TrustedSec Security Podcast Episode 43 for April 28, 2016. This podcast is hosted by Rick Hayes, Scott White, Geoff Walton and Ben Ten.
Visit the show notes page to download the Podcast or check us out on iTunes
Download Page https://www.trustedsec.com/podcasts/trustedsec-security-podcast-episode-43.mp3
XML Page https://www.trustedsec.com/podcasts/trustedsecsecuritypodcast.xml
Announcements:
TrustedSec TV
https://www.youtube.com/channel/UCRkiASOIDfCDJeB9xkJoMRg
CactusCon
When: May 6-7, 2016
Where: Phoenix, AZ
http://www.cactuscon.com
Charlotte ISSA Annual Summit
When: May 19, 2016
Where: Charlotte, NC
https://www.charlotteissa.org
BSidesSATX
When: May 21, 2016
Where: San Antonio, TX
http://www.securitybsides.com/w/page/62049224/BSidesSATX
BSides Boston
When: May 20-21, 2016
Where: Boston, MA
http://www.bsidesboston.org
BSidesPGH
When: June 10, 2016
Where: Pittsburgh, PA
https://bsidespgh.com/2016
ShowmeCon
When: June 13-14, 2016
Where: St. Louis, MO
http://showmecon.com
BSidesCLE
When: June 24-25, 2016
Where: Cleveland, OH
https://bsidescle.com
Converge
When: July 14-15, 2016
Where: Detroit, MI
http://convergeconference.org/main
Hackers on Planet Earth (HOPE) XI
When: July 22- 24, 2016
Where: New York, NY
http://x.hope.net
Shoutouts:
Boomer, Mad and Alex for their hard work and determination.
Stories:
Source: http://www.pymnts.com/fraud-prevention/2016/online-fraud-attack-rates-soar-since-october/
Since the cutover to EMV in October, fraudsters have moved their business online. According to PYMNTS there were 27 attacks for every 1,000 transactions conducted in 2015 Q4. That’s 11 percent more than were reported in 2015 Q3, and a 215 percent increase from 2015 Q1.
The attack rate more than quadrupled for digital goods, and nearly doubled for luxury goods, between Q4 of 2015 and Q1 of 2016.
$4.79 out of every $100 of sales are at risk, up $2.90 (150%) out of $100 from 2015 Q1.
Source: https://www.landaire.net/blog/apple-imageio-denial-of-service/
Application Services is a framework in iOS and OS X which provides what’s known as the Image I/O framework. ImageIO itself is a collection of utilities and data types for parsing various image formats.
Source: http://www.independent.co.uk/life-style/gadgets-and-tech/news/apple-id-password-expired-expiry-text-website-scam-phishing-a6991126.html
Apple users are receiving phishing messages designed to trick them into handing over their Apple ID passwords and other pieces of personal information.
People hit by the scam usually receive an unsolicited message which claims to come from Apple, urging them to immediately change their Apple ID password before it expires.
Source: http://www.computerworld.com/article/3060140/security/cisco-fixes-serious-denial-of-service-flaws.html
Cisco Systems has released patches to fix serious denial-of-service flaws in its Wireless LAN Controller (WLC) software, Cisco Adaptive Security Appliance (ASA) software and the Secure Real-Time Transport Protocol (SRTP) library that’s used in many products.
Source: http://www.scmagazine.com/husband-and-wife-plead-guilty-in-irs-breach-that-compromised-700k-accounts/article/492035/
A husband and wife Friday pleaded guilty in a Georgia district court for their roles in the May 2015 IRS “Get Transcript” breach that compromised nearly 700,000 taxpayer accounts.
Anthony Alika, 42, pleaded guilty to one count of conspiracy to commit money laundering while his wife Sonia Alika, 27, pleaded guilty to one count of illegally structuring cash withdrawals to evade bank reporting requirements, according to a Department of Justice (DoJ) press release.
Source: http://arstechnica.com/security/2016/04/billion-dollar-bangladesh-hack-swift-software-hacked-no-firewalls-10-switches
The Bangladesh central bank had no firewall and was using a second-hand $10 network when it was hacked earlier this year. Investigation by British defense contractor BAE Systems has also shown that the SWIFT software used to make payments was compromised, enabling the hackers to send money around the world without leaving any trace in Bangladesh.
Source: http://www.cnet.com/news/facebook-hacker-finds-another-intruder-beat-him
A security researcher looking for flaws in Facebook’s internal network has found traces of at least one other intruder who got into the system first.
The hacker, or hackers, had access to Facebook’s internal system for several months and got access to hundreds of employee usernames and passwords, researcher Orange Tsai of Taiwan said in a blog post last week. After Tsai had hacked his way into the vulnerable server, he found scripts setup by another hacker or hackers designed to scoop up login details of employees.
Source: http://www.scmagazine.com/mit-launches-bug-bounty-program/article/491878
One of the nation’s top tech schools, The Massachusetts Institute of Technology (MIT) launched a bug bounty program last week that it termed “experimental.”
Source: http://www.nytimes.com/2016/04/25/us/politics/us-directs-cyberweapons-at-isis-for-first-time.html
The United States has opened a new line of combat against the Islamic State, directing the military’s six-year-old Cyber Command for the first time to mount computer-network attacks that are now being used alongside more traditional weapons.
The effort reflects President Obama’s desire to bring many of the secret American cyberweapons that have been aimed elsewhere, notably at Iran, into the fight against the Islamic State — which has proved effective in using modern communications and encryption to recruit and carry out operations.
Source: http://www.nextgov.com/cybersecurity/2016/04/fbi-official-recovering-cyber-attack-who-isnt-so-important/127697
Members of the FBI’s investigative team is less concerned with the perpetrator’s identity than they are in blocking the intrusion, according to one FBI official.
“We don’t have to have attribution completely figured out to take action,” said Donald Freese, director of the FBI’s National Cyber Investigative Joint Task Force, during Akamai’s Government Forum in Washington on Thursday. “We’ve gotten much smarter about that.” Freese said his team focuses primarily on two categories of perpetrators: nation-states and criminals.
Source: http://www.informationsecuritybuzz.com/study/verizons-2016-data-breach-investigations-report-finds-cybercriminals-exploiting-human-nature/
The Verizon 2016 Data Breach Investigations Report. This year’s report points to repeating themes from prior-year findings and storylines that continue to play off of human frailty, including:
Eighty-nine (89) percent of all attacks involve financial or espionage motivations
Most attacks exploit known vulnerabilities that have never been patched despite patches being available for months, or even years. In fact, the top 10 known vulnerabilities accounted for 85 percent of successful exploits.
Sixty-three (63) percent of confirmed data breaches involve using weak, default or stolen passwords
95 percent of breaches and 86 percent of security incidents fall into nine patterns
Ransomware attacks are on the rise, increased by XX percent over 2015
Basic defenses continue to be sorely lacking in many organizations
Source: http://motherboard.vice.com/read/another-day-another-hack-7-million-emails-and-hashed-passwords-for-minecraft
Over seven million user accounts belonging to members of Minecraft community “Lifeboat” have been hacked, according to security researcher Troy Hunt.
Hunt said he will upload the data to his breach notification website “Have I Been Pwned?”, which allows people to check if their account is compromised, on Tuesday, and that it includes email addresses and weakly hashed passwords—meaning that hackers could likely obtain full passwords from some of the data.
Source: http://www.christianpost.com/news/hillary-clinton-porn-cyber-attack-bernie-sanders-facebook-162780/
Just before five Democratic Primary elections in five states, candidate Facebook groups supporting Bernie Sanders were taken down from the social media network as those pages were flooded with pornographic images in what appears to be a cyber attack, for which his rival Hillary Clinton’s supporters were blamed.
The Facebook pages, some with more than 100,000 members, were abruptly removed for a few hours before they managed to recover their accounts early Tuesday, the day primaries were held in Connecticut, Rhode Island, Delaware, Pennsylvania, and Maryland.
Source: http://www.darkreading.com/endpoint/pci-dss-32-3-things-you-need-to-know-/d/d-id/1325292?_mc=RSS_DR_EDT
The PCI Security Standards Council has outlined the main requirements for the PCI DSS 3.2 upgrade and as always, there’s plenty of time for businesses to prepare for the changes.
The post TrustedSec Security Podcast Episode 43 – Fraud Report, ImageIO, Apple Phish, Cisco DoS, Get Transcript, SWIFT, MIT Big Bounty, ISIS Attacks, Attribution, 2016 BDIR.Lifeboat, Political Porn, PCI 3.2 appeared first on TrustedSec - Information Security.