RBI OKs Video-based Authentication. But Will Banks Use It?

Geetha Nandikotkur • January 17, 2020

The Reserve Bank of India has decided to allow all banks to use remote video-based "know your customer" authentication for onboarding new clients. But some observers say many Indian banks may prove reluctant to use video KYC because they lack the necessary technology and new customers lack smartphones.

Anti-Phishing, DMARC

RBI Moves to Boost Digital Payment Transactions

Latest

Cybercrime

'WeLeakInfo' Website Shut Down

Scott Ferguson • January 17, 2020

Law enforcement agencies in five countries have shut down WeLeakInfo.com, which allegedly provided cybercriminals with access to over 12 billion personal records culled from 10,000 data breaches.

Business Email Compromise (BEC)

BEC Fraudsters Targeting Financial Documents: Report

Scott Ferguson • January 17, 2020

As business email compromise schemes continue to evolve, some cybercriminals are focusing on accessing companies' financial documents, which provide useful information to support the theft of money, according to a new report from security firm Agari.

Active Defense & Deception

Analysis: Huawei 5G Dilemma

Nick Holland • January 17, 2020

The latest edition of the ISMG Security Report discusses why Britain is struggling to determine whether to use China's Huawei technology in developing its 5G networks. Plus: An update on a mobile app exposing infant photos and videos online and an analyst's take on the future of deception technology.

Governance

Windows Vulnerability: Researchers Demonstrate Exploits

Scott Ferguson • January 16, 2020

A day after the NSA disclosed a significant vulnerability that could affect the cryptographic operations in some versions of Windows, security researchers started releasing "proof of concept" code designed to show how attackers potentially could exploit the flaw. This highlights the urgency of patching.

Cybercrime

Alarming Trend: More Ransomware Gangs Exfiltrating Data

Mathew J. Schwartz • January 16, 2020

As if ransomware wasn't already bad enough, more gangs are now exfiltrating data from victims before leaving systems crypto-locked. Seeking greater leverage against non-paying victims, Maze and Sodinokibi attackers are not just threatening to leak stolen data; they're also following through.

Critical Infrastructure Security

Senators Field Legislation to Build Huawei 5G Alternatives

Mathew J. Schwartz • January 16, 2020

One gaping hole in the U.S. government's push to counter Chinese-built 5G telecommunications gear remains the lack of alternatives. But a bipartisan group of senators is seeking to create a $1 billion fund to create trusted, Western-built options.

Breach Notification

Equifax Settles Mega-Breach Lawsuit for $1.38 Billion

Jeremy Kirk • January 15, 2020

A federal judge in Atlanta has given final approval to a settlement that resolves a class action lawsuit against credit bureau Equifax, which in 2017 suffered one of the largest data breaches in history. The minimum cost to Equifax will be $1.38 billion.

Breach Notification

Baby's First Data Breach: App Exposes Baby Photos, Videos

Jeremy Kirk • January 14, 2020

A baby photo and video-sharing app called Peekaboo Moments is exposing sensitive logs through an exposed Elasticsearch database, a researcher has found. The data includes baby photos and videos, birthdates, location data and device information.

Endpoint Security

'Cable Haunt' Modem Flaw Leaves 200 Million Devices at Risk

Mathew J. Schwartz • January 13, 2020

A flaw in a Broadcom chip built into many cable modems means hundreds of millions of the devices are vulnerable to a buffer overflow exploit, dubbed Cable Haunt, that attackers can use to take full control of a modem, researchers say. Only some ISPs have begun pushing firmware updates to fix the flaw.

Cybercrime

Why Penetration Tests Are So Essential

Steve King • January 13, 2020

Corporate network security breaches, which can prove costly to remediate and expose a company to lawsuits, are frequently the result of vulnerabilities that could have been fixed for a relatively low cost. A a brute force penetration test is a critical first step in finding those vulnerabilities.

Governance

Facebook's FTC Privacy Settlement Challenged in Court

Scott Ferguson • January 10, 2020

Six months after Facebook agreed to a landmark privacy settlement with the U.S. Federal Trade Commission that resulted in a $5 billion fine, a federal judge is still considering objections from advocacy groups that claim the deal doesn't go far enough.

Critical Infrastructure Security

Hackers Increasingly Probe North American Power Grid

Mathew J. Schwartz • January 10, 2020

Hackers have been increasingly probing the North American power grid for weaknesses, but the industry - driven in part by regulators - is increasingly able to identify and repel attackers, industrial cybersecurity experts say.