People power took an interesting turn as a crowdfunding effort raised $US250,000 ($A326,000) to purchase the browsing histories of US politicians – who recently voted in legislation to allow ISPs to aggregate and resell the browsing histories of their customers. There were also demands by US lawmakers to know how many US residents the National Security Agency is currently surveilling.
Victims of the Bart ransomware would welcome the release of a decryption tool for files locked by the code, although McAfee projections that 2017 will be a bumper year for malware suggest there will be new problems to replace the old ones.
An exploit of the Apache Struts web development framework was being used to install ransomware on servers, while Samsung was struggling to fix 40 critical vulnerabilities in its Tizen operating system – used in its TVs and smartwatches.
Internet of Things (IoT) security has taken a big hit recently, with home products susceptible to cybercriminals. IoT malware has even been starting to show destructive behavior, with data-wiping routines being added to new compromises. But medical devices, at least, may get a small reprieve after OWASP’s move to release a set of best practices for securely deploying such devices.
One report concluded that 30 percent of malware is zero-day code that is not picked up by legacy antivirus solutions. Web browsers aren’t much more help, either, with security compromises causing all kinds of headaches for security engineers. There is certainly no lack of variety to convey to C-level leaders that need to know more about cybersecurity.
Ongoing attacks had some wondering whether the battle to protect email was already lost. Forensic analysis of banking malware suggested the discovery of a clue that reveals a long-suspected link to North Korea, while examination of Russian hacking code showed new Windows hacks that drew from old Solaris compromises from 20 years ago.
The CIA was in the same boat, drawing on the Russian-made Carberp Trojan to anchor some of its own malware deployments. Also on the international hacking front, Chinese hackers were going after third-party IT suppliers in an effort to steal corporate data. Chinese hackers were also blamed for an attack on a US trade lobbying group,
Even as a critical Xen hypervisor flaw endangered virtualized environments, Microsoft’s Azure cloud service offered privilege and vulnerability management services, while security executives were facing up to the new threat posed by employees using Tor services to hide their online activity.
Researchers demonstrated a way that UEFI flaws can be exploited to install highly persistent ransomware. An Android version of the notorious Pegasus iOS spyware was discovered, while Apple patched a Wi-Fi bug in the iPhone’s Broadcom wireless chipset.
There were doubts about Turkish hackers’ claim that Apple paid them a ransom in exchange for not holding millions of iCloud accounts to ransom. And security firm F-Secure bought a small utility called Little Flocker in an effort to fight macOS ransomware.
Security vendor McAfee was on its own again after splitting from parent Intel Security with new investment and a business plan that includes securing hardware as well as continuing strong consulting and integration services growth to date.