend on walls are in for a shocking future. What is the proper response, then? What defenses are there The reality is that just like in physical warfare, the defenses will take some time to develop and articulate. more

Data Breaches and You: ISOC Global Internet Report 2016 Explains Critical Steps You Need to Take Now

Data breaches are the oil spills of the digital economy. Over 429 million people were affected by reported data breaches in 2015 -- and that number is certain to grow even higher in 2016. These large-scale data breaches along with uncertainties about the use of our data, cybercrime, surveillance and other online threats are eroding trust on the Internet. more

The Networked Society and Personal Freedom

Given the current debate around mass surveillance which is undertaken by both governments and (social) media companies, the recurring question is what is happening to our hard-fought personal freedom? In the case of government-based mass surveillance there isn't an opt-out option, and in reality opt-out is also not a valid solution to services provided by Google, Apple, Facebook and the millions of apps that we all use to some extent or another. more

Worldwide Security Spending to Reach $96 Billion in 2018, Up 8 Percent from 2017, Says Gartner

Worldwide enterprise security spending to total $96.3 billion in 2018, an increase of 8 percent from 2017, Gartner forecasts. more

$300 Million Annual Loss Due to Non-Cooperation in Fight Against Phishing

During a presentation today at the eCrime Researchers Summit in Atlanta, Georgia, security researchers revealed that average lifetime of malicious websites are often longer than they should be due to lack of communication and cooperation between security vendors. According to results, website lifetimes are extended by about 5 days when "take-down" companies -- often hired by Banks -- are unaware of the site. "On other occasions, the company learns about the site some time after it is first detected by someone else; and this extends the lifetimes by an average of 2 days," says Richard Clayton. more

New Research Finds Over 80% of Domain Names Used by Phishers Are Legitimate Domains

New research from the Anti-Phishing Working Group (APWG) has found that up to 81% of domain names used for phishing are legitimate domains that have been hacked. More specifically, out of the 30,454 phishing domains under observation, only 5,591 domain names (18.5%) were registered by phishers according to APWG. The remaining small percentage of the domains used in phishing belonged to subdomain resellers such as ISPs and other web-based services. more

FBI vs Apple: A Bit Of Light Reading

Encryption is key to commerce online. Anything that weakens it is a threat to the digital economy, so the FBI vs Apple case is something that a lot of people are watching very closely... The most recent development is that Apple has filed "Motion to Vacate the Order Compelling Apple Inc. to Assist Agents in Search, and Opposition to the Government's Motion to Compel Assistance." Legal filings aren't light bedtime reading, but this one explores the legal issues as well as the privacy and security implications from multiple angles and underlines why this case is so important. more

The FBI and the iPhone: Important Unanswered Questions

As you probably know, the FBI has gotten into Syed Farook's iPhone. Many people have asked the obvious questions: how did the FBI do it, will they tell Apple, did they find anything useful, etc.? I think there are deeper questions that really get to the full import of the break. How expensive is the attack? Security - and by extension, insecurity - are not absolutes. Rather, they're only meaningful concepts if they include some notion of the cost of an attack. more

Mega International DNS Malware Operation Dismantled, Reports FBI

FBI today announced six Estonian nationals have been arrested and charged with running a sophisticated Internet fraud ring that infected millions of computers worldwide with a virus and enabled the thieves to manipulate the multi-billion-dollar Internet advertising industry. Users of infected machines were unaware that their computers had been compromised -- or that the malicious software rendered their machines vulnerable to a host of other viruses. more

Cybercrime Costs German Companies €267 Billion, Organised Crime and Foreign Nations Blamed

German companies have suffered substantial financial losses due to cybercrime and sabotage, totaling approximately €267 billion ($298 billion) over the past year. This represents a 29% increase compared to the previous year, according to a survey released on Wednesday by the industry association Bitkom. more

Good Samaritans with Network Visibility

In a big open office 30 feet from me, a team of US Veterans speak intently on the phone to businesses large and small, issuing urgent warnings of specific cyber security threats. They call to get stubborn, confused people to take down hidden ransomware distribution sites. They call with bad news that a specific computer at the business has malware that steals login credentials. more

M3AAWG Offers Some Sensible Password Advice

M3AAWG is a trade association that brings together ISPs, hosting providers, bulk mailers, and a lot of infrastructure vendors to discuss messaging abuse, malware, and mobile abuse. (Those comprise the M3.) One of the things they do is publish best practice documents for network and mail operators, including two recently published, one on Password Recommendations for Account Providers, and another on Password Managers Usage Recommendations. more