Security

Spectre – the security vulnerabilities in modern CPUs' speculative execution engines that can be exploited to steal sensitive data – just won't quietly die in the IT world.

Its unwelcome persistence isn't merely a consequence of the long lead time required to implement mitigations in chip architecture; it's also sustained by its ability to inspire novel attack techniques.

The latest of these appeared in a paper presented at the Network and Distributed Systems Security (NDSS) Symposium 2019 in San Diego, California, on Monday.

Many popular PDF viewers and online validation services contain vulnerabilities that can be exploited to make unauthorized changes to signed PDF documents without invalidating their signature, researchers have warned.

A team of researchers from the Ruhr-University Bochum in Germany has analyzed 22 desktop applications (including their Windows, Linux and macOS versions) and 7 online validation services.

Three days --that's the time it took hackers to start launching attacks against Drupal sites using an exploit for a security flaw the CMS project patched last week.

The attacks, detected by web firewall firm Imperva, tried to take advantage of yet-to-be-patched Drupal sites and plant a JavaScript cryptocurrency miner called CoinIMP on vulnerable sites.

With endpoint attacks on the rise, and the risk and cost of a data breach steadily increasing, protecting enterprise networks has become an urgent priority. And, it seems that no one is immune: in a recent survey of global companies, 93 percent experienced a cyberattack in the last year. For one-third of those companies, attacks were a weekly occurrence.

It's more important than ever to manage your passwords online, and also harder to keep up with them. That's a bad combination. So the FIDO Alliance—a consortium that develops open source authentication standards—has pushed to expand its secure login protocols to make seamless logins a reality. Now Android's on board, which means 1 billion devices can say goodbye to passwords in more digital services than seen before.

Browser extensions, like any other piece of software, can be abused or manipulated by hackers for malicious purposes. Duo Security wants to make it harder for that to happen.

The company on Thursday released a beta version of a tool, CRXcavator, that screens extensions for Google Chrome, the world’s most popular web browser, for malicious code. “As our portal to the internet, browsers represent what is likely the largest common attack surface across consumers and businesses alike,” the Cisco-owned company said in a blog post.

L33tdawg: I just reached out to Pravin Madhani to see if K2 would be willing to bring their tech to be tested in public at HITBSecConf. Would be interesting :)

Silicon Valley based K2 Cyber Security has emerged from stealth mode with a technology that prevents zero-day attacks by monitoring app performance in the cloud.

K2 is able to create an execution map for each application and is able to stop it if it is hijacked by malware.

China largely abandoned a hacking truce negotiated by Barack Obama as President Donald Trump embarked on a trade war with Beijing last year, according to the cybersecurity firm Crowdstrike Inc.

A slowdown in Chinese hacking following the cybersecurity agreement Obama’s administration secured in 2015 appears to have been reversed, the firm said in a report released Tuesday that reviewed cyber activity by U.S. adversaries in 2018.

A piece of malware targeting automated teller machines (ATMs) has an interface that looks like a slot machine, Kaspersky Lab reports.

Dubbed WinPot, the malware was initially detected in March last year, targeting the ATMs of a popular vendor to make the devices automatically dispense all cash from their most valuable cassettes.

Maritime transport still contributes in an important way to the world’s economy, with on-time shipments influencing everything from commodities availability and spot pricing to the stability of small countries. Unfortunately, capsizing a ship with a cyberattack is a relatively low-skill enterprise, according to an analysis from Pen Test Partners.

With so many previously outlined ways to infiltrate networks on-board shipping vessels (think satcom hacking, phishing, USB attacks, insecure crew Wi-Fi, etc.), the question becomes, what could an adversary do with that access?