Latest

Breach Response

Yahoo's Mega-Breaches: Altaba Moves to Settle Lawsuits

Mathew J. Schwartz  •  September 18, 2018

Lawsuits sparked by massive data breaches at Yahoo - and the company's failure to report those breaches to investors in a timely manner - could soon be resolved. Plaintiffs and defendants say they have committed to a $47 million deal that they expect to submit for court approval within 45 days.

Cybercrime

Why Cybercrime Remains Impossible to Eradicate

Mathew J. Schwartz  •  September 18, 2018

More evidence that running cybercrime schemes remains inexpensive and accessible to anyone with criminal intent: To send spam emails, admitted botnet herder Peter Levashov quoted customers $500 for 1 million emails. And that was just his 2016 pricing.

Cybercrime

Police in Europe Tie Card Fraud to People-Smuggling Gang

Mathew J. Schwartz  •  September 17, 2018

Coordinated police raids in Germany and Sweden have resulted in the arrest of two Syrian nationals suspected of running a cyber fraud operation that purchased stolen card data to book hundreds of airline and train tickets to help smuggle people from the Middle East into Europe.

Endpoint Security

Wielding EternalBlue, Hackers Hit Major US Business

Jeremy Kirk  •  September 17, 2018

Attack code known as EternalBlue, designed to exploit a Windows SMB flaw, continues to work for attackers despite Microsoft having issued patches more than a year ago. One major U.S. business was a recent victim as part of a cryptocurrency-mining malware campaign, a researcher reports.

Encryption & Key Management

Intel Patches Firmware Flaw That Leaks ME Encryption Keys

Jeremy Kirk  •  September 14, 2018

Intel has had a challenging time lately on the vulnerability front. It has issued yet another patch for its Management Engine after a researcher was able to extract two types of encryption keys. The problem was a repeat of one that Intel patched just last year.

Breach Response

Europe Catches GDPR Breach Notification Fever

Mathew J. Schwartz  •  September 14, 2018

Less than four months after GDPR enforcement began, Europe has arguably entered the modern data breach notification era. Reports of data breaches continue to increase, and breached organizations now face the specter of class-action lawsuits over material as well as non-material damages.

Breach Response

Equifax Breach: Key Lessons Learned

Nick Holland  •  September 14, 2018

The latest edition of the ISMG Security Report features an analysis of a new Government Accountability Office report on the causes of last year's massive Equifax breach. Also: An update on the role of tokenization in protecting payments.

Cybercrime

Romanian Hacker 'Guccifer' to Be Extradited to US

Mathew J. Schwartz  •  September 13, 2018

A Romanian court has ruled that the notorious hacker "Guccifer," who discovered the existence of Hillary's Clinton's private email server, will be extradited to the U.S. to serve a 52-month prison sentence after he finishes serving a seven-year sentence in his home country.

Cybercrime as-a-service

Russian Pleads Guilty to Operating Kelihos Botnet

Mathew J. Schwartz  •  September 13, 2018

Russian national Peter Levashov, who was arrested in Spain last year and extradited to the U.S., has admitted to a two-decade crime spree that included running multiple botnets that harvested online credentials while also pumping out spam, banking Trojans and ransomware.

General Data Protection Regulation (GDPR)

Fresh GDPR Complaints Take Aim at Targeted Advertising

Jeremy Kirk  •  September 13, 2018

A web browser startup, Brave, has filed complaints in Europe alleging Google and other behavioral advertising companies are violating Europe's GDPR. Brave's complaints could set up one of the biggest battles so far over how personal data gets used - or abused - for targeted advertising.

►

Authentication

The Role of Password Management

Tom Field  •  September 13, 2018

Password management is a critical component of a security strategy that some organizations still find challenging, says Gerald Beuchelt of LogMeIn Inc.

General Data Protection Regulation (GDPR)

Google and EU Fight France Over 'Right to Be Forgotten'

Mathew J. Schwartz  •  September 12, 2018

Should Europe's "right to be forgotten" apply worldwide? That's the focus of a case before the EU's highest court, which has pitted proponents - including Austria and France - against Google, Microsoft and the European Commission, who argue that the EU law provision should only apply in Europe.