The U.S. Senate is scheduled to consider early Tuesday the Cybersecurity Information Sharing Act of 2015, a controversial bill that is intended to encourage businesses to share information about cyberthreats with the government by providing them immunity from customer lawsuits.The CISA bill has been criticized by civil rights groups and some companies in the technology industry, which claim the proposed legislation, dubbed a surveillance bill in disguise, provides loopholes for government intelligence agencies like the National Security Agency to get access to personal information of users.The bill has powerful backers though, including industry groups, many lawmakers and the White House, which believe the legislation is necessary in the wake of a large number of recent cyberattacks on companies and government agencies.To read this article in full or to leave a comment, please click here
U.K. police arrested a 15-year-old boy in Northern Ireland on Monday in connection with the data breach at TalkTalk, as the broadband and phone provider faces growing criticism over its handling of the incident.The teenager, detained in Country Antrim, could face charges under the Computer Misuse Act, the Metropolitan Police said.TalkTalk's website was breached on Oct. 21, resulting in the loss of customer names, addresses, birth dates, email addresses, phone numbers, account information, payment card and bank account details.To read this article in full or to leave a comment, please click here
DoT
Saying portable electronic smoking devices such as e-cigarettes, e-cigars, e-pipes or personal vaporizers are basically a fire threat the Department of Transportation in coordination with the Federal Aviation Administration today ruled that the devices will no longer be allowed in checked luggage on commercial aircraft(they still can be carried in carry-on bags but cannot be charging).
+More on Network World: 21 more crazy and scary things the TSA has found on travelers+To read this article in full or to leave a comment, please click here
It looks like Chancellor Angela Merkel is not the only German official who might have been spied on by the nation's allies. The head of a German Federal Chancellery unit reportedly had his laptop infected with Regin, a cyberespionage program believed to be used by the U.S. National Security Agency and its closest intelligence partners.
The German federal prosecutor's office has opened an investigation into the breach, which came to light in 2014, German news magazine Der Spiegel reported Friday. The Chancellery is the federal agency that serves Merkel's office.To read this article in full or to leave a comment, please click here
Potentially as many as 4 million customers were affected by the cyberattack on UK telecoms provider TalkTalk, yet the company's CEO Dido Harding admitted that TalkTalk was "not legally required" to encrypt customer data. Harding told the Sunday Times "[Our data] wasn't encrypted, nor are you legally required to encrypt it. We have complied with all of our legal obligations in terms of storing of financial information."While that may be true, such a statement provides little comfort to TalkTalk customers who are targets of high-level social engineering attacks meant to empty their bank accounts.To read this article in full or to leave a comment, please click here
New products of the weekOur roundup of intriguing new products. Read how to submit an entry to Network World's products of the week slideshow.DeceptionGrid version 5Key features: DeceptionGrid version 5 brings expanded forensic and analytics capabilities to reduce the time-to-breach detection of attackers that have penetrated a network. New real-time automation provides a broad view of an attacker’s activities with detailed event forensics, allowing the entire attacker Kill Chain to be analyzed and presented in a timeline that provides a visual overlay of the attack. More info.To read this article in full or to leave a comment, please click here
It’s likely that you already have a variety of security tools -- intrusion prevention, network access control, endpoint security, mobile device management – that come with automation capabilities designed to quickly find and stop attacks.
But for a variety of perfectly good reasons, you’ve been reluctant to turn these features on. You may be worried about blocking legitimate business transactions by mistake, keeping employees from getting work done because their devices have been temporarily quarantined or risking the wrath of users when wiping remote devices.
Or maybe you’ve been so swamped that you haven’t had the time to set up these automation capabilities. “It takes time and skills to tune these products effectively in order to take advantage of their automation capabilities,” says Jon Oltsik, senior principal analyst at Enterprise Strategy Group. “Furthermore, automation usually depends upon integrating several security technologies together, which can be difficult,” Oltsik adds.To read this article in full or to leave a comment, please click here(Insider Story)
As Internet of Things invades the enterprise, companies need to revamp their approach to protecting data because the old ways aren’t going to get the job done. Not in a world of 25 billion or more IoT devices connected to the Internet by 2020, as Gartner predicts.
So, what are the new challenges that IoT will present?
Basil Hashem, VMware
The biggest change IoT brings is a new scale to an organization's data protection strategy, both in terms of diversity of devices and volume of data that is generated, according to Basil Hashem, senior director of mobile strategy at VMware.To read this article in full or to leave a comment, please click here(Insider Story)
Spam emails containing the Dridex malware are being seen almost daily despite the arrest of one of its key operators in August.The finding confirms that while law enforcement can claim temporary victories in fighting cybercriminal networks, it's sometimes difficult to completely shut down their operations.The U.S. Department of Justice said on Oct. 13 it was seeking the extradition of a 30-year-old Moldovan man, Andrey Ghinkul. Prosecutors allege he used Dridex malware to steal US$10 million from U.S. companies and organizations.To read this article in full or to leave a comment, please click here
Don’t you hate it when you receive a spammy text message or an unwanted robocall or telemarketing call? The FCC said it received over 215,000 complaints from consumers last year, which averages out to about 590 per day. Last week, in its newest efforts to bring down the hammer on spammers, the FCC started releasing robocall and telemarketing consumer complaint data which will be updated every week; the purpose of such name/blame/shame weekly lists is “to help developers build and improve ‘do-not-disturb’ technologies that allow consumers to block or filter unwanted calls and texts.”To read this article in full or to leave a comment, please click here
Don’t you hate it when you receive a spammy text message or an unwanted robocall or telemarketing call? The FCC said it received over 215,000 complaints from consumers last year, which averages out to about 590 per day. Last week, in its newest efforts to bring down the hammer on spammers, the FCC started releasing robocall and telemarketing consumer complaint data which will be updated every week; the purpose of such name/blame/shame weekly lists is “to help developers build and improve ‘do-not-disturb’ technologies that allow consumers to block or filter unwanted calls and texts.”To read this article in full or to leave a comment, please click here
It's move-in day, and you finally have the papers and the keys for your new home. But do you have the passwords?That's one of the questions homebuyers and renters should be asking themselves now that connected devices like locks, lights and thermostats are growing more common, according to the Online Trust Alliance. The industry group joined up with the U.S. National Association of Realtors to compile a checklist for anyone moving in or out of a connected home.Built-in Internet of Things gear can make a new residence like a gadget you'd buy from an electronics store, with the added complication that someone else configured and used it before you did. Access to connected-home devices can mean a view into intimate information about how someone lives, or how they lived before they moved out: Door locks and thermostats might record when you're home, lights note what rooms you spend your time in, and security cameras keep an eye on you.To read this article in full or to leave a comment, please click here
DARPA is looking for a platform that can tell whether Internet of Things devices have been hijacked based on fluctuations in the heat, electromagnetic waves and sound they put out as well as the power they use.The agency wants technology that can decipher these analog waves and reveal what IoT devices are up to in their digital realms, according to a DARPA announcement seeking research proposals under the name “Leveraging the Analog Domain for Security (LADS)”.The LADS program would separate security monitoring from the device itself so if it is compromised, the monitoring platform can’t be affected.To read this article in full or to leave a comment, please click here
When iOS 9 debuted in September, Cisco's AnyConnect VPN client for iOS stopped working correctly with some VPN server configurations, preventing resources from loading. During iOS 9's beta period, Cisco filed a bug report with Apple about iOS 9 breaking DNS resolution in IPv4-based split tunnneling, but iOS 9 shipped without a fix. So did iOS 9.01, 9.02, and this week's iOS 9.1.But on Thursday, Cisco released an AnyConnect client update in the App Store, version 4.0.03016, that resolves the issue. Split-tunnel VPNs again work correctly, InfoWorld's tests reveal.To read this article in full or to leave a comment, please click here
A Russian cyberespionage group that frequently targets government institutions from NATO member countries tried to infiltrate the international investigation into the crash of Malaysia Airlines Flight 17 (MH17).MH17 was a passenger flight from Amsterdam to Kuala Lumpur that crashed in eastern Ukraine close to the Russian border on 17 July, 2014. All 283 passengers and 15 crew members lost their lives.The Dutch Safety Board led an international investigation into the incident and released a final report on Oct. 13, concluding that the Boeing 777-200 aircraft was shot down by a warhead launched from a Russian-built Buk missile system.To read this article in full or to leave a comment, please click here
Joomla, a popular content management system, released patches on Thursday for a vulnerability that can allow an attacker to get full administrative access to a website.Joomla versions 3.2 through 3.4.4 are vulnerable, and the latest version is 3.4.5.The SQL injection flaw was found by Asaf Orphani, a researcher with Trustwave's SpiderLabs, and Netanel Rubin of PerimeterX.SQL injection flaws occur when a backend database executes a malicious query when it shouldn't. The type of vulnerability is one of the most prevalent ones within web applications.To read this article in full or to leave a comment, please click here
Tens of thousands of people who bought MacKeeper have filed for refunds as part of a proposed class-action settlement against the application's former developer.The number of refund requests has far exceeded what is typical in these type of lawsuits, surprising even experienced class-action lawyers.But the unfortunate side effect of the robust response means those who've applied will probably get a smaller refund.The class-action suit was filed in May 2014 on behalf of Pennsylvania resident Holly Yencha, who contended that MacKeeper falsely flagged security and performance problems in order to coax consumers into paying US$39.95 for the full version.To read this article in full or to leave a comment, please click here
IBM may be the fastest-growing vendor in the worldwide security software market, but it's also the owner of the world's largest source of spam.That's according to a Wednesday report by security expert Brian Krebs, who called out the company's SoftLayer subsidiary for being "the Internet’s most spam-friendly" service provider.SoftLayer currently holds the top position on antispam nonprofit Spamhaus.org's list of the world’s worst spam support ISPs, which it defines as the ISPs with the worst abuse departments and "consequently the worst reputations for knowingly hosting spam operations."To read this article in full or to leave a comment, please click here
JP Morgan Chase Bank tweeted in error that its chip credit cards would be getting PIN security, a bank spokesman confirmed Thursday.The tweet, posted mid-day on Wednesday by @ChaseSupport, said: "Your security is our priority! We're planning to add Chip and PIN to our credit cards in the near future.""That tweet was sent in error yesterday," said JP Morgan Chase Bank spokesman Paul Hartwick in an email to Computerworld. "At this time we do not have current plans to offer chip-and-PIN credit cards."MORE ON NETWORK WORLD: 6 simple tricks for protecting your passwords
The bank, one of the nation's largest card issuers, has already distributed 64 million of the newer, more secure chip cards, he said. Of those, 51 million are credit cards and 13 million are debit cards. The vast majority are on Visa's network and some are on MasterCard's.To read this article in full or to leave a comment, please click here
Technical support scammers have begun targeting Mac owners, a security researcher said today, adding them to much larger pool of potential victims running Windows because Apple's operating system has been relatively untouched by malware."These scams aren't being done with cold calls, but by aggressive malvertising," said Jerome Segura, a senior security researcher with San Jose, Calif.-based Malwarebytes. In some cases, Segura said, legitimate online ad networks are being abused by criminals.Mac owners who browse to what Segura called "lower-quality websites" may encounter attack code or scripts that hijack the browser to display scary, but bogus, warnings that their machine is at risk, then offer a telephone number to call for technical assistance.To read this article in full or to leave a comment, please click here