The week in security: Apple patches iOS 0-day, new attack decrypts HTTPS

The Australian government has had a mixed bag of outcomes this year around cybersecurity, with many lauding its leadership in the area – which is helping CISOs tighten the screws on virtualisation-enabled DevOps staff – while others warned that government encouragement around threat-intelligence sharing needed to get some teeth as signs suggested billions spent on cybersecurity weren't really making us that much safer and that data security is still an unsolved problem.

Also not making us safer are Facebook, Google and Twitter, said some UK MPs, while others said businesses would get more benefits by tightening access privileges to restrict access to information – particularly for departing employees, many of whom have shown a predilection for taking company intellectual property as part of their severance package.

Yet even when they don't steal data, security staff are still keeping busy figuring out the best way to get new jobs. This tied in with ongoing warnings about managing deficiencies in the so-called human firewall, which were bolstered by warnings about 'Sweet32' attacks that can decrypt HTTPS sessions even without the encryption key.

That's likely to create new burdens for companies figuring out not only how to avoid being hacked, but what to do when they are. A Gartner security event brought warnings about the state of data security and the dizzying influx of issues created by a flood of smart devices. Cisco was patching its firewall devices against a flaw discovered in the recent NSA hack – highlighting the importance of choosing and managing vendors carefully.

There were warnings about ransomware disguised as voicemail notifications, while the New York Times said its Moscow bureau was hit with a cyberattack. A new Linux Trojan was found to be scanning content management systems as reconnaissance for building botnets, while some warned that hackers of the NSA had likely missed out on a massive financial windfall by leaking rather than selling the exploits they found.

Following in the vein of Tor, cybersecurity contractors debuted a new anonymising service called IDVector, creating a new headache for law-enforcement authorities – which, reports suggested, are already big fans of the same encryption technologies that are causing them so many problems in investigating crimes.

Meanwhile, US Republicans subpoenaed three tech firms that had declined to hand over information related to Hillary Clinton's private email server, while that country's government was under fire for plans to collect social-media information from visitors to the country. Even as security experts said the hack of an Epic Games forum was a reminder of the need to install security patches, while hackers leveraged a vulnerability in vBulletin software to break into 27 million more accounts.

And, in a small win on the good guys' side, security firm CrowdStrike became an official contributor to Google's Virus Total malware database. Apple moved quickly to patch iOS against a zero-day spyware attack, while Dropbox imposed a blanket password reset on users who signed up before mid-2012.

HP Enterprise suffered a confidence blow after the CIO of NASA refused to sign off on an authority for the company to continue operating the agency's systems after the expiration of a $US2.5b systems-security contract awarded in 2011.

There were warnings that application-layer DDoS attacks are on the rise, the discovery of an Android botnet that relies on Twitter for its instructions, and the revelation that hacked adultery site Ashley Madison had been misleading users by presenting a security award that was completely made up. Privacy bodies in Australia and Canada were unimpressed, to say the least.

Join the CSO newsletter!

Error: Please check your email address.

Tags hackersLinuxNASAtwitterUK MPstrojancyber securityFacebookAppleGartnerGoogleAustralian Government Cyber Security StrategyHTTPS

More about AppleCiscoCrowdStrikeDropboxEpic GamesFacebookGartnerGoogleHPLinuxNASANSATwitterVirus Total

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by David Braue

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place