Russian group suspected to be linked to Ukraine power station cyberattack

A cyberattack that knocked out power in the Ukraine last month is believed to have been initiated by a hacking group with strong Russian interests.iSight Partners, a cybersecurity firm headquartered in Dallas, wrote on Thursday that a group called Sandworm was likely involved.The link was made after a study of a malware sample called KillDisk and a related one used by Sandworm in the past called BlackEnergy 3, wrote John Hultquist, director of cyberespionage analysis at iSight Partners.To read this article in full or to leave a comment, please click here

Android-powered smart TVs targeted by malicious apps

Smart TVs running older versions of Android are being targeted by several websites offering apps containing malware, according to Trend Micro.The security vendor wrote on Thursday that it found a handful of app websites targeting people in the U.S. and Canada by offering the malicious apps.The apps are exploiting a flaw in Android that dates to 2014, showing that many smart TVs do not have the latest patches."Most smart TVs today use older versions of Android, which still contain this flaw," wrote Ju Zhu, a mobile threats analyst with Trend. "While most mobile Android devices can easily be upgraded to the latest version, upgrading smart TV sets may be more challenging for users because they are limited by the hardware."To read this article in full or to leave a comment, please click here

Full Stack Journey Episode #1: Bart Smith

In this first-ever episode of the Full Stack Journey podcast, I talk with Bart Smith (old GitHub account migrating to new GitHub account, YouTube channel). Bart shares some details about his journey from being a Microsoft-centric infrastructure engineer to what he calls a cloud-native full-stack engineer. Here are some notes from our conversation, along with some additional resources Bart wanted to share with readers/listeners. Enjoy!

The podcast audio recording is available on Soundcloud.

Show Notes

  • His journey started in June 2014 as a result of the Microsoft announcement regarding support for Linux and Kubernetes on Azure—this really indicated a shift in the industry.
  • Bart’s view is that a full-stack engineer knows about operations, the hardware stack (compute, storage, network), the software (network, operating system [OS], management, logging), and most importantly knows how to “code” an immutable infrastructure. An operations full-stack engineer can read code, work with developers, and be part of a DevOps team of support DevOps teams in deploying code into production both to on-premises solutions and off-premises solutions.
  • IT folks don’t need to be strictly involved in software engineering to benefit from a journey toward a more full-stack role.
  • His journey from Microsoft-centric engineer to Continue reading

Microsoft, Google, Facebook to U.K.: Don’t weaken encryption

Microsoft, Google and Facebook are urging U.K. officials not to undermine encryption as they work on laws that would authorize forcing communications service providers to decrypt customer traffic.In a joint written submission to the U.K. Parliament the three U.S.-based companies lay down several areas of concern, which, if not addressed, they say could damage their businesses and leave them caught in legal crossfires among the many countries where they do business.To read this article in full or to leave a comment, please click here

How long will consumers put up with the IoT’s failures?

A recurring theme undercutting the enthusiasm surrounding the Internet of Things and smart home at CES this week has been how the shortcomings of the technology could hold back the market. How long will consumers put up with products that don't work, fail to connect to the network, or put their privacy at risk?A panel of IoT support experts speaking at CES today explained that, while some of the better-known products, like Google's Nest thermostat, are designed with easy setup and connectivity, many others fall short in important areas. Since consumers aren't always necessarily equipped to resolve these issues on their own, these concerns threaten to hold the IoT market back from reaching its lofty projections.To read this article in full or to leave a comment, please click here

Will the European Union’s new General Data Protection Regulation impact your business?  

This column is available in a weekly newsletter called IT Best Practices.  Click here to subscribe.   Does your company do business internationally, and especially with customers within the European Union (EU)? If so, then you need to pay attention to what's happening in the areas of data privacy and data sovereignty. Big changes are underway and they could have an impact on how you manage customer information. At the end of December, the European Commission (EC) approved the final version of the General Data Protection Regulation (GDPR). It's a massive overhaul of the EU's 1995 data protection rules (Directive 95/46/EC), which were quite out of date given the technology developments and globalization of the last two decades. The EC has been working on the GDPR since 2012 in order to strengthen online privacy rights and boost Europe's digital economy.To read this article in full or to leave a comment, please click here

Callous snow-plow-blade thieves violate first rule of security cameras

Not that much is expected of your garden-variety thieves, but stealing a 500-pound snow plow blade from a fire department in the dead of winter requires an elevated level of disregard for the wellbeing of your fellow citizens.Such a brazen theft in this era of ubiquitous surveillance also requires a surprisingly common breed of cluelessness, as the act violates the first rule of security cameras: They are everywhere.I note this particular case of reckless stupidity in part because the occupants of the pickup pictured above victimized the fire department and residents of North Attleboro, Mass., my hometown, when they attached the blade to their truck and drove off. Friends and former neighbors were put at risk.To read this article in full or to leave a comment, please click here

Drupal sites at risk due to insecure update mechanism

The update mechanism of the popular Drupal content management system is insecure in several ways, allowing attackers to trick administrators into installing malicious updates.Researcher Fernando Arnaboldi from security firm IOActive noticed that Drupal will not inform administrators that an update check has failed, for example due to inability to access the update server. Instead, the back-end panel will continue to report that the CMS is up to date, even if it's not.This can be a problem, considering that hackers are quick to exploit vulnerabilities in popular content management systems like Drupal, WordPress or Joomla, after they appear. In one case in 2014, users had only a seven-hour window to deploy a critical Drupal patch until attackers started exploiting the vulnerability that it fixed.To read this article in full or to leave a comment, please click here

My Experiences With Cisco’s VIRL

Since it has been out for more than a year, and has been developed and improved tremendously during that time, I decided to finally take the plunge and buy a year’s subscription to the Cisco VIRL software. Part 1: Comparing and Tweaking VIRL Until now, I have been using any combination of real hardware, CSR1000Vs, and IOL […]

The post My Experiences With Cisco’s VIRL appeared first on Packet Pushers.

My Experiences With Cisco’s VIRL

Since it has been out for more than a year, and has been developed and improved tremendously during that time, I decided to finally take the plunge and buy a year’s subscription to the Cisco VIRL software. Part 1: Comparing and Tweaking VIRL Until now, I have been using any combination of real hardware, CSR1000Vs, and IOL […]

The post My Experiences With Cisco’s VIRL appeared first on Packet Pushers.

Worth Reading: Broadband Investment in a Slump

Reports suggest that spending could continue to be tight among broadband carriers. Bloomberg, for instance, suggests that 2016 could be a more-of-the-same year after a slowdown of 8.1 percent in 2015. A good case in point is AT&T. Seeking Alpha reports that Evercore predicts that the carrier’s wireless investments this year may end up being 21 percent lower than in 2014. via it business edge

The post Worth Reading: Broadband Investment in a Slump appeared first on 'net work.

Continued support for MD5 endangers widely used cryptographic protocols

The old and insecure MD5 hashing function hasn't been used to sign SSL/TLS server certificates in many years, but continues to be used in other parts of encrypted communications protocols, including TLS, therefore weakening their security.Researchers from the INRIA institute in France have devised several attacks which prove that the continued support for MD5 in cryptographic protocols is much more dangerous than previously believed.They showed that man-in-the-middle attackers can impersonate clients to servers that use TLS client authentication and still support MD5 hashing for handshake transcripts. Intercepting and forwarding credentials through protocols that use a TLS channel binding mechanism is also possible.To read this article in full or to leave a comment, please click here

Does a data breach really affect your firm’s reputation?

The long-held view is that breached companies are cast aside by consumers, investors and shareholders. A breach isn’t just a temporary glitch – it’s a mistake, a faux pas, which you can’t just shake off.This warning that has been used by information security professionals over the course of the last five years and for good reason; nothing gets a CEO or CFO’s attention on security matters more than "this is losing us money".However, on closer inspection, it could be argued that this reputation argument is a falsehood.Over the course of the last 18 months, we’ve seen some of the biggest, most widespread, data breaches in the history of the Internet.To read this article in full or to leave a comment, please click here

Overcoming stubborn execs for security sake

Even with the greater awareness for strong security within organizations—and the high-profile hacks that have contributed to that increased awareness—security executives still encounter significant hurdles in doing their jobs to protect data and systems.Clashes with senior business executives as well as those at lower levels of organizations make it more challenging for CSOs and CISOs to create a secure environment, and yet they continue to happen.Many of the conflicts that occur between security and business executives are due to ongoing philosophical differences regarding risk, says Dave Dalva, vice president at Stroz Friedberg, who has worked in the position of CISO for a number of clients.To read this article in full or to leave a comment, please click here

1 … 3,046 3,047 3,048 3,049 3,050 … 3,694