As the number of smart plants that use M2M, sensors, and other ICT continue to rise, so too does the lure for attackers.
Manufacturing, energy, and utilities sectors are reportedly spending a combined 206.51 billion Euros globally on ICT in 2019, says Shuba Ramkumar, senior research analyst, Frost & Sullivan.
Organizations are connecting systems to the Internet that they once kept purposely siloed for safety. “Smart plants face new challenges due to the ever-expanding connectivity of their control systems as they link into and rely on business operations and remote monitoring and management,” says Graham Speake, lead trainer at the SANS Institute and a 30-year cyber security industry veteran.To read this article in full or to leave a comment, please click here(Insider Story)
It's a case that would seem to defy the odds many times over: Two Florida women born on the same day, in the same state, and given almost the same name. Though no one realized it at the time, it turns out they were also given the same Social Security number.Joanna Rivera and Joannie Rivera only recently discovered the problem, according to a report this week, but in the meantime it's caused no end of trouble for them. Credit applications have been denied; tax returns have been rejected.Identity theft might have been a likely assumption, but in this case, it was something different.To read this article in full or to leave a comment, please click here
A popular Java library has a serious vulnerability, discovered over nine months ago, that continues to put thousands of Java applications and servers at risk of remote code execution attacks.The flaw is located in Apache Commons, a library that contains a widely used set of Java components maintained by the Apache Software Foundation. The library is used by default in multiple Java application servers and other products including Oracle WebLogic, IBM WebSphere, JBoss, Jenkins and OpenNMS.The flaw is specifically in the Collections component of Apache Commons and stems from unsafe deserialization of Java objects. In programming languages, serialization is the process of converting data to a binary format for storing it in a file or memory, or for sending it over the network. Deserialization is the reverse of that process.To read this article in full or to leave a comment, please click here
What makes an online fraudster? Can you tell by looking at their age? Gender? Billing address? When they shop? The answer is both yes and no, according to a recent report called "The United States of Fraud," produced Sift Science, a fraud detection and prevention software company. They identified factors including age, billing address, shipping address and purchase value that are more likely to signal fraud. This is especially important given the U.S.'s ongoing shift to EMV credit cards. With cards being harder to clone to then use in-store, fraudsters are predicted to shift their efforts online. "EMV technology makes it so much more difficult to duplicate a physical credit card," says Jason Tan, CEO and co-founder of Sift Science. "They're still looking to make their money, and doing their business online is a lucrative channel because it's scalable and anonymous." To read this article in full or to leave a comment, please click here
If you are looking for a good deal, then Black Friday is generally a smart time to buy a TV. For example, Vizio is one of the most popular brands and there are dozens of Vizio TVs showing up in leaked Black Friday ads; but good luck finding one that isn’t “smart.”In the case of Vizio, smart equals spying. So before you jump on a steal of a deal – or if you already own a Vizio smart TV – then you need to know that Vizio is tracking your viewing habits and sharing it with advertisers so you can be tracked across your phone and other devices.Samsung and LG have previously been involved in smart TV spying scandals, but the companies now track users’ viewing habits if customers turn on the feature. “Vizio’s actions,” according to a ProPublica investigation, “appear to go beyond what others are doing in the emerging interactive television industry…. Vizio appears “to provide the information in a form that allows advertisers to reach users on other devices.”To read this article in full or to leave a comment, please click here
Microsoft is delivering its cloud services, including Azure, Office 365 and Dynamics CRM Online from two new datacenter regions in Germany, in a move that aims to deflect customer concerns about access to their data by U.S. surveillance.The data centers, located in Magdeburg and Frankfurt am Main, will be unusual in that control over the data will not be with Microsoft but with Deutsche Telekom subsidiary T-Systems, which will be acting as a data trustee for Microsoft's customers' data.Access to customer data stored in these new datacenters will be under the control of T-Systems and Microsoft will not be able to access the data without the permission of customers or the data trustee, Microsoft said in a statement Wednesday. If permission is granted by the data trustee, Microsoft will access the data only under its supervision.To read this article in full or to leave a comment, please click here
TalkTalk Telecom Group in the U.K. expects the one-off cost of a recent cyberattack to be up to £35 million (US$53 million) but said the number of customers affected may have been far less than had been earlier expected.The company said, while presenting its half-year results Wednesday, that forensic analysis had found that 4 percent of its customers have any personal data at risk.Giving a breakdown, TalkTalk disclosed that the total number of customers whose personal details were accessed were 156,959, and of these customers 15,656 bank account numbers and sort codes were accessed. 28,000 obscured credit and debit card numbers were also accessed by the hackers but cannot be used for financial transactions, as they were were 'orphaned', and cannot be identified by the stolen data, the company said.To read this article in full or to leave a comment, please click here
Apple computers haven't been impacted by ransomware, a pervasive and insidious class of malware that encrypts files on a computer in exchange for a ransom.That's not because Apple's operating system is any more secure than Windows; it's more that malware writers haven't gotten around to writing ransomware for OS X since infecting Windows machines has been so profitable.However, a Brazilian security researcher, Rafael Salema Marques, decided to show how easy it would be for malware writers to target OS X in a polished experiment that took him a couple of days.To read this article in full or to leave a comment, please click here
ProtonMail, the Switzerland-based encrypted email service, has found its footing again after a wild ride over the past week.The free service has said it was hit by two different groups using distributed denial-of-service attacks (DDoS) that took it offline.Now it has partnered with Radware, which offered its DDoS mitigation service for a "reasonable price," allowing service to resume, ProtonMail wrote in a blog post on Tuesday."The attackers hoped to destroy our community, but this attack has only served to bring us all together, united by a common cause and vision for the future," the company wrote.To read this article in full or to leave a comment, please click here
For Patch Tuesday November 2015, Microsoft released 12 security bulletins, four rated as critical and the remaining 8 rated as important.Rated CriticalMS15-112 is the cumulative fix for remote code execution flaws in Internet Explorer. Microsoft lists 25 CVEs, most of which are IE memory corruption vulnerabilities. 19 are called Internet Explorer memory corruption vulnerabilities, with three CVEs labeled slightly different as Microsoft browser memory corruption vulnerabilities. Of the remaining CVEs, one involves Microsoft browser ASLR bypass, one is for an IE information disclosure flaw, and one is a scripting engine memory corruption vulnerability. You should deploy this as soon as possible.To read this article in full or to leave a comment, please click here
On Tuesday, Manhattan US Attorney Preet Bharara's office unsealed an indictment against three individuals charged with hacking several financial institutions, financial news publishers, and other companies.In a statement to Reuters, JPMorgan confirmed that the recently unsealed indictment is connected to last year's hack, which impacted 83 million households.Monday's indictment focuses on Gery Shalon, Joshua Samuel Aaron, and Ziv Orenstein.In court documents shared with CSO Online, the prosecutors say that between 2012 and 2015, the three pulled off "the largest theft of customer data from a U.S. financial institution in history" by stealing the personal information of more than 100 million people.To read this article in full or to leave a comment, please click here
If you believe what the tech industry tells us, everything is coming online. From pacemakers to washing machines to street lights, all will be networked together and feeding data into the cloud. If this Internet of Things comes to pass, we're going to need a lot more security than we have today.Chip design company ARM announced plans Tuesday for a new line of chips intended to help secure those devices. ARM is best known for designing the microprocessors in smartphones and tablets, but it also designs smaller chips, called microcontrollers, that feature heavily in IoT. Some four billion ARM microcontrollers were shipped by ARM licensees last year.To read this article in full or to leave a comment, please click here
One of the problems with traditional magnetic storage has always been that, because it's written with magnetic fields, it can be wiped by those fields too.That makes for a pretty unstable medium—though convenient and more efficient than many.Magnetic storage is used in ID and credit cards too, but the environments that the cards encounter are brutal on the media.So is space travel, and indeed the residential living rooms with magnet-containing home theatre speakers, for example. Remember the mysteriously deteriorating cassette tape?Yet magnetic media has its favorable qualities—it's more secure than Radio Frequency (RF) chips, for example.To read this article in full or to leave a comment, please click here
Administrators of Web servers that were infected with a recently released ransomware program for Linux are in luck: There's now a free tool that can decrypt their files.The tool was created by malware researchers from antivirus firm Bitdefender, who found a major flaw in how the Linux.Encoder.1 ransomware uses encryption.The program makes files unreadable by using the Advanced Encryption Standard (AES), which uses the same key for both the encryption and decryption operations. The AES key is then encrypted too by using RSA, an asymmetric encryption algorithm.To read this article in full or to leave a comment, please click here
Comodo said Monday it fixed a bug that led to the issuance of some now-banned digital certificates. Other CAs might have the same problem, too.Under new rules from the CA/Browser Forum (CAB) that came into force on Nov. 1, certification authorities (CAs) are not supposed to issue new SSL/TLS (Secure Sockets Layer/Transport Layer Security) certificates for internal host names.Comodo had been preparing for the rule change, but a "subtle bug" was introduced in its issuing system on Oct. 30, wrote Rob Stradling, senior research and development scientist, in a post on the CAB Forum.To read this article in full or to leave a comment, please click here
As if Pluto and its moons weren’t unique enough – scientists at the SETI Institute say if tiny Hydra were spinning much faster its surface would fly off.
The fact that most of Plutos moons -- Styx, Nix, Kerberos and Hydra – are spinning wildly anyway is an anomaly, so when NASA’s New Horizon’s space probe got close enough to make some observations about the spin rates of Pluto’s known satellites what was found surprised a few folks. Typically most inner moons in the solar system keep one face pointed toward their central planet, NASA stated.
+More on Network World: NASA telescopes watch cosmic violence, mysteries unravel+To read this article in full or to leave a comment, please click here
When the Office of Management and Budget rolled out its far-reaching blueprint for federal agencies to improve their cybersecurity posture, it identified a number of areas where government CIOs and CISOs can improve, including rapid detection and response to incidents and the need to recruit and retain top security talent.The Cybersecurity Strategy and Implementation Plan (PDF available here) also highlights the need for agencies to take steps to mitigate one of the more pervasive -- and overlooked -- security risks: insider threats.[ Related: Insider threats force balance between security and access ]To read this article in full or to leave a comment, please click here
Spurred by the rash of high-profile hacks, companies are purchasing cyber-insurance to protect themselves from the financial liability associated with data loss and business disruption. But the still-maturing market for cyber-insurance remains fraught with loopholes and inconsistencies, and suffers from a shortage of qualified staff who can properly assess cybersecurity profiles, experts and CIOs say."The application process is less than what you would think it would be, in terms of the due diligence," says Shawn Wiora, CIO and CISO of Creative Solutions in Healthcare, a nursing care facility provider. "I like to work with strong partners and, at this point, I'm not sure that a lot of [the insurers] know what they're doing."To read this article in full or to leave a comment, please click here
7 ways hackers can use Wi-Fi against youImage by ThinkstockWi-Fi — oh so convenient, yet oh so dangerous. Here are seven ways you could be giving away your identity through a Wi-Fi connection and what to do instead.Using free hotspotsImage by ThinkstockTo read this article in full or to leave a comment, please click here
Microsoft announced Monday that it has made a deal to acquire Secure Islands, an Israeli company that focuses on protecting companies' data. Neither company disclosed the terms of the deal.The acquisition will help Microsoft level up its Azure Rights Management Service, which lets companies protect files individually and in bulk with tools that ensure they aren't opened or modified by people who are unauthorized to do so. Secure Islands's services include data classification technology that automatically detects the creation of new files from a variety of sources and then applies a protection policy to it. To read this article in full or to leave a comment, please click here