RSS Reader for Computer Security Articles
Nearly two dozen cities in Texas have been hit by a ransomware attack executed by a single threat actor. These attacks beg the question: Is it ever worth it to pay a cyber attacker’s ransom? In this episode of TECH(feed), Juliet discusses the pattern of ransomware attacks on local governments, how municipalities have responded and how to prevent a ransomware attack in the first place.
Credit to Author: Sharky| Date: Thu, 22 Aug 2019 03:00:00 -0700
Programmer pilot fish goes online to a message board for a development system that’s used for one of his company’s applications.
But he gets a message that the site is blocked. He can either forget about it, click a link to continue, or click a link to see the company’s access policy.
He clicks to continue, gets what he needs, and then, just out of curiosity, he clicks to see the access policy to get an idea of why this site is being blocked.
But instead of seeing the access policy, fish sees this message: Content blocked. Click here to access our internet resource policy.
Sputters baffled fish, “It actually blocked the policy!”
Credit to Author: BrianKrebs| Date: Wed, 21 Aug 2019 11:58:53 +0000
Almost weekly now I hear from an indignant reader who suspects a data breach at a Web site they frequent that has just asked the reader to reset their password. Further investigation almost invariably reveals that the password reset demand was not the result of a breach but rather the site’s efforts to identify customers who are reusing passwords from other sites that have already been hacked. But ironically, many companies taking these proactive steps soon discover that their explanation as to why they’re doing it can get misinterpreted as more evidence of lax security. This post attempts to unravel what’s going on here.
Read More
Several new vulnerability disclosures in Windows Remote Desktop Protocol suggest it’s time to stop using it. Here’s how.
Credit to Author: Gregg Keizer| Date: Tue, 20 Aug 2019 11:53:00 -0700
The WebKit project – the open-source initiative that generates code for Apple’s Safari browser – quietly announced last week that it would follow in Mozilla’s footsteps and quash tracking technologies designed to follow users across the web.
In a short message on Aug. 14, the WebKit team pointed to its new Tracking Prevention Policy, a document that spells out its plans in detail, including what types of tracking it will create and how it will deal with any side effects.
“We have implemented or intend to implement technical protections in WebKit to prevent all tracking practices included in this policy,” the document read. “If we discover additional tracking techniques, we may expand this policy to include the new techniques and we may implement technical measures to prevent those techniques.”
Credit to Author: Woody Leonhard| Date: Mon, 19 Aug 2019 09:33:00 -0700
No doubt you recall the warning back in February that Windows 7, Server 2008 and Server 2008 R2 patches starting in July would use the SHA-2 encryption protocol. If you want to install Win7 patches issued after July, you have to get the SHA-2 translator installed.
A few days ago, Microsoft tossed a zinger into the FAQs down at the bottom of its SHA-2 post, 2019 SHA-2 Code Signing Support requirement for Windows and WSUS. That post now says that you have to install a seemingly unrelated patch, KB 3133977, entitled, BitLocker can’t encrypt drives because of service crashes in svchost.exe process in Windows 7 or Windows Server 2008 R2.
Credit to Author: BrianKrebs| Date: Mon, 19 Aug 2019 13:03:32 +0000
Cybercrooks increasingly are anonymizing their malicious traffic by routing it through residential broadband and wireless data connections. Most often, those connections are hacked computers, mobile phones, or home routers. But this is the story of a sprawling “bulletproof residential VPN” service that appears to have been built by acquiring chunks of Internet addresses from some the largest ISPs and mobile data providers in the United States and abroad.
Read More
Credit to Author: Woody Leonhard| Date: Thu, 15 Aug 2019 05:28:00 -0700
August is going to be a perilous patching month.
We’re tracking down credible reports of the Server 2012 R2 Monthly rollup breaking RDP logins, a conflict between the Win10 1903 cumulative update and last month’s version of Outlook 365, confusion about Win7 patches being branded as “IA64 only,” dealing with the lack of telemetry (!) in the August Win7 Security Only patch, much mayhem trying to install SHA-2 signed patches (including the Win7 Monthly Rollup) on systems using Symantec Endpoint Protection, even more confusion over the difference between Symantec Endpoint Protection and Norton Security Suite, and lots of the usual installation failures and rollbacks.