Inside | Real news, curated by real humans
Inside Security

Inside Security (Feb 11th, 2019)

It is hard to believe, but today is issue #500 in my (probably inaccurate) accounting of this newsletter. I began this effort in mid-June 2016. My first issue had links to stories about spear phishing dissidents by Citizen Lab, pre-installed OEM malware on numerous Windows PCs, the perils of password reuse and hacking connected cars. Sometimes the past is always present with us.

I was one of the first editors hired by Inside -- now we have dozens of newsletters and if you haven’t looked at our offerings you might want to browse over to Inside.com and see if a couple of them resonate with you -- most of them are not about tech. One of them you should examine is Inside CTO. It is being curated by my well-known colleague Violet Blue and is off to a good start.

I want to thank Endgame for their sponsorship of this newsletter. This month I highlight this post on their blog that talks about hiring the best security personnel. One challenge is being able to understand your culture and not just hire someone, but keep them motivated and how they can continue to learn and meet new challenges. This is an important point that deserves mention, and the post covers some other success factors they have learned.

--David Strom

  • Email gray
  • Permalink gray

1. German antitrust regulators have issued restrictions on Facebook, saying they can’t gather data from third-party websites without each user’s explicit permission. Facebook is appealing the decision. -- NPR

  • Email gray
  • Permalink gray

3. Researchers have found new malware that can steal cryptocurrency funds surreptitiously by copying ewallet addresses from the OS clipboard. It leverages the browser-based MetaMask service. An Android version has been discovered and eliminated from the Google Play store. -- WE LIVE SECURITY (ESET)

  • Email gray
  • Permalink gray

4. The Matrix ransomware has been found and has a new twist. Instead of asking for a fixed ransom up front, it looks at samples of your data files and sets the price based on its perceived value. It is targeting specific enterprise users. -- SENTINEL ONE BLOG

  • Email gray
  • Permalink gray

5. Researchers have found phishing attacks targeting Facebook and Google using the automated Google Translate service. The attacker loads a phony landing page using the service, so victims see a legit Google URL which can help phishers bypass defenses. -- AKAMAI BLOG

  • Email gray
  • Permalink gray

6. The latest version of TLS, v.1.3, has a vulnerability to a new cryptographic attack. In this academic paper, researchers describe a variation on the classic Bleichenbacher attack using side-channel cache compromises. Most of the TLS implementations, including OpenSSL and Amazon’s s2n, will require updates.

7. The McDonalds smartphone app has been compromised so that hackers can order their own Happy Meals, paid by the victim’s funds. The company denies this is a security issue however. -- NAKED SECURITY (SOPHOS)

8. Russia is planning a massive exercise to completely disconnect from the Internet sometime this spring. This is to isolate the country from a potential cyber attack. All ISPs have to peer traffic through new government-approved peering points. -- ZDNET

9. One result of the GDPR is a better understanding of the Right to be Forgotten. Consumers have the ability to request all of their personal data be removed from requested websites. This post walks through the steps involved and sets the ruling in its historical context. -- VARONIS BLOG

10. This is a handy guide for SMB cybersecurity. It helps to understand your threat model, know the GDPR regulations, review your password and authentication policies, and other tips. -- PROTONMAIL BLOG

  • Email gray
  • Permalink gray

I am midway through reading Evan Ratliff’s book about Paul Le Roux entitled, The Mastermind: Drugs, Empire. Murder. Betrayal. The author, who has written extensively on this criminal for various websites, has followed Le Roux’s career from inventing the technology behind TrueCrypt to creating a massive online pharmacy that straddled the globe, build on top of his own domain registrar to hide his illegal activities. This article in Vice gives you a taste. It is a tale of a 21st century cartel that was largely the work of Le Roux and his aging laptop. What amazed me about his story is how hard Le Roux worked to stay just barely inside the law, until he got greedy and decided to go completely into contract killings and international drug-running.

  • Email gray
  • Permalink gray

This newsletter is written and curated by David Strom. I live in St. Louis MO and have covered the infosec industry for decades. I also ran editorial operations for various B2B IT publications including Network Computing (USA), Tom’s Hardware and ReadWrite.com’s business websites. You can find me at @dstrom or my personal site.

Finally, we note our editing team: Lon Harris (editor-in-chief at Inside.com, game-master at Screen Junkies) and Susmita Baral (editor at Inside, recent bylines in NatGeo, Teen Vogue, and Quartz. Runs the biggest mac and cheese account on Instagram).

  • Email gray
  • Permalink gray

Many thanks to Inside Security's corporate supporters.  Please go check them out!

Endgame

Endgame's endpoint security platform protects the world’s largest organizations from targeted attacks, eliminating the time & cost associated with incident response. Learn more

 

Nok Nok Labs has the ambition to transform authentication, by unifying it into one standard protocol, giving business the control they need. Learn more

 

Find out why Global Leaders are trusting HackerOne to test and secure their mission-critical applications

 

 

 

[YOUR LOGO HERE – click for details]

Subscribe to Inside Security