Signal creator Moxie Marlinspike speaking at "The Cryptographer's Panel" at RSA Conference 2018 (Photo: Mathew J. Schwartz/ISMG)

Signal Founder Says Cellebrite's Forensics Tools Flawed

Jeremy Kirk • April 22, 2021

Law enforcement agencies use forensics tools from Israeli company Cellebrite to gain access to locked mobile devices and extract data. But the creator of encrypted messaging app Signal says he's found vulnerabilities in Cellebrite's tools, raising questions about whether the extracted data can be trusted.

Cybercrime

Unscripted: 3 Security Leaders Dissect Today's Top Trends

Latest

Application Security

Analysis: REvil’s $50 Million Extortion Effort

Anna Delaney • April 23, 2021

The latest edition of the ISMG Security Report features an analysis of ransomware gang REvil’s threat to release stolen Apple device blueprints unless it receives a massive payoff. Also featured: Discussions of the importance of a “shift left” strategy and efforts to secure cryptocurrencies.

Endpoint Security

New FIDO Protocol Simplifies IoT Device Onboarding

Prajeet Nair • April 22, 2021

The FIDO Alliance, an association that has developed voluntary authentication standards with a goal of minimizing the use of passwords, has launched an onboarding protocol for IoT devices that's designed to enhance security.

Governance & Risk Management

Self-Sovereign Identity: More Use Cases

Nick Holland • April 22, 2021

More use cases are emerging for self-sovereign identity, which gives individuals more control over their digital identities, according to Heather Dahl and Ken Ebert of Indicio.tech.

Fraud Management & Cybercrime

The Economics of Software Flaw Discoveries, Exploits

Jeremy Kirk • April 22, 2021

The economics of vulnerability discoveries and exploits is always evolving, and knowing those dynamics can provide insights into what attackers are doing, says Casey Ellis of Bugcrowd.

Application Security

Joker Malware Targets More Android Devices

Akshaya Asokan • April 22, 2021

Joker malware has targeted more than 500,000 Android devices across the world through malicious apps in AppGallery, the official app store of Huawei, according to the security firm Doctor Web.

Endpoint Security

SonicWall Patches 3 Zero-Day Flaws

Jeremy Kirk • April 21, 2021

SonicWall has patched three zero-day vulnerabilities in the hosted and on-premises versions of its Email Security product after attackers began exploiting them last month. Attackers can exploit the flaws to access email and pivot deeper into organizations' systems, FireEye Mandiant reports.

Fraud Management & Cybercrime

Mitigating Risks as Ransomware Tactics Change

Anna Delaney • April 21, 2021

Ransomware attacks now routinely feature multifaceted extortion efforts, and defenses need to evolve, says Stuart McKenzie of FireEye, who offers an analysis of the findings of the FireEye M-Trends 2021 report.

3rd Party Risk Management

Nation-State Actor Linked to Pulse Secure Attacks

Doug Olenick • April 20, 2021

The U.S. Cybersecurity and Infrastructure Security Agency, Ivanti and FireEye report that federal agencies and other entities have been compromised by two attack groups, with one possibly acting on behalf of the Chinese government. The groups are exploiting vulnerabilities in Ivanti's Pulse Connect Secure.

Governance & Risk Management

Identity Management at the Core of Recent M&A Activity

Doug Olenick • April 20, 2021

Identity management was the focus of three acquisitions announced in the last several days by Mastercard, Entrust and Keyfactor.

ATM / POS Fraud

Payment Card Theft Ring Tech Leader Gets 10-Year Sentence

Scott Ferguson • April 19, 2021

A Ukrainian national who admitted to working as a system administrator and IT manager for the notorious FIN7 cybercriminal gang, which has been involved in the theft of millions of payment cards, has been sentenced to 10 years in federal prison.

Cybercrime

How to Prevent Wire Transfer Fraud

Suparna Goswami • April 19, 2021

How is wire transfer fraud evolving, and how can the risk be mitigated? Three experts provide insights in this panel discussion.

Cybercrime as-a-service

Houston Rockets Investigate Ransomware Attack

Doug Olenick • April 16, 2021

The NBA's Houston Rockets reported on Wednesday that the organization was recently hit with a ransomware attack for which the Babuk cyber gang has taken responsibility. Babuk ransomware is known to be buggy and cannot always be decrypted - even with the proper key.