Editor's News

A new Twitter spam campaign has been detected, which gets around safety blocks within the direct messaging (DM) functionality.   According to Malwarebytes researcher Christopher Boyd, the tactic sees attackers compromise legitimate accounts and send links to Tweets posted by spam profiles / other compromised accounts, rather than send a direct URL.   “They are compromising legitimate accounts then sending links to Tweets posted by spam profiles/other compromised accounts. The linked Tweet will then send...

LogMeIn has announced that it is to end its free remote access product to unify its product range,   In a blog post, LogMeIn said that it will only offer a paid-for product and offer “what we believe to be the best premium desktop, cloud and mobile access experience available on the market today”.   It said: “Starting in January, we will gradually migrate users of LogMeIn branded remote access offerings and Ignition branded remote access offerings to...

A recent malware campaign targeted American journalists and activists from the Electronic Frontier Foundation (EFF).   According to the Register, the attacks were by “state-aligned actors” from Vietnam and targeted against foreign activists and journalists. The attack, using an email lure, invited activists to an Oxfam conference in Asia. The malware contained malicious links and attachments and was only detected by one anti-virus technology in 47, according to VirusTotal.   EFF attributed the attacks to a group...

The Information Commissioner’s Office (ICO) should move from issuing monetary penalties to a stronger form of punishment for data loss and bad behaviour.   Speaking to IT Security Guru, privacy consultant Martin Hoskins asked what the fines had achieved, and said that they are not achieving their purpose. “If it is not changing behaviours, then it should not be allowed to continue as it is not fit for purpose. I’ve always been one for getting...

Senior executives at South Korean banks and credit card firms have resigned following a breach which may affect up to 20 million people.   In this case, an employee from personal credit ratings firm Korea Credit Bureau (KCB) was arrested and accused of stealing data from the customers of three credit card firms while working for them as a temporary consultant.   According to the South China Morning Post, the stolen data included customer names,...

Greater transparency of surveillance activities is to be introduced by the NSA, while the duration personal information can be held is to also be introduced.   Delivering a speech on Friday on the NSA, President Obama said that it will review decisions about intelligence priorities and sensitive targets on an annual basis, so that its actions are regularly scrutinised by the senior national security team.   As well as this, a new Presidential directive will...

Security B-Sides London will return to the UK in 2014, to be held on Tuesday the 29th April.   Under the banner of “Connecting People & Agents of All Kinds”, the community-driven event will again be held at Kensington Town Hall. Past speakers at B-Sides London have included penetration testers, industry analysts and leading consultants from the information security space.   Security B-Sides London welcomes all content for presentation ideas from prospective speakers; talks are...

Neiman Marcus President and CEO Karen Katz has formally apologised in a letter to customers.   Saying that the group deeply regrets the incident and it was “very sorry that some of our customers' payment cards were used fraudulently” and that it “remains steadfast in our commitment to delivering exceptional customer service”.   Its continuing forensic investigation found the intrusion on the 1st January after it was informed of potentially unauthorised payment card activity which...

Malware named “Black POS” was not flagged by more than 40 commercial anti-virus tools, explaining why it was able to infect Target’s point of sale system.   According to security blogger Brian Krebs, a source said that the POS malware was installed in Target’s environment around November 27th, and it was customised to avoid detection and for use in specific environments.   He said: “That source and one other involved in the investigation who also...

Target CEO Gregg Steinhafel has admitted that there was malware on its point-of-sale (PoS) systems.   In an interview with CNBC, Steinhafel said that while it did not know the full extent of what transpired, it had established the malicious compromise. According to Sophos’ Naked Security blog, credit card data is not encrypted all of the time, even on PCI-DSS compliant systems, instead it is briefly unencrypted inside the PoS terminal itself.   Writing on...