May 13

New/Trends

• How Can Your Business Defend Itself Against Fraud-as-a-Service?

• Known macOS Vulnerabilities Led Researcher to Root Out New Flaws

• 5 Years That Altered the Ransomware Landscape

• Quarter of Security Pros Say Mental Health Has Worsened

• Five Eyes Nations Issue New Supply Chain Security Advisory

• Multi-Factor Authentication: A Key to Cyber Risk Insurance Coverage

• CIS Control 18 Penetration Testing

• Europe puts Apple’s CSAM plans back in the spotlight

Law/Policy

• DEA Investigating Breach of Law Enforcement Data Portal

• Corporate Involvement in International Cybersecurity Treaties

• Office of the National Cyber Director Announces Senior Leadership

• Oversight and control will hamper America’s cybersecurity

Technical

• Operations Smart Contract to Realize Decentralized System Operations Workflow for Consortium Blockchain

• DNS based In-Browser Cryptojacking Detection

• Automorphism Shuffles for Graphs and Hypergraphs and Its Applications

• Secure Distributed/Federated Learning: Prediction-Privacy Trade-Off for Multi-Agent System

Reports, Blogs, Podcasts

• ICE Is a Domestic Surveillance Agency

• Apple Mail Now Blocks Email Trackers

• 15.3 Million Request-Per-Second DDoS Attack

• New Sophisticated Malware

• Smashing Security podcast #274: Hands off my biometrics, and a wormhole squirmish

• Keeper Connection Manager: Privileged access to remote infrastructure with zero-trust and zero-knowledge security

• US college set to permanently close after 157 years, following ransomware attack

• GUEST ESSAY: Rising global tensions put us a few lines of code away from a significant cyber event

May 6

News/Trends

• Researchers Warn of ‘Raspberry Robin’ Malware Spreading via External Drives

• Hackers Using PrivateLoader PPI Service to Distribute New NetDooka Malware

• Experts Uncover New Espionage Attacks by Chinese ‘Mustang Panda’ Hackers

• Ukrainians DDoS Russian Vodka Supply Chains

• Microsoft, Apple and Google Team Up on Passwordless Standard

• Hunter Biden Laptop Repairman Sues Over Hacker Allegations

• Google responds to EU data rulings with new Workspace controls

• On Password Day, a Chilling Observation

Law/Policy

• National Security Memorandum on Promoting United States Leadership in Quantum Computing While Mitigating Risks to Vulnerable Cryptographic Systems

• Ransomware researchers are being targeted by the criminals they track

• Pipeline Security: Biden Administration Begins Promulgating Rules to Protect Critical U.S. Infrastructure from Cyberattacks

• Sen. Gary Peters is overseeing a boom in cyber bills

Technical

• Zero Day Threat Detection Using Graph and Flow Based Security Telemetry

• Secure Decentralized Online Gaming with Lending Functionalities

• Optimal Algorithms for Mean Estimation under Local Differential Privacy

• Unmanned Aerial Vehicles Meet Reflective Intelligent Surfaces to Improve Coverage and Secrecy

Reports, Blogs, Podcasts

• Smashing Security podcast #273: Password blips, and who’s calling the airport?

• Keeper Connection Manager : Privileged access to remote infrastructure with zero-trust and zero-knowledge security

• Russia to Rent Tech-Savvy Prisoners to Corporate IT?

• Fighting Fake EDRs With ‘Credit Ratings’ for Police

• Corporate Involvement in International Cybersecurity Treaties

• 15.3 Million Request-Per-Second DDoS Attack

• New Sophisticated Malware

• Using Pupil Reflection in Smartphone Camera Selfies

April 28

News/Trends

• Explainable AI for Fraud Prevention

• A Peek into Visa’s AI Tools Against Fraud

• Doppler Takes on Secrets Management

• Global Security Spending Set to Hit $198bn by 2025

• Cyber Skills Gap Linked to Breaches

• Jamf adds network and endpoint security tools for enterprise Macs

• In a remote-work world, a zero-trust revolution is necessary

• 12 Android settings that’ll strengthen your security

• Phishing goes KISS: Don’t let plain and simple messages catch you out!

Law/Policy

• U.S. Senate Unanimously Passes Cybersecurity Legislation Requiring 72 Hour Cyber Incident Notification

• Fact Sheet: DHS International Cybersecurity Efforts

• FACT SHEET: United States and 60 Global Partners Launch Declaration for the Future of the Internet

• GAO Promotes Need for Public-Private ‘Partnerships’ in Cybersecurity Policy

Technical

• A Mask-Based Adversarial Defense Scheme

• Real or Virtual: A Video Conferencing Background Manipulation-Detection System

• When adversarial examples are excusable

• Source-independent quantum random number generator against detector blinding attacks

Reports, Blogs, Podcasts

• Block over two billion known breached passwords from your AD with Specops Password Policy tools

• REvil reborn? Notorious gang’s dark web site redirects to new ransomware operation

• Smashing Security podcast #271: Crypto break-in, Google blurring, and mics not muting

• Java Cryptography Implementation Mistake Allows Digital-Signature Forgeries

• Leaked Chats Show LAPSUS$ Stole T-Mobile Source Code

• News & Analysis: NO. 328

• Removing ^M Characters

• Google’s New Safety Section Shows What Data Android Apps Collect About Users

April 22

News/Trends

• FBI Warns US Farmers of Ransomware Surge

• State Actors Drive Record Number of Zero-Day Exploits in 2021

• Wawa wants a refund, says Mastercard owes $32 million for data breach penalties

• Has a security researcher been scared away?

• When it comes to data, resist your inner packrat

• In a remote-work world, a zero-trust revolution is necessary

• 12 Android settings that’ll strengthen your security

• California eyes law to protect workers from digital surveillance

Law/Policy

• Apple, Meta turned over user data to hackers using forged requests: report

• House sends bipartisan cyber crime bill to Biden

• More than $600M in cryptocurrency stolen in video game hack

• New law in reporting cyber breaches seen as overdue first step

Technical

• ARLIF-IDS — Attention augmented Real-Time Isolation Forest Intrusion Detection System

• Can Voters Detect Errors on Their Printed Ballots? Absolutely

• A Revealing Large-Scale Evaluation of Unsupervised Anomaly Detection Algorithms

• Block Hunter: Federated Learning for Cyber Threat Hunting in Blockchain-based IIoT Networks

Reports, Blogs, Podcasts

• REvil reborn? Notorious gang’s dark web site redirects to new ransomware operation

• Free Yanlouwang decryptor released, after flaw found in ransomware code

• Smashing Security podcast #271: Crypto break-in, Google blurring, and mics not muting

• Java Cryptography Implementation Mistake Allows Digital-Signature Forgeries

• Clever Cryptocurrency Theft

• Undetectable Backdoors in Machine-Learning Models

• Bitdefender Enhances Premium VPN Service With New Privacy Protection Technologies

• Forescout Enhances Continuum Platform With New OT Capabilities

• Researcher Releases PoC for Recent Java Cryptographic Vulnerability

April 8

News/Trends

• Firefox 99 is out – no major bugs, but update anyway!

• Google’s monthly Android updates patch numerous “get root” holes

• LAPSUS$ hacks continue despite two hacker suspects in court

• Apple quietly stops meaningful auto-updates in iOS

• Android 12 Upgrade Report Card: What a weird year

• Five ransomware groups, five victims… will it ever ease up?

• YouTube Fraudsters Steal $1.7m in Crypto ‘Giveaway’

• Global Supply Chain Attacks Surge 51% in H2 2021

Law/Policy

• State Department Launches New Cybersecurity Bureau

• Apple, Meta turned over user data to hackers using forged requests: report

• House sends bipartisan cyber crime bill to Biden

• New law in reporting cyber breaches seen as overdue first step

Technical

• Do They Accept or Resist Cybersecurity Measures? Development and Validation of the 13-Item Security Attitude Inventory (SA-13)

• Transformer-Based Language Models for Software Vulnerability Detection: Performance, Model’s Security and Platforms

• What You See is What You Get: Distributional Generalization for Algorithm Design in Deep Learning

• Machine Learning-Enabled IoT Security: Open Issues and Challenges Under Advanced Persistent Threats

Reports, Bogs, Podcasts

• Smashing Security podcast #269: Trezor Deep Throat, a CCTV stalker, and Amazon’s list of banned words

• Companies are more prepared to pay ransoms than ever before, reveals new report

• Control IT and SaaS complexity with Axonius

• AirTags Are Used for Stalking Far More than Previously Reported

• US Disrupts Russian Botnet

• News & Analysis | NO. 325

• The Original APT: Advanced Persistent Teenagers

• Microsoft Obtains Court Order to Take Down Domains Used to Target Ukraine

• New Octo Banking Trojan Spreading via Fake Apps on Google Play Store

April 1

News/Trends

• Some sigh-ber jokes for April Fool’s Day

• Spring Fixes Zero-Day Vulnerability in Framework and Spring Boot

• Companies Going to Greater Lengths to Hire Cybersecurity Staff

• Over Half of Data Security Incidents Caused by Insiders

• How to stop worrying and love zero trust

• How Russia’s invasion of Ukraine affected the cyber threat landscape

• On browsers and bugs

• Apple pushes out two emergency 0-day updates – get ’em now!

Law/Policy

• House sends bipartisan cyber crime bill to Biden

• New law in reporting cyber breaches seen as overdue first step

• US officials say Russia behind hack of Ukrainian satellite communications at invasion start: report

• Russia accuses US of leading massive cyber campaign

Technical

• Multi-platform Process Flow Models and Algorithms for Extraction and Documentation of Digital Forensic Evidence from Mobile Devices

• Verifiable Access Control for Augmented Reality Localization and Mapping

• Email Summarization to Assist Users in Phishing Identification

• Supporting tangible multi-factor key exchange in households

Reports/Blogs/Podcasts

• Smashing Security podcast #268: LinkedIn deepfakes, doxxing Russian spies, and a false alarm

• Forcepoint ONE helps firms simplify their security

• Fake Emergency Search Warrants Draw Scrutiny from Capitol Hill

• Hackers Gaining Power of Subpoena Via Fake “Emergency Data Requests”

• Chrome Zero-Day from North Korea

• Stalking with an Apple Watch

• A Detailed Look at the Conti Ransomware Gang

• Russian Wiper Malware Responsible for Recent Cyberattack on Viasat KA-SAT Modems

March 25

News/Trends

• Serious Security: DEADBOLT – the ransomware that goes straight for your backups

• U.S. Charges 4 Russian Govt. Employees Over Hacking Critical Infrastructure Worldwide

• Experts Uncover Campaign Stealing Cryptocurrency from Android and iPhone Users

• North Korean Hackers Exploited Chrome Zero-Day to Target Fintech, IT, and Media Firms

• Major League Baseball Players’ Personal Data Stolen

• Utah Becomes Latest US State to Pass a Data Privacy Law

• Four Russians Charged with Dragonfly Attacks on Critical Infrastructure

Law/Policy

• White House Warns of Possible Russian Cyberattacks

• DOJ charges former Russian government employees for hacking energy sectors

• Hillicon Valley — FBI warns of possible Russian cyberattacks

• Sensitive health data of 50 million Americans hacked or breached last year: analysis

Technical

• A Reinforcement Approach for Detecting P2P Botnet Communities in Dynamic Communication Graphs

• Secure Multi-Party Delegated Authorisation For Access and Sharing of Electronic Health Records

• Steganalysis of Image with Adaptively Parametric Activation

• MERLIN — Malware Evasion with Reinforcement LearnINg

Reports, Blogs, Podcasts

• Smashing Security podcast #267: Virtual kidnapping, two helipads, and a naughty Apple employee

• Simplify your security with Forcepoint ONE

• AvosLocker ransomware – what you need to know

• Linux Improves Its Random Number Generator

• NASA’s Insider Threat Program

• Developer Sabotages Open-Source Software Package

• A Closer Look at the LAPSUS$ Data Extortion Group

• Pro-Ukraine ‘Protestware’ Pushes Antiwar Ads, Geo-Targeted Malware

March 17

News/Trends

• Glasswall Launches Freemium Version of its Desktop Content Disarm and Reconstruction App

• Stopping Russian Cyberattacks at Their Source

• Cut Down on Alert Overload and Leverage Layered Security Measures

• Popular NPM Package Updated to Wipe Russia, Belarus Systems to Protest Ukraine Invasion

• The Golden Hour of Incident Response

• As tax deadlines approach, Emotet malware disguises itself in an IRS email

• To Governance and Beyond: Cybersecurity as a Journey

• Beware bogus Betas – cryptocoin scammers abuse Apple’s TestFlight system

Law/Policy

• Russian ministry says it’s ‘recording unprecedented attacks’ on government websites

• Ukraine claims to have arrested ‘hacker’ helping Russians

• Intel chair ‘amazed’ Russia hasn’t launched full-scale cyberwarfare 

• Bipartisan group of senators press Mayorkas on US readiness for Russian cyberthreat

Technical

• Energy-Latency Attacks via Sponge Poisoning

• A Personal Computer for a Distrustful World

• On the Use of Fine-grained Vulnerable Code Statements for Software Vulnerability Assessment Models

• A Language-Independent Analysis Platform for Source Code

Reports, Blogs, Podcasts

• Deepfake President Zelensky calls on Ukraine to surrender, as TV station hacked

• Smashing Security podcast #266: Dick pics, secret spies, and Kaspersky

• Police arrest scammer on FBI’s “Most Wanted” list in relation to $100 million fraud

• “Change Password”

• Breaking RSA through Insufficiently Random Primes

• US Critical Infrastructure Companies Will Have to Report When They Are Hacked

• Lawmakers Probe Early Release of Top RU Cybercrook

• Internet Backbone Giant Lumen Shuns .RU

March 3

News/ Trends

• How to Stimulate Organizations’ Security Awareness Training Programs

• How Retailers Can Address ‘Buy Now, Pay Later’ Fraud

• 7 Ways to Secure Collaboration Tools in Your Organization

• Researchers Demonstrate New Side-Channel Attack on Homomorphic Encryption

• #CCSE22: The Latest Cybersecurity Workforce Trends

• Russia Denies Satellite Hacking and Warns of Wider War

• Breach Notification: Poor Transparency Complicates Response

• Preparing for Cyberattacks and Limiting Liability

Law/Policy

• US legislation brings mandatory cyberattack and ransomware reporting one step closer

• Senate passes cybersecurity bill amid fears of Russian cyberattacks

• Cyber officials urge agencies to armor up for potential Russian attacks

• Hillicon Valley — Presented by Ericsson — Facebook removes Russian misinformation campaign

Technical

• Multi-Layer Perceptron Neural Network for Improving Detection Performance of Malicious Phishing URLs Without Affecting Other Attack Types Classification

• Privacy of Fitness Applications and Consent Management in Blockchain

• Video is All You Need: Attacking PPG-based Biometric Authentication

• Man-at-the-End Software Protection as a Risk Analysis Process

Reports, Blogs, Podcasts

• In a time of war, it’s important to stay secure

• Behavioral Analytics is getting trickier

• Windows is in Moscow’s crosshairs, too

• Ransomware with a difference: “Derestrict your software, or else!”

• Instagram scammers as busy as ever: passwords and 2FA codes at risk

• Vulnerability Exploit Attempts Surge Tenfold Against Ukrainian Websites

• Details of an NSA Hacking Operation

• Vulnerability in Stalkerware Apps

• Smashing Security podcast #264: Hacked car chargers, Telegram sextortionists, and secret bossware

• Russia Sanctions May Spark Escalating Cyber Conflict

February 25

News/Trends

• The Future of Cyber Insurance

• Putting the X Factor in XDR

• Fears Rise of Potential Russian Cyberattacks on US, Allies Over Sanctions

• Apple AirTag anti-stalking protection bypassed by researchers

• Manufacturing was the top industry targeted by ransomware last year

• Windows is in Moscow’s crosshairs, too

• Inclusive Awareness is the Key to Effective Cybersecurity: An Interview with Jenny Radcliffe

• Anonymous Hacking Group Declares “Cyber War” Against Russia

Law/Policy

• Hillicon Valley — Cyberattack hits Ukrainian websites

• Hillicon Valley — Social media platforms take action on Ukraine

• Ukraine government websites down in latest cyberattack

• White House says Russia behind cyberattack on banks, ministry in Ukraine

Technical

• ML-based Anomaly Detection in Optical Fiber Monitoring

• Using Deep Learning to Detect Digitally Encoded DNA Trigger for Trojan Malware in Bio-Cyber Attacks

• Machine Learning for Intrusion Detection in Industrial Control Systems: Applications, Challenges, and Recommendations

• A Holistic View on Data Protection for Sharing, Communicating, and Computing Environments: Taxonomy and Future Directions

News, Blogs, Podcasts

• Ukraine calls for volunteer hackers to protect its critical infrastructure and spy on Russian forces

• Manufacturing was the top industry targeted by ransomware last year, claims report

• Smashing Security podcast #263: Problèmes de Weefeee, AI artists, and Web 3.0

• Privacy Violating COVID Tests

• An Elaborate Employment Con in the Internet Age

• Bypassing Apple’s AirTag Security

• Candles, Crypto, and Electricity

• Putin Warns Russian Critical Infrastructure to Brace for Potential Cyber Attacks