A new ransomware campaign known as SamSam has targeted as many computers in an organization as possible to encrypt then and then offers a volume discount for fixing the whole company. First time volume discounts have been seen in the wild! Neat!

Google will add SSO from Chrome on May 7^th, a better version than the one that was compromised last year. Once a user logs in past there, a ‘verify it’s you’ prompt will pop up to ask users whether they recognize the account they are being signed into.

Jan Koum, the founder of WhatsApp who sold his private messaging app to Facebook four years ago for $19 billion, reportedly plans to step downin the wake of increasing concerns over the parent company’s intentions for its user data as well efforts to weaken its encryption.

The latest version of Chrome OS now keeps all devices protected from Meltdown, Google says.  Update stuff!

More than 1,000 experts from nearly 30 countries have tested their ability to protect IT systems and critical infrastructure networks at NATO’s Locked Shields 2018 live-fire cyber defense exercise.

Hackers managed to compromise the Ukrainian energy ministry website, encrypt files, and post a ransom demand. Although Ukraine has been heavily hit by global malware outbreaks over the last year, including WannaCry, NotPetya, and Bad Rabbit, the recent incident appears isolated and by no means the work of state-sponsored actors, security experts say.

Konrads Voits of Ypsilanti, Michigan, has been sentenced to seven years and three months in prison for attempting to hack the Washtenaw County Jail computer systemand modifying prison records to get his friend released early.

Four years after the initial iteration was released, the National Institute of Standards and Technology (NIST) has released version 1.1 of the Framework for Improving Critical Infrastructure Cybersecurity. Direct link here.

Here’s a spicy list of neat features in the Windows 10 April 18 creator update, including dictation hotkeys, audio preferences per app, and improved Bluetooth pairing.

On Tuesday, Department of Justice (DOJ) prosecutors asked a San Francisco federal court judge to impose that sentence on Karim Baratov, a Canadian citizen born in Kazakhstan who was indicted in March 2017 for working with two officers of the Russian Federal Security Service (FSB) -that’s Russia’s successor to the KGB – to pull off the historic Yahoo breach. They asked for nearly 8 years.

Hackers are working on utilizing the blockchain infrastructure to host and hide malicious activity— .bit domains are increasingly being used to hide payloads, stolen data, and command and control servers, FireEye says.

A group named GOLD GALLEON has targeted global maritime shipping companies– As part of the BEC social engineering scheme, actors usually employ spear-phishing emails to steal email credentials of individuals responsible for handling business transactions. This allows them to intercept emails between involved parties, modify financial documents, and redirect funds to attacker-controlled bank accounts.

The recently patched Drupal (open source CMS) vulnerability tracked as CVE-2018-7600 and dubbed Drupalgeddon2 has been exploited in the wild to deliver backdoors, cryptocurrency miners and other types of malware.

Foxit has addressed over a dozen vulnerabilitiesin their PDF Reader, a free application that provides users with an alternative to Adobe Acrobat Reader.

A new security standard announced Tuesday, WebAuthn, has won near-final approval from the World Wide Web Consortium, which establishes Web standards. It is based on a specification written by the FIDO Alliance, can make the Internet more secure for consumers. It uses public key cryptography and is resistant to phishing attacks.

A former employee stole data on 1.5 million customers, Atlanta-based SunTrust Banks announced on Friday. The stolen information includes names, addresses, and phone numbers, along with certain account balances, as this was the data included in the contact lists, the company confirmed.

Over 95% of the email domains managed by the Executive Office of the President (EOP) haven’t implemented the Domain Message Authentication Reporting & Conformance (DMARC) protocol, the Global Cyber Alliance (GCA) has discovered. After analyzing 26 such domains, GCA discovered that 18 haven’t even started the deployment of DMARC, while 7 of them have implemented the protocol at the lowest level (“none”), which only monitors emails.

After Delta Air Lines and Sears Holdings, Best Buy has also come forward to warn customers that their payment card information may have been compromised as a result of a breach suffered by online services provider.

Panera had a plaintext database for their online ordering systemin which user ID’s were incremented by single digits (1, 2, 3), so if you knew where to look for that ID in the URL, you could find some info about other users. Neat! Brian Krebs is currently fighting with Panera about this and Panera is ‘currently investigating.’

Last week, LGBTQ social networking app Grindr has found itself with the uncomfortable job of explaining why it has quietly been sharing the HIV status of its users with third parties.

Intel decided not to fix the microcode that allowed Spectreto be a thing for a large swath of legacy processors, most from 2007-2010 and a few Atom chips from 2015. Anything listed in red on this pageis not getting the microcode update.

The Department of Homeland Security publicly acknowledged the use of StingRays(fake cell ‘towers’ used to scrape information like location, call and text data) in the Washington, D.C. metro area for the first time. No word on what, if anything, they plan to do about it.

An attacker last week found a flaw in the Verge (XVG) cryptocurrency that allowed them to execute a widely-hypothesized blockchain takeover called a 51% attack- leveraging the majority of the mining power of the chain by spoofing time stamps and netting $80/second for nearly 3 hours.

After doubling in 2016, the frequency of ransomware attacks doubled again in 2017, according to findings in the latest Verizon Data Breach Investigations Report (DBIR).

Ransomware, spyware, and cryptomining were the biggest enterprise threatsduring an otherwise quiet quarter for malware, researchers report.

Craigslist shut down its personalssection on Friday in response to the passage of H.R. 1865, the Fight Online Sex Trafficking Act (FOSTA) bill, in both houses of Congress on Wednesday. Both moves have likely been taken to avoid lawsuits in the wake of the government gutting the law that protects online sites and services from responsibility for content posted by users.

A ransomware attack — possibly a variant of SamSam— has affected some customer-facing applications and some internal services at the City of Atlanta. The FBI and incident response teams from Microsoft and Cisco are investigating. The city’s police department, water services and airport are not affected.

Researchers have discovered a new side-channel attack methodthat can be launched against devices with Intel processors, and the patches released in response to the Spectre and Meltdown vulnerabilities might not prevent these types of attacks. The BranchScope attack has been demonstrated on devices with three types of Intel i5 and i7 CPUs based on Skylake, Haswell and Sandy Bridge microarchitectures.

A US consumer protection agency said Monday it has opened an investigation into Facebook’s privacy practices, another blow to the social network, which is struggling to deal with a growing crisis on misuse of private data. If you have installed Facebook Messenger app on your Android device, there are chances that the company had been collecting your contacts, SMS, and call history data at least until late last year.

In a big victory for international law enforcement, Spanish police have arrested the alleged leader of Carbanak, a cybercrime group believed responsible for stealing over $1.2 billion from more than 100 banks in 40 countries.

Netflix expanded its bug bounty program on Wednesday opening it up to any white hat hackerand at the same time increased the top reward to $15,000.

Since emerging from Intel as a standalone cybersecurity company in April 2017, McAfee has consistently made multiple new product announcements simultaneously. It has continued that model this week with a new version of the Enterprise Security Manager (ESM 11), and enhancements to Behavioral Analytics, Investigator, Advanced Threat Defense, and Active Response. And two new SOC’s!

Mid-day Tuesday, Microsoft’s Windows Defender blocked more than 80,000 instances of several new variants of the Dofoil(aka Smoke Loader) downloader. The signatureless machine learning capabilities of Defender detected anomalous behavior, and within minutes had protected Windows 10, 8.1 and 7 users from the outbreak. Microsoft describes how the Dofoil downloader works, and how it was detected. Noticeably, it does not explain how the computers were compromised in the first place.

Researchers uncovered another piece of the puzzlein the compromise of the popular Windows utility CCleaner last fall that further points to a targeted cyber espionage campaign: a backdoor that had been deployed in a previous software supply chain attack last year. Security firm Avast – which acquired CCleaner vendor Piriform on July 18 of last year – recently found that the attackers appear to have had a third stage of their attack planned that used the ShadowPad backdoor for capturing keystrokes and stealing information from infected networks.

New Trojan! Researchers at Proofpoint most recently detected the FlawedAmmyy Remote Access Trojan as the payload in email campaigns from early March 2018. The FlawedAmmyy malware was built on top of leaked source code for version 3 of Ammyy Admin, a legitimate form of remote desktop software used among millions of consumers and businesses to handle remote control and diagnosis on Windows machines.

Somebody screwed up at Oculus last Wednesday, when an expired security certificate (SSL) caused all Rift virtual reality headsets to keel over. This effectively killed all connectivity to the Oculus Runtime Services, which meant no one could do anything for the better part of the day. They fixed it, though! Renew your certs!

US President Donald Trump blocked Monday an unsolicited bid by Singapore-based Broadcom to take over smartphone chipmaker Qualcomm, citing national security concerns.

Experts from the Cyber-Security Research Center at the Ben-Gurion University of the Negev in Israel combined previous research on communications through ultrasonic waves with a technique that can be used to turn a device’s speakers into a microphone in an effort to create a covert data exfiltration channel.

In a new report this week, security vendor McAfee says it observed a 267% increase in fileless malware samples leveraging PowerShell just in the fourth quarter of 2017, compared to the same period a year ago. The total number of PowerShell malware samples that McAfee observed in 2017 was a massive 432% higher than the number observed in 2016.

Last week Science reported that claims that are demonstrably false – as in, tweets related to news that had been investigated by six independent fact-checking organizations, including PolitiFact, Snopes and FactCheck.org – are 70% more likely to be retweeted. Bogus claims about politics spread further than any other category of news included in their analysis.

Today is Safer Internet Day 2018 (of course that’s a thing) and here are 3 quick tips you can use to make your social media experiences a bit safer: 1) Turn on 2-factor authentication, 2) BE NICE, 3) Log out when you’re done! Yay safer internet!

Security researchers at Chinese IT security firm Qihoo 360 Netlab discovered a new piece of wormable Android malware, dubbed ADB.Miner, that scans wide-range of IP addresses to find vulnerable devices (anything Android-based and IoT) and infect them to mine digital cryptocurrency.

A critical vulnerability discovered in the Chrome and Firefox browser extension of the grammar-checking software Grammarly inadvertently left all 22 million users’ accounts, including their personal documents and records, vulnerable to remote hackers.

Dubbed Smominru, and focused on mining Monero crypto-currency, a new botnet managed to infect over 526,000 Windows hosts to date, most of which are believed to be servers. After conducting a sinkholing operation, the security researchers discovered that the infected machines are distributed worldwide, with the highest numbers in Russia, India, and Taiwan.

The 2018 Identity Fraud Study released today by Javelin Strategy & Research, found that in 2017, the total number of fraud victims increased 8% to 16.7 million. The Javelin report also found that 6.64% of consumers became victims of identity fraud last year, an increase of almost 1 million victims from the previous year. The increase was driven by growth in existing non-card fraud and account takeover (ATO) schemes.

British bank Lloyds, along with US institutions including Bank of America and JP Morgan, decided that the recent volatility of cryptocurrency prices has made them too much of a gamble for credit card purchases. Simply put, you’ll need a debit card from now on to buy cryptocoins such as Monero, Ethereum and Bitcoin, to prevent you speculating on credit given that last year’s surge in cryptocurrency prices has been offset by a recent, sudden plunge in value.

In the wake of the cryptocurrency lifestyle, marketers have taken to trying to push cryptocurrency (or scams) on unsuspecting get-rich-quickers. Not on Facebook, the platform banned all ads dealing with cryptocurrency last week.

There’s an Adobe Flash zero-day vulnerability that exploits Microsoft Office interactions with embedded Flash objects, typically being given as attachments in emails. It’s 1998 all over again! Adobe to patch next week.

Ransomware made it into the Oxford English Dictionary. What a time to be alive.

Attacks targeting ATMs, called “jackpotting,” which have been seen in Europe and Asia for some time, have now reached the US, according to a recent alert from the US Secret Service obtained by Brian Krebs. It’s a two-step process, step 1, access vulnerable (think XP) ATM via PC, step infect malware and deploy all the cash! Yay!

A map showing paths taken by users of an exercise tracking app reveals potentially sensitive information about American and allied military personnel in places including Afghanistan, Iraq and Syria. Military will probably ban fitbit-type things on bases soon.

Computer maker Lenovo has updated Fingerprint Manager Pro for Windows 7, 8, and 8.1 to address several insecure credential storage issues in the software, including the presence of a hardcoded password. The vulnerability has been addressed in Lenovo Fingerprint Manager Pro version 8.01.87.

Fallout from flawed fixes for the Meltdown and Spectre microprocessor firmware vulnerabilities continues as Microsoft released a second emergency patch this month for Windows: this time, to deactivate Intel’s buggy update for one of the Spectre issues. Microsoft late Friday issued an out-of-band update that disables the mitigation patch for the branch target injection flaw (CVE-2017-5715), aka Spectre variant 2.

Last week, on Tuesday morning, three armed men entered the office of an Ottawa Bitcoin exchange, Canadian Bitcoins, where they tied up four employees and demanded Bitcoins. Sorry, there’s no punchline. This is not a joke. The bank robbers did not expect clinking bagfuls of shiny gold Bitcoins like you see in the cryptocurrency icons. One was arrested.

Cisco informed customers on Monday that updates released for its Adaptive Security Appliance (ASA) software patch a critical vulnerability that can be exploited to gain full control of devices or cause them to reload. The security hole, tracked as CVE-2018-0101 and assigned a CVSS score of 10, allows a remote and unauthenticated attacker to execute arbitrary code or cause a denial-of-service (DoS) condition. The flaw exists in the Secure Sockets Layer (SSL) VPN functionality of the ASA software. Disabling ‘web-vpn’ stops this. Or update the devices.

Russian authorities have uncovered a massive fraud ring that installed malicious software at gas pumps making customers think they were getting more fuel than they were. In fact they were pumping up to 7% less than they were being charged for, according to Russian news source Rosbalt.

Uber has fixed a security bug that could’ve allowed an attacker to hack into user accounts by bypassing two-factor authentication, after the ride-sharing company initially said the flaw wasn’t a “particularly severe” issue. The company quietly issued a fix shortly after ZDNet first revealed the bug on Sunday.

Intel on Monday warned that you should stop deploying its current versions of Spectre/Meltdown patches, which Linux creator Linus Torvalds calls ‘complete and utter garbage.’

Seagate recently patched several vulnerabilities discovered by researchers in the company’s Personal Cloud and GoFlex products, but some weaknesses impacting the latter remain unfixed.

The authors of the Satori IoT malware family have dramatically increased their pool of bot recruits for attack botnets with a latest version of the tool targeting systems running ARC processors. ARC processors are 32-bit power-efficient CPUs that are used in a wide range of applications including automotive, industrial, and IoT. More than 1.5 billion embedded systems containing ARC cores ship every year, including electronic steering controls and infotainment systems in cars, as well as personal fitness bands and digital TV set tops, and smart thermostats.

Three Sonic the Hedgehog games for Android, downloaded over 100 million times, are at risk of leaking user geolocation and other personal device data to suspicious servers, putting users at risk of man-in-the-middle attacks and similar type vulnerabilities, according to security experts. (Sonic the Hedgehog Classic, Sonic Dash 2: Sonic Boom and Sonic Dash)

OnePlus has confirmed that up to 40,000 customers have been affected by a credit card breach, in the latest embarrassing misstep for the Chinese handset maker.

A Google security researcher has discovered a severe vulnerability in almost all Blizzard games that could allow remote attackers to run malicious code on gamers’ computers. Google’s Project Zero team researcher Tavis Ormandy discovered that the Blizzard Update Agent is vulnerable to a hacking technique called the “DNS Rebinding” attack that allows any website to act as a bridge between the external server and your localhost. This allows privileged Javascript code to be ran from the agent. A fix is ‘in the works.’

A variant of the Dridex banking trojan recently popped up in an email campaign, with an unusual twist: The attackers used compromised FTP sites for hosting malicious documents, according to researchers at Forcepoint. It was a notable departure from the norm of using HTTP links and could represent the start of a new trend.

Despite the rash of ransomware, malware and other big vulnerabilities over the last few months, phishing is still a big deal. Last week, a phishing campaign that hijacked the Netflix brand made big news. Users were greeted with an email that their Netflix account was on hold and it went downhill from there, including asking users to re-confirm credit card payment and even take a selfie to confirm identity.

A majority vote in the US House of Representatives to renew Section 702 of the Foreign Intelligence Surveillance Act (FISA) for six years will, in their view, give them continued access to the indispensable tools they need to prevent major foreign terrorist attacks. This means 6 more years of warrantless searches if it all goes through.

An Ontario man made his first court appearance Monday to answer charges of running a website that collected personal and password data from some three billion accounts, and sold them for profit. The information was stolen during massive hacks of websites including LinkedIn and the Ashley Madison online dating service.

Assessments conducted last year by the U.S. Department of Homeland Security’s Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) showed that boundary protection remains the biggest problem in critical infrastructure organizations, but identification and authentication issues (shared passwords) have become increasingly common.

A critical vulnerability has been discovered in the widely used Transmission BitTorrent app that could allow hackers to remotely execute malicious code on BitTorrent users’ computers and take control of them. So don’t use it; in fact, don’t torrent things at all!

Some of the patches that came out in the last few weeks for the CPU vulnerabilities have dramatically slowed systems, or halted them altogether. Intel, Google and Microsoft have been scrambling to fix this, in some circumstances removing patches, reuploading patches, and halting patches from hitting end-user systems.

Researchers identified 60 apps on Google Play infected with AdultSwine malware that in some cases displayed graphic adult-themed ads on apps intended for children. They have been removed from the Google Play store.

The CIA has concluded that Russia’s GRU military spy arm waged the NotPetya data-wiping cyberattack on Ukraine in June of last year, according to a report late last week in The Washington Post. This was long postulated, but they confirmed it.

A new piece of malware designed to target industrial control systems (ICS) has been used in an attack aimed at a critical infrastructure organization, FireEye reported on Thursday. The malware, which FireEye has dubbed “Triton,” is designed to target Schneider Electric’s Triconex Safety Instrumented System (SIS) controllers. Customers have been advised not to leave the front panel key position in “Program” mode when the controller is not being configured.

Boy meets girl. Girl tracks boy with spyware. Girl (allegedly) hires hitman to kill boy. Girl arrested by hitman, who works for the FBI. This is a delightful read, for real.

Updates released by Apple on Monday for iOS, macOS and Safari should mitigate the effects of the vulnerabilities exploited by the recently disclosed attack method named Spectre. KEEP YOUR OPERATING SYSTEMS UPDATED!!

Users have complained that the updates released by Microsoft last week for the Spectre and Meltdown vulnerabilities cause Windows to break down on some computers with AMD processors. Shortly after releasing the Meltdown/Spectre updates, Microsoft warned that it had  . The company informed users that if they had not been offered the security updates, they may be running an incompatible antivirus application.

Security researchers have discovered several severe vulnerabilities and a secret hard-coded backdoor in Western Digital’s My Cloud NAS devices that could allow remote attackers to gain unrestricted root access to the device. Western Digital’s My Cloud and My Cloud Mirror firmware version 2.30.165 and earlier are affected by all above-reported vulnerabilities.

Spectre and Meltdown, two CPU flaws that are potentially catastrophic. Both affect nearly everything with a CPU in it. Both have been (mostly) patched by recent updates. KB4056892 for Windows, iOS 11.2, MacOS 10.13.2, and the January 5th security patch for Android. KEEP YOUR THINGS UP TO DATE.

An application compiled just weeks ago was found to be an installer for a Monero miner designed to send the mined currency to a North Korean university, AlienVault reports. This exploits xmrig, a program already associated with wide campaigns exploiting unpatched IIS servers to mine Monero.

Microsoft is working on a password-free world, starting at home. Their company has 125,000 employees and all of them use Windows Hello as their default logins. Apparently, the facial recognition on Windows Hello is better than the iPhone X, but not immune to the same infra-red photography techniques used to subvert both platforms.

The U.S. Customs and Border Patrol announced new restrictions on when agents can copy data from digital devices at border crossing points. Agents now need “reasonable suspicion” in advance of searches of phones, computers, tablets, cameras or any other digital device belonging to people entering or leaving the United States. Border agents will also be restricted from accessing data stored remotely in the cloud.

In a one-two punch, the Wi-Fi Alliance today introduced several key enhancements to its Wi-Fi Protected Access II (WPA2) security protocol and unveiled its next security protocol WPA3.

A breach of the Unique Identification Authority of India’s Aadhaar biometric system is putting personally identifiable information (PII) of more than 1 billion Indian residents at risk, reports the Tribune, an Indian publication. Read more about Aadhaar here.