January 26

News/Trends

• Critical Cisco Flaw Lets Hackers Remotely Take Over Unified Comms Systems

• Perfecting the Defense-in-Depth Strategy with Automation

• Data Privacy Week: Companies are Banning Generative AI Due to Privacy Risks

• K-12 Cybersecurity Spending, Insurance on the Rise

• LODEINFO Fileless Malware Evolves with Anti-Analysis and Remote Code Tricks

• Mother of all breaches reveals 26 billion records: what we know so far

• Cyber Threat Landscape: 7 Key Findings and Upcoming Trends for 2024

• HHS Releases New Voluntary Performance Goals to Enhance Cybersecurity Across the Health Sector and Gateway for Cybersecurity Resources

• Kasseika Ransomware Using BYOVD Trick to Disarm Security Pre-Encryption

• New macOS Malware Targets Cracked Apps

Law/Policy

• Looking Ahead to the FTC’s Implementation of the Data Breach Notification Rule for Nonbanking Financial Institutions

• UK Tells Business Leaders to ‘Toughen Up’ Against Cyberattacks

• Israel, Czech Republic Reinforce Cyber Partnership Amid Hamas War

• Dutch SA Sanctions Credit Card Company for Failure to Perform Data Protection Impact Assessment

• FTC on Models-as-a-Service

Technical

• CNN architecture extraction on edge GPU

• EvadeDroid: A Practical Evasion Attack on Machine Learning for Black-box Android Malware Detection

• A privacy-preserving multi-factor authentication scheme for cloud-assisted IoMT with post-quantum security

• Optimal Control of Malware Propagation in IoT Networks

Report, blogs, podcasts

• Chatbots and Human Conversation

• Report: Software Supply Chain Attacks Are Getting Easier

• AI is already being used by ransomware gangs, warns NCSC

• US Data Compromises Surged to Record High in 2023

• Privacy predictions for 2024

• Poisoning AI Models

• Using Google Search to Find Software Can Be Risky

• Smashing Security podcast #356: Big dumpers, AI defamation, and the slug that slurped

• With hackers poisoning water systems, US agencies issue incident response guide to boost cybersecurity

January 19

News/Trends

• Russian Coldriver Hackers Deploy Malware to Target Western Officials

• TA866 Resurfaces in Targeted OneDrive Campaign

• MFA Spamming and Fatigue: When Security Measures Go Wrong

• U.S. Cybersecurity Agency Warns of Actively Exploited Ivanti EPMM Vulnerability

• German security researchers at risk of prosecution for “hacking” because of a plain text hardcoded password?

• Cloud Vendor Returns North Star Health Alliance Data Stolen and Stored by LockBit

• AI, Gaming, FinTech Named Major Cybersecurity Threats For Kids

• US Government Urges Action to Mitigate Androxgh0st Malware Threat

• OpenAI Announces Plans to Combat Misinformation Amid 2024 Elections

• Incogni study reveals overwhelming majority of spam calls originate locally

Law/Policy

• FCC Presses Carmakers, Wireless Providers to Protect Domestic Abuse Survivors From Stalking Tools

• FTC Joins Global Data Security and Privacy Investigative Consortium

• DOD Unveils First-Ever National Defense Industrial Strategy

• White House Looks to Eliminate College Degree Requirements for Cyber Jobs With Federal Contractors

Technical

• Uncertainty-Aware Hardware Trojan Detection Using Multimodal Deep Learning

• Secure Targeted Message Dissemination in IoT Using Blockchain Enabled Edge Computing

• Eclectic Rule Extraction for Explainability of Deep Neural Network based Intrusion Detection Systems

• MALIGN: Explainable Static Raw-byte Based Malware Family Classification using Sequence Alignment

• Security and Privacy Issues in Cloud Storage

Report, blogs, podcasts

• Code Written with AI Assistants Is Less Secure

• Smashing Security podcast #355: Fishy Rishi, 23andMe, and the labour of love

• Dark web threats and dark market predictions for 2024

• E-Crime Rapper ‘Punchmade Dev’ Debuts Card Shop

• Critical flaw found in WordPress plugin used on over 300,000 websites

• The 2023 Global Cybercrime Report: A look at the key takeaways

• A lightweight method to detect potential iOS malware

• Growing Pains at the Bureau of Cyberspace and Digital Policy, Report Finds

• Voice Cloning with Very Short Samples

January 12

News/Trends

• Applying the Tyson Principle to Cybersecurity: Why Attack Simulation is Key to Avoiding a KO

• CISA Urges Critical Infrastructure to Patch Urgent ICS Vulnerabilities

• Nation-State Actors Weaponize Ivanti VPN Zero-Days, Deploying 5 Malware Families

• New Python-based FBot Hacking Toolkit Aims at Cloud and SaaS Platforms

• NCSC Publishes Practical Security Guidance For SMBs

• Malware Takedowns Show Progress, But Fight Against Cybercrime Not Over

• Only 4% of US States Fully Prepared for Cyber-Attacks Targeting Elections

• Follow-on extortion campaign: confirmation of some findings by Arctic Wolf

• Alert: Water Curupira Hackers Actively Distributing PikaBot Loader Malware

• Unifying Security Tech Beyond the Stack: Integrating SecOps with Managed Risk and Strategy

Law/Policy

• EU Enhances Cybersecurity Requirements for Agencies

• DOJ to up Tempo of Cybercrime Operations in 2024, Senior Official Says

• After Barrage of Hacks, Hospitals Will Face New Federal Cybersecurity Rules Tied to Funding

• US DHS Solicits Synthetic Data Expertise for AI Training

Technical

• Phishing Website Detection through Multi-Model Analysis of HTML Content

• Learning-Based Difficulty Calibration for Enhanced Membership Inference Attacks

• A Survey of Network Requirements for Enabling Effective Cyber Deception

• Transcending Transcend: Revisiting Malware Classification in the Presence of Concept Drift

Report, blogs, podcasts

• Cyber Insecurity and Misinformation Top WEF Global Risk List

• Smashing Security podcast #354: Chuck Norris and the fake CEO, artificial KYC, and an Airbnb scam

• Pharmacies Giving Patient Records to Police without Warrants

• If You Prepare, a Data Security Incident Will Not Cause an Existential Crisis

• Here’s Some Bitcoin: Oh, and You’ve Been Served!

• PIN-Stealing Android Malware

• DDoS Attack Traffic Surged in 2023, Cloudflare Finds

• The Evolution of Anomaly Detection and the Importance of Configuration Monitoring in Cybersecurity

• Meet Ika & Sal: The Bulletproof Hosting Duo from Hell

• Stuxnet: The malware that cost a billion dollars to develop?

January 5

News/Trends

• SpectralBlur: New macOS Backdoor Threat from North Korean Hackers

• LastPass Enforces 12-Character Master Passwords

• 5 Ways to Reduce SaaS Security Risks

• 3 Malicious PyPI Packages Found Targeting Linux with Crypto Miners

• UAC-0050 Group Using New Phishing Tactics to Distribute Remcos RAT

• Malware Using Google MultiLogin Exploit to Maintain Access Despite Password Reset

• New Variant of DLL Search Order Hijacking Bypasses Windows 10 and 11 Protections

• VoIP Firm XCast Agrees to Settle $10m Illegal Robocall Case

• New JinxLoader Targeting Users with Formbook and XLoader Malware

Law/Policy

• FTC Soliciting Contest Submissions to Help Tackle Voice Cloning Technology

• BT Misses Deadline for Removing Huawei From Network Core

• European Central Bank to Put Banks Through Cyber Stress Test

• Pentagon Reveals Updated Cost Estimates for CMMC Implementation

Technical

• The Security and Privacy of Mobile Edge Computing: An Artificial Intelligence Perspective

• Risk-optimized Outlier Removal for Robust 3D Point Cloud Classification

• Securing the Digital World: Protecting smart infrastructures and digital industries with Artificial Intelligence (AI)-enabled malware and intrusion detection

• Malware Detection in IOT Systems Using Machine Learning Techniques

Report, blogs, podcasts

• Medical Device Cybersecurity: Agencies Need to Update Agreement to Ensure Effective Coordination — GAO

• The State of Ransomware in the U.S.: Report and Statistics 2023

• Improving Shor’s Algorithm

• It’s Not Just Technology: What it Means to be a Global Leader in AI

• New iPhone Exploit Uses Four Zero-Days

• CI/CD Security: Advanced Best Practices to Secure Your Pipelines

• Facial Recognition Systems in the US

• Leveraging DevSecOps to quell cyber risks in a teeming threat landscape

• What Is the Future and Technology of Zero Trust?