The dark web knows too much about me

We asked cybersecurity experts to scour the dark web for our personal information. What they found was disturbing.

What do Dunkin’ Donuts, Fortnite, Sprint and the Dow Jones company all have in common? They’ve all suffered from massive hacks in 2019 alone.

After every data breach, victim data often surfaces on the encrypted “hidden” internet known as the dark web, a network of sites that can only be accessed with special security software. Dark web markets operate like the ecommerce websites we shop on every day, but often trade in illicit goods like drugs, weapons and stolen data.

Complete article on cnet.com

A Year Later, Cybercrime Groups Still Rampant on Facebook

Almost exactly one year ago, KrebsOnSecurity reported that a mere two hours of searching revealed more than 100 Facebook groups with some 300,000 members openly advertising services to support all types of cybercrime, including spam, credit card fraud and identity theft. Facebook responded by deleting those groups. Last week, a similar analysis led to the takedown of 74 cybercrime groups operating openly on Facebook with more than 385,000 members.

Complete article on krebsonsecurity.com

How Call Centers are the Weakest Links in Authentication Chain

As companies increase their cybersecurity defenses, fraudsters are now targeting call centers with easily obtained and plentiful personally identifying information and they are sharing it too.

A report from TRUSTID confirms that call center professionals are being inundated with social engineering attempts from fraudsters looking to takeover customer accounts.

The results spotlighted six insights…

Complete article on securitymagazine.com

How Walmart Uses a Purple Team to Improve Cyber-Resilience

Few if any, organizations on the planet operate at the size and scale of Walmart. Scale isn’t just about normal retail operations either; it also comes in play with how the organization handles its own security resiliency testing.

In a session at the RSA Conference here, Jason O’Dell, director of incident response and hunt at Walmart, explained how the world’s largest retailer uses an innovative approach known as purple teaming at scale to improve security and reduce risk.

Complete article on eweek.com

The Windows 10 security guide: How to safeguard your business

How do you configure Windows 10 PCs to avoid common security problems? There’s no software magic bullet, unfortunately, and the tools are different for small businesses and enterprises. Here’s what to watch out for.

It is tempting to think that the process of securing a Windows 10 device can be reduced to a simple checklist. Install some security software, adjust a few settings, hold a training session or two, and you can move on to the next item on your to-do list.

Alas, the real world is far more complicated than that.

Complete article on zdnet.com

Who needs malware? IBM says most hackers just PowerShell through boxes now, leaving little in the way of footprints

A company’s internal network, once compromised, is now more likely to be ransacked by automated scripts than a piece of malware.

This according to researchers with IBM’s X-Force, who found that in 2018 just 43 per cent of the attacks it analyzed utilized any sort of locally installed files. Rather, the hackers utilized PowerShell scripts to execute their dirty deeds in memory without significantly touching file systems, if at all.

Complete article on theregister.co.uk

DISA digs into blockchain as a service

The Defense Information Systems Agency is paying close attention to the cloud-based blockchain offerings introduced by Amazon Web Services, Microsoft and IBM as it explores how to incorporate the technology into the infrastructure used by the Defense Department.

“We are looking at potentially offering something that would be secure, scalable and agile for the networks that our mission partners could create and manage on our infrastructure inside accredited DOD environments,” Sherri Sokol, innovation leader at DISA, told GCN. “It would really just be the platform, infrastructure resource management and monitoring, which are services that DISA already offers.”

Complete article on threatpost.com

The APT Name Game: How Grim Threat Actors Get Goofy Monikers

How do advanced persistent threat groups such as Darkhotel and Anchor Panda get their ridiculous names?

What’s in a name? When it comes to advanced persistent threat groups, it is often quite a bit.

While their monikers’ may seem whimsical – Fancy Bear, Nomadic Octopus, Ocean Lotus and Darkhotel – the reality is these are not arbitrary names. In fact, many are similar to schoolyard nicknames or a type of shorthand – tied to the attributes of the mysterious groups behind cyberattacks.

Complete article on threatpost.com

Americans want to regulate AI but don’t trust anyone to do it

In 2018, several high-profile controversies involving AI served as a wake-up call for technologists, policymakers, and the public. The technology may have brought us welcome advances in many fields, but it can also fail catastrophically when built shoddily or applied carelessly.

It’s hardly a surprise, then, that Americans have mixed support for the continued development of AI and overwhelmingly agree that it should be regulated, according to a new study from the Center for the Governance of AI and Oxford University’s Future of Humanity Institute.

Complete article on threatpost.com

‘Unprecedented’ DNS Hijacking Attacks Linked to Iran

The attacks, targeting several countries to redirect traffic and harvest credentials, have been linked to Iran.

A wave of DNS hijacking attacks targeting victims in North America, Europe, Middle East and North Africa have been linked to Iran. The attacks, which have been ongoing over the past two years, have had “a high degree of success” harvesting targets’ credentials, according to researchers.

Researchers at FireEye said that the attacks were launched mainly against government, telecom and internet infrastructure firms. Attacks involved intercepting traffic from firms with the goal of harvesting victims’ usernames, passwords and domain credentials.

Complete article on threatpost.com