Editor's News

Banks in the United States are to face a cyber security test that will be conducted by the New York State Department of Financial Services. According to the Wall Street Journal, around 200 banks will be required to participate in a live webcast where they will answer questions about their cyber security policies and processes on 12th December. All of the banks will be asked questions simultaneously and later will be able to see how they stack...

A large stash of data was hacked recently, exposing the personal and financial information on more than 850,000 Fortune 500 CEOs, lawmakers and A-list celebrities. Reported by Brian Krebs to have been found on the same servers as the Adobe source code, the file “CorporateCarOnline” the plain text archive apparently contained 850,000 credit card numbers, expiry dates and associated names and addresses, with more than one-quarter (241,000) including  high or no-limit American Express accounts. Those names included basketball star LeBron...

Microsoft will release eight bulletins next week, including three critical-rated patches for vulnerabilities in Internet Explorer and Microsoft Windows. Tyler Reguly, technical manager of IT security research and development at Tripwire, said: “It's a pretty typical patch Tuesday, Internet Explorer, Windows, and Office patches. This month shows that new Microsoft software isn't immune to flaws -- Office 2013, IE 11, and Windows 8.1 will all receive patches on Tuesday.” Wolfgang Kandek, CTO of Qualys, said...

HyTrust has acquired cloud encryption and key management vendor HighCloud Security to add cloud-optimised data security and privacy to administrative visibility and control. According to the companies, the combined offering will enable ‘cloaked’ private, hybrid and public clouds and helps address three of the primary security concerns in cloud environments: control; visibility; and data security and privacy. Eric Chiu, president and founder of HyTrust, said: “HyTrust represents the control point for cloud management, providing automated...

The United States computer emergency readiness team (CERT) has issued an alert about the CryptoLocker ransomware. Proving the major impact that it has had upon businesses and users globally, the US CERT said that the 2013 campaign “restricts access to infected computers and demands the victim provide a payment to the attackers in order to decrypt and recover their files”. It said: “As of this time, the primary means of infection appears to be phishing emails containing...

Trustwave has announced the acquisition of data security vendor Application Security. Adding automated database security scanning technologies to its product and service offering, Trustwave will continue to develop, support and offer the DbProtect and AppDetectivePRO products to help with compliance, patch management and mitigate data-centric vulnerabilities. Trustwave said that Application Security’s technologies will enhance Trustwave’s penetration testing and vulnerability management services, with additional database scanning and testing capabilities. Financial terms of the acquisition, which has already closed, were...

The UK’s financial firms will face a major stress test of their security systems today in order to tell how strong they are in the face of a cyber attack. According to Reuters, the "Waking Shark II" test will bombard firms with a series of announcements and scenarios, such as how a major attack on computer systems might hit stock exchanges and unfold on social media. It will be co-ordinated from a single room housing regulators,...

Microsoft to patch latest IE zero day four days after disclosure. In an update, Dustin Childs, group manager, response communications at Microsoft Trustworthy Computing said that the vulnerability, CVE-2013-3918, which affects an Internet Explorer ActiveX Control, will be addressed in a critical bulletin due to be released today. The vulnerability, which was detailed by FireEye last Friday, revealed that it can be used in drive-by download attacks as it leverages the information leakage vulnerability and an IE out-of-bounds...

Scotland Yard has announced that it plans to expand its cyber crime unit to 500 people. According to a report in the Telegraph, there are plans to massively expand the unit in the coming years, eventually boosting the number to around 500. Adrian Culley, global technical consultant at Damballa and former head of the Scotland Yard Computer Crime unit, told IT Security Guru that he thought the news was “very encouraging”, especially since the formation of...

The Chicago Tribune was apparently hacked via a SQL Injection flaw in an old section of the website. According to the Hacker News, the Serbian hacker group 'TeslaTeam' found a flaw in a Tribune subdomain which allowed them to breach the website's database and exposed partial credentials. A pastebin post included links to a page that included the 2008 Illinois school report and 14 encrypted passwords. A spokesperson for the Tribune group declined to comment. Robert Hansen, technical...